Mathias Vorreiter Pedersen
945ecffd05
C++: Add charpred to ParameterNode
2020-04-13 14:18:57 +02:00
Mathias Vorreiter Pedersen
7f5330dd0a
Merge branch 'master' into ir-flow-fields
2020-04-09 16:08:44 +02:00
Mathias Vorreiter Pedersen
0c5bca8f4e
C++: Replace underscores with dashes in query @id
2020-04-09 12:09:15 +02:00
Mathias Vorreiter Pedersen
b2759877cc
Merge pull request #3219 from jbj/DefaultTaintTracking-partial-no-structs
...
C++: Avoid partial chi flow to struct/class
2020-04-08 12:31:53 +02:00
Jonas Jensen
6726a23c31
Merge pull request #3221 from disconnect3d/patch-1
...
Fix missing colon in ReturnConstTypeMember.cpp
2020-04-08 11:22:31 +02:00
Mathias Vorreiter Pedersen
d65c52d281
Merge branch 'master' into ir-flow-fields
2020-04-08 09:16:42 +02:00
Jonas Jensen
42e9d1416b
Merge pull request #3206 from geoffw0/newfreefix
...
C++: Fix `cpp/new-free-mismatch` false positives
2020-04-08 08:39:43 +02:00
Disconnect3d
96a0bddcf6
Update ReturnConstTypeMember.cpp
2020-04-07 22:30:57 +02:00
Geoffrey White
7fedac3266
C++: Fix apparently noncritical typo.
2020-04-07 20:56:07 +01:00
Geoffrey White
50194f372b
C++: Autoformat.
2020-04-07 20:54:54 +01:00
Mathias Vorreiter Pedersen
52b179aee5
Merge branch 'master' into ir-flow-fields
2020-04-07 21:27:17 +02:00
Geoffrey White
2686d9888c
C++: Add QLDoc.
2020-04-07 18:12:24 +01:00
Geoffrey White
66a0b7884e
Merge branch 'master' into alloc-size
2020-04-07 17:12:35 +01:00
Geoffrey White
ff39f714e8
C++: Autoformat.
2020-04-07 17:07:31 +01:00
Robert Marsh
0ccf39777c
Merge pull request #3189 from jbj/DefaultTaintTracking-Configuration
...
C++: Path explanations in DefaultTaintTracking
2020-04-07 08:38:10 -07:00
Jonas Jensen
39911af56b
C++: Avoid partial chi flow to struct/class
...
Flow through partial chi-instruction operands was introduced to make
definition-by-reference work, but its implementation also allowed all
other partial writes to propagate. In particular, tainting a field would
taint the whole struct, which in turn led to taint propagating across
unrelated fields of a struct.
The security test `CWE-134/semmle/argv/argvLocal.c` shows that we also
want to propagate taint from an array element to the whole array, and it
also seems right to propagate taint from a union member to the whole
union.
2020-04-07 16:24:24 +02:00
Mathias Vorreiter Pedersen
d56284fe8f
C++: Move added flow from simpleLocalFlowStep to simpleInstructionLocalFlowStep and remove flow that could cause field conflation
2020-04-07 16:00:40 +02:00
Mathias Vorreiter Pedersen
8928091dfb
Merge pull request #3181 from jbj/DefaultTaintTracking-qldoc
...
C++: QLDoc in DefaultTaintTracking
2020-04-07 14:58:21 +02:00
Jonas Jensen
057155f28f
Merge remote-tracking branch 'upstream/master' into DefaultTaintTracking-Configuration
2020-04-07 14:39:30 +02:00
Mathias Vorreiter Pedersen
5719967a8e
C++: Remove single-field case from PostUpdateNode and accept tests
2020-04-07 12:03:28 +02:00
Geoffrey White
d5accc70e1
C++: Add a test similar to issues/44.
2020-04-06 16:47:24 +01:00
Geoffrey White
a71ae2b468
C++: Consistent treatment of placement new.
2020-04-06 14:54:15 +01:00
Geoffrey White
492c5f367f
C++: Simplify NewDelete.qll.
2020-04-06 14:54:15 +01:00
Mathias Vorreiter Pedersen
c577541850
C++: Fix reverse read dataflow consistency failure and accept tests
2020-04-06 15:50:08 +02:00
Geoffrey White
cbe133d0e6
C++: Deprecate freeCall in the legacy wrapper Alloc.qll.
2020-04-06 14:32:49 +01:00
Geoffrey White
e223557201
C++: Wean NewDelete.qll off the legacy wrapper Alloc.qll.
2020-04-06 14:32:15 +01:00
Geoffrey White
8059d69bbd
C++: Model calls to operator new / delete for NewFreeMismatch.ql.
2020-04-06 14:27:05 +01:00
Geoffrey White
3e9f9645ae
C++: Exclude calls to operator new / delete from NewFreeMismatch.ql.
2020-04-06 14:08:00 +01:00
Geoffrey White
97cdcbee63
C++: Test for NewFreeMismatch.ql with operator new / delete.
2020-04-06 13:57:28 +01:00
Mathias Vorreiter Pedersen
3aa293210d
C++: Ensure that only non-conflated chi instructions are used everywhere
2020-04-06 12:02:56 +02:00
Robert
1096e5d947
Merge pull request #3163 from robertbrignull/code_scanning_suites
...
Add code-scanning suites
2020-04-06 08:45:40 +01:00
Mathias Vorreiter Pedersen
317734f41e
C++: Attach PostUpdateNodes to Chi nodes following aschackmull's suggestion
2020-04-05 22:35:26 +02:00
Jonas Jensen
530d4294b0
Merge remote-tracking branch 'upstream/master' into DefaultTaintTracking-Configuration
2020-04-05 07:27:07 +02:00
Jonas Jensen
58366b19e9
C++: Path explanations in the last two queries
...
For some reason I thought that these two queries were special because
they manipulate `SecurityOptions` to change the taint-tracking sources.
It turns out it was just the opposite: the queries used to be special
because they invalidated the cache for the `tainted` predicate, but that
predicate is no longer used, so these queries are no longer special.
2020-04-04 16:47:06 +02:00
Jonas Jensen
54a23a486a
C++: Accept test changes for 108d5177b8
2020-04-04 16:46:59 +02:00
Jonas Jensen
d7332644f0
C++: Fix DefinitionByReferenceNode.toString
...
This predicate now has a value also for calls to function pointers.
2020-04-04 15:31:01 +02:00
Jonas Jensen
108d5177b8
C++: Fix two bugs found by @rdmarsh2
...
Co-Authored-By: Robert Marsh <rdmarsh2@gmail.com >
2020-04-04 15:24:44 +02:00
Robert Marsh
316d932829
Merge pull request #3198 from MathiasVP/valuenumbering-provider-new-file
...
C++/C#: Prevent accidental import of ValueNumberPropertyProvider
2020-04-03 13:31:11 -07:00
Jonas Jensen
bb3616e4c4
C++: Add example for globalVarFromId
2020-04-03 17:51:35 +02:00
Jonas Jensen
5822cd7b84
C++: Put paths in the remaining LGTM-suite queries
2020-04-03 17:10:47 +02:00
Jonas Jensen
3ec1f691c2
C++: First query with flow-paths through globals
2020-04-03 16:45:00 +02:00
Jonas Jensen
aaebe3687e
C++: Fix copy-paste error in convertedExprNode
2020-04-03 16:37:23 +02:00
Jonas Jensen
469bdae9b2
C++: More helpful toString for def. by ref. node
2020-04-03 16:37:23 +02:00
Jonas Jensen
36da2d1dae
C++: Manipulate the source end of paths too
...
Without this, we get duplicate alerts in some cases and
unnatural-looking source nodes in other cases. The source nodes were
often `Conversion`s.
2020-04-03 16:37:23 +02:00
Jonas Jensen
e916f07a8e
C++: Formatting fixups
2020-04-03 15:52:13 +02:00
Jonas Jensen
427815d3d1
C++: taintedWithPath QLDoc + simplification
2020-04-03 15:52:13 +02:00
Jonas Jensen
3653627650
C++: Let configuration class extend singleton
2020-04-03 15:52:13 +02:00
Mathias Vorreiter Pedersen
c54cddead1
C++: Include PrintValueNumbering in testcase
2020-04-03 12:42:06 +02:00
Jonas Jensen
16c7a35b1c
Merge pull request #3195 from geoffw0/taintstring
...
C++: Model taint flow through std::string constructor and c_str()
2020-04-03 12:05:07 +02:00
Geoffrey White
73bfd819d9
C++: Rename classes.
2020-04-03 09:23:31 +01:00
