Commit Graph

87716 Commits

Author SHA1 Message Date
Taus
999b8f23cb Python: Attributes
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:38 +00:00
Taus
4336b07d48 Python: Function calls
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:38 +00:00
Taus
b8bc230a38 Python: Assert statements
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:38 +00:00
Taus
4e3a633f14 Python: Support various literals
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:38 +00:00
Taus
f89a773b80 Python: Ignore synthetic CFG nodes
We can only annotate the ones that correspond directly to AST nodes
anyway.

Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:38 +00:00
Taus
4583244ec6 Python: More AstNodeImpl improvements
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:37 +00:00
Taus
e66bf87f22 Python: Instantiate CFG tests with new CFG library
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:37 +00:00
Taus
6b3a790015 Python: Instantiate CFG module fully
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:37 +00:00
Taus
b5df1886ea Python: Use fields everywhere in new AST classes
Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:37 +00:00
Taus
30f28bab8d Python: First stab at shared control-flow 2026-05-28 21:09:37 +00:00
Taus
019e6f233f Python: Make CFG tests parameterised
Currently we only instantiate them with the old CFG library, but in the
future we'll want to do this with the new library as well.

Co-authored-by: yoff <yoff@github.com>
2026-05-28 21:09:37 +00:00
Taus
df6d0cad5e Python: Add ConsecutiveTimestamps test
This one is potentially a bit iffy -- it checks for a very powerful
propetry (that implies many of the other queries), but as the test
results show, it can produce false positives when there is in fact no
problem. We may want to get rid of it entirely, if it becomes too noisy.
2026-05-28 21:09:37 +00:00
Taus
6d829d6cc8 Python: Add NeverReachable test
This looks for nodes annotated with `t.never` in the test that are
reachable in the CFG. This should not happen (it messes with various
queries, e.g. the "mixed returns" query), but the test shows that in a
few particular cases (involving the `match` statement where all cases
contain `return`s), we _do_ have reachable nodes that shouldn't be.
2026-05-28 21:09:37 +00:00
Taus
661fd3156f Python: Add BasicBlockOrdering test
This one demonstrates a bug in the current CFG. In a dictionary
comprehension `{k: v for k, v in d.items()}`, we evaluate the value
before the key, which is incorrect. (A fix for this bug has been
implemented in a separate PR.)
2026-05-28 21:09:37 +00:00
Taus
cc471fd672 Python: Add some CFG-validation queries
These use the annotated, self-verifying test files to check various
consistency requirements.

Some of these may be expressing the same thing in different ways, but
it's fairly cheap to keep them around, so I have not attempted to
produce a minimal set of queries for this.
2026-05-28 21:09:37 +00:00
Taus
9a4fb5c971 Python: Add self-validating CFG tests
These tests consist of various Python constructions (hopefully a
somewhat comprehensive set) with specific timestamp annotations
scattered throughout. When the tests are run using the Python 3
interpreter, these annotations are checked and compared to the "current
timestamp" to see that they are in agreement. This is what makes the
tests "self-validating".

There are a few different kinds of annotations: the basic `t[4]` style
(meaning this is executed at timestamp 4), the `t.dead[4]` variant
(meaning this _would_ happen at timestamp 4, but it is in a dead
branch), and `t.never` (meaning this is never executed at all).

In addition to this, there is a query, MissingAnnotations, which checks
whether we have applied these annotations maximally. Many expression
nodes are not actually annotatable, so there is a sizeable list of
excluded nodes for that query.
2026-05-28 21:09:36 +00:00
Taus
6165623cbf Merge pull request #21724 from github/tausbn/python-add-self-validating-cfg-tests 2026-05-28 22:07:55 +02:00
Michael Nebel
2eac8890d3 Merge pull request #21893 from michaelnebel/cshar/updateroslyn
C#: Update Roslyn and other pinned depenencies.
2026-05-28 13:49:29 +02:00
Geoffrey White
34d4e9a8e2 Merge pull request #21898 from geoffw0/swiftflow
Swift: Extend swift/weak-sensitive-data-hashing, swift/weak-password-hashing sinks
2026-05-28 11:52:32 +01:00
Michael Nebel
ed8b9c29cc Merge pull request #21866 from michaelnebel/csharp/refreturnindexerproperty
C#: Property- and Indexer calls for ref return properties and indexers.
2026-05-28 12:31:17 +02:00
Asger F
17fe3e4e31 Merge pull request #21901 from asgerf/unified-fix-test
Unified: fix test output
2026-05-27 22:19:17 +02:00
Asger F
313500e581 Unified: update test outputs 2026-05-27 21:27:09 +02:00
Asger F
ad56ebd361 Unified: update test output 2026-05-27 21:25:32 +02:00
Asger F
6be9e2315d Merge pull request #21841 from github/tausbn/unified-swift-named-body-fields
Unified: Get rid of all `$children` fields
2026-05-27 21:25:11 +02:00
Geoffrey White
5c2488e304 Swift: Fix typo. 2026-05-27 16:29:48 +01:00
Geoffrey White
4fbea4ef95 Swift: Autoformat. 2026-05-27 16:28:21 +01:00
Taus
35faec3db1 Python: Address review comments
- Get rid of unnecessary parentheses
- Use call syntax in the relevant test
- Get rid of `dead(2)` annotation
2026-05-27 15:27:19 +00:00
Taus
41fd59c1c1 Unified: regenerate Ast.qll and dbscheme 2026-05-27 15:02:28 +00:00
Taus
d6e7e38e1c Unified: merge in main
Keeps our version of the conflicting files. They will be regenerated in
the next commit.
2026-05-27 15:01:03 +00:00
Jeroen Ketema
7723324687 Merge pull request #21896 from jketema/jketema/deprecated
C++: Remove deprecated code
2026-05-27 14:11:10 +02:00
Michael Nebel
d4c7b5b6fe C#: Update encoding of SBCS to UTF8 with BOM. 2026-05-27 14:01:34 +02:00
Michael Nebel
6b55f865cd C#: Update integration test expected output. 2026-05-27 13:24:45 +02:00
Jeroen Ketema
42c4d8a98b Merge pull request #21897 from jketema/jketema/missing-friend
C++: Update expected test results after extractor changes
2026-05-27 12:54:00 +02:00
Geoffrey White
f962eac914 Swift: Fill the simple gaps in modelling. 2026-05-27 11:20:00 +01:00
Geoffrey White
c6c3e1474c Swift: Add a few more test cases for simple missing models. 2026-05-27 11:15:28 +01:00
Geoffrey White
94e6ec6511 Swift: Widen the new sinks to cover more cases the MaD sinks are missing. 2026-05-27 10:34:12 +01:00
Geoffrey White
c902c75651 Swift: Add change note. 2026-05-27 10:33:42 +01:00
Geoffrey White
2b4ea18dfe Swift: Add a similar sink for password hashing as well. 2026-05-27 10:33:41 +01:00
Geoffrey White
98b7659cc1 Swift: Add a special case sink for weak sensitive data hashing sinks that are calls through a metatype. 2026-05-27 10:33:39 +01:00
Geoffrey White
d9c0b9ca31 Swift: Additional test cases for CryptoKit. 2026-05-27 10:33:37 +01:00
Geoffrey White
b44bca9ea7 Swift: Add HashFunction protocol and other realism to the CryptoKit test stubs (this is needed for new cases to work as intended). 2026-05-27 10:33:31 +01:00
Jeroen Ketema
e66b1e4beb Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-27 10:58:05 +02:00
Jeroen Ketema
362c48cc6d C++: Add change note 2026-05-27 10:44:44 +02:00
Jeroen Ketema
35364a087a C++: Update expected test results after extractor changes 2026-05-27 10:23:16 +02:00
Asger F
f18cdcfec6 Merge pull request #21848 from asgerf/asgerf/swift-yeast
Unified: Add schema checking and corpus-style tests
2026-05-26 22:00:21 +02:00
Jeroen Ketema
7862922e5c C++: Remove deprecated code 2026-05-26 17:54:51 +02:00
Taus
fbc861e7a4 unified: Clarify grammar comment
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-05-26 16:19:02 +02:00
Michael Nebel
7f2fb2eb99 C#: Use the generic version of the associated implementation. 2026-05-26 15:59:25 +02:00
Michael Nebel
769b1957a5 C#: Update generated files. 2026-05-26 14:13:02 +02:00
Michael Nebel
26da373bd4 C#: Update Roslyn and other pinned dependencies. 2026-05-26 14:11:36 +02:00