Taus
9dc774aaa3
Python: Remove points-to dependency from parts of SSA
...
For whatever reason, the CFG node for exceptions and exception groups
was placed with the points-to code. (Probably because a lot of the
predicates depended on points-to.)
However, as it turned out, two of the SSA modules only depended on
non-points-to properties of these nodes, and so it was fairly
straightforward to remove the imports of `LegacyPointsTo` for those
modules.
In the process, I moved the aforementioned CFG node types into
`Flow.qll`, and changed the classes in the `Exceptions` module to the
`...WithPointsTo` form that we introduced elsewhere.
2025-11-26 12:30:31 +00:00
Taus
e09840426c
Python: Get rid of points-to from Definitions.qll
...
Turns out the `ImportTime` module (despite living in
`semmle.python.types` does not actually depend on points-to, so some of
the `LegacyPointsTo` imports could be replaced or removed.
2025-11-26 12:30:31 +00:00
Taus
7328f26311
Python: Fix reachability-related test failures
2025-11-26 12:30:31 +00:00
Taus
21e74a3f01
Python: Fully remove points-to from Flow.qll
...
Gets rid of a bunch of predicates relating to reachability (which
depended on the modelling of exceptions, which uses points-to), moving
them to `LegacyPointsTo`. In the process, we gained a new class
`BasicBlockWithPointsTo`.
2025-11-26 12:30:31 +00:00
Taus
7176898503
Python: Fix library tests
2025-11-26 12:30:31 +00:00
Taus
b3b87c968b
Python: Fix extractor/experimental tests
2025-11-26 12:30:31 +00:00
Taus
665104e626
Python: Fix Python 3 tests
2025-11-26 12:30:31 +00:00
Taus
85029bd77d
Python: Fix Python 2 tests
2025-11-26 12:30:30 +00:00
Taus
5b63b4957c
Python: Fix query tests
...
Mostly just adding `private import LegacyPointsTo`. Sometimes getting
rid of other imports that are superceded by that module.
2025-11-26 12:30:30 +00:00
Taus
2732a652ab
Python: Fix example snippets
...
One might argue that these should be rewritten entirely to use more
modern APIs, but for now I'll be content with just having them compile
properly.
2025-11-26 12:30:30 +00:00
Taus
0a4ec2ca10
Python: Move some non-points-to methods out of points-to
...
These methods were in `pointsto.Base` but did not actually interact with
the points-to machinery directly, so they were easy to move out.
2025-11-26 12:30:30 +00:00
Taus
f0465f441f
Python: Get rid of some get...Object methods
...
This frees `Class.qll`, `Exprs.qll`, and `Function.qll` from the
clutches of points-to. For the somewhat complicated setup with
`getLiteralObject` (an abstract method), I opted for a slightly ugly but
workable solution of just defining a predicate on `ImmutableLiteral`
that inlines each predicate body, special-cased to the specific instance
to which it applies.
2025-11-26 12:30:30 +00:00
Taus
78c33ab55a
Python: Remove points-to references from python.qll
...
For now, these have just been made into `private` imports. After doing
this, I went through all of the (now not compiling) files and added in
private imports to the modules that they actually depended on.
I also added an explicit import of `LegacyPointsTo` (even though it may
be unnecessary) in cases where the points-to dependency was somewhat
surprising (and one we want to get rid of). This was primarily inside
the various SSA layers.
For modules inside `semmle.python.{types, objects, pointsto}` I did not
bother, as these are fairly clearly related to points-to.
2025-11-26 12:30:30 +00:00
Joe Farebrother
85cb3e026c
Merge pull request #20762 from joefarebrother/go-insecure-cookie
...
Go: Promote non-httponly cookie query, and add insecure cookie query
2025-11-25 16:39:45 +00:00
Joe Farebrother
cece73bdbf
Remove references to gorilla
2025-11-25 14:36:16 +00:00
Joe Farebrother
c7b16a043e
Address reviews - update comments, remove unneeded stubs
2025-11-25 14:36:00 +00:00
Joe Farebrother
c6110ed541
Split SecureCookies into query specific files
2025-11-25 14:35:47 +00:00
Joe Farebrother
5b702d963e
Refactor parts of SensitiveCookieNameConfig
2025-11-25 14:35:42 +00:00
Joe Farebrother
03d63dec2e
Address reviews - rename and update doc comments
2025-11-25 14:35:29 +00:00
Joe Farebrother
1bd5005fc1
Fix typos
2025-11-25 14:35:17 +00:00
Joe Farebrother
6282c34396
Update formatting
2025-11-25 14:35:09 +00:00
Joe Farebrother
a25861d8a3
Update integration test
2025-11-25 14:35:02 +00:00
Joe Farebrother
ed483dd5b2
Add change note
2025-11-25 14:34:57 +00:00
Joe Farebrother
d633120f4d
Update integration tests
2025-11-25 14:34:48 +00:00
Joe Farebrother
536e885f18
Remove experimental query
2025-11-25 14:34:41 +00:00
Joe Farebrother
fa30041498
Add qhelp & fix tests
2025-11-25 14:34:28 +00:00
Joe Farebrother
2b1cd846b3
Fixes and doc updates
2025-11-25 14:34:10 +00:00
Joe Farebrother
8d544e5b15
Add tests
2025-11-25 14:33:51 +00:00
Joe Farebrother
5094784a4b
Add modeling for gin
2025-11-25 14:33:43 +00:00
Joe Farebrother
74c424dc4c
Fixes, add secure query
2025-11-25 14:33:33 +00:00
Joe Farebrother
7d76619bea
Implement cookie write concepts and httponly query
2025-11-25 14:33:23 +00:00
Mathias Vorreiter Pedersen
26e5320a80
Merge pull request #20901 from MathiasVP/canonical-content
...
C++: Don't use `Field`s to define `FieldContent`
2025-11-25 13:54:19 +00:00
Jeroen Ketema
861ca7526e
Merge branch 'main' into canonical-content
2025-11-25 14:08:42 +01:00
Mathias Vorreiter Pedersen
2024f32e81
C++: Add an example with missing flow.
2025-11-25 12:36:29 +00:00
Mathias Vorreiter Pedersen
47ab307410
C++: Respond to review comments.
2025-11-25 12:06:58 +00:00
Geoffrey White
1c2d8bb70e
Merge pull request #20851 from geoffw0/access-invalid-pointer-fp
...
Rust: Improve rust/access-invalid-pointer
2025-11-25 09:49:07 +00:00
Geoffrey White
daead038ab
Merge pull request #20829 from geoffw0/cert-checks
...
Rust: New Query rust/disabled-certificate-check
2025-11-24 15:21:58 +00:00
Mathias Vorreiter Pedersen
eb6b08591d
Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-11-24 15:01:09 +00:00
Mathias Vorreiter Pedersen
2e53370716
Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-11-24 15:01:00 +00:00
Ian Lynagh
555301cec7
Merge pull request #20874 from igfoo/igfoo/overlay
...
C++: Add the beginnings of overlay support
2025-11-24 14:11:09 +00:00
Mathias Vorreiter Pedersen
0487e0622a
C++: Accept test changes from tests that use getAQlClass.
2025-11-24 14:04:35 +00:00
Mathias Vorreiter Pedersen
ecb80cb4fc
C++: Represent field content using a column that is shared by all template instantiations.
2025-11-24 12:29:49 +00:00
Tom Hvitved
43111b8eaa
Merge pull request #20716 from hvitved/rust/path-resolution-variable-impl
...
Rust: Path resolution before variable resolution
2025-11-24 13:08:53 +01:00
Tom Hvitved
ac644b257a
Merge pull request #20848 from hvitved/rust/ranked-forex-rename
...
Rust: Use `ToIndex` instead of `FromIndex` in ranked `forex` predicates
2025-11-24 13:05:58 +01:00
Tom Hvitved
c7a0411c55
Merge pull request #20892 from hvitved/rust/builtin-mut-placeholders
...
Rust: Add placeholder declarations for `&mut` and `*mut`
2025-11-24 13:05:15 +01:00
Tom Hvitved
17e1e1713e
Rust: Add placeholder declarations for &mut and *mut
2025-11-23 20:56:07 +01:00
Tom Hvitved
b16f8c20a9
Update rust/ql/lib/codeql/rust/internal/PathResolution.qll
...
Co-authored-by: Simon Friis Vindum <paldepind@github.com >
2025-11-23 19:05:24 +01:00
Geoffrey White
b62968fa0f
Rust: Spelling.
2025-11-22 09:22:33 +00:00
Geoffrey White
993154ed57
Rust: Avoid duplicating sinks.
2025-11-21 19:34:16 +00:00
Geoffrey White
0ea28b4026
Rust: Test .expected changes.
2025-11-21 18:57:06 +00:00
