Commit Graph

84425 Commits

Author SHA1 Message Date
Taus
a7458df0a4 Python: Appease the QLDoc checker 2025-11-26 22:13:21 +00:00
Taus
c6ad438bfc Python: Add change note 2025-11-26 21:58:26 +00:00
Taus
24a29f46be Python: Fix all metrics-related compilation failures
In hindsight, having a `.getMetrics()` method that just returns `this`
is somewhat weird. It's possible that it predates the existence of the
inline cast, however.
2025-11-26 21:28:51 +00:00
Taus
c75329d7b7 Python: Move metrics-related API to LegacyPointsTo module
Gets rid of the `getMetrics` methods on the `Function`, `Class`, and
`Module` classes. To access the metrics, one must first import the
`LegacyPointsTo` module, and then either change the type to
`{Function,Class,Module}Metrics` or cast to the appropriate type.
2025-11-26 17:06:55 +00:00
Taus
cd1619b43e Python: Fix queries and tests 2025-11-26 17:06:55 +00:00
Taus
b9a5b3b628 Python: Remove points-to from SSA.ql
Happily, this was not as deeply entwined as it looked at first glance.
2025-11-26 17:06:55 +00:00
Taus
5b47fcbfa4 Python: Remove dependence on Builtins from attribute module
The `Builtins` module is deeply entwined with points-to, so it would be
nice to not have this dependence. Happily, the only thing we used
`Builtin` for was to get the names of known builtins, and for this we
already maintain such a set of names in
`dataflow.new.internal.Builtins`.
2025-11-26 12:30:31 +00:00
Taus
9dc774aaa3 Python: Remove points-to dependency from parts of SSA
For whatever reason, the CFG node for exceptions and exception groups
was placed with the points-to code. (Probably because a lot of the
predicates depended on points-to.)

However, as it turned out, two of the SSA modules only depended on
non-points-to properties of these nodes, and so it was fairly
straightforward to remove the imports of `LegacyPointsTo` for those
modules.

In the process, I moved the aforementioned CFG node types into
`Flow.qll`, and changed the classes in the `Exceptions` module to the
`...WithPointsTo` form that we introduced elsewhere.
2025-11-26 12:30:31 +00:00
Taus
e09840426c Python: Get rid of points-to from Definitions.qll
Turns out the `ImportTime` module (despite living in
`semmle.python.types` does not actually depend on points-to, so some of
the `LegacyPointsTo` imports could be replaced or removed.
2025-11-26 12:30:31 +00:00
Taus
7328f26311 Python: Fix reachability-related test failures 2025-11-26 12:30:31 +00:00
Taus
21e74a3f01 Python: Fully remove points-to from Flow.qll
Gets rid of a bunch of predicates relating to reachability (which
depended on the modelling of exceptions, which uses points-to), moving
them to `LegacyPointsTo`. In the process, we gained a new class
`BasicBlockWithPointsTo`.
2025-11-26 12:30:31 +00:00
Taus
7176898503 Python: Fix library tests 2025-11-26 12:30:31 +00:00
Taus
b3b87c968b Python: Fix extractor/experimental tests 2025-11-26 12:30:31 +00:00
Taus
665104e626 Python: Fix Python 3 tests 2025-11-26 12:30:31 +00:00
Taus
85029bd77d Python: Fix Python 2 tests 2025-11-26 12:30:30 +00:00
Taus
5b63b4957c Python: Fix query tests
Mostly just adding `private import LegacyPointsTo`. Sometimes getting
rid of other imports that are superceded by that module.
2025-11-26 12:30:30 +00:00
Taus
2732a652ab Python: Fix example snippets
One might argue that these should be rewritten entirely to use more
modern APIs, but for now I'll be content with just having them compile
properly.
2025-11-26 12:30:30 +00:00
Taus
0a4ec2ca10 Python: Move some non-points-to methods out of points-to
These methods were in `pointsto.Base` but did not actually interact with
the points-to machinery directly, so they were easy to move out.
2025-11-26 12:30:30 +00:00
Taus
f0465f441f Python: Get rid of some get...Object methods
This frees `Class.qll`, `Exprs.qll`, and `Function.qll` from the
clutches of points-to. For the somewhat complicated setup with
`getLiteralObject` (an abstract method), I opted for a slightly ugly but
workable solution of just defining a predicate on `ImmutableLiteral`
that inlines each predicate body, special-cased to the specific instance
to which it applies.
2025-11-26 12:30:30 +00:00
Taus
78c33ab55a Python: Remove points-to references from python.qll
For now, these have just been made into `private` imports. After doing
this, I went through all of the (now not compiling) files and added in
private imports to the modules that they actually depended on.

I also added an explicit import of `LegacyPointsTo` (even though it may
be unnecessary) in cases where the points-to dependency was somewhat
surprising (and one we want to get rid of). This was primarily inside
the various SSA layers.

For modules inside `semmle.python.{types, objects, pointsto}` I did not
bother, as these are fairly clearly related to points-to.
2025-11-26 12:30:30 +00:00
Joe Farebrother
85cb3e026c Merge pull request #20762 from joefarebrother/go-insecure-cookie
Go: Promote non-httponly cookie query, and add insecure cookie query
2025-11-25 16:39:45 +00:00
Joe Farebrother
cece73bdbf Remove references to gorilla 2025-11-25 14:36:16 +00:00
Joe Farebrother
c7b16a043e Address reviews - update comments, remove unneeded stubs 2025-11-25 14:36:00 +00:00
Joe Farebrother
c6110ed541 Split SecureCookies into query specific files 2025-11-25 14:35:47 +00:00
Joe Farebrother
5b702d963e Refactor parts of SensitiveCookieNameConfig 2025-11-25 14:35:42 +00:00
Joe Farebrother
03d63dec2e Address reviews - rename and update doc comments 2025-11-25 14:35:29 +00:00
Joe Farebrother
1bd5005fc1 Fix typos 2025-11-25 14:35:17 +00:00
Joe Farebrother
6282c34396 Update formatting 2025-11-25 14:35:09 +00:00
Joe Farebrother
a25861d8a3 Update integration test 2025-11-25 14:35:02 +00:00
Joe Farebrother
ed483dd5b2 Add change note 2025-11-25 14:34:57 +00:00
Joe Farebrother
d633120f4d Update integration tests 2025-11-25 14:34:48 +00:00
Joe Farebrother
536e885f18 Remove experimental query 2025-11-25 14:34:41 +00:00
Joe Farebrother
fa30041498 Add qhelp & fix tests 2025-11-25 14:34:28 +00:00
Joe Farebrother
2b1cd846b3 Fixes and doc updates 2025-11-25 14:34:10 +00:00
Joe Farebrother
8d544e5b15 Add tests 2025-11-25 14:33:51 +00:00
Joe Farebrother
5094784a4b Add modeling for gin 2025-11-25 14:33:43 +00:00
Joe Farebrother
74c424dc4c Fixes, add secure query 2025-11-25 14:33:33 +00:00
Joe Farebrother
7d76619bea Implement cookie write concepts and httponly query 2025-11-25 14:33:23 +00:00
Mathias Vorreiter Pedersen
26e5320a80 Merge pull request #20901 from MathiasVP/canonical-content
C++: Don't use `Field`s to define `FieldContent`
2025-11-25 13:54:19 +00:00
Jeroen Ketema
861ca7526e Merge branch 'main' into canonical-content 2025-11-25 14:08:42 +01:00
Mathias Vorreiter Pedersen
2024f32e81 C++: Add an example with missing flow. 2025-11-25 12:36:29 +00:00
Mathias Vorreiter Pedersen
47ab307410 C++: Respond to review comments. 2025-11-25 12:06:58 +00:00
Geoffrey White
1c2d8bb70e Merge pull request #20851 from geoffw0/access-invalid-pointer-fp
Rust: Improve rust/access-invalid-pointer
2025-11-25 09:49:07 +00:00
Geoffrey White
daead038ab Merge pull request #20829 from geoffw0/cert-checks
Rust: New Query rust/disabled-certificate-check
2025-11-24 15:21:58 +00:00
Mathias Vorreiter Pedersen
eb6b08591d Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-11-24 15:01:09 +00:00
Mathias Vorreiter Pedersen
2e53370716 Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
2025-11-24 15:01:00 +00:00
Ian Lynagh
555301cec7 Merge pull request #20874 from igfoo/igfoo/overlay
C++: Add the beginnings of overlay support
2025-11-24 14:11:09 +00:00
Mathias Vorreiter Pedersen
0487e0622a C++: Accept test changes from tests that use getAQlClass. 2025-11-24 14:04:35 +00:00
Mathias Vorreiter Pedersen
ecb80cb4fc C++: Represent field content using a column that is shared by all template instantiations. 2025-11-24 12:29:49 +00:00
Tom Hvitved
43111b8eaa Merge pull request #20716 from hvitved/rust/path-resolution-variable-impl
Rust: Path resolution before variable resolution
2025-11-24 13:08:53 +01:00