hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 02:44:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
12,232 Commits 1,672 Branches 157 Tags
aa7a0e68793be9fabecc2612fb6f70ca15045930
Commit Graph

3712 Commits

Author SHA1 Message Date
Jason Reed
aa7a0e6879 CPP: Add tags for VS Code jump-to-defition 2020-04-29 10:15:26 -04:00
alexet
6a41028d3a CPP:Add preliminary local jump to def queries 2020-04-29 10:15:26 -04:00
Nick Rolfe
55301b4b2f Merge pull request #3074 from matt-gretton-dann/codeql-c-extractor/50-char8_t 
Add support for C++20's char8_t type.
 2020-04-29 12:15:25 +01:00
Mathias Vorreiter Pedersen
8a1d96b313 Merge pull request #3374 from jbj/PartialDefinition-refactor 
C++: Refactor `PartialDefinition` charpred
 2020-04-29 13:03:40 +02:00
Jonas Jensen
de3fa8e68b Merge pull request #3337 from Cornelius-Riemenschneider/alloc-type 
C++: Allocation.qll: Provide getAllocatedElementType predicate for AllocationExprs.
 2020-04-29 11:55:02 +02:00
Matthew Gretton-Dann
a6947e0296 C++: Complete support for char8_t 2020-04-29 10:18:13 +01:00
Matthew Gretton-Dann
c0d0f7862b C++: Add DB Upgrade script 2020-04-29 10:18:13 +01:00
Matthew Gretton-Dann
52670dd956 C++: Update expected test output. 2020-04-29 10:18:13 +01:00
Matthew Gretton-Dann
2d898af2fe C++: Add library support for char8_t type. 2020-04-29 10:18:13 +01:00
Matthew Gretton-Dann
79b3a995e9 C++: Add DB support for C++20's char8_t 2020-04-29 10:18:13 +01:00
Shati Patel
5c80cd5032 Merge branch 'rc/1.24' into mergeback 2020-04-29 08:05:53 +01:00
Jonas Jensen
796041af72 C++: Refactor PartialDefinition charpred 
This class used `newtype` for seemingly no reason. The new code is
shorter and should be faster as well.
 2020-04-28 17:10:25 +02:00
Mathias Vorreiter Pedersen
b1a94d8809 Merge branch 'master' into get-an-assigned-value-join-order 2020-04-27 14:11:30 +02:00
Tom Hvitved
d28c4fb0f5 Merge pull request #3202 from jbj/pathStep-join-unique 
Java/C++/C#: Use `unique` to improve join order fix
 2020-04-27 13:06:27 +02:00
Cornelius Riemenschneider
3f7d68178c Use stripTopLevelSpecifiers() to get the allocated element type for malloc(). 2020-04-27 12:46:14 +02:00
Cornelius Riemenschneider
92e8604fa1 Provide getAllocatedElementType predicate for AllocationExprs. 
This predicate tries to determine the type of the allocated elements of an allocation expression.
 2020-04-27 12:41:19 +02:00
Cornelius Riemenschneider
203315ae33 Assign malloc results in test to variables. 2020-04-27 12:40:35 +02:00
Geoffrey White
230e5a3a9a Merge pull request #3326 from Cornelius-Riemenschneider/alloc-size-mul 
C++: Allocation.qll: Analyze common pattern of malloc() invocations to provide more accurate getSizeMult()
 2020-04-27 11:18:54 +01:00
Jonas Jensen
20c956e0a9 Merge pull request #3320 from Semmle/rdmarsh/cpp/taint-tracking-util-port 
C++: move logic from DefaultTaintTracking into TaintTrackingUtil
 2020-04-27 11:34:03 +02:00
Cornelius Riemenschneider
a50d5b7c6a Accept changed test output. 2020-04-27 09:17:16 +02:00
Robert Marsh
4eea62cbde Merge pull request #3345 from Cornelius-Riemenschneider/openssl-allocators 
C++: Allocation.qll: Add support for openssl allocation/deallocation functions.
 2020-04-24 14:48:05 -07:00
Jonas Jensen
718f4cd3f9 C++: Speed up SuspiciousAddWithSizeof select 
This `select` clause had become very slow after we started caching
`ElementBase::toString` because the query used string concatenation to
produce alert messages, and those string concatenations were done very
early in the pipeline, producing lots of strings that would be discarded
moments later.

By using `$@` to interpolate elements into strings, the concatenation is
done outside of QL.

Testing on a Chromium snapshot, this commit takes us from

    #select#ff ................ 6m2s

to

    #select#cpe#134#fff ....... 15.2s
 2020-04-24 16:18:18 +02:00
Mathias Vorreiter Pedersen
98c2fd8401 Merge branch 'master' into get-an-assigned-value-join-order 2020-04-24 15:03:59 +02:00
Mathias Vorreiter Pedersen
7df45a9bb4 Merge pull request #3316 from jbj/arithTypesMatch-perf 
C++: inline arithTypesMatch predicate
 2020-04-24 09:13:02 +02:00
Jonas Jensen
d98e956c2b Merge pull request #3322 from felicitymay/merge-124-master 
Merge rc/1.24 into master
 2020-04-24 08:48:54 +02:00
Cornelius Riemenschneider
c25eb19b18 Add support for openssl allocation/deallocation functions. 2020-04-24 01:57:14 +02:00
Cornelius Riemenschneider
0ea7fedeb0 Address review and fix bug in deconstructSizeExpr/3. 
Logic is hard, and I made a mistake inverting the formula for the second case, so the
predicate never held for a sizeExpr like sizeof(int)*sizeof(void).
Now, this case is correctly handled by the fallback.
 2020-04-23 16:39:29 +02:00
Cornelius Riemenschneider
492f1f446a Remove pragma[inline] from deconstructSizeExpr/3. 2020-04-23 15:53:11 +02:00
Mathias Vorreiter Pedersen
deff2820c2 C++: Modernize getAnAssignedValue following PR comments 2020-04-23 14:14:35 +02:00
Jonas Jensen
37e3bc4b3e C++: invoke unique without | | 
Based on PR feedback. This will avoid a syntactic wart and make the
invocation do the right thing both with and without
`language[monotonicAggregates]`.
 2020-04-23 13:10:05 +02:00
Jonas Jensen
312e6229fb Merge pull request #3330 from MathiasVP/libc-assert 
C++: Generalize charpred of LibcAssert
 2020-04-23 13:06:41 +02:00
Cornelius Riemenschneider
a33b7f8c99 Make getSizeMult() functional. 2020-04-23 12:15:31 +02:00
Jonas Jensen
d6f77c0f98 Merge pull request #3328 from MathiasVP/literal-comment 
C++: Remove unnecessary part of comment
 2020-04-23 11:10:16 +02:00
Mathias Vorreiter Pedersen
0fb534c79e C++: Fix join order in getAnAssignedValue 2020-04-23 11:04:40 +02:00
Jonas Jensen
f696594d35 Merge pull request #3295 from MathiasVP/field-flow-single-struct 
C++: Add PostUpdateNode for updates to structs with no chi instructions
 2020-04-23 10:02:10 +02:00
Jonas Jensen
cbed175931 Merge pull request #3273 from Semmle/rdmarsh/cpp/RemoteFlowSource-model 
C++: Add remote flow sources via models
 2020-04-23 09:54:40 +02:00
Mathias Vorreiter Pedersen
1016a0c0db C++: Generalize charpred of LibcAssert 2020-04-23 09:48:30 +02:00
Mathias Vorreiter Pedersen
7b51d0c8a5 C++: Remove unnecessary part of comment 2020-04-23 08:35:44 +02:00
Cornelius Riemenschneider
293e6466d4 AllocationExpr.getSizeMult() now analyzes the size expression of function calls. 
This yields more precise size information in a lot of the common cases of C allocation code,
as the common pattern malloc(count * sizeof(type)) is now understood.
 2020-04-23 02:05:31 +02:00
Cornelius Riemenschneider
247fc42ec5 Add tests that show AllocationExpr.getSizeMult() behaviour. 2020-04-23 02:02:57 +02:00
Robert Marsh
0dc797d288 C++: autoformat ModelUtil.qll 2020-04-22 16:14:58 -07:00
Robert Marsh
ac22e7950c C++: autoformat FlowSources.qll 2020-04-22 16:11:33 -07:00
Robert Marsh
471f536326 Merge pull request #3307 from dbartol/dbartol/BinaryConditional 
C++: IR translation for binary conditional operator
 2020-04-22 15:01:16 -07:00
Felicity Chapman
89bf35cd43 Merge branch 'rc/1.24' into merge-124-master 
Conflicts:
	change-notes/1.24/analysis-javascript.md
    Resolved in favor of the rc/1.24 branch
 2020-04-22 19:01:47 +01:00
Dave Bartolomeo
163ecd97de Merge pull request #3277 from geoffw0/rangeshift 
C++: Support for & and >> in SimpleRangeAnalysis
 2020-04-22 11:36:36 -04:00
Jonas Jensen
448bd2be87 C++: Make Declaration not abstract 
It looks like this change will stop `SignedOverflowCheck.ql` from
needlessly re-evaluating several cached stages.
 2020-04-22 17:34:18 +02:00
Jonas Jensen
7a3663976b C++: inline arithTypesMatch predicate 
This predicate is effectively a Cartesian product between all enum
types. It's infeasible to compute it in full, so luckily the optimizer
has been able to apply enough magic to make it feasible. That's not a
robust solution, and it has indeed broken on at least one version of the
1.24 release candidate.

On a Chromium snapshot where I ran the LGTM suite overnight, the
`m#MistypedFunctionArguments::arithTypesMatch#bb` predicate (magic for
`arithTypesMatch`) took 170m5s. That was commit b69fdf5 from the
internal repo. I tried to reproduce it in VSCode, this time with commit
646646, but it wasn't quite as bad: the predicate took only 38 seconds.
In any case, making the problematic predicate `pragma[inline]` removes
the slow magic and makes the `MistypedFunctionArguments.ql` query
faster.
 2020-04-22 15:14:07 +02:00
Dave Bartolomeo
66381e89ef C++: Add comment from PR feedback 2020-04-22 08:11:43 -04:00
Robert Marsh
9e0d6e8aa0 C++: move taint step cases to TaintTrackingUtil 2020-04-22 01:38:00 -07:00
Geoffrey White
2e392516c2 Apply suggestions from code review 
Co-Authored-By: Dave Bartolomeo <dbartol@github.com>
 2020-04-22 09:09:16 +01:00