hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-19 16:33:40 +01:00
Code Issues Packages Projects Releases Wiki Activity
46,022 Commits 1,692 Branches 160 Tags
ae01201c4379ef8d841c0076a3df31f0c849cd16
Commit Graph

46022 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mathias Vorreiter Pedersen
ae01201c43 Merge pull request #11109 from jketema/fix-field-dataflow-tests 
C++: Fix the IR dataflow configuration for the field flow tests
 2022-11-03 19:19:30 +00:00
Mathias Vorreiter Pedersen
1d1161771a Merge pull request #11108 from jketema/indirect-arg-out-as-partial-def 
C++: Turn `IndirectArgumentOutNode` into a `PartialDefinitionNode`
 2022-11-03 17:57:12 +00:00
Jeroen Ketema
96425a1787 C++: Fix the IR dataflow configuration for the field flow tests 2022-11-03 18:06:37 +01:00
Jeroen Ketema
c87b516130 C++: Turn IndirectArgumentOutNode into a PartialDefinitionNode 2022-11-03 17:58:35 +01:00
Mathias Vorreiter Pedersen
f4915073c8 Merge pull request #11097 from MathiasVP/accept-test-change 
C++: Accept test change
 2022-11-03 11:24:57 +00:00
Mathias Vorreiter Pedersen
5d5c64a58b C++: Accept test change. 2022-11-03 10:27:07 +00:00
Mathias Vorreiter Pedersen
18802a2883 Merge pull request #11042 from MathiasVP/simplify-buffer.qll 
C++: Simplify `buffer.qll` repair
 2022-11-03 09:18:39 +00:00
Mathias Vorreiter Pedersen
30f15473db C++: Use 'max' instead of 'unique.' 2022-11-01 16:55:45 +00:00
Jeroen Ketema
80ef3b39ff Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow 2022-10-31 18:26:34 +01:00
Jeroen Ketema
222c9a6357 Merge pull request #11048 from jketema/add-constant-test 
C++: Add `strcpy` test for `cpp/non-constant-format`
 2022-10-31 18:01:13 +01:00
Jeroen Ketema
b43cbf7f95 Update cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2022-10-31 17:03:29 +01:00
Jeroen Ketema
abe9258943 C++: Add strcpy test for cpp/non-constant-format 2022-10-31 15:29:17 +01:00
Jeroen Ketema
83afc2a0ad C++: Add strcpy prototype to test 2022-10-31 15:25:35 +01:00
Ian Lynagh
21600c612d Merge pull request #11037 from igfoo/igfoo/log 
Kotlin: Integration tests: Allow \ as a path separator in logs test
 2022-10-31 14:03:57 +00:00
Tamás Vajk
e356720c73 Merge pull request #11014 from tamasvajk/kotlin-for-loop-var 
Kotlin: Resugar `for` loops
 2022-10-31 14:48:21 +01:00
Chris Smowton
d959630991 Merge pull request #11040 from smowton/smowton/fix/inherited-method-implementing-collection-interface 
Kotlin: fix method types when an inherited method implements a collection type
 2022-10-31 12:40:28 +00:00
Ian Lynagh
a53c2104d1 Kotlin: Integration tests: Allow \ as a path separator in logs test 2022-10-31 11:24:39 +00:00
Chris Smowton
c11d63e4d2 Merge pull request #11015 from smowton/smowton/fix/go-cleartext-logging-exclude-protobuf-getters 
Go: exclude protobuf read steps from cleartext-logging query
 2022-10-31 10:43:52 +00:00
Geoffrey White
c161bb5e95 Merge pull request #11035 from geoffw0/simplify2 
Swift: Simplify some more QL
 2022-10-31 09:50:55 +00:00
Rasmus Wriedt Larsen
ead0844174 Merge pull request #10998 from RasmusWL/essa-use-use-test 
Python: Add failing ESSA use-use test
 2022-10-31 10:38:26 +01:00
Tamas Vajk
4cd0f1ca66 Apply code review findings 2022-10-31 08:43:53 +01:00
Harry Maclean
3f403f0f87 Merge pull request #10700 from hmac/activesupport 
Ruby: Model some ActiveSupport methods
 2022-10-31 11:50:44 +13:00
Mathias Vorreiter Pedersen
1b50168d08 C++: Add an initial pruning stage to prevent this 
large TC in 'localFlowToExpr':
```
Evaluated relational algebra for predicate Buffer#61e3d199::localFlowStepToExpr#2#ff@0a49913i with tuple counts:
    4713946   ~0%    {2} r1 = SCAN DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff OUTPUT In.1, In.0

  40897385  ~46%    {2} r2 = JOIN boundedFastTC:Buffer#61e3d199::localFlowToExprStep#2#ff_10#higher_order_body:DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff_0#higher_order_body WITH DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1

  45611331  ~43%    {2} r3 = r1 UNION r2
    3376553  ~14%    {2} r4 = JOIN r3 WITH DataFlowUtil#47741e1f::ExprNode::getExpr#0#dispred#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
                    return r4
```

After this commit the tuple counts looks like:
```
Evaluated relational algebra for predicate Buffer#61e3d199::localFlowStepToExpr#2#ff@8cc38x5k on iteration 2 running pipeline standard with tuple counts:
         51367   ~3%    {2} r1 = JOIN Buffer#61e3d199::getBufferSize0#1#f#prev_delta WITH DataFlowUtil#47741e1f::ExprNode::getExpr#0#dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.0

        124933  ~18%    {2} r2 = JOIN r1 WITH #Buffer#61e3d199::localFlowToExprStep#2Plus#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1

        176300  ~17%    {2} r3 = r1 UNION r2
        184685  ~22%    {2} r4 = JOIN r3 WITH DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1
         56646  ~47%    {2} r5 = JOIN r4 WITH DataFlowUtil#47741e1f::ExprNode::getExpr#0#dispred#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
         44635  ~16%    {2} r6 = r5 AND NOT Buffer#61e3d199::localFlowStepToExpr#2#ff#prev(Lhs.0, Lhs.1)
                        return r6
```
 2022-10-30 14:20:15 +01:00
Mathias Vorreiter Pedersen
aa8214addf C++: Simplify 'Buffer.qll' by avoiding 'asIndirectExpr'. This removes the flow from 'x' to 'x++', which makes the whole library a lot simpler. 2022-10-30 12:58:53 +01:00
Chris Smowton
b370497f96 Avoid split overrides 2022-10-29 18:23:45 +01:00
Chris Smowton
3573e211cc Correct test expectations 2022-10-29 11:40:58 +01:00
Chris Smowton
b6e4f472d1 Remove unnecessary import 2022-10-29 11:40:57 +01:00
Chris Smowton
6d321e0151 Add change note 2022-10-29 11:40:57 +01:00
Chris Smowton
5c66d87ed6 gofmt 2022-10-29 11:40:57 +01:00
Chris Smowton
0c6c135967 Go: exclude protobuf read steps from cleartext-logging query 
This query already treats structs differently to usual: it includes field -> whole struct taint steps, but explicitly excludes struct -> field steps. This means that a logging framework sinking an entire struct with a tainted field yields an alert, but we don't get FPs caused by writing field `x` but then reading field `y`.

However, protobuf messages have a special treatment, with taint usually associated with the whole struct and getter methods propagating that taint out. Suppressing these getter method steps specifically for the cleartext-logging query mirrors its treatment of structs in general and avoids this sort of field-mismatch FP.

On the downside we will miss same-field propagation like `m.field = password; Log(m.GetField())` if we don't have source code for the implementation of `m`. However this is hopefully unusual since the typical use of protobufs is to serialize and deserialize, rather than using the struct as a general-purpose datastructure.
 2022-10-29 11:40:57 +01:00
Chris Smowton
8266a22332 Kotlin: fix method types when an inherited method implements a collection type 
In this circumstance the compiler seems to generate a specialised version of the implementing function with its argument type replaced by the interface-implementing child class' type parameter. However it stores a back-pointer to the real declared function, which we should use as the call target.
 2022-10-29 11:29:04 +01:00
Dave Bartolomeo
85790fcade Merge pull request #10964 from smowton/smowton/admin/modernise-qlpacks 
qlpacks: libraryPathDependencies -> dependencies
 2022-10-28 16:44:22 -04:00
Mathias Vorreiter Pedersen
18d3801c92 Merge pull request #11033 from MathiasVP/exclude-void-calls 
C++: Don't create `DataFlow::Node`s for `void`-typed instructions
 2022-10-28 20:46:33 +02:00
Chris Smowton
d9744c81b7 Merge pull request #11017 from smowton/smowton/fix/kotlin-wildcard-suppression-annotation 
Kotlin: fix wildcard suppression where the annotation applies to a parent type/argument.
 2022-10-28 18:33:07 +01:00
Ian Lynagh
84427e132e Kotlin: Move the logs test to all-platforms 2022-10-28 17:56:41 +01:00
Geoffrey White
f122005aaf Swift: Simplify out some variables. 2022-10-28 17:26:17 +01:00
Geoffrey White
b4d939a620 Swift: Correct a comment. 2022-10-28 17:11:24 +01:00
Chris Smowton
f9e811bddf Legacy support qlpacks: continue using libraryPathDependencies; add a comment noting this is obsolete. 2022-10-28 16:47:30 +01:00
Chris Smowton
1914a114a2 Merge pull request #11018 from smowton/smowton/fix/kotlin-extension-specialisation 
Kotlin: specialise extension receivers the same as other function parameters
 2022-10-28 16:15:41 +01:00
Chris Smowton
d6e2f5f4a8 Use ?.not() to negate a nullable boolean 2022-10-28 16:13:55 +01:00
Chris Smowton
1e1c9f639c Avoid Kotlin 1.5+ function firstNotNullOfOrNull 2022-10-28 16:13:55 +01:00
Chris Smowton
24f87ac963 Kotlin: fix wildcard suppression where the annotation applies to a parent type/argument. 
In the process I also fix the missed case where suppression can be switched off using a parameterized annotation.
 2022-10-28 16:13:55 +01:00
Ian Lynagh
2796d60d79 Merge pull request #11019 from igfoo/igfoo/win_integ 
Kotlin: Get some integration tests running on Windows
 2022-10-28 16:12:15 +01:00
Chris Smowton
5ad5cdce47 Swift integration-test runner: use --additional-packs 2022-10-28 16:07:38 +01:00
Chris Smowton
ee63e60bb7 qlpacks: libraryPathDependencies -> dependencies 2022-10-28 16:07:36 +01:00
Geoffrey White
648c2d09f9 Swift: Simplify InsecureTLS.ql. 2022-10-28 15:56:03 +01:00
Rasmus Wriedt Larsen
a04c78ab94 Python: Apply suggestions from code review 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2022-10-28 15:31:42 +02:00
Ian Lynagh
49425e6c2a Kotlin: Integration tests: Make a couple more posix-only for now 2022-10-28 13:59:36 +01:00
Tamas Vajk
d745381ebe Remove unneeded consistency test output 2022-10-28 14:56:25 +02:00
Tamas Vajk
803a97df7f Kotlin: Resugar for loops with tuples as loop variables 2022-10-28 14:55:50 +02:00