Commit Graph

74382 Commits

Author SHA1 Message Date
Paolo Tranquilli
5251dc2058 Rust: use check_diagnostics improvements 2024-11-27 13:36:27 +01:00
Mathias Vorreiter Pedersen
d86fea5ba5 Merge pull request #18114 from MathiasVP/actually-check-func-name-in-mad
C++: Actually check function names in MaD
2024-11-27 11:22:10 +00:00
Paolo Tranquilli
27738eaacc Rust: reorganize perf diagnostics 2024-11-27 12:05:06 +01:00
Geoffrey White
c113a0b5a1 Rust: Fix typo. 2024-11-27 10:51:42 +00:00
Geoffrey White
60c212bb10 Rust: Update for changes on main. 2024-11-27 10:42:24 +00:00
Geoffrey White
ba560f2fe9 Rust: Model SQLx. 2024-11-27 10:31:05 +00:00
Geoffrey White
e96f15d9b4 Rust: Add a test exposing SQL Injection sinks directly. 2024-11-27 10:31:04 +00:00
Anders Schack-Mulligen
df2e2e503a Merge pull request #17901 from aschackmull/java/allowlist-sanitizer
Java: Add a default taint sanitizer for contains-checks on lists of constants
2024-11-27 11:09:05 +01:00
Owen Mansel-Chan
c580046f8c Merge pull request #18121 from github/workflow/coverage/update
Update CSV framework coverage reports
2024-11-27 09:37:19 +00:00
Simon Friis Vindum
9ec9d79b4f Rust: Add additional tests for flow through structs 2024-11-27 10:10:49 +01:00
Simon Friis Vindum
46abb9083b Merge pull request #18115 from paldepind/rust-rename-expr
Rust: Rename `expr` on `CallExpr` and `LetExpr`
2024-11-27 09:41:04 +01:00
Anders Schack-Mulligen
5ef496dd1b Java: Add more qldoc. 2024-11-27 09:07:35 +01:00
Tom Hvitved
7402276ec7 Data flow: Move more logic into DataFlowImplCommon 2024-11-27 09:03:37 +01:00
Anders Schack-Mulligen
85778f7fea Java: Fix semantic merge conflict in expected file. 2024-11-27 08:53:41 +01:00
Simon Friis Vindum
8f886c6603 Merge pull request #18088 from paldepind/rust-self-parameters
Rust: Handle `self` parameters in variables and SSA library
2024-11-27 08:42:58 +01:00
Ed Minnix
2b0c7a209b Fix test results 2024-11-26 22:42:24 -05:00
Ed Minnix
a4b2ee1205 Fix generic 2024-11-26 22:42:13 -05:00
Ed Minnix
b820b324bd Change note 2024-11-26 22:32:45 -05:00
Ed Minnix
216d298780 Microsoft.JSInterop models 2024-11-26 22:29:43 -05:00
github-actions[bot]
89b2a6b726 Add changed framework coverage reports 2024-11-27 00:21:55 +00:00
Owen Mansel-Chan
0e94ee81ae Don't getUnderlyingType before looking through pointer type
If `T` is the type of an embedded field, it is invalid for `T` to be a
named type defined to be a pointer type (`type T *S`). It is also
invalid for `T` to be a type parameter. So this `getUnderlyingType()` is
redundant.
2024-11-26 22:25:56 +00:00
Owen Mansel-Chan
2cba97e87d Small stylistic improvement 2024-11-26 22:25:55 +00:00
Owen Mansel-Chan
1bc1472b0b Add change note 2024-11-26 22:25:53 +00:00
Owen Mansel-Chan
4990f16ba5 Refactor struct field predicate to remove redundancy 2024-11-26 22:25:48 +00:00
Owen Mansel-Chan
8dc0688b6f Fix bug 2024-11-26 22:25:47 +00:00
Owen Mansel-Chan
593896b40e Add test showing promoted field bug
NCField should be promoted to EmbedsNameClash. Currently it isn't
because its embedded parent pkg2.NameClash is not a promoted field in
EmbedsNameClash (because of a name clash with pkg1.NameClash), but this
should not make a difference.
2024-11-26 22:25:41 +00:00
Owen Mansel-Chan
553bc8c13d Merge pull request #18108 from owen-mc/go/mad/model-slices-package
Go: model `slices` package (skipping functions that involve iterating over a function)
2024-11-26 21:24:22 +00:00
Edward Minnix III
86c7a49264 Apply suggestions from code review
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2024-11-26 13:12:16 -05:00
Paolo Tranquilli
556774edc7 Rust: do not put extraction steps in the expected diagnostics 2024-11-26 18:00:15 +01:00
Simon Friis Vindum
92427ab0c1 Merge branch 'main' into rust-rename-expr 2024-11-26 17:40:47 +01:00
Paolo Tranquilli
8abd3c4707 Rust: Remove windows difference from diagnostics 2024-11-26 16:48:49 +01:00
Taus
d779ae5c3e Python: Add change note for CFG pruning fix
... And also bump the extractor version.
2024-11-26 15:39:15 +00:00
Paolo Tranquilli
24eb65692f Rust: add some performance diagnostics
This outputs some duration counts for various parts of the extraction
process in the database in the form of telemetry diagnostics.

The diagnostics format was preferred to putting things in the relational
database as that will scale better to code scanning and is more flexible
as for the data we can put into it without passing through the dbscheme.
Also, although it's not the case yet, it will be possible to output
diagnostics even if creation of the database fails.
2024-11-26 16:35:38 +01:00
Owen Mansel-Chan
141259c003 Update go/ql/lib/ext/slices.model.yml
Co-authored-by: Chris Smowton <smowton@github.com>
2024-11-26 14:48:20 +00:00
Simon Friis Vindum
7ab5663fa6 Rust: Address PR feedback 2024-11-26 15:42:19 +01:00
Jeroen Ketema
8d59159691 C++: Fix qlref file 2024-11-26 15:35:52 +01:00
Simon Friis Vindum
d30f3e2822 Rust: Renamed expr on CallExpr and LetExpr 2024-11-26 15:22:14 +01:00
Mathias Vorreiter Pedersen
e42c7452ef C++: Cleanup conjuncts. This doesn't change any behavior. 2024-11-26 13:57:51 +00:00
Mathias Vorreiter Pedersen
39b61598e9 C++: Accept test changes. 2024-11-26 13:57:38 +00:00
Mathias Vorreiter Pedersen
f7cf5af720 C++: Actually check the function name. 2024-11-26 13:56:22 +00:00
Jami
36acfeb305 Merge pull request #18087 from jcogs33/jcogs33/java-sha2
Java: add SHA-384 to list of secure crypto algorithms
2024-11-26 08:51:58 -05:00
yoff
6d6f269e6c Merge pull request #17997 from yoff/java/inline-range-tests 2024-11-26 14:48:07 +01:00
Tom Hvitved
0c6b4cdb8f Merge pull request #18078 from hvitved/rust/variant-flow
Rust: Data flow through variants
2024-11-26 14:45:00 +01:00
Mathias Vorreiter Pedersen
f65f11b404 C++: Add a test for a somewhat embarrasing bug: MaD didn't check the function name in some cases. 2024-11-26 13:43:42 +00:00
Taus
2734377e5d Python: Add API graph support for parameter annotations
Adds API graph support for observing that in
```python
def foo(x : Bar): ...
```
The variable `x` is likely to be an instance of the type `Bar` inside
this function.
In particular, we add `getInstanceFromAnnotation` as a predicate on API
graph nodes that tracks this step (corresponding to a new edge type
labeled with "annotation" in the API graph), and extend the existing
`getAnInstance` predicate to also include instances arising from type
annotations.

A more complete solution would also add support for annotated
assignments (`x : Foo = ...` or just `x : Foo`) as well as track types
through type aliases (`type Foo = Bar`). This turns out to be
non-trivial, however, as these type constructs don't have any CFG nodes
(and so no data-flow nodes by default either). In order to not have
perfect be the enemy of good, this commit is only targeting the type
parameter case (which is also likely to be the most common use case
anyway).

The tests for API graphs have been extended accordingly, including tests
for the kinds of type ascriptions that we _don't_ currently model in API
graphs (marked with `MISSING:` in the inline tests).
2024-11-26 13:03:06 +00:00
Jeroen Ketema
6aa7c93af2 C++: More qlhelp fixes 2024-11-26 13:58:54 +01:00
Jeroen Ketema
fc6c327ab7 C++: Add change note 2024-11-26 13:55:30 +01:00
Taus
047e9742a0 Merge pull request #18086 from github/tausbn/add-vscode-task-for-creating-change-notes
Add script and VSCode task for creating change notes
2024-11-26 13:55:21 +01:00
Jeroen Ketema
e1f70a0dec C++: Add missing </p> to qlhelp 2024-11-26 13:50:09 +01:00
Taus
5279857d06 Fix comment 2024-11-26 12:48:20 +00:00