Chris Smowton
c2b42ce091
Fix sanitization by strings.Replace[All] in go/unsafe-quoting and go/log-injection
2021-12-14 12:37:18 +00:00
Chris Smowton
9309abf8cd
Merge pull request #574 from sauyon/dataflow-update
...
Update dataflow libraries and add support for CSV summary flow
2021-12-13 11:28:28 +00:00
Chris Smowton
89b2a2f9b0
Merge pull request #633 from owen-mc/database-sql-model-incorrect
...
Fix incorrect type name in database/sql model
2021-12-13 11:01:38 +00:00
Chris Smowton
559aec1d64
Merge pull request #632 from owen-mc/refactor-variadic-helper-functions-for-builtin-functions
...
Refactor isVariadic helper functions
2021-12-13 10:59:42 +00:00
Chris Smowton
08c10bf97b
Merge pull request #625 from smowton/smowton/fix/minor-perf-improvements
...
Improve performance: join-order AllocationSizeOverflow's source and use `matches` not `regexpFind`
2021-12-13 10:36:02 +00:00
Owen Mansel-Chan
ce27b0da52
Fix incorrect type name in database/sql model
...
This error seems to have been introduced in
36bbf1eeb9
2021-12-12 17:47:52 -05:00
Owen Mansel-Chan
353aa8d603
Refactor isVariadic helper functions
...
Store information more naturally for built-in functions.
2021-12-12 16:56:26 -05:00
Andrew Eisenberg
3cc48fea6a
Merge pull request #622 from github/post-release/v2.7.3
...
Post release/v2.7.3
2021-12-10 10:00:11 -08:00
Chris Smowton
e9e4f5a687
Improve performance: join-order AllocationSizeOverflow's source and use matches not regexpFind
...
The join order fix takes 10 seconds off that predicate; the get-a-flag changes take about 25% off compared to using regexes.
2021-12-10 12:23:50 +00:00
Chris Smowton
facda77852
Dataflow relations: narrow all dataflow nodes before taking product with Configurations
...
This is particularly important for ConversionWithoutBoundsCheckConfig which has 20 configs. By paring DataFlow::Node down to only those that have a local-flow successor, or only those with an isAdditionalFlowStep for some related configuration, the result size can be significantly reduced prior to taking the product against Configuration and finally paring down using config.fullBarrier etc.
Saves about 1m20s per analysis on cockroachdb.
2021-12-09 16:56:38 +00:00
Andrew Eisenberg
cedf55c46e
Update pack dependency
2021-12-09 07:58:14 -08:00
Owen Mansel-Chan
b234ba7f26
Fix bad join order in getAFalsifiedGuard
...
viableParamArg should be evaluated first.
2021-12-08 17:33:59 -05:00
Owen Mansel-Chan
a01f90b903
Give DataFlowCallable a user-facing name (Callable), move to Scopes.qll
...
I removed asFunctionNode() because it would need an import, but it
doesn't seem to be used anywhere.
2021-12-08 11:30:39 -05:00
Owen Mansel-Chan
a6532b988f
Allow implicit taint reads through more content types
2021-12-08 11:20:38 -05:00
Owen Mansel-Chan
754c838cc0
Fix accidental cartesian product
...
PointerContent needs to have the PointerType specified as well
2021-12-08 11:20:37 -05:00
Owen Mansel-Chan
d70307243c
Fix bad join order in BarrierGuard.guards/2
2021-12-08 11:20:37 -05:00
Owen Mansel-Chan
1a9ea38c0b
Update non-shared dataflow files to match sync
2021-12-08 11:20:36 -05:00
Owen Mansel-Chan
095fe6e4a7
Do not allow "Argument" on its own
...
# Conflicts:
# ql/test/library-tests/semmle/go/dataflow/ExternalFlow/srcs.expected
2021-12-08 11:20:36 -05:00
Sauyon Lee
b2f62b185d
Allow for Return[i] specifications
2021-12-08 11:20:36 -05:00
Owen Mansel-Chan
578a31ecd8
Keep call to defaultTaintSanitizerGuard
2021-12-08 11:20:35 -05:00
Owen Mansel-Chan
01bfbde9ae
Sync dataflow libraries again
2021-12-08 11:20:35 -05:00
Owen Mansel-Chan
63b944a1b4
Another instance of getEnclosingFunction -> getRoot
2021-12-08 11:20:34 -05:00
Chris Smowton
3cf1459c4f
Revert getACallee type change
2021-12-08 11:20:33 -05:00
Chris Smowton
6110506e02
Revert "Make getACallee return DataFlowCallable"
...
This reverts commit b4742ccdf81bec3f872923da79953c61dea103f6.
2021-12-08 11:20:33 -05:00
Owen Mansel-Chan
5ec0b09160
Diasble clearing content and add test for it
2021-12-08 11:20:32 -05:00
Owen Mansel-Chan
2d8fd71189
Comment on why summaryDataFlowCall is none()
2021-12-08 11:20:31 -05:00
Owen Mansel-Chan
adf3dc0c61
Move type assertion into declared type
2021-12-08 11:20:31 -05:00
Owen Mansel-Chan
9f763dd044
Move built-in models to ExternalFlow
2021-12-08 11:20:30 -05:00
Owen Mansel-Chan
d717734820
Do not allow "Argument" on its own
2021-12-08 11:20:30 -05:00
Owen Mansel-Chan
d2ca1fb2eb
Address review comments #2
2021-12-08 11:20:29 -05:00
Owen Mansel-Chan
12058a2621
Fix containerStoreStep and containerReadStep
2021-12-08 11:20:29 -05:00
Owen Mansel-Chan
b7aa85b054
Address some review comments
2021-12-08 11:20:28 -05:00
Owen Mansel-Chan
5e38f48b74
Autoformat
2021-12-08 11:20:25 -05:00
Owen Mansel-Chan
71bf834765
Fix incorrect assumption
...
node2 doesn't have to be a PostUpdateNode
2021-12-08 11:20:23 -05:00
Sauyon Lee
a632a58221
add CSV models of append
2021-12-08 11:20:22 -05:00
Sauyon Lee
070e383516
allow empty namespaces for Go
2021-12-08 11:20:21 -05:00
Owen Mansel-Chan
70c9ca5611
Update documentation in ExternalFlow.qll
2021-12-08 11:20:21 -05:00
Owen Mansel-Chan
038f951e9f
Fix containerStoreStep
...
Update some comments as well, and change a variable name
2021-12-08 11:20:20 -05:00
Sauyon Lee
873f496038
Use basicLocalFlowStep instead of .getASuccessor
...
This prevents non-monotonic recursion through summary post-update nodes
2021-12-07 07:39:28 -05:00
Sauyon Lee
0572c4785c
Model net http sources as csv
2021-12-07 07:39:27 -05:00
Sauyon Lee
bebdb0ba53
Add RangeIndexNode
2021-12-07 07:39:27 -05:00
Sauyon Lee
3750af41d3
Add standard container steps
2021-12-07 07:39:27 -05:00
Sauyon Lee
8c4a1d2559
Consider CSV remote sources as untrusted flow sources
2021-12-07 07:39:26 -05:00
Sauyon Lee
d62f417130
Remove uses of getEnclosingCallable
2021-12-07 07:39:26 -05:00
Sauyon Lee
30ab22f5a6
Fix compilation errors with new DataFlowCallable
2021-12-07 07:39:26 -05:00
Chris Smowton
b10d5cf0b0
Broaden ReturnNode to include return nodes of summaries
2021-12-07 07:39:25 -05:00
Chris Smowton
94d9d08489
Fix DataFlow::Node::getEnclosingCallable
2021-12-07 07:39:25 -05:00
Sauyon Lee
c8a2a6356a
Add summary parameter nodes
2021-12-07 07:39:25 -05:00
Sauyon Lee
4af4a11729
Make getACallee return DataFlowCallable
2021-12-07 07:39:24 -05:00
Sauyon Lee
8cba368ef5
Model archive/tar.FileInfoHeader in CSV
2021-12-07 07:39:24 -05:00
