Commit Graph

5239 Commits

Author SHA1 Message Date
Dave Bartolomeo
687d6d2643 C++: Replace TRawInstruction() calls
Replace most direct calls to `TRawInstruction()` with calls to `getInstructionTranslatedElement()` and `getInstructionTag()`, matching existing practice. One tiny RA diff in an inconsequential join order in `getInstructionVariable`.
2020-06-17 10:52:32 -04:00
Geoffrey White
833f5b0cf3 C++: Add flow through assignment operators. 2020-06-17 15:47:37 +01:00
Geoffrey White
b9a65581ce C++: Some constructors should have dataflow instead of taint. 2020-06-17 15:47:37 +01:00
Geoffrey White
031c9b98f1 C++: General taint flow through constructors. 2020-06-17 15:47:37 +01:00
Geoffrey White
30151c99d7 C++: Remove the std::string Constructor model. 2020-06-17 15:43:58 +01:00
Geoffrey White
d565cfc58e C++: Add a test of default constructors etc. 2020-06-17 15:41:36 +01:00
Geoffrey White
c196ea24b2 C++: Add taint tests of class constructors and assignment. 2020-06-17 15:41:00 +01:00
Geoffrey White
ea9e9a7a26 C++: Add taint tests of std::string constructors and assignment. 2020-06-17 15:41:00 +01:00
Dave Bartolomeo
c1016743a5 C++: Remove instructionOrigin()
This noopt predicate is no longer necessary. It's equivalent to `instruction = TRawInstruction(element, tag)`, which is already materialized and has a more favorable column order anyway.
2020-06-17 10:25:59 -04:00
Dave Bartolomeo
e85cc0b0c6 C++: Stop caching raw IR construction predicates
These predicates are only used within the new single IR stage, so there's no need to cache them beyond that. RA diffs are trivial. Where previously many of the predicate on `Instruction` were inline wrappers around cached predicates from `IRConstruction`, now the predicates from `IRConstruction` get inlined into the `Instruction` predicates, and the `Instruction` predicates get materialized. The net amount of work is the same, but now it's not getting cached unnecessarily.
2020-06-17 09:47:48 -04:00
Anders Schack-Mulligen
d28b5ace63 Dataflow: Sync. 2020-06-17 15:40:48 +02:00
Mathias Vorreiter Pedersen
01abaf373a Merge pull request #3728 from geoffw0/memberfunctions
C++: Split MemberFunction.qll from Function.qll.
2020-06-17 14:54:33 +02:00
Geoffrey White
7edaade175 C++: Improve QLDoc. 2020-06-17 12:11:42 +01:00
Geoffrey White
0a9ec70c31 C++: Autoformat. 2020-06-17 11:54:50 +01:00
Geoffrey White
f3e24963cb C++: Update QLDoc. 2020-06-17 10:27:34 +01:00
Jonas Jensen
e0ba23d2c7 C++: @precision high for tainted-format-string*
I think these queries have excellent results on lgtm.com. Many of the
results come from projects that use `sprintf` like it's a templating
engine, trusting that values from `argv` or `getenv` contain the correct
number of `%s`. I think we want to flag that.

The structure of the change note is modeled after 91af51cf46.
2020-06-17 09:03:13 +02:00
Dave Bartolomeo
8e977dc6bf C++/C#: Move overrides of IRType::getByteSize() into leaf classes
See https://github.com/github/codeql/pull/2272. I've added code comments in all of the places that future me will be tempted to hoist these overrides.
2020-06-16 16:48:42 -04:00
Dave Bartolomeo
24c3110989 Merge from master 2020-06-16 16:37:38 -04:00
Robert Marsh
ef940e815f C++: Add comment for false positives in swap tests 2020-06-16 11:46:14 -07:00
Robert Marsh
0c99b3644c C++: remove false negative comments in swap tests 2020-06-16 11:33:26 -07:00
Robert Marsh
1c9b6f0a48 Merge branch 'master' into ir-this-parameter-2
Accept test changes - dataflow changes are all positive
2020-06-16 11:28:49 -07:00
Geoffrey White
3d75d287a9 C++: Split MemberFunction.qll from Function.qll. 2020-06-16 17:40:46 +01:00
Robert Marsh
ab327b989d Merge pull request #3713 from MathiasVP/flow-diff-test
C++: Add test for differences between AST and IR field flow
2020-06-16 09:09:46 -07:00
Jonas Jensen
e5e373cff2 Merge pull request #3673 from MathiasVP/assign-op-using-swap
C++: Add tests for taint through swap
2020-06-16 15:43:52 +02:00
Jonas Jensen
17737cd872 C++: Account for unreachable blocks in guards
This restores the code I removed in 4642037dc.
2020-06-16 14:33:12 +02:00
Mathias Vorreiter Pedersen
c30d1a618e C++: Add charpred to partial definition node classes in qltest 2020-06-16 09:55:37 +02:00
Jonas Jensen
d80a033bed Merge pull request #3719 from dbartol/github/codeql-c-analysis-team/69-consistency
C++/C#: Fix a couple new consistency failures, and improve consistency messages
2020-06-16 08:48:35 +02:00
Aditya Sharad
d7d00bddf6 Merge pull request #3718 from adityasharad/cpp/formatting-function-doc
C++: Fix QLDoc on `FormattingFunction` library
2020-06-15 08:39:16 -07:00
Dave Bartolomeo
fecffab8e7 C++: Fix consistency error
`TTranslatedAllocationSideEffects` wasn't limiting itself to functions that actually have IR, so it was getting used even in template definitions.
2020-06-15 10:47:00 -04:00
Dave Bartolomeo
8cbc7e8654 C++/C#: Improve consistency failure result messages
Some of our IR consistency failure query predicates already produced results in the schema as an `@kind problem` query, including `$@` replacements for the enclosing `IRFunction` to make it easier to figure out which function to dump when debugging. This change moves the rest of the query predicates in `IRConsistency.qll` to do the same. In addition, it wraps each call to `getEnclosingIRFunction()` to return an `OptionalIRFunction`, which can be either a real `IRFunction` or a placeholder in case `getEnclosingIRFunction()` returned no results. This exposes a couple new consistency failures in `syntax-zoo`, which will be fixed in a subsequent commit.

This change also deals with consistency failures when the enclosing `IRFunction` has more than one `Function` or `Location`. For multiple `Function`s, we concatenate the function names. For multiple `Location`s, we pick the first one in lexicographical order. This changes the number of results produced in the existing tests, but does't change the actual number of problems.
2020-06-15 10:46:46 -04:00
Aditya Sharad
1033d22d1b C++: Fix QLDoc on FormattingFunction library
Copy-paste typo from `DataFlowFunction`.
2020-06-15 07:32:53 -07:00
Mathias Vorreiter Pedersen
6748f3887e C++: Add test demonstrating differences between AST and IR field flow. Also refactored the partial definitions test 2020-06-15 09:39:15 +02:00
Dave Bartolomeo
89a1fd4b4a C++/C#: Fix formatting 2020-06-13 08:22:04 -04:00
Dave Bartolomeo
73d2e09a8d C++:/C# Remove opcode from TRawInstruction 2020-06-12 17:36:01 -04:00
Dave Bartolomeo
978275cbd4 C++/C#: Move irFunc out of various TInstruction branches 2020-06-12 17:26:45 -04:00
Dave Bartolomeo
07c1520b4d C++/C#: Move ast out of TRawInstruction 2020-06-12 17:03:02 -04:00
Dave Bartolomeo
2aabe431f6 C++/C#: Stop caching getOldInstruction() 2020-06-12 16:22:58 -04:00
Dave Bartolomeo
ac169931b3 C++/C#: More efficient evaluation of SSA::hasInstruction() 2020-06-12 16:09:50 -04:00
Dave Bartolomeo
4331b9b54e C++: Simplify logic to an implication 2020-06-12 09:31:19 -04:00
Jonas Jensen
abd05bcff1 Merge pull request #3596 from robertbrignull/more-suites
Add more code-scanning suites
2020-06-12 09:08:20 +02:00
Robert Marsh
65f4ef712e C++: accept false positive tests after merge
The IR false positives are due to the same path length limit as the AST
false positives on the same line.
2020-06-11 15:27:13 -07:00
Robert Marsh
a7efa0d602 Merge branch 'master' into ir-this-parameter-2 2020-06-11 13:21:52 -07:00
Mathias Vorreiter Pedersen
b78c06559e Merge pull request #3691 from geoffw0/reftest
C++: Add a test case for CWE-114 involving pointers and references.
2020-06-11 22:02:45 +02:00
Geoffrey White
fdd7ad2300 C++: Add a SideEffectFunction model to 'system'. 2020-06-11 18:59:17 +01:00
Geoffrey White
e8b34e07f8 C++: Add an AliasFunction model to 'system'. 2020-06-11 18:44:41 +01:00
Geoffrey White
7fee2c239d C++: Add an ArrayFunction model to 'system'. 2020-06-11 18:44:09 +01:00
Geoffrey White
b38a7a9ffc C++: Fill out ArrayFunction model for 'fgets'. 2020-06-11 18:20:24 +01:00
Geoffrey White
40c20f2731 C++: Add the test for DefaultTaintTracking as well. 2020-06-11 17:37:05 +01:00
Geoffrey White
2f192f6a0c C++: Add a test of char* -> std::string -> char* taint. 2020-06-11 17:37:05 +01:00
Dave Bartolomeo
41df7000c5 Merge from master, including fixing up merge conflicts 2020-06-11 12:20:46 -04:00