Commit Graph

83874 Commits

Author SHA1 Message Date
Geoffrey White
6f1eca8be1 Rust: Make the QLDoc for fromSource a bit more precise. 2025-10-28 16:22:25 +00:00
Tom Hvitved
f2380d3ef1 Merge pull request #20612 from hvitved/rust/type-inference-blanket-non-satisfaction
Rust: Compute incompatible blanket implementations
2025-10-28 14:00:55 +01:00
Tom Hvitved
b3bbe78974 Rust: Fix bad join
Before
```
Pipeline standard for TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61@31ee5u2w was evaluated in 821 iterations totaling 1057ms (delta sizes total: 689971).
           416937   ~1%    {6} r1 = SCAN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` OUTPUT In.0, In.3, In.1, In.2, In.4, In.5

           222757   ~2%    {8} r2 = JOIN r1 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
           164360   ~3%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        315350783   ~1%    {6} r3 = SCAN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` OUTPUT In.0, In.3, In.1, In.2, In.4, In.5

           593815   ~1%    {8} r4 = JOIN r3 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
           342226   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

           826517   ~0%    {8} r5 = JOIN r1 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
           345294   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

            73715   ~0%    {8} r6 = JOIN r3 WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                           {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
            47802   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

           899682   ~5%    {6} r7 = r2 UNION r4 UNION r5 UNION r6
           711040   ~6%    {6}    | AND NOT `TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61#prev`(FIRST 6)
                           return r7
```

After
```
Pipeline standard for TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61@ad458u2w was evaluated in 821 iterations totaling 374ms (delta sizes total: 691168).
        222757   ~2%    {8} r1 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
        164360   ~3%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        593815   ~1%    {8} r2 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.3, _, Lhs.4, Rhs.2
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
        342226   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        826517   ~0%    {8} r3 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev_delta` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
        345294   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

         73715   ~0%    {8} r4 = JOIN `TypeInference::MethodCallMatching::directTypeMatch0/6#dfcc7717#prev` WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.0, Lhs.2, Lhs.3, Lhs.5, Rhs.4, _, Lhs.4, Rhs.3
                        {6}    | REWRITE WITH Tmp.5 := "", Out.5 := InverseAppend(In.6,Tmp.5,In.7) KEEPING 6
         47802   ~1%    {6}    | SCAN OUTPUT In.0, In.1, In.2, In.5, In.4, In.3

        899682   ~5%    {6} r5 = r1 UNION r2 UNION r3 UNION r4
        711095   ~6%    {6}    | AND NOT `TypeInference::MethodCallMatching::directTypeMatch/6#f0fb0b61#prev`(FIRST 6)
                        return r5
```
2025-10-28 13:09:39 +01:00
Tom Hvitved
104ba0e291 Rust: Fix bad join
Before
```
Pipeline standard for TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748@ada3a07w was evaluated in 801 iterations totaling 31ms (delta sizes total: 182871).
           50151   ~1%    {4} r1 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta OUTPUT In.0, In.2, In.3, In.4
           39574   ~0%    {5}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.3, Rhs.3, _, Lhs.2, Rhs.2
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           36996   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

        36102333   ~0%    {4} r2 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev OUTPUT In.0, In.2, In.3, In.4
           90175   ~1%    {5}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.3, Rhs.3, _, Lhs.2, Rhs.2
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           65014   ~1%    {3}    | SCAN OUTPUT In.0, In.2, In.1

           50151   ~1%    {5} r3 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta OUTPUT In.2, In.0, In.1, In.3, In.4
           24208   ~1%    {4}    | JOIN WITH `FunctionType::FunctionPosition.isSelf/0#dispred#9e84d302` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4
           95022   ~0%    {9}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Rhs.2, Rhs.3, Rhs.4, _, Rhs.1, Lhs.1, _
                          {6}    | REWRITE WITH Tmp.5 := ";", Tmp.5 := (In.6 ++ Tmp.5), Tmp.8 := "", Out.5 := InverseAppend(Tmp.5,Tmp.8,In.7) KEEPING 6
           93919   ~1%    {7}    | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _
                          {6}    | REWRITE WITH NOT [NOT [Tmp.6 := "borrow", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 = Tmp.6], NOT [Tmp.6 := "", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 != Tmp.6]] KEEPING 6
           81298   ~1%    {5}    | SCAN OUTPUT In.1, In.4, _, In.0, In.3
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           64110   ~1%    {3}    | SCAN OUTPUT In.0, In.2, In.1

        36102333   ~0%    {5} r4 = SCAN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev OUTPUT In.2, In.0, In.1, In.3, In.4
        17473531   ~0%    {4}    | JOIN WITH `FunctionType::FunctionPosition.isSelf/0#dispred#9e84d302` ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4
           47409   ~1%    {9}    | JOIN WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Rhs.2, Rhs.3, Rhs.4, _, Rhs.1, Lhs.1, _
                          {6}    | REWRITE WITH Tmp.5 := ";", Tmp.5 := (In.6 ++ Tmp.5), Tmp.8 := "", Out.5 := InverseAppend(Tmp.5,Tmp.8,In.7) KEEPING 6
           29885   ~0%    {7}    | SCAN OUTPUT In.0, In.1, In.2, In.3, In.4, In.5, _
                          {6}    | REWRITE WITH NOT [NOT [Tmp.6 := "borrow", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 = Tmp.6], NOT [Tmp.6 := "", TEST InOut.5 = Tmp.6, Tmp.6 := true, TEST InOut.2 != Tmp.6]] KEEPING 6
           16952   ~1%    {5}    | SCAN OUTPUT In.1, In.4, _, In.0, In.3
                          {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
           16829   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

          182949   ~1%    {3} r5 = r1 UNION r2 UNION r3 UNION r4
          182949   ~1%    {3}    | AND NOT `TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748#prev`(FIRST 3)
                          return r5
```

After
```
Pipeline standard for TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748@31ee547w was evaluated in 801 iterations totaling 19ms (delta sizes total: 182946).
         81298   ~0%    {5} r1 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev` ON FIRST 3 OUTPUT Lhs.4, Rhs.4, _, Lhs.3, Rhs.3
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         64110   ~1%    {3}    | SCAN OUTPUT In.0, In.2, In.1

         39574   ~0%    {5} r2 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev_delta WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev` ON FIRST 2 OUTPUT Lhs.4, Rhs.3, _, Lhs.3, Rhs.2
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         36996   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

         16952   ~0%    {5} r3 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev WITH `TypeInference::MethodCallMatchingInput::Access.getInferredSelfType/3#dispred#45b2f893#prev_delta` ON FIRST 3 OUTPUT Lhs.4, Rhs.4, _, Lhs.3, Rhs.3
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         16829   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

         90175   ~0%    {5} r4 = JOIN TypeInference::MethodCallMatching::AccessConstraint::MkRelevantAccess#7a01048b#prev WITH `TypeInference::MethodCallMatchingInput::Access.getInferredNonSelfType/2#dispred#b181cb0a#prev_delta` ON FIRST 2 OUTPUT Lhs.4, Rhs.3, _, Lhs.3, Rhs.2
                        {3}    | REWRITE WITH Tmp.2 := "", Out.2 := InverseAppend(In.3,Tmp.2,In.4) KEEPING 3
         65014   ~0%    {3}    | SCAN OUTPUT In.0, In.2, In.1

        182949   ~1%    {3} r5 = r1 UNION r2 UNION r3 UNION r4
        182949   ~1%    {3}    | AND NOT `TypeInference::MethodCallMatching::AccessConstraint::RelevantAccess.getTypeAt/1#dispred#e8abf748#prev`(FIRST 3)
                        return r5
```
2025-10-28 13:09:32 +01:00
Nora Dimitrijević
727bddea19 Merge pull request #20607 from d10c/d10c/update-diff-informed-testing
Update diff-informed testing to always treat sources and sinks as alert locations
2025-10-28 11:52:31 +01:00
Tom Hvitved
409f7fb743 Address review comments 2025-10-28 11:48:45 +01:00
Geoffrey White
d6c4ab2724 Merge branch 'main' into gen2 2025-10-28 09:26:13 +00:00
Geoffrey White
abcc1712d5 Rust: Remove more redundant models. 2025-10-28 09:26:11 +00:00
Nora Dimitrijević
a0975e7e19 Constrain location overrides to actual sources/sinks 2025-10-28 09:42:20 +01:00
Nora Dimitrijević
96e1536769 C++/SqlTainted 2025-10-28 09:42:17 +01:00
Nora Dimitrijević
8e0c453c37 Rust/InsecureCookie 2025-10-28 09:42:14 +01:00
Nora Dimitrijević
4952cb27fb Rust/AccessAfterLifetime 2025-10-28 09:42:11 +01:00
Nora Dimitrijević
0f0bd0f455 Go/SSRF
go/ql/src/experimental/CWE-918/SSRF.ql
2025-10-28 09:42:09 +01:00
Nora Dimitrijević
d41268fc84 Go/UnhandledCloseWritableHandle 2025-10-28 09:42:06 +01:00
Nora Dimitrijević
ec63547925 C++/UseOfHttp 2025-10-28 09:42:03 +01:00
Nora Dimitrijević
a65d4d5997 C++/TaintedAllocationSize 2025-10-28 09:42:01 +01:00
Nora Dimitrijević
f3d51e0151 C++/ArithmeticUncontrolled 2025-10-28 09:41:57 +01:00
Nora Dimitrijević
1321cbb021 C++/DecompressionBombs 2025-10-28 09:41:55 +01:00
Nora Dimitrijević
bbe2bf2b7f C++/CleartextTransmission 2025-10-28 09:41:52 +01:00
Nora Dimitrijević
b0180409f4 C++/CleartextFileWrite 2025-10-28 09:41:49 +01:00
Nora Dimitrijević
d89aa0f19d C++/CleartextBufferWrite 2025-10-28 09:41:46 +01:00
Nora Dimitrijević
17b261a506 C++/AuthenticationBypass 2025-10-28 09:41:43 +01:00
Nora Dimitrijević
0ed27f4e81 C++/CleartextSqliteDatabase 2025-10-28 09:41:40 +01:00
Nora Dimitrijević
f7a1a4cf75 C++/NonConstantFormat 2025-10-28 09:41:38 +01:00
Nora Dimitrijević
2756e8255f C++/UnboundedWrite 2025-10-28 09:41:35 +01:00
Nora Dimitrijević
a4ac0392a6 C++/OverflowDestination 2025-10-28 09:41:32 +01:00
Nora Dimitrijević
65d79ff6fc C++/ExecTainted 2025-10-28 09:41:29 +01:00
Nora Dimitrijević
464f6cb096 C++/ConstantSizeArrayOffByOne 2025-10-28 09:41:26 +01:00
Nora Dimitrijević
974d174757 Actions/CodeInjectionQuery
actions/ql/src/Security/CWE-094/CodeInjectionMedium.ql

actions/ql/src/Security/CWE-094/CodeInjectionCritical.ql
2025-10-28 09:41:24 +01:00
Nora Dimitrijević
62fde8f6e7 Actions/ArgumentInjectionQuery
actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionCritical.ql

actions/ql/src/experimental/Security/CWE-088/ArgumentInjectionMedium.ql
2025-10-28 09:41:21 +01:00
Nora Dimitrijević
c40223319c Actions/EnvVarInjectionQuery
actions/ql/src/Security/CWE-077/EnvVarInjectionMedium.ql

actions/ql/src/Security/CWE-077/EnvVarInjectionCritical.ql
2025-10-28 09:41:18 +01:00
Nora Dimitrijević
edc72d29d7 Actions/EnvPathInjectionQuery
actions/ql/src/Security/CWE-077/EnvPathInjectionMedium.ql

actions/ql/src/Security/CWE-077/EnvPathInjectionCritical.ql
2025-10-28 09:41:16 +01:00
Nora Dimitrijević
1f53ffbdd7 Actions/ArtifactPoisoningQuery
actions/ql/src/Security/CWE-829/ArtifactPoisoningCritical.ql

actions/ql/src/Security/CWE-829/ArtifactPoisoningMedium.ql
2025-10-28 09:41:13 +01:00
Nora Dimitrijević
8a750b3125 Swift/UnsafeUnpackQuery
swift/ql/src/experimental/Security/CWE-022/UnsafeUnpack.ql
2025-10-28 09:41:10 +01:00
Nora Dimitrijević
895bd93062 Swift/UnsafeJsEvalQuery
swift/ql/src/queries/Security/CWE-094/UnsafeJsEval.ql
2025-10-28 09:41:08 +01:00
Nora Dimitrijević
cd86e7d6f5 Swift/StringLengthConflationQuery
swift/ql/src/queries/Security/CWE-135/StringLengthConflation.ql
2025-10-28 09:41:05 +01:00
Nora Dimitrijević
5a6f731ab7 Swift/StaticInitializationVectorQuery
swift/ql/src/queries/Security/CWE-1204/StaticInitializationVector.ql
2025-10-28 09:41:02 +01:00
Nora Dimitrijević
7ba7c435f2 Swift/InsufficientHashIterationsQuery
swift/ql/src/queries/Security/CWE-916/InsufficientHashIterations.ql
2025-10-28 09:41:00 +01:00
Nora Dimitrijević
6c52d4ba91 Swift/ConstantPasswordQuery
swift/ql/src/queries/Security/CWE-259/ConstantPassword.ql
2025-10-28 09:40:57 +01:00
Nora Dimitrijević
c190fae737 Swift/CleartextStoragePreferencesQuery
swift/ql/src/queries/Security/CWE-312/CleartextStoragePreferences.ql
2025-10-28 09:40:54 +01:00
Nora Dimitrijević
2332cea330 Swift/CleartextStorageDatabaseQuery
swift/ql/src/queries/Security/CWE-311/CleartextStorageDatabase.ql
2025-10-28 09:40:51 +01:00
Nora Dimitrijević
462d8c5dc4 Shared: update qldoc 2025-10-28 09:40:48 +01:00
Nora Dimitrijević
6ede0a7950 Ruby/WeakFilePermissions 2025-10-28 09:40:46 +01:00
Nora Dimitrijević
495be51ae7 Ruby/WeakParams 2025-10-28 09:40:43 +01:00
Nora Dimitrijević
50f2540db1 Ruby/ManuallyCheckHttpVerb 2025-10-28 09:40:41 +01:00
Nora Dimitrijević
6519bd9909 Ruby/PolynomialReDoSQuery
ruby/ql/src/queries/security/cwe-1333/PolynomialReDoS.ql
2025-10-28 09:40:38 +01:00
Nora Dimitrijević
1ff24cbee8 Python/LdapInsecureAuth
python/ql/src/experimental/Security/CWE-522/LdapInsecureAuth.ql
2025-10-28 09:40:35 +01:00
Nora Dimitrijević
998de144ea Python/CorsBypass 2025-10-28 09:40:32 +01:00
Nora Dimitrijević
4bc9ede2e8 Python/UnsafeUsageOfClientSideEncryptionVersion 2025-10-28 09:40:30 +01:00
Nora Dimitrijević
6d57316862 Python/UnsafeUnpackQuery
python/ql/src/experimental/Security/CWE-022bis/UnsafeUnpack.ql
2025-10-28 09:40:27 +01:00