Commit Graph

40697 Commits

Author SHA1 Message Date
github-actions[bot]
ab4b7d8509 Add changed framework coverage reports 2022-06-02 00:18:51 +00:00
Erik Krogh Kristensen
536d226a6b fix bad CP in the charPred for CipherOperation 2022-06-01 23:36:11 +02:00
Chris Smowton
dc7d07ff46 Extract correct implied wildcards for Java classes and @JvmSuppressWildcards-annotated entities
For Java classes this means following the structure of the underlying Java type to determine where the wildcard was really present and where the Java signature ruled it out. The annotation tracking simply means looking for @JvmSuppressWildcards on any surrounding class or function to turn off wildcard introduction by default.
2022-06-01 20:00:22 +01:00
Chris Smowton
37fce6ace9 Restore implicit wildcard types
The Kotlin compiler represents types like List<out CharSequence> internally as List<CharSequence> due to the fact that List's type parameter is covariant, and similarly Comparable<in CharSequence> where Comparable's type parameter is contravariant. However it restores use-site variance when emitting class files, so we must do the same thing for
compatability with Java code.

Note this is a partial solution because it will also add wildcards to Java .class files that *could* have a variance / wildcard but don't -- for example, a Java method could really take an invariant Comparable<CharSequence>, which is only achievable in Kotlin via the @JvmSuppressWildcards annotation. We also don't yet support
@JvmSuppressWildcards given on a surrounding class or function.
2022-06-01 19:58:40 +01:00
Mathias Vorreiter Pedersen
cde2880392 Swift: Add getEnclosingFunction to AstNode. 2022-06-01 16:40:08 +01:00
Paolo Tranquilli
0df8a9883a CODEOWNERS: remove BUILD.bazel from codeql-ci-reviewers 2022-06-01 17:11:20 +02:00
Paolo Tranquilli
77f7fe8dbc Swift: merge codegen and cppcodegen
Python code was simplified, and now a `--generate` option can be used
to drive what can be generated.

The extractor pack creation now will use an internally generated
dbscheme. This should be the same as the checked in one, but doing so
allows `bazel run create-extractor-pack` and `bazel run codegen` to be
run independently from one another, while previously the former had to
follow the latter in case of a schema change. This is the change that
triggered the above simplification, as in order for the two dbscheme
files to be identical, the first `// generated` line had to state the
same generator script.
2022-06-01 17:07:52 +02:00
Erik Krogh Kristensen
4b2b6fae88 Merge pull request #9395 from asgerf/js/fix-type-confusion
JS: Fix cartesian product in TypeConfusionThroughParameterTampering
2022-06-01 16:28:17 +02:00
Mathias Vorreiter Pedersen
7d962ac62b Merge pull request #9397 from MathiasVP/use-autogenerated-parent-in-cfg-library
Swift: Use the autogenerated `getParent`
2022-06-01 14:45:43 +01:00
Mathias Vorreiter Pedersen
cb7be4f8ba Merge pull request #9398 from github/redsun82/swift-getparent
Swift: simplify `GetImmediateParent.qll`
2022-06-01 14:35:20 +01:00
Mathias Vorreiter Pedersen
eabb5c7137 Swift: Respond to PR comments. 2022-06-01 14:34:22 +01:00
Paolo Tranquilli
3414028b1b Swift: simplify GetImmediateParent.qll 2022-06-01 15:01:49 +02:00
Mathias Vorreiter Pedersen
db0498e38c Swift: Use the autogenerated 'getParent' predicate in the CFG library. 2022-06-01 13:49:12 +01:00
Mathias Vorreiter Pedersen
ecce7f1f10 Merge pull request #9380 from github/redsun82/swift-getparent
Swift: generate `getParent` implementation
2022-06-01 13:48:48 +01:00
Paolo Tranquilli
6b90b2b05f Swift: add children to IsPattern 2022-06-01 14:35:58 +02:00
Paolo Tranquilli
a4f97dd67a Swift: add comment about unique in getImmediateParent 2022-06-01 14:32:59 +02:00
Paolo Tranquilli
bc0a32c26e Swift: sort import list
Also fix parent tests with updated `statements.swift` file.
2022-06-01 14:32:59 +02:00
Paolo Tranquilli
3597efb728 Swift: rename to getImmediateParent and use hidden AST 2022-06-01 14:32:58 +02:00
Paolo Tranquilli
a894ba64c4 Swift: make test run in Python 3.8 2022-06-01 14:32:58 +02:00
Paolo Tranquilli
a86d0fc8a7 Swift: move getAChild to a separate module 2022-06-01 14:32:58 +02:00
Paolo Tranquilli
946e1f498a Swift: generate getParent implementation
By explicitly marking children in the `schema.yml` file, an internal
`getAChild` predicate is implemented, that is in turn used in `AstNode`
to implement `getParent`.

This is yet to be used in the control flow library to replace the
hand-rolled implementation.

A further, more complex step is to use the same information to fully
generate the core implementation of `PrintAst` (including the
accessor string). This will be done later.

The `parent` tests use the same swift code as the extractor tests, and
this is currently enforced by `sync-files.py`. Notice that `qltest.sh`
had to be modified to deal with multiple files, which was not working
yet.
2022-06-01 14:32:58 +02:00
Ian Lynagh
6f9e9e889b Merge pull request #9396 from igfoo/igfoo/labeler
CI: Add Kotlin and Go to labeler.yml
2022-06-01 13:30:22 +01:00
Ian Lynagh
ef4f09cf52 CI: Labeler: Don't label Kotlin for changenotes
They get labeled as Java. Given we aren't labeling shared QLL changes,
it makes sense not to label shared changenotes either.
2022-06-01 13:19:00 +01:00
Geoffrey White
cd4ff54743 C++: Improve performance of Printf::callsVariadicFormatter. 2022-06-01 13:17:10 +01:00
Ian Lynagh
67c4850c61 CI: Add Kotlin and Go to labeler.yml 2022-06-01 12:01:08 +01:00
Ian Lynagh
e0d9317889 Merge pull request #9389 from igfoo/igfoo/function_loc_override
Kotlin: Remove extractFunction's location override
2022-06-01 11:46:22 +01:00
Ian Lynagh
703ced3fe9 Merge pull request #9390 from igfoo/igfoo/valueparam
Kotlin: extractValueParameter: Simplify typeSubstitution logic
2022-06-01 11:46:05 +01:00
Jorge
897d5c9471 Apply suggestions from code review
Co-authored-by: yoff <lerchedahl@gmail.com>
2022-06-01 12:44:08 +02:00
Asger F
db0ac7b3b3 JS: Fix cartesian product in TypeConfusionThroughParameterTampering 2022-06-01 11:37:23 +02:00
Paolo Tranquilli
4d6c8da74b Swift: no perfect forwarding for label fetchers
While we need universal references to catch different value categories,
we don't need perfect forwarding as `fetchLabel` does not behave
differently on lvalue and rvalues.
2022-06-01 11:26:21 +02:00
Rasmus Wriedt Larsen
729cf79be7 Merge pull request #9351 from RasmusWL/django-file-read
Python: Support `read` on Django file
2022-06-01 10:45:26 +02:00
Anders Schack-Mulligen
9abd2259d3 Merge pull request #9381 from aschackmull/redos/perf
ReDoS: Improve performance in ExponentialBackTracking.qll.
2022-06-01 10:39:28 +02:00
Anders Schack-Mulligen
4f3751dfea Merge pull request #9316 from hvitved/dataflow/edges-get-a-successor-consistency
Data flow: Make `PathGraph::edges/2` and `PathNode::getASuccessor/1` consistent
2022-06-01 10:38:25 +02:00
Michael Nebel
9cc10e4511 Merge pull request #9257 from michaelnebel/java/mad-commons-io-sha
Java: Update commons-io SHA for model regeneration and update models.
2022-06-01 09:46:30 +02:00
Paolo Tranquilli
6e44a12a67 Swift: make enable_if_t a non-type parameter
This disallows completely calling the disabled function (which could
be done by explicitly providing `void` otherwise).
2022-06-01 08:47:53 +02:00
Paolo Tranquilli
905cc23719 Swift: update comment 2022-06-01 08:41:43 +02:00
Paolo Tranquilli
19f16678ac Swift: change translation signature and detection
Translation now takes const references to swift entities and return
trap entries (instead of taking apointer as an out parameter).
2022-06-01 08:41:43 +02:00
Paolo Tranquilli
c3cb0d6ad7 Swift: fix name extraction in VarDecl 2022-06-01 08:41:43 +02:00
Paolo Tranquilli
86b4f16b3a Swift: remove Binding<> class
That class was meant to allow aggregate initialization of generated
C++ entries having the label `id` as first argument.

As aggregate initialization turned out to be undesirable (names of
fields are not explicit, and `{}` must be inserted for empty
superclasses), this commit removes it and disallows aggregate
initialization altogether by defining empty constructors for generated
classes.
2022-06-01 08:41:43 +02:00
Paolo Tranquilli
9231013401 Swift: use C++ entry style visitor in DeclVisitor 2022-06-01 08:41:43 +02:00
Robert Marsh
42ec6350eb Merge pull request #9349 from MathiasVP/fix-inconsistent-cfg
Swift: Fix three CFG inconsistencies
2022-05-31 14:38:08 -04:00
Ian Lynagh
6be4afcf36 Kotlin: extractValueParameter: Simplify typeSubstitution logic
The type substitution is now done in the wrapper, so the worker doesn't
need to be passed typeSubstitution.
2022-05-31 19:23:54 +01:00
Porcupiney Hairs
ae2bc1b410 Include suggested changes from review. 2022-05-31 23:10:57 +05:30
Ian Lynagh
21d69ae819 Kotlin: Remove extractFunction's location override
It wasn't being used.
2022-05-31 17:43:25 +01:00
Mathias Vorreiter Pedersen
e2ddfcd437 Merge pull request #9387 from github/geoffw0-patch-2
Swift: Update readme
2022-05-31 16:34:17 +01:00
Robert Marsh
bd095abea4 Merge pull request #9388 from MathiasVP/cfg-for-yield
Swift: CFG for `yield`
2022-05-31 11:22:21 -04:00
Nick Rolfe
f417c12c5e Merge pull request #9332 from github/post-release-prep/codeql-cli-2.9.3
Post-release preparation for codeql-cli-2.9.3
2022-05-31 16:17:50 +01:00
Mathias Vorreiter Pedersen
6386daf44c Merge branch 'main' into fix-inconsistent-cfg 2022-05-31 15:59:53 +01:00
Robert Marsh
78fd0385fc Merge pull request #9355 from MathiasVP/not-all-functions-throw
Swift: Only construct exceptional edges for calls that may throw
2022-05-31 10:56:31 -04:00
Mathias Vorreiter Pedersen
5f9d03f7c6 Swift: CFG for 'yield'. 2022-05-31 15:45:43 +01:00