Commit Graph

41418 Commits

Author SHA1 Message Date
Tamas Vajk
1297d1c744 Add framework and cwe static data 2021-05-25 13:33:25 +02:00
Tamas Vajk
2adb3e992a Code quality improvements on coverage report generator script 2021-05-25 13:33:25 +02:00
Tamas Vajk
d0a46eb7b7 Adjust formatting 2021-05-25 13:33:25 +02:00
Tamas Vajk
f26dba67ac Adjust 'Total' label to 'Totals' 2021-05-25 13:33:25 +02:00
Tamas Vajk
564fca0da4 Adjust workflow triggers and uploads 2021-05-25 13:33:25 +02:00
Tamas Vajk
ef414681be Add RST documentation page 2021-05-25 13:33:25 +02:00
Tamas Vajk
beea36191b Add CSV file with framework and CWE info to be used in RST file 2021-05-25 13:33:25 +02:00
Tamas Vajk
979034a17f Add github action to generate CSV coverage report 2021-05-25 13:33:25 +02:00
Mathias Vorreiter Pedersen
5382ef7761 C++: Split the overview section of qhelp into a couple of paragraphs. 2021-05-25 13:18:15 +02:00
Mathias Vorreiter Pedersen
f842d09a16 Apply suggestions from code review
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
2021-05-25 13:16:04 +02:00
Timo Müller
f44b97c1c3 Apply suggestions from code review
Improved variable naming in examples and some documentation clearup

Co-authored-by: Chris Smowton <smowton@github.com>
2021-05-25 13:03:07 +02:00
Timo Müller
e7021ffbee Apply suggestions from code review
More clear or precise wording within the documentation

Co-authored-by: Chris Smowton <smowton@github.com>
2021-05-25 12:53:47 +02:00
shati-patel
bfc8845f23 Update wording 2021-05-25 11:36:18 +01:00
Arthur Baars
aea0c6fc64 Merge pull request #190 from github/aibaars/fix-heredoc-parent
Fix Scope::parentOf for HeredocBody nodes
2021-05-25 11:58:21 +02:00
Erik Krogh Kristensen
c70651b6fe always have arrayLikeElement as TypeTracking properties 2021-05-25 11:48:54 +02:00
Anders Schack-Mulligen
4884da363f Java: Bugfix. 2021-05-25 11:48:35 +02:00
Anders Schack-Mulligen
017bf68906 Dataflow: Fix bad join order. 2021-05-25 11:40:53 +02:00
Arthur Baars
ce23ae33e7 Fix Scope::parentOf for HereDocBody 2021-05-25 11:27:45 +02:00
Arthur Baars
bb62564c9e Add test for heredoc with variables 2021-05-25 11:16:55 +02:00
Tom Hvitved
8cbb3caaa4 Merge pull request #5947 from hvitved/csharp/encode-display-name
C#: Encode `"` in `BuildDisplayName`
2021-05-25 10:58:31 +02:00
Mathias Vorreiter Pedersen
b33adb8630 Merge pull request #5930 from MathiasVP/promote-incorrect-allocation-error-out
C++: Promote `cpp/incorrect-allocation-error-handling`
2021-05-25 10:57:31 +02:00
Tom Hvitved
b55bce46f8 C#: Restrict non-returning CIL analysis to methods not from source 2021-05-25 10:41:58 +02:00
Arthur Baars
86d57d3e26 Fix LGTM suites 2021-05-25 10:41:07 +02:00
Mathias Vorreiter Pedersen
eb244c0eb2 C++: Fix documentation. 2021-05-25 10:16:22 +02:00
Arthur Baars
73aae5dfd9 Use num_cpus-1 threads by default 2021-05-25 09:28:49 +02:00
Arthur Baars
4f404e9b11 Temporarily include some queries in the code scanning suite
This should be reverted once we have a decent set of default queries.
2021-05-25 09:21:40 +02:00
Mathias Vorreiter Pedersen
e857ac1149 C++: Add more tests and remove redundant conjunct. 2021-05-25 09:17:42 +02:00
Arthur Baars
a02cfd27c9 Compile query packs with previous CodeQL versions too 2021-05-24 17:48:49 +02:00
Slavomir
4212eb7ac2 Add codemill spec for clevergo 2021-05-24 15:35:57 +02:00
Slavomir
521039d6a2 Add codemill spec 2021-05-24 15:34:16 +02:00
Slavomir
8525c58e1a Improve qhelp doc 2021-05-24 15:19:50 +02:00
Slavomir
74f8f1dcdb Cleanup 2021-05-24 15:19:35 +02:00
Arthur Baars
78d9191526 Build query pack 2021-05-24 13:27:50 +02:00
Sauyon Lee
1a67f8d867 Merge pull request #530 from edvraa/key
CWE-326: Insufficient key size
2021-05-24 01:11:16 +00:00
Tom Hvitved
2a33756bdf C#: Encode " in BuildDisplayName 2021-05-23 14:44:48 +02:00
Tom Hvitved
0d14b9413d C#: Avoid recomputing ControlFlowTree::Range outside the CFG construction stage 2021-05-23 14:14:43 +02:00
Tom Hvitved
088a1a9707 C#: Simplify TriedControlFlowElement::getAThrownException() 2021-05-23 14:14:43 +02:00
Tom Hvitved
3162e12082 C#: Redefine ControlFlowElement::getAssembly 2021-05-23 14:14:43 +02:00
Tom Hvitved
5102fcd5f3 C#: Rewrite predicates from using forall to using unique
This avoids generation of expensive anti-join predicates with Cartesian products.
2021-05-23 14:14:43 +02:00
Tom Hvitved
2361476966 C#: Improve join-order in SplitImpl::hasSuccessor
Joining on `succ` first gets rid of bad join-orders like

```
Tuple counts for Splitting::SplitImpl::hasSuccessor_dispred#ffff/4@i4#f49ebw:
                      59306        ~2%          {3} r1 = JOIN Splitting::SplitImpl::appliesTo#ff#prev_delta WITH Splitting::Cached::TAssertionSplit#ffff_30#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.0 'this', Lhs.1 'pred'
                      454395       ~0%          {3} r2 = JOIN r1 WITH Splitting::AssertionSplitting::getAnAssertionDescendant#ff ON FIRST 1 OUTPUT Lhs.2 'pred', Rhs.1 'succ', Lhs.1 'this'
                      12157        ~0%          {4} r3 = JOIN r2 WITH ControlFlowGraphImpl::succ#fff ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.0 'pred', Lhs.1 'succ', Rhs.2 'c'

                      0            ~0%          {4} r4 = JOIN Splitting::LoopSplitting::LoopUnrollingSplitImpl::appliesToPredecessor_dispred#fff#prev_delta WITH Splitting::Cached::TLoopSplit#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'pred', Lhs.2 'c', Rhs.1, Rhs.0
                      0            ~0%          {5} r5 = JOIN r4 WITH ControlFlowGraphImpl::succ#fff_021#join_rhs ON FIRST 2 OUTPUT Lhs.2, Lhs.3 'this', Lhs.0 'pred', Lhs.1 'c', Rhs.2 'succ'
                      0            ~0%          {5} r6 = r5 AND NOT Splitting::SplitImpl::hasSuccessor_dispred#ffff#antijoin_rhs#2(Lhs.2 'pred', Lhs.4 'succ', Lhs.3 'c', Lhs.0)
                      0            ~0%          {4} r7 = SCAN r6 OUTPUT In.1 'this', In.2 'pred', In.4 'succ', In.3 'c'

                      12157        ~0%          {4} r8 = r3 UNION r7

                      0            ~0%          {3} r9 = SCAN Splitting::BooleanSplitting::BooleanSplitImpl::appliesToBlock_dispred#fff#prev_delta OUTPUT In.1, In.0 'this', In.2

                      0            ~0%          {4} r10 = JOIN r9 WITH project#PreBasicBlocks::PreBasicBlock::getElement_dispred#fff ON FIRST 1 OUTPUT Rhs.1 'pred', Lhs.1 'this', Lhs.0, Lhs.2
                      0            ~0%          {6} r11 = JOIN r10 WITH ControlFlowGraphImpl::succ#fff ON FIRST 1 OUTPUT Lhs.1 'this', Lhs.2, Lhs.3, Lhs.0 'pred', Rhs.1, Rhs.2 'c'
                      0            ~0%          {6} r12 = r11 AND NOT PreBasicBlocks::PreBasicBlock::getLastElement_dispred#ff(Lhs.1, Lhs.3 'pred')
                      0            ~0%          {4} r13 = SCAN r12 OUTPUT In.0 'this', In.3 'pred', In.4 'succ', In.5 'c'

                      35244        ~1%          {3} r14 = JOIN Splitting::SplitImpl::appliesTo#ff#prev_delta WITH Splitting::Cached::TInitializerSplit#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.0 'this', Lhs.1 'pred'
                      24640675     ~6%          {3} r15 = JOIN r14 WITH Splitting::InitializerSplitting::constructorInitializes#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'this', Lhs.2 'pred'
                      24640675     ~21147%      {3} r16 = JOIN r15 WITH Splitting::InitializerSplitting::InitializedInstanceMember::getInitializer_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'this', Lhs.2 'pred'
                      470227342920 ~481608%     {3} r17 = JOIN r16 WITH Splitting::InitializerSplitting::InitializedInstanceMember::getAnInitializerDescendant#ff ON FIRST 1 OUTPUT Lhs.2 'pred', Rhs.1 'succ', Lhs.1 'this'
                      24560447     ~66468%      {4} r18 = JOIN r17 WITH ControlFlowGraphImpl::succ#fff ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.0 'pred', Lhs.1 'succ', Rhs.2 'c'

                      24560447     ~66468%      {4} r19 = r13 UNION r18
                      24572604     ~48162%      {4} r20 = r8 UNION r19

                      0            ~0%          {3} r21 = JOIN r9 WITH project#PreBasicBlocks::PreBasicBlock::getElement_dispred#fff ON FIRST 1 OUTPUT Rhs.1 'pred', Lhs.2, Lhs.1 'this'
                      0            ~0%          {4} r22 = JOIN r21 WITH ControlFlowGraphImpl::succ#fff_021#join_rhs ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.0 'pred', Rhs.2 'succ', Rhs.1
                      0            ~0%          {5} r23 = JOIN r22 WITH Splitting::Cached::TBooleanSplit#fff_20#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.2 'succ', Lhs.0 'this', Lhs.1 'pred', Lhs.3 'c'
                      0            ~0%          {4} r24 = JOIN r23 WITH Splitting::BooleanSplitting::SsaBooleanSplitSubKind::canReachCorrelatedCondition#ff ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.3 'pred', Lhs.1 'succ', Lhs.4 'c'

                      0            ~0%          {2} r25 = SCAN Splitting::FinallySplitting::FinallySplitImpl::appliesToPredecessor_dispred#ff#prev_delta OUTPUT In.1 'pred', In.0 'this'

                      0            ~0%          {4} r26 = JOIN r25 WITH ControlFlowGraphImpl::succ#fff ON FIRST 1 OUTPUT Lhs.1 'this', Lhs.0 'pred', Rhs.1, Rhs.2 'c'
                      0            ~0%          {4} r27 = r26 AND NOT Splitting::FinallySplitting::FinallyControlFlowElement::isEntryNode_dispred#f(Lhs.2 'succ')
                      0            ~0%          {5} r28 = JOIN r27 WITH Splitting::Cached::TFinallySplit#fff_21#join_rhs ON FIRST 1 OUTPUT Lhs.2 'succ', Lhs.0 'this', Lhs.1 'pred', Lhs.3 'c', Rhs.1
                      0            ~0%          {6} r29 = JOIN r28 WITH ControlFlowGraphImpl::Statements::TryStmtTree::getAFinallyDescendant#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'this', Lhs.2 'pred', Lhs.0 'succ', Lhs.3 'c', Lhs.4
                      0            ~0%          {7} r30 = JOIN r29 WITH ControlFlowGraphImpl::Statements::TryStmtTree::nestLevel_dispred#ff ON FIRST 1 OUTPUT Lhs.1 'this', Lhs.2 'pred', Lhs.3 'succ', Lhs.4 'c', Lhs.5, Lhs.0, Rhs.1
                      0            ~0%          {7} r31 = SELECT r30 ON In.6 >= In.4
                      0            ~0%          {4} r32 = SCAN r31 OUTPUT In.0 'this', In.1 'pred', In.2 'succ', In.3 'c'

                      0            ~0%          {4} r33 = r24 UNION r32

                      0            ~0%          {4} r34 = JOIN r25 WITH ControlFlowGraphImpl::succ#fff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'this', Lhs.0 'pred', Rhs.2 'c'
                      0            ~0%          {4} r35 = JOIN r34 WITH Splitting::FinallySplitting::FinallyControlFlowElement::isEntryNode_dispred#f ON FIRST 1 OUTPUT Lhs.1 'this', Lhs.2 'pred', Lhs.0 'succ', Lhs.3 'c'
                      0            ~0%          {5} r36 = JOIN r35 WITH Splitting::Cached::TFinallySplit#fff_21#join_rhs ON FIRST 1 OUTPUT Lhs.2 'succ', Lhs.0 'this', Lhs.1 'pred', Lhs.3 'c', Rhs.1
                      0            ~0%          {6} r37 = JOIN r36 WITH ControlFlowGraphImpl::Statements::TryStmtTree::getAFinallyDescendant#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'this', Lhs.2 'pred', Lhs.0 'succ', Lhs.3 'c', Lhs.4
                      0            ~0%          {7} r38 = JOIN r37 WITH ControlFlowGraphImpl::Statements::TryStmtTree::nestLevel_dispred#ff ON FIRST 1 OUTPUT Lhs.1 'this', Lhs.2 'pred', Lhs.3 'succ', Lhs.4 'c', Lhs.5, Lhs.0, Rhs.1
                      0            ~0%          {7} r39 = SELECT r38 ON In.6 > In.4
                      0            ~0%          {4} r40 = SCAN r39 OUTPUT In.0 'this', In.1 'pred', In.2 'succ', In.3 'c'

                      0            ~0%          {3} r41 = SCAN Splitting::ExceptionHandlerSplitting::ExceptionHandlerSplitImpl::appliesToPredecessor_dispred#fff#prev_delta OUTPUT In.1 'pred', In.2 'c', In.0 'this'
                      0            ~0%          {4} r42 = JOIN r41 WITH ControlFlowGraphImpl::last#fff_120#join_rhs ON FIRST 2 OUTPUT Rhs.2, Lhs.2 'this', Lhs.0 'pred', Lhs.1 'c'
                      0            ~0%          {5} r43 = JOIN r42 WITH Stmt::TryStmt::getCatchClause_dispred#fff_201#join_rhs ON FIRST 1 OUTPUT Rhs.1, Rhs.2, Lhs.1 'this', Lhs.2 'pred', Lhs.3 'c'
                      0            ~0%          {4} r44 = JOIN r43 WITH Stmt::TryStmt::getCatchClause_dispred#fff ON FIRST 2 OUTPUT Rhs.2, Lhs.2 'this', Lhs.3 'pred', Lhs.4 'c'
                      0            ~0%          {5} r45 = JOIN r44 WITH Stmt::CatchClause::isLast_dispred#f ON FIRST 1 OUTPUT Lhs.0, 1, Lhs.1 'this', Lhs.2 'pred', Lhs.3 'c'
                      0            ~0%          {3} r46 = JOIN r45 WITH catch_type_02#join_rhs ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.3 'pred', Lhs.4 'c'
                      0                         {3} r47 = MATERIALIZE r46 AS unknown

                      0            ~0%          {3} r48 = Splitting::ExceptionHandlerSplitting::ExceptionHandlerSplitImpl::appliesToPredecessor_dispred#fff#prev_delta AND NOT r47(Lhs.0 'this', Lhs.1 'pred', Lhs.2 'c')
                      0            ~0%          {3} r49 = SCAN r48 OUTPUT In.1 'pred', In.2 'c', In.0 'this'

                      0            ~0%          {4} r50 = JOIN r49 WITH ControlFlowGraphImpl::succ#fff_021#join_rhs ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.0 'pred', Lhs.1 'c', Rhs.2 'succ'

                      0            ~0%          {4} r51 = JOIN r49 WITH ControlFlowGraphImpl::succ#fff_021#join_rhs ON FIRST 2 OUTPUT Rhs.2 'succ', Lhs.2 'this', Lhs.0 'pred', Lhs.1 'c'
                      0            ~0%          {5} r52 = JOIN r51 WITH ControlFlowGraphImpl::ControlFlowTree::first_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'this', Lhs.2 'pred', Lhs.3 'c', Lhs.0 'succ'
                      0            ~0%          {6} r53 = JOIN r52 WITH Stmt::CatchClause::getBlock_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, 1, Lhs.1 'this', Lhs.2 'pred', Lhs.3 'c', Lhs.4 'succ'
                      0            ~0%          {4} r54 = JOIN r53 WITH catch_type_02#join_rhs ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.3 'pred', Lhs.4 'c', Lhs.5 'succ'
                      0                         {4} r55 = MATERIALIZE r54 AS unknown

                      0            ~0%          {4} r56 = r50 AND NOT r55(Lhs.0 'this', Lhs.1 'pred', Lhs.2 'c', Lhs.3 'succ')
                      0            ~0%          {4} r57 = r56 AND NOT ControlFlowGraphImpl::Statements::StandardStmt::getChildElement0_dispred#fff#antijoin_rhs#2(Lhs.3 'succ')
                      0            ~0%          {4} r58 = SCAN r57 OUTPUT In.0 'this', In.1 'pred', In.3 'succ', In.2 'c'

                      0            ~0%          {4} r59 = r40 UNION r58
                      0            ~0%          {4} r60 = r33 UNION r59
                      24572604     ~48162%      {4} r61 = r20 UNION r60
                      24572604     ~48162%      {4} r62 = r61 AND NOT Splitting::SplitImpl::hasSuccessor_dispred#ffff#prev(Lhs.0 'this', Lhs.1 'pred', Lhs.2 'succ', Lhs.3 'c')
                                                return r62
```
2021-05-23 14:14:43 +02:00
Artem Smotrakov
1b51dd47ec Added an example with deserialization filter to UnsafeDeserializationRmi.qhelp 2021-05-23 13:24:42 +02:00
Artem Smotrakov
c837605c85 Added test cases with sanitizers for UnsafeDeserializationRmi.ql 2021-05-23 13:01:22 +02:00
Artem Smotrakov
d2e29fc72c Renamed RmiUnsafeDeserialization.ql -> UnsafeDeserializationRmi.ql 2021-05-23 10:21:05 +02:00
Artem Smotrakov
2d93eeae33 Covered deserialization filters in RmiUnsafeDeserialization.ql 2021-05-23 10:21:05 +02:00
Artem Smotrakov
e28f919f3d Look for remote callable method only in RmiUnsafeDeserialization.ql 2021-05-23 10:21:05 +02:00
Artem Smotrakov
0182dfe1c0 Added RmiUnsafeDeserialization.qhelp 2021-05-23 10:21:04 +02:00
Artem Smotrakov
5ffe04d6a5 Updated expected output for RmiUnsafeDeserialization.java test 2021-05-23 10:21:04 +02:00
Artem Smotrakov
3d20330a92 More tests for RmiUnsafeDeserialization 2021-05-23 10:21:04 +02:00
Artem Smotrakov
ec6186a1c5 Draft of tests for RmiUnsafeDeserialization.ql 2021-05-23 10:21:04 +02:00
Artem Smotrakov
efa4b4f414 Cover Registry in RmiUnsafeDeserialization.ql 2021-05-23 10:21:04 +02:00