semmle-qlci
8128d23b6e
Merge pull request #2505 from erik-krogh/EventEmitter
...
Approved by esbena, max-schaefer
2020-01-16 08:47:38 +00:00
semmle-qlci
18879386bf
Merge pull request #2627 from asger-semmle/js-useless-expression-trycatch
...
Approved by esbena
2020-01-16 08:40:57 +00:00
Dave Bartolomeo
48301e1187
Merge pull request #2594 from rdmarsh2/ir-overlappingVariableMemoryLocations
...
C++: compute overlap on irvars with vvar indexes
2020-01-15 13:06:33 -07:00
Tom Hvitved
e5abaa79ae
Merge pull request #2585 from calumgrant/cs/serialization-check-bypass
...
C#: Improvements to cs/serialization-check-bypass
2020-01-15 20:40:51 +01:00
Sauyon Lee
7040b76cf6
Merge pull request #219 from max/new-env-vars
...
Teach extractor about CodeQL environment variables.
2020-01-15 11:37:26 -08:00
Geoffrey White
04af2ace94
CPP: Add DataFlow to strdup.
2020-01-15 19:18:37 +00:00
Geoffrey White
9b5be995d2
CPP: Split Strdup model into it's own class and file.
2020-01-15 18:38:33 +00:00
Geoffrey White
ce389ca791
CPP: Add tests for strdup.
2020-01-15 18:26:24 +00:00
Robert Marsh
a91f10fe40
Merge pull request #2629 from dbartol/dbartol/missing-vvars
...
C++/C#: Fix missing virtual variables
2020-01-15 08:32:43 -08:00
Calum Grant
6790028d4c
C#: Use guards library
2020-01-15 15:46:19 +00:00
Erik Krogh Kristensen
a76ab39a39
no longer need for .getALocalSource() in custom load/store
2020-01-15 16:00:57 +01:00
Max Schaefer
1ad90b6739
Teach extractor about CodeQL environment variables.
2020-01-15 14:01:30 +00:00
Erik Krogh Kristensen
e08fc08337
don't use pseudo-properties for resolved promise data-flow
2020-01-15 14:56:58 +01:00
Erik Krogh Kristensen
830100d2ed
support interprocedural flow with custom load/store steps
2020-01-15 14:23:17 +01:00
Max Schaefer
ad432965db
Remove DeclaredEntity.getDecl().
...
It's not particularly useful except for functions, and the name is easy to confuse with `Entity.getDeclaration()`. Instead we now have `getFuncDecl()` just for functions, and a bit more API on `Function` to avoid its use where possible.
2020-01-15 13:14:06 +00:00
Asger Feldthaus
7141f15858
JS: Add change note
2020-01-15 11:49:57 +00:00
Asger Feldthaus
6d9306366c
JS: ignore useless-expr in first stmt in try block
2020-01-15 11:49:23 +00:00
Max Schaefer
b7a830593d
Correctly create extract nodes for returns where we cannot infer the type of the returned expression, but know from context that it must be a tuple type.
2020-01-15 10:22:29 +00:00
Max Schaefer
86708f7867
Merge pull request #212 from sauyon/dependency-update
...
Dependency update
2020-01-15 09:18:14 +00:00
Tom Hvitved
f7278d36e1
Merge pull request #2498 from aschackmull/java/taint-getter
...
Java/C++/C#: Add support for taint-getter/setter summaries in data flow.
2020-01-15 09:55:19 +01:00
Dave Bartolomeo
e60f902c36
C++/C#: Fix missing virtual variables
...
The aliased SSA code was assuming that, for every automatic variable, there would be at least one memory access that reads or writes the entire variable. We've encountered a couple cases where that isn't true due to extractor issues. As a workaround, we now always create the `VariableMemoryLocation` for every local variable.
I've also added a sanity test to detect this condition in the future.
Along the way, I had to fix a perf issue in the PrintIR code. When determining the ID of a result based on line number, we were considering all `Instruction`s generated for a particular line, regardless of whether they were all in the same `IRFunction`. In addition, the predicate had what appeared to be a bad join order that made it take forever on large snapshots. I've scoped it down to just consider `Instruction`s in the same function, and outlined that predicate to fix the join order issue. This causes some numbering changes, but they're for the better. I don't think there was actually any nondeterminism there before, but now the numbering won't depend on the number of instantiations of a template, either.
2020-01-14 17:57:15 -07:00
Grzegorz Golawski
b7325232d7
Query to detect LDAP injections in Java
...
Consider DNs as injection points as well
Add more taint steps
2020-01-14 23:07:21 +01:00
Robert Marsh
42be28b211
C++: autoformat
2020-01-14 13:17:57 -08:00
Sauyon Lee
f32a785127
Merge pull request #217 from max/issue-24
...
Switch RedundantExpr query back to using AST instead of global value numbering.
2020-01-14 13:05:44 -08:00
Robert Marsh
5a5832b7de
Merge pull request #2569 from jbj/ir-total-chi-flow
...
C++: IR data flow through total chi operands
2020-01-14 12:47:58 -08:00
Max Schaefer
3d508d44e7
Fix global value numbering.
2020-01-14 20:44:13 +00:00
Erik Krogh Kristensen
d09bce5cd7
custom load/store steps to implement promise flow
2020-01-14 21:37:55 +01:00
Max Schaefer
2fdd45255c
Add two new tests.
2020-01-14 17:06:42 +00:00
Max Schaefer
61976d8dea
Fix code that does not account for the fact that Field is a subtype of ValueEntity.
2020-01-14 15:52:48 +00:00
Max Schaefer
0c254f8cd1
Fix a typo.
2020-01-14 15:35:18 +00:00
Max Schaefer
c96cebb022
Make reads(ValueEntity) and writes(ValueEntity) work for fields.
2020-01-14 15:35:18 +00:00
Geoffrey White
170981ef41
CPP: Change note.
2020-01-14 14:36:44 +00:00
Geoffrey White
e8139c0f31
CPP: Autoformat.
2020-01-14 14:35:58 +00:00
Geoffrey White
2fa846d1a6
CPP: Correct test.
2020-01-14 14:33:43 +00:00
Geoffrey White
d98d80b07d
CPP: Improve locations for AV Rule 114.ql.
2020-01-14 14:33:43 +00:00
Anders Schack-Mulligen
a6526c60cb
Java: Replace ad-hoc TestClass detection.
2020-01-14 14:26:22 +01:00
semmle-qlci
3c4749be88
Merge pull request #2624 from asger-semmle/js-duplicate-alert-strict-mode
...
Approved by max-schaefer
2020-01-14 11:59:45 +00:00
Anders Schack-Mulligen
241b8a05e4
Java/C++/C#: Address review comment.
2020-01-14 11:59:55 +01:00
Asger Feldthaus
2245882441
JS: Add change note and fix cwe tags
2020-01-14 10:53:40 +00:00
Asger Feldthaus
d76859b7df
JS: Address review comments
2020-01-14 10:53:00 +00:00
Asger F
2c05ee8ab8
JS: Add regression test
2020-01-14 10:53:00 +00:00
Asger F
9bd3c4a11c
JS: Add sanitizer for "in" exprs
2020-01-14 10:53:00 +00:00
Asger Feldthaus
7ac30e2289
JS: Add test for rephinement nodes
2020-01-14 10:53:00 +00:00
Asger F
a447645c10
JS: Add test with typeof on value
2020-01-14 10:52:59 +00:00
Asger F
bd9405ab84
JS: Guard against more FPs
2020-01-14 10:52:59 +00:00
Asger F
738123d3f5
JS: More sanitizers
2020-01-14 10:52:59 +00:00
Asger F
f7543aec95
JS: Support Reflect.ownKeys
2020-01-14 10:52:59 +00:00
Asger F
8af233307a
JS: Support enumeration through Object.entries
2020-01-14 10:52:59 +00:00
Asger F
ac2f0a8e11
JS: Do not require flow from key -> rhs
2020-01-14 10:52:59 +00:00
Asger F
96bf9db200
JS: Add another test and more barriers
2020-01-14 10:52:59 +00:00
