Commit Graph

41418 Commits

Author SHA1 Message Date
Luke Cartey
29e4fa349a C# autobuilder: Build all solutions at the highest depth
The most common reason for the C# autobuilder to fail is because it
cannot determine a single unique .sln or .proj file to build, instead
reporting multiple sln or proj files at the same shortest depth. This
commit changes this to build all such files, rather than reporting an
error.
2019-09-17 21:27:01 +01:00
Geoffrey White
07e29bb627 CPP: Add a test of ConditionalDeclExpr. 2019-09-17 17:38:54 +01:00
AndreiDiaconu1
f589033364 PR fixes 2019-09-17 16:17:39 +01:00
AndreiDiaconu1
5e0addc776 C# IR: using, checked, unchecked stmts
Added basic support for the using stmt, checked stmt, unchecked stmt
Note that the translations do not use the compiler generated element framework and hence they are just rough approximations. For accuracy, in the future their translation should use it.
2019-09-17 16:16:32 +01:00
Luke Cartey
3c07caefe4 C#: Add test for transitive capture calls. 2019-09-17 15:21:30 +01:00
Luke Cartey
70c2cc595b C#: Add capture test for nested lambdas, commented out
Add a commented out version of the test, and modify the expected files
to contain the same results at new offsets.
2019-09-17 15:13:10 +01:00
Rasmus Wriedt Larsen
631603fa92 Python: Modernise the py/mixed-tuple-returns query. 2019-09-17 16:07:56 +02:00
semmle-qlci
e314a2ce88 Merge pull request #1939 from felicitymay/1.22/fix-blog-links
Approved by jf205
2019-09-17 12:35:48 +01:00
Esben Sparre Andreasen
ac6554b7da Merge branch 'master' into js/improve-getAResponseDataNode 2019-09-17 13:18:41 +02:00
Jonas Jensen
b2df18ab78 C++: Document tests better
This addresses PR comments by @rdmarsh2.
2019-09-17 13:17:25 +02:00
Jonas Jensen
ef601cf78e C++: Annotate changes in struct_init.c test 2019-09-17 13:16:36 +02:00
Jonas Jensen
655f940085 C++: Accept changes in CWE-{119,120} tests
These new results seem better than the previous ones, but the previous
ones are still there. Perhaps the `Buffer.qll` library could use some
adjustment, but this seems like an improvement in isolation.
2019-09-17 13:16:36 +02:00
Jonas Jensen
fd6d06fe6f C++: Data flow through address-of operator (&)
The data flow library conflates pointers and their objects in some
places but not others. For example, a member function call `x.f()` will
cause flow from `x` of type `T` to `this` of type `T*` inside `f`. It
might be ideal to avoid that conflation, but that's not realistic
without using the IR.

We've had good experience in the taint tracking library with conflating
pointers and objects, and it improves results for field flow, so perhaps
it's time to try it out for all data flow.
2019-09-17 13:16:34 +02:00
Asger F
f8eff06aa1 JS: Change note 2019-09-17 11:20:39 +01:00
Luke Cartey
92b94c1a39 C#: Include runtime target in TTransitiveCaptureCall
TTransitiveCaptureCall represents a control flow node that may
transitively call many different callables which capture a variable from
the current scope. Captured variables are represented as synthetic
parameters to the callable, at negative indices. However, each of the
different targets may capture a different subset of variables from the
enclosing scope, so we must include the target along side the CFN in
order to prevent incorrect capture flow.
2019-09-17 03:05:29 -07:00
Tom Hvitved
396a72db5f Merge pull request #1898 from AndreiDiaconu1/ircsharp-collections
C# IR: Object creation refactor and collection initializers
2019-09-17 10:48:07 +02:00
Felicity Chapman
8a27af2016 Update remaining links to blog 2019-09-17 09:30:15 +01:00
Dave Bartolomeo
21f6ab787d C++: Rename predicates in FunctionInputsAndOutputs.qll and add QLDoc 2019-09-16 12:06:06 -07:00
Tom Hvitved
1f927516d8 Merge pull request #1936 from calumgrant/cs/nameof-qualified-namespace
C# extractor: Handle nameof(A.B) where A.B is a qualified namespace
2019-09-16 19:28:48 +02:00
Geoffrey White
3df31e6ccf CPP: Tiny qldoc fixes. 2019-09-16 16:52:48 +01:00
Calum Grant
4e6216379d Merge pull request #1935 from AndreiDiaconu1/ircsharp-forinitfix
C# IR: Fix for init
2019-09-16 16:24:30 +01:00
AndreiDiaconu1
43accd37e1 Address PR comments 2019-09-16 15:42:45 +01:00
Max Schaefer
df739e0fca JavaScript: Fix performance regression in IncorrectSuffixCheck. 2019-09-16 15:25:17 +01:00
Calum Grant
8eeded5982 C#: Handle nameof(A.B) where A.B is a nested namespace. 2019-09-16 15:12:10 +01:00
AndreiDiaconu1
fcb3d99351 C# IR: Fix for init 2019-09-16 11:57:37 +01:00
semmle-qlci
e6b748a8e7 Merge pull request #1875 from esben-semmle/js/blacklist-more-hardcoded-passwords
Approved by xiemaisi
2019-09-16 10:57:35 +01:00
Tom Hvitved
4f897b2628 C#: Address review comments 2019-09-16 10:45:37 +02:00
Esben Sparre Andreasen
a5645e168a JS: exclude keys from whitelist 2019-09-16 10:13:18 +02:00
Esben Sparre Andreasen
c9d31e90fe JS: add change notes 2019-09-16 10:11:43 +02:00
Esben Sparre Andreasen
0e2d2f8662 JS: whitelist some hardcoded dummy-passwords in two queries 2019-09-16 10:11:43 +02:00
Esben Sparre Andreasen
aa3f4a7048 JS: change passwords in tests 2019-09-16 10:09:59 +02:00
jf205
526c123016 Merge pull request #1931 from shati-patel/docs/ql-lexer
Docs/QL lexer: Require whitespace character after annotation
2019-09-14 07:00:31 +01:00
Dave Bartolomeo
553238a9e8 Merge pull request #1922 from jbj/qlcfg-const-pointer-to-member
C++: Add PointerToFieldLiteral class
2019-09-13 10:44:52 -07:00
Shati Patel
9187db585c QL lexer: Require whitespace character after annotation 2019-09-13 16:13:13 +01:00
shati-patel
fd4709d43a Merge pull request #1930 from jf205/js-links-122
docs: update some links in a couple of javascript topics
2019-09-13 15:58:23 +01:00
Asger F
a8e8ae868a JS: Update extractor version string 2019-09-13 15:48:31 +01:00
Asger F
173f32d2ba JS: Recognize 'require' calls in more cases 2019-09-13 15:48:31 +01:00
Asger F
3b7ecd5ccf JS: Add NumModules metric 2019-09-13 15:48:31 +01:00
Max Schaefer
fa4db5a841 JavaScript: Fix link to restify in library tutorial.
(cherry picked from commit af24d125388ed89dcd364697d955026a1f46fd33)
2019-09-13 15:28:21 +01:00
Max Schaefer
f1588b2622 JavaScript: Fix description of call graphs.
(cherry picked from commit 2817cf060f6a506ee51a0296b3745e7406fc7cfc)
2019-09-13 15:28:21 +01:00
james
ffa370a8ad docs: fix broken links in js topics
(cherry picked from commit e8f867204d)
2019-09-13 15:28:20 +01:00
semmle-qlci
82097f63ac Merge pull request #1903 from jf205/js-links
Approved by asger-semmle
2019-09-13 15:25:02 +01:00
Erik Krogh Kristensen
9dc9adda64 fix capitalization in test case
Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
2019-09-13 14:54:18 +01:00
Erik Krogh Kristensen
3fb64abb09 fix consistency and spelling in the documentation
suggestions from the documentation team

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
2019-09-13 14:52:11 +01:00
Jonas Jensen
7cfbe88e7b C++: IR DataFlow::Node.toString consistency
The `toString` for IR data-flow nodes are now similar to AST data-flow
nodes. This should make it easier to use the IR as a drop-in replacement
in the future. There are still differences because the IR data flow
library takes conversions into account.

I did not attempt to align the new nodes we use for field flow. That can
come later, when we add field flow to IR data flow.
2019-09-13 14:33:31 +02:00
Jonas Jensen
562bffe710 C++: Simplify toString of ImplicitParameterNode
This string looked out of place compared to `ExplicitParameterNode`,
whose string is simply the name of the parameter and therefore
indistinguishable from an access to the parameter without looking at the
location also. This has not been a problem so far, and if we want to
distinguish more clearly between initial values and accesses at some
point, we should do it for `ExplicitParameterNode` and
`UninitializedNode` too.
2019-09-13 14:33:26 +02:00
Erik Krogh Kristensen
c4f27ed4cc rename TaintedLength to LoopBoundInjection 2019-09-13 11:12:01 +01:00
Erik Krogh Kristensen
673e883c21 use superscript to denote the size of the tainted object 2019-09-13 11:00:11 +01:00
semmle-qlci
d0d3882121 Merge pull request #1919 from esben-semmle/js/fixup-1
Approved by asger-semmle, xiemaisi
2019-09-13 10:40:38 +01:00
semmle-qlci
1313821a25 Merge pull request #1904 from erik-semmle/passportModel
Approved by asger-semmle, esben-semmle
2019-09-13 10:38:14 +01:00