Commit Graph

42508 Commits

Author SHA1 Message Date
Andrew Eisenberg
3c8f415f69 Recommend installing the latest version of the CLI to use packaging 2022-06-29 10:33:27 -07:00
Andrew Eisenberg
7864a7580e Fix import statements 2022-06-29 10:22:45 -07:00
Andrew Eisenberg
41244180b3 Apply suggestions from code review
Co-authored-by: Felicity Chapman <felicitymay@github.com>
2022-06-29 10:18:13 -07:00
Andrew Eisenberg
ddf06f8617 Add change notes and qldoc for moved files 2022-06-29 10:03:12 -07:00
Henry Mercer
4dcec2b98c Apply suggestions from code review
Co-authored-by: Felicity Chapman <felicitymay@github.com>
Co-authored-by: Andrew Eisenberg <aeisenberg@github.com>
2022-06-29 17:49:59 +01:00
Alex Denisov
5233a5e17b Swift: also extract imported modules 2022-06-29 17:27:57 +02:00
Andrew Eisenberg
a3f4d1bf66 Move contextual queries from src to lib
With this change, users are now able to run View AST command in
vscode within vscode workspaces that do not include the core libraries.
The relevant core library only needs to be installed in the package
cache.
2022-06-29 07:51:26 -07:00
Alex Ford
578a967160 Merge pull request #9641 from boveus/patch-1
Make ActiveRecordInstanceMethodCall Public
2022-06-29 14:39:36 +01:00
Paolo Tranquilli
d00fec34c3 Merge pull request #9336 from MathiasVP/swift-decls-in-cfg
Swift: CFG for local declarations
2022-06-29 15:10:45 +02:00
Erik Krogh Kristensen
0e4954a68c add navigation.navigate as an XSS / URL sink 2022-06-29 14:56:20 +02:00
Brandon Stewart
5888325549 Merge branch 'main' into patch-1 2022-06-29 08:42:24 -04:00
Mathias Vorreiter Pedersen
e03646aba4 Merge pull request #9737 from geoffw0/arithmetic
Swift: Add ArithmeticOperation.qll library
2022-06-29 13:40:20 +01:00
Nick Rolfe
5db2f9a768 Merge remote-tracking branch 'origin/main' into nickrolfe/pathname 2022-06-29 13:16:49 +01:00
Nick Rolfe
c1302a90e0 Ruby: use MaD for more precise Pathname flow summaries 2022-06-29 13:16:18 +01:00
yoff
8988a02806 Merge pull request #9733 from tausbn/python-fix-bad-mro-flatten-list-join
Python: Fix bad join in MRO `flatten_list`
2022-06-29 13:29:48 +02:00
yoff
f122af81ea Merge pull request #9741 from tausbn/python-fix-bad-join-in-regexpbackref-getgroup
Python: Fix bad join in `RegExpBackRef::getGroup`
2022-06-29 13:23:07 +02:00
Mathias Vorreiter Pedersen
f35ab7c292 Swift: Accept test changes to the cfg. These happen due to the fixes in 9e0cf62cda. 2022-06-29 12:20:07 +01:00
Erik Krogh Kristensen
9ecc3a2671 filter out potential misparses from java/suspicious-regexp-range 2022-06-29 13:16:40 +02:00
Erik Krogh Kristensen
2e295e4a04 filter out potential misparses from rb/suspicious-regexp-range 2022-06-29 13:16:28 +02:00
yoff
731f866242 Merge pull request #9717 from tausbn/python-fix-bad-mro-linearization-of-bases-join
Python: Fix bad join in MRO
2022-06-29 13:08:18 +02:00
Mathias Vorreiter Pedersen
15dc08351e Merge pull request #9747 from MathiasVP/fix-joins-in-swift-cwe-135
Swift: Don't join on index in `swift/string-length-conflation`
2022-06-29 11:58:36 +01:00
Geoffrey White
8b7535af81 Swift: Don't use abstract classes. 2022-06-29 11:49:22 +01:00
Geoffrey White
2cf65c7d35 Swift: Autoformat tests. 2022-06-29 11:49:21 +01:00
Geoffrey White
822002d37d Swift: Missing qldoc. 2022-06-29 11:49:20 +01:00
Mathias Vorreiter Pedersen
cc25e2644f Swift: Don't join on index in 'swift/string-length-conflation'. 2022-06-29 11:40:46 +01:00
Ian Lynagh
d285e19e77 Merge pull request #9731 from igfoo/igfoo/private
Kotlin: Make more methods private
2022-06-29 11:24:33 +01:00
Mathias Vorreiter Pedersen
4356155eeb Merge branch 'main' into swift-decls-in-cfg 2022-06-29 10:03:34 +01:00
Alex Denisov
4d81206a87 Swift: teach extractor to emit build artifacts for later consumption 2022-06-29 10:58:24 +02:00
AlexDenisov
1997d6b18c Merge pull request #9745 from github/alexdenisov/put-traps-into-a-temp-folder
Swift: store TRAP files in a temporary folder until the extraction is complete
2022-06-29 10:55:27 +02:00
Jeroen Ketema
55e052af26 Merge pull request #9686 from aschackmull/dataflow/no-node-scan
Dataflow performance: Avoid node scans
2022-06-29 10:38:56 +02:00
AlexDenisov
e1ef637c54 Update swift/extractor/SwiftExtractorConfiguration.h
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com>
2022-06-29 10:16:14 +02:00
AlexDenisov
968ede3d4a Merge pull request #9746 from github/alexdenisov/add-test-case-showing-modules-loading-issue
Swift: add a test case showing module loading problem
2022-06-29 10:07:56 +02:00
Paolo Tranquilli
296b8cb630 Merge pull request #9719 from github/redsun82/swift-enum-is-case
Swift: add EnumIsCase test
2022-06-29 09:55:20 +02:00
Tony Torralba
12fa6967dc Merge pull request #8669 from joefarebrother/intent-verification
Java: Add query for Improper Verification of Intent by Broadcast Receiver (CWE-925)
2022-06-29 09:43:07 +02:00
Jeroen Ketema
8b13d1fab8 Merge pull request #9726 from github/rdmarsh2/stack-address-join-order
C++: fix join order in UsingExpiredStackAddress
2022-06-29 09:35:47 +02:00
Tony Torralba
741b2a923a Merge pull request #9207 from joefarebrother/android-external-storage
Java: Add sources for Android external storage
2022-06-29 09:34:51 +02:00
Alex Denisov
57811a4efc Swift: add a test case showing module loading problem
Extractor fails to load separate modules that were built by another
version of an actual compiler.
2022-06-29 07:38:18 +02:00
Alex Denisov
488befb577 Swift: store TRAP files in a temporary folder until the extraction is complete
Currently, we have a number of assertions in the codebase and certain
assumptions about the AST. These don't always hold, sometimes leading to
a crash in the extractor.
The crashes leave incomplete TRAP files that cannot be imported into the
database.

With this change, we still get those incomplete TRAP files, but we also
get a database in the end (even thoough it is also incomplete as we
cannot import everything).
2022-06-29 07:17:06 +02:00
AlexDenisov
6c68872163 Merge pull request #9743 from MathiasVP/fix-path-problem
Swift: Fix `kind` in `swift/string-length-conflation`
2022-06-29 06:58:36 +02:00
Mathias Vorreiter Pedersen
c2e57c3c9b Swift: Fix 'kind' in 'swift/string-length-conflation'. 2022-06-28 22:33:28 +01:00
Shyam Mehta
b5ca2c3d9d Add additional tests from real world query run 2022-06-28 17:32:20 -04:00
Brandon Stewart
13fae22756 Merge branch 'main' into patch-1 2022-06-28 17:27:07 -04:00
yoff
1105cd569b Merge branch 'main' into python/port-tarslip 2022-06-28 22:17:28 +02:00
yoff
6087bc6888 Merge branch 'main' into python/more-logic-tests 2022-06-28 22:16:38 +02:00
yoff
ac0c8d238f python: only clear taint on false-edge 2022-06-28 20:14:52 +00:00
Shyam Mehta
7122f29296 Finish Partial Path Traversal Query 2022-06-28 15:02:06 -04:00
Shyam Mehta
4c7d476280 [JAVA] Partial Path Traversal Vuln Query 2022-06-28 13:52:41 -04:00
Taus
38b8640582 Python: Fix bad join in RegExpBackRef::getGroup
Although this wasn't (as far as I know) causing any performance issues,
it was making the join-order badness report quite noisy, and so I
figured it was worth fixing.

Before:
```
Tuple counts for RegexTreeView::RegExpBackRef::getGroup#dispred#f0820431#ff/2@d3441d0b after 84ms:
1501195 ~3%     {2} r1 = JOIN RegexTreeView::RegExpTerm::getLiteral#dispred#f0820431#ff_10#join_rhs WITH RegexTreeView::RegExpTerm::getLiteral#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1 'result', Lhs.1 'result'
149     ~0%     {5} r2 = JOIN r1 WITH RegexTreeView::RegExpBackRef#class#31aac2a7#ffff ON FIRST 1 OUTPUT Rhs.1, Rhs.2, Rhs.3, Lhs.1 'result', Lhs.0 'this'
149     ~1%     {3} r3 = JOIN r2 WITH regex::RegexString::numbered_backreference#dispred#f0820431#ffff ON FIRST 3 OUTPUT Lhs.3 'result', Rhs.3, Lhs.4 'this'
4       ~0%     {2} r4 = JOIN r3 WITH RegexTreeView::RegExpGroup::getNumber#dispred#f0820431#ff ON FIRST 2 OUTPUT Lhs.2 'this', Lhs.0 'result'

1501195 ~3%     {2} r5 = JOIN RegexTreeView::RegExpTerm::getLiteral#dispred#f0820431#ff_10#join_rhs WITH RegexTreeView::RegExpTerm::getLiteral#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'result', Rhs.1 'result'
42526   ~0%     {5} r6 = JOIN r5 WITH RegexTreeView::RegExpGroup#31aac2a7#ffff ON FIRST 1 OUTPUT Lhs.1 'this', Lhs.0 'result', Rhs.1, Rhs.2, Rhs.3
22      ~0%     {8} r7 = JOIN r6 WITH RegexTreeView::RegExpBackRef#class#31aac2a7#ffff ON FIRST 1 OUTPUT Lhs.2, Lhs.3, Lhs.4, Lhs.1 'result', Lhs.0 'this', Rhs.1, Rhs.2, Rhs.3
0       ~0%     {6} r8 = JOIN r7 WITH regex::RegexString::getGroupName#dispred#f0820431#ffff ON FIRST 3 OUTPUT Lhs.5, Lhs.6, Lhs.7, Rhs.3, Lhs.3 'result', Lhs.4 'this'
0       ~0%     {2} r9 = JOIN r8 WITH regex::RegexString::named_backreference#dispred#f0820431#ffff ON FIRST 4 OUTPUT Lhs.5 'this', Lhs.4 'result'

4       ~0%     {2} r10 = r4 UNION r9
                return r10
```

In this case I opted for a classical solution: tying together the
literal and number (or name) part of the backreference in order to
encourage a two-column join.

After:
```
Tuple counts for RegexTreeView::RegExpBackRef::getGroup#dispred#f0820431#ff/2@b0cc4d5n after 0ms:
898  ~1%     {3} r1 = JOIN RegexTreeView::RegExpTerm::getLiteral#dispred#f0820431#ff WITH RegexTreeView::RegExpGroup::getNumber#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1, Lhs.0 'result'
4    ~0%     {2} r2 = JOIN r1 WITH RegexTreeView::RegExpBackRef::hasLiteralAndNumber#f0820431#fff_120#join_rhs ON FIRST 2 OUTPUT Rhs.2 'this', Lhs.2 'result'

1110 ~0%     {5} r3 = JOIN RegexTreeView::RegExpGroup#31aac2a7#ffff WITH RegexTreeView::RegExpTerm::getLiteral#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.0 'result', Rhs.1
146  ~0%     {3} r4 = JOIN r3 WITH regex::RegexString::getGroupName#dispred#f0820431#ffff ON FIRST 3 OUTPUT Lhs.4, Rhs.3, Lhs.3 'result'
0    ~0%     {2} r5 = JOIN r4 WITH RegexTreeView::RegExpBackRef::hasLiteralAndName#f0820431#fff_120#join_rhs ON FIRST 2 OUTPUT Rhs.2 'this', Lhs.2 'result'

4    ~0%     {2} r6 = r2 UNION r5
            return r6
```
2022-06-28 16:51:09 +00:00
Andrew Eisenberg
0f8ffb12e6 Update docs/codeql/codeql-cli/analyzing-databases-with-the-codeql-cli.rst 2022-06-28 09:45:54 -07:00
Mathias Vorreiter Pedersen
f97cc9e37c Merge pull request #9739 from MathiasVP/swift-conflation-query-high-precision
Swift: Set 'swift/string-length-conflation' to precision `high`
2022-06-28 17:26:23 +01:00