Commit Graph

49367 Commits

Author SHA1 Message Date
Owen Mansel-Chan
4828430fd4 Extract all object types before emitting them
Note that `extractObjectType` calls `extractType` which may add
additional objects to the list that `ForEachObject` loops over, so
we should emit object types as a second pass.
2022-05-10 14:52:10 +01:00
Owen Mansel-Chan
4fa972fdc5 Rename variable for clarity 2022-05-10 14:52:10 +01:00
Owen Mansel-Chan
1da5399652 Fix obvious test failures 2022-05-10 14:52:10 +01:00
Owen Mansel-Chan
0194eb98d7 Add an upgrade and downgrade script 2022-05-10 14:52:10 +01:00
Owen Mansel-Chan
4d9937d1c6 Add tests 2022-05-10 14:52:10 +01:00
Owen Mansel-Chan
63d1663eb2 bug fix: label pointer-typed receivers correctly
We were trying to convert the object's type to a named type
to iterate through its methods, forgetting that it could also be
a pointer to a named type.

This bug was exposed because we no longer extract an object's
type before extracting it (unless it is a receiver), and when we
extracted a named type we extract its methods and when
extracting a method we extract its receiver and we always give
it the correct label in that situation.
2022-05-10 14:52:10 +01:00
Owen Mansel-Chan
92c331402d Extract type parameters in types, not just decls 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
213fa1fec2 Break out of loop when a match has been found 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
982f11f8c7 Make ScopedObjectID take a function
This is so that ExtractType() won't be called except in the case
of a receiver variable, which is important for extracting type
parameters.
2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
f908a6f1dc Rename parm to param for clarity 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
1e08201632 Extract type param declarations 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
3510f2cdcd Support non-basic interfaces in extractor 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
a05a525755 Extract generic type instantiations to new table 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
e84db95f9c Extract generic function instantiations to new table 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
b8ab46d969 Add QL class for type parameter types 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
3952b1c07a Extract type parameter types (and update dbscheme) 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
f7dcb11816 Extract uninstantiated generic types only 2022-05-10 14:52:09 +01:00
Owen Mansel-Chan
7f0a37913f Use Go 1.18 2022-05-10 14:52:09 +01:00
yoff
f67be52b99 python: fix compilation
by making client code use the "new" class.
Really, this part of the split class should have the old name,
to minimise disruptions to clients.
Same goes for the other split classes.
2022-05-10 12:53:13 +00:00
yoff
db008f1939 python: summaries may allowParameterReturnInSelf 2022-05-10 12:48:42 +00:00
yoff
238c578f5a python: Add LocalSourceParameterNode
This can be used when one wants to consider a
(source) parameter node as a local source.
2022-05-10 12:48:42 +00:00
yoff
28b239a9a4 python: add qldoc 2022-05-10 12:48:42 +00:00
yoff
da3634188d python: variaous fixes
- sync summary files
- format files
- fix compilation
2022-05-10 12:48:42 +00:00
yoff
f14ee0e794 python: Flow summaries based on type tracking
Two classes have been inserted into the hierarchies:

- `NonLibraryDataFlowCallable` with a method `getACall2`.
This method implements "get a call, not considering flow summaries".
For `NonLibraryDataFlowCallable`s, `getACall` will defer to `getACall2`.
While you could have a synthesised call to such a callable,
it would not correspond to a `CallNode`.

- `NonLibraryDataFlowSourceCall` with methods
`getArg2` and `getCallable2`. These also refer to a call graph that
does not consider flow summaries.

`getArg2` is used to synthesise pre-update nodes for arguments.

`getCallable2` is used in `connects` to compute argument passing.
This is used to define data flow nodes for overflow arguments.

`getACall2` ensures that `LibraryCallableValue::getACall` is not called
when the charpred of `FunctionCall` is evaluated.
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
506efcf051 python: refactor TDataFlowCall
- Branch predicates are made simple. In particular, they do not try to detect library calls.
- All branches based on `CallNode`s are gathered into one.
- That branch has been given a class `NonSpecialCall`, which is the new parent of call classes based on `CallNode`s. (Those classes now have more involved charpreds.)
- A new such class, 'LambdaCall` has been split out from `FunctionCall` to allow the latter to replace its
  general `CallNode` field with a specific `FunctionValue` one.
- `NonSpecialCall` is not an abstract class, but it has some abstract overrides. Therefor, it is not
  considered a resolved call in the test `UnresolvedCalls.qll`.
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
d85844bb89 python: type tracking uses source nodes 2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
81ca479ca9 Python: local flow for type tracking
summary flow is excluded from the local flow relation used for
typetracking, but included in the one used for global data flow.
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
177dea5307 python: use new syntax for flow summaries
also convert to inline tests
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
4024ce4777 python: some summary flows 2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
8c263b349f python: add summary flow steps 2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
828db3a392 python: Add summary nodes
allowing more `OutNode`s (not restricting to `CallNode`s),
gives more flow in the `classesCallGraph` test
2022-05-10 12:48:42 +00:00
Rasmus Lerchedahl Petersen
80175a9af5 Python: Compiles and mostly pass tests
- add flowsummaries shared files
- register in indentical files
- fix initial non-monotonic recursions
  - add DataFlowSourceCall
  - add resolvedCall
  - add SourceParameterNode

failing tests:
- 3/library-tests/with/test.ql
2022-05-10 12:48:42 +00:00
Mathias Vorreiter Pedersen
1d10f14629 Merge pull request #9100 from redsun82/swift-tbd-rework
Swift: changes required for TBD node rework
2022-05-10 13:31:43 +01:00
Rasmus Wriedt Larsen
2b6e0cfb44 Merge pull request #8340 from yoff/python/simple-csrf
python: minimal CSRF implementation
2022-05-10 13:36:38 +02:00
Rasmus Wriedt Larsen
cb17e2a649 Merge pull request #8595 from porcupineyhairs/pypam
Python : Add query to detect PAM authorization bypass
2022-05-10 13:35:12 +02:00
Erik Krogh Kristensen
09360bce20 Merge pull request #9085 from erik-krogh/cash
JS: add model for the cash library
2022-05-10 13:20:57 +02:00
Paolo Tranquilli
bf71e4c500 Swift: getPrimaryQlClass -> getAPrimaryQlClass 2022-05-10 12:42:18 +02:00
Tom Hvitved
712fe002b9 Data flow: Sync files 2022-05-10 12:41:10 +02:00
Tom Hvitved
bfabfc3601 Data flow: Add Configuration::includeHiddenNodes() 2022-05-10 12:40:46 +02:00
Paolo Tranquilli
0b9dc9703f Swift: changes required for TBD node rework
These changes are required to allow a new type-safe approach to TBD
nodes, that will come in a separate commit.

This introduces:
* the possibility to add properties to the root `Element`
* a functor taking tags to the corresponding binding trap entry
* `hasProp()` methods for optional properties in QL
* `getPrimaryQlClass()` method
2022-05-10 11:59:25 +02:00
Rasmus Lerchedahl Petersen
aa3d7babf4 python: fix bad merge
caused by an optimistic attempt at solving a
merge conflict in the online GUI.
2022-05-10 11:37:41 +02:00
Rasmus Wriedt Larsen
2421076d2f Merge pull request #8696 from RasmusWL/new-nosql-examples
Python: Improve experimental modeling for `pymongo`
2022-05-10 11:03:05 +02:00
yoff
6c3e2db7fd Merge branch 'main' into python/simple-csrf 2022-05-10 10:55:28 +02:00
Cornelius Riemenschneider
7aa3d0fd26 Merge pull request #9091 from github/criemen/dotnet-lua-tracing-config
C#: Port the existing compiler-tracing.spec files to Lua.
2022-05-10 10:54:20 +02:00
Anders Schack-Mulligen
f85e06c2e4 Dataflow: Sync. 2022-05-10 10:12:39 +02:00
Cornelius Riemenschneider
40503aa368 Address review. 2022-05-10 08:06:25 +00:00
Harry Maclean
a6cab022f6 Ruby: Add missing import 2022-05-10 17:32:01 +12:00
Harry Maclean
7b63493fa9 Ruby: Fix identification IO.open args 2022-05-10 17:32:00 +12:00
Harry Maclean
79c6dc1af0 Refactor IO/File modelling
The main goal here is to get rid of the duplicate definitions of module
`IO`, which currently exist in both `frameworks/core/IO.qll` and
`frameworks/Files.qll`.

We do this by moving the classes inside `Files::IO` to `core/IO.qll`,
but moving most of the actual definitions of those classes to an
internal module `core.internal.FileOrIO`. This means both `Files.qll`
and `IO.qll` can depend on them without leaking them to end users.
2022-05-10 17:32:00 +12:00
Harry Maclean
2d12ad6238 Ruby: Model IO.popen
This method is very similar to `Kernel.system`: it executes its
arguments as a system command in various ways.
2022-05-10 17:32:00 +12:00