Commit Graph

50816 Commits

Author SHA1 Message Date
Chris Smowton
b4c4a26e22 Element.hasChildElement: associate local classes specialisations with their unspecialised containing function 2022-10-17 18:43:12 +01:00
Chris Smowton
baaa06391c Extract interface forwarders with public visiblity 2022-10-17 18:43:12 +01:00
Chris Smowton
1613e47388 Improve and accept changes to compiler-generated methods test 2022-10-17 18:43:11 +01:00
Chris Smowton
b763c406b6 hasChildElement: include method -> local class edges 2022-10-17 18:38:13 +01:00
Chris Smowton
fff9a75ff8 Accept test changes 2022-10-17 18:38:13 +01:00
Chris Smowton
4201031ae0 Restrict interface override synthesis to cases where both the overriding class and the interface are Kotlin-defined.
If the interface is Java-defined and it provides a default interface implementation then real class-file default methods are being used and kotlinc won't synthesise anything. If the loaded .class file wasn't made by Kotlin, then we see all the real methods and there is no need to synthesise anything either.
2022-10-17 18:38:13 +01:00
Chris Smowton
e8a35983ee Implement Kotlin default interface method forwarding
Kotlin's implementation of defaults depends on the -Xjvm-default setting (or the @JvmDefault deprecated annotation, not implemented here): by default, actual interface class files don't use default method, and any class that would inherit one instead implements the interface calling a static method defined on TheInterface$DefaultImpls. With
-Xjvm-default=all or =all-compatibility, real interface default methods are emitted, with the latter retaining the DefaultImpls methods so that other Kotlin can use it.

Here I adopt a hybrid solution: create a real default method implementation, but also emit a forwarding method like `@override int f(int x) { return super.TheInterface.f(x); }`, because the Java extractor will see `MyClass.f` in the emitted class file and try to dispatch directly to it. The only downside is that we emit a default interface
method body for a prototype that will appear to be `abstract` to the Java extractor and which it will extract as such. I work around this by tolerating the combination `default abstract` in QL. The alternative would be to fully mimic the DefaultImpls approach, giving 100% fidelity to kotlinc's strategy and therefore no clash with the Java
extractor's view of the world.
2022-10-17 18:38:13 +01:00
Chris Smowton
595a66a3a4 Fix extraction of primitive-typed arrays 2022-10-17 18:29:59 +01:00
Chris Smowton
ecb3788467 Make useAnonymousClass private 2022-10-17 18:24:04 +01:00
Chris Smowton
f358be85eb Accept test changes 2022-10-17 18:23:10 +01:00
Chris Smowton
9611fea479 Fix mistaking unspecialised for raw types, and failing to account for an empty declaration stack 2022-10-17 18:22:41 +01:00
Geoffrey White
040d72e7f1 Merge pull request #10857 from geoffw0/locationstring
Swift: Give Location a useful toString
2022-10-17 18:10:51 +01:00
james
d917416479 fix document anchor in codeql-library-for-ruby 2022-10-17 16:51:48 +01:00
James Fletcher
4d7195509c Merge branch 'main' into lgtm-cli-vs-code 2022-10-17 16:24:29 +01:00
james
51c0287905 address review comments 2022-10-17 16:19:15 +01:00
Paolo Tranquilli
3a99b9845e Merge pull request #10856 from github/redsun82/swift-show-ql-class-in-collapsed-hierarchy-tests
Swift: show QL class in generated tests on collapsed hierarchies
2022-10-17 16:38:24 +02:00
Taus
58754982ce Python: Update type tracking tests
No longer missing! 🎉
2022-10-17 14:34:10 +00:00
Taus
ad13fbaeb6 Python: Add tests
A slightly complicated test setup. I wanted to both make sure I captured
the semantics of Python and also the fact that the kinds of global flow
we expect to see are indeed present.

The code is executable, and prints out both when the execution reaches
certain files, and also what values are assigned to the various
attributes that are referenced throughout the program. These values are
validated in the test as well.

My original version used introspection to avoid referencing attributes
directly (thus enabling better error diagnostics), but unfortunately
that made it so that the model couldn't follow what was going on.

The current setup is a bit clunky (and Python's scoping rules makes it
especially so -- cf. the explicit calls to `globals` and `locals`), but
I think it does the job okay.
2022-10-17 14:29:41 +00:00
Taus
651afaf11b Python: Hook up new implementation
Left as its own commit, as otherwise the diff would have been very
confusing.
2022-10-17 14:29:41 +00:00
Taus
0051ba1596 Python: Add new module resolution implementation
A fairly complicated bit of modelling, mostly due to the quirks of
how imports are handled in Python.

A few notes:

- The handling of `__all__` is not actually needed (and perhaps not
  desirable, as it only pertains to `import *`, though it does match
  the current behaviour), but it might become useful at a later date,
  so I left it in.
- Ideally, we would represent `foo as bar` in an `import` as a
  `DefinitionNode` in the CFG. I opted _not_ to do this, as it would
  also affect points-to, and I did not want to deal with any fallout
  arising from that.
2022-10-17 14:29:41 +00:00
Chris Smowton
eb97735568 Merge pull request #10797 from smowton/smowton/fix/byte-short-inversion
Kotlin: fix bit-inversion operator for Byte and Short types
2022-10-17 15:05:57 +01:00
Chris Smowton
e1c93c9284 Merge pull request #10816 from smowton/smowton/fix/kotlin-adapted-function-references
Kotlin: extract function references using compiler-generated adapters
2022-10-17 15:05:16 +01:00
erik-krogh
bb4bc55c6a update expected output 2022-10-17 15:52:21 +02:00
Geoffrey White
dcf254a9e3 Swift: Make QL-for-QL happy. 2022-10-17 14:23:28 +01:00
Taus
f5b2eb94a6 Merge pull request #10783 from yoff/python/subscript-nodes
Python: API graph improvements for subscripts
2022-10-17 15:21:56 +02:00
Tamas Vajk
21c13fb9a3 Kotlin: Exclude variables of live literals from java/field-masks-super-field 2022-10-17 15:07:44 +02:00
Geoffrey White
0281bfedda Merge pull request #10689 from d10c/swift/cleartext-storage-nsuserdefaults
Swift: Query for CWE-312: Exposure of sensitive information using NSUserDefaults
2022-10-17 14:05:17 +01:00
Geoffrey White
13f9834fde Merge pull request #10780 from karimhamdanali/swift-hardcoded-key
Swift: detect hardcoded encryption keys
2022-10-17 14:02:31 +01:00
Arthur Baars
7af4c08055 Merge pull request #10803 from hmac/actiondispatch-response
Ruby: Model ActionDispatch::Response
2022-10-17 14:51:25 +02:00
Geoffrey White
9767064310 Swift: Fix bug for sqlite3_prepare_v3. 2022-10-17 13:40:35 +01:00
Geoffrey White
1221cbaee7 Swift: Updated results after merge with main. 2022-10-17 13:35:46 +01:00
Geoffrey White
13018150ed Merge branch 'main' into sqlinject 2022-10-17 13:30:14 +01:00
Geoffrey White
85e164d4f6 Swift: QLDoc some stuff while we're here. 2022-10-17 13:22:44 +01:00
Tony Torralba
01a08d44bb Apply suggestions from code review
Co-authored-by: Felicity Chapman <felicitymay@github.com>
2022-10-17 14:14:38 +02:00
Geoffrey White
3b9151cb24 Swift: Restore UnknownLocation.toString(), it seems helpful. 2022-10-17 13:11:22 +01:00
Paolo Tranquilli
e49268d036 Swift: show QL class in generated tests on collapsed hierarchies
In those kinds of tests the results may have different final classes
that are not necessarily visible (or tested) solely through the string
representation. For better testing and reading of expected results,
`getQlPrimaryClasses` is added in these cases.
2022-10-17 14:08:04 +02:00
erik-krogh
f09e3bd3ac add String#% as a printf like call 2022-10-17 13:51:43 +02:00
Geoffrey White
9c8bbe384b Swift: Add Location.toString. 2022-10-17 12:48:17 +01:00
Paolo Tranquilli
c3968a2166 Merge pull request #10854 from github/redsun82/swift-extract-implicit-conversions
Swift: extract all `ImplicitConversionExpr`
2022-10-17 13:46:10 +02:00
Geoffrey White
4d0c23c4da Swift: Add a test of Location.qll. 2022-10-17 12:45:26 +01:00
Chris Smowton
efd7b6e692 Use isFunction 2022-10-17 12:27:58 +01:00
Arthur Baars
f7ff2cdc0d Merge branch 'main' into actiondispatch-response 2022-10-17 13:22:17 +02:00
erik-krogh
d4919d04ba add a taint-step for format-calls 2022-10-17 13:16:38 +02:00
erik-krogh
f222cc1f3e refactor the existing taint-step for string interpolation into StringFormatters.qll 2022-10-17 13:16:38 +02:00
erik-krogh
6de1abcb0e add a returnsFormatted predicate to the printf model, similar to the JS implementation 2022-10-17 13:16:38 +02:00
erik-krogh
a2b924bbdf move model of printf style calls to StringFormatters.qll 2022-10-17 13:16:34 +02:00
Paolo Tranquilli
789be9a1ad Swift: add ImplicitConversionExpr test 2022-10-17 12:57:44 +02:00
Karim Ali
bbc03a1578 add false negatives to the test case 2022-10-17 12:54:34 +02:00
Karim Ali
bb3bf64364 update example with both AES and Blowfish for better clarity 2022-10-17 12:54:34 +02:00
Karim Ali
b840a41222 fix typo in doc 2022-10-17 12:54:34 +02:00