Commit Graph

60239 Commits

Author SHA1 Message Date
dependabot[bot]
03771ffad2 Bump actions/checkout from 2 to 4
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-09-05 12:17:54 +02:00
Tom Hvitved
cb8922034c Merge pull request #14133 from hvitved/ruby/flow-test-path-graph-fixes
Ruby: Use proper `PathGraph` module in inline flow tests
2023-09-05 10:33:07 +02:00
Tamas Vajk
bf96e688ff Fix review findings 2023-09-05 10:19:41 +02:00
Rasmus Wriedt Larsen
49f5d38956 Merge pull request #14068 from RasmusWL/dataflow-config-refactor
Python: Use new dataflow API
2023-09-04 21:04:10 +02:00
Tom Hvitved
a2912cd72b Ruby: Use proper PathGraph module in inline flow tests
Gets rid of
```
PathNode is incompatible with PathNode (the type of the edge relation).
```
warnings.
2023-09-04 20:27:34 +02:00
Tom Hvitved
4a1163b38c Merge pull request #14109 from hvitved/ruby/hide-desugared-assignments-in-dataflow 2023-09-04 19:59:33 +02:00
Mathias Vorreiter Pedersen
1232120d42 C++: Naively copy the 'surprising lifetimes' query from Coding Standards and add required metadata. 2023-09-04 16:21:28 +01:00
Michael B. Gale
5337785571 Remove TODO comment 2023-09-04 15:10:00 +01:00
Michael B. Gale
bd5f5314ea C#: Pass .dotnet path to standalone extractor 2023-09-04 15:09:28 +01:00
Michael B. Gale
37535d1f52 C#: Make WithDotNet public 2023-09-04 15:08:57 +01:00
Michael B. Gale
3b010a2fb3 C# standalone: accept path to .dotnet folder 2023-09-04 15:08:53 +01:00
Michael B. Gale
4c2a7aab3d Do not rename global.json in standalone mode 2023-09-04 15:04:44 +01:00
Michael B. Gale
bbe90be0db Wrap StandaloneBuildRule in WithDotNet 2023-09-04 15:02:44 +01:00
Tom Hvitved
55aedbc46c C#: Fix logic for flow into property writes 2023-09-04 15:42:50 +02:00
Kasper Svendsen
ecee427c72 Merge pull request #14117 from kaspersv/delete-unnecessary-test
Java: Delete java test query which fails to compile
2023-09-04 15:28:57 +02:00
Alex Ford
0325c87ccb Merge pull request #13825 from boveus/add-cwe-208
Ruby: Add Unsafe HMAC Comparison Query.
2023-09-04 14:10:12 +01:00
Ian Lynagh
a2659eecfb Merge pull request #14018 from igfoo/igfoo/extractor_information_kotlin1
Kotlin: Write usesK2 ("uses Kotlin 2") information to the database
2023-09-04 13:38:23 +01:00
Michael B. Gale
77369a09a4 Merge pull request #13872 from Kwstubbs/Kevin_error_sanitizer
Go: Add sanitizer to remove paths passing through http.Error
2023-09-04 13:25:55 +01:00
Alex Ford
11e5565344 Merge branch 'main' into add-cwe-208 2023-09-04 12:45:49 +01:00
Ian Lynagh
03ad04bc8e Merge pull request #14118 from igfoo/igfoo/kotlin_master
Kotlin: Make it possible to build with master
2023-09-04 12:12:25 +01:00
AlexDenisov
e2602fbbc4 Merge pull request #14119 from github/alexdenisov/sequence-expr
Swift: fix SequenceExpr extraction
2023-09-04 12:29:07 +02:00
Paolo Tranquilli
7d89028688 Merge pull request #14106 from github/alexdenisov/rename-xcode-autobuilder
Swift: rename autobuilder. NFC
2023-09-04 12:28:47 +02:00
Ian Lynagh
bbf441f87a Kotlin: Add an integration test for Kotlin 2 2023-09-04 11:28:31 +01:00
Alex Denisov
888dd786b4 Swift: fix SequenceExpr extraction
Before we extracted all the subexpressions from the `SequenceExpr` while we should've only extracted the expressions at odd indices:
```
...
/// SequenceExpr - A list of binary operations which has not yet been
/// folded into a tree.  The operands all have even indices, while the
/// subexpressions with odd indices are all (potentially overloaded)
/// references to binary operators.
class SequenceExpr final : public Expr,
...
```

The AST for a `SequenceExpr` looks like this:

```
sequence_expr:
  unresolved_dot_expr:
    ...
  assign_expr:
    member_ref_expr:
      ...
    dot_syntax_call_expr:
      ...
  unresolved_member_chain_expr:
    ...
```

however, what's is not visible with the "final" AST is that `unresolved_dot_expr` is the unresolved version of `assign_expr.member_ref_expr` and the `unresolved_member_chain_expr` is the unresolved version of `assign_expr.dot_syntax_call_expr`.
This becomes visible when I enable typechecker debugging:

```c++
auto &typeCheckerOptions = invocation.getTypeCheckerOptions();
typeCheckerOptions.DebugConstraintSolver = true;
```

Which prints the following snippets:

```
---Initial constraints for the given expression---
(assign_expr type='()' location=foo.swift:25:54 range=[foo.swift:25:13 - line:25:57]
  (unresolved_dot_expr type='$T2' location=foo.swift:25:29 range=[foo.swift:25:13 - line:25:29] field 'preferredDatePickerStyle' function_ref=unapplied
    (unresolved_dot_expr type='$T1' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18] field 'datePicker' function_ref=unapplied
      (declref_expr type='DatePickerCell' location=foo.swift:25:13 range=[foo.swift:25:13 - line:25:13] decl=foo.(file).DatePickerRowProtocol extension.configurePickerStyle(_:_:).cell@foo.swift:15:33 function_ref=unapplied)))
  (unresolved_member_chain_expr implicit type='$T5' location=foo.swift:25:57 range=[foo.swift:25:56 - line:25:57]
    (unresolved_member_expr type='$T4' location=foo.swift:25:57 range=[foo.swift:25:56 - line:25:57] name='wheels' function_ref=unapplied)))

// ...

---Type-checked expression---
(assign_expr type='()' location=foo.swift:25:54 range=[foo.swift:25:13 - line:25:57]
  (member_ref_expr type='@lvalue UIDatePickerStyle' location=foo.swift:25:29 range=[foo.swift:25:13 - line:25:29] decl=UIKit.(file).UIDatePicker.preferredDatePickerStyle
    (force_value_expr implicit type='UIDatePicker' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18] implicit_iuo_unwrap
      (load_expr implicit type='UIDatePicker?' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18]
        (member_ref_expr type='@lvalue UIDatePicker?' location=foo.swift:25:18 range=[foo.swift:25:13 - line:25:18] decl=foo.(file).DatePickerCell.datePicker@foo.swift:10:29
          (declref_expr type='DatePickerCell' location=foo.swift:25:13 range=[foo.swift:25:13 - line:25:13] decl=foo.(file).DatePickerRowProtocol extension.configurePickerStyle(_:_:).cell@foo.swift:15:33 function_ref=unapplied)))))
  (dot_syntax_call_expr type='UIDatePickerStyle' location=foo.swift:25:57 range=[foo.swift:25:56 - line:25:57]
    (declref_expr type='(UIDatePickerStyle.Type) -> UIDatePickerStyle' location=foo.swift:25:57 range=[foo.swift:25:57 - line:25:57] decl=UIKit.(file).UIDatePickerStyle.wheels function_ref=unapplied)
    (argument_list implicit
      (argument
        (type_expr implicit type='UIDatePickerStyle.Type' location=foo.swift:25:56 range=[foo.swift:25:56 - line:25:56] typerepr='UIDatePickerStyle')))))
```

The proposed solution is to only extract subexpressions at indices from `SequenceExpr` thus ignoring all the unresolved leftovers.

Note: I'm not entirely sure about the case when there is only child (`elements.size() == 1`) so I'm always extracting it.

This patch fixes the last source of unresolved expressions.
2023-09-04 11:42:12 +02:00
Rasmus Wriedt Larsen
a58c9e91ea Merge pull request #14130 from RasmusWL/fixup-accept-ci-changes
Misc: Fixup for `accept-expected-changes-from-ci.py`
2023-09-04 09:47:31 +02:00
Rasmus Wriedt Larsen
301133ad94 Misc: Fixup for accept-expected-changes-from-ci.py
Allow empty lines while looking for diff (between `---expected` and `FAILED`). This can happen when there is `Locations outside the test directory` since an empty line is printed after that warning message (this output can be interleaved with the diff due to parallel execution).
2023-09-04 09:32:06 +02:00
Erik Krogh Kristensen
284ca5e4ee Merge pull request #14129 from github/dependabot/cargo/ql/regex-1.9.5
Bump regex from 1.9.3 to 1.9.5 in /ql
2023-09-04 08:11:51 +02:00
dependabot[bot]
4919cc4c4e Bump regex from 1.9.3 to 1.9.5 in /ql
Bumps [regex](https://github.com/rust-lang/regex) from 1.9.3 to 1.9.5.
- [Release notes](https://github.com/rust-lang/regex/releases)
- [Changelog](https://github.com/rust-lang/regex/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rust-lang/regex/compare/1.9.3...1.9.5)

---
updated-dependencies:
- dependency-name: regex
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-09-04 03:47:05 +00:00
Alex Ford
98851736d6 Revert "Ruby: configsig rb/tainted-format-string"
This reverts commit f5860cb4818dc3c07eeb6731e75bf5df203dd48f.
2023-09-03 17:20:06 +01:00
Alex Ford
bf6837cca0 Revert "Ruby: configsig rb/http-to-file-access"
This reverts commit e77ba1589663905c952cdb643ab66885760b27bd.
2023-09-03 17:20:06 +01:00
Alex Ford
e399eac2b3 Ruby: changenote for using new dataflow api 2023-09-03 17:20:06 +01:00
Alex Ford
73ed5696f3 Ruby: configsig rb/xxe 2023-09-03 17:20:06 +01:00
Alex Ford
956207b7d9 Ruby: configsig rb/meta/tainted-nodes 2023-09-03 17:20:06 +01:00
Alex Ford
f24102e0e7 Ruby: configsig rb/weak-params 2023-09-03 17:20:06 +01:00
Alex Ford
6c06def5d7 Ruby: configsig rb/manually-checking-http-verb 2023-09-03 17:20:06 +01:00
Alex Ford
39af2d2870 Ruby: configsig rb/user-controlled-file-decompression 2023-09-03 17:20:06 +01:00
Alex Ford
cdc788b162 Ruby: configsig rb/hardcoded-credentials 2023-09-03 17:20:06 +01:00
Alex Ford
4d1684e37b Ruby: configsig rb/overly-permissive-file 2023-09-03 17:20:06 +01:00
Alex Ford
b6d12f8b1c Ruby: configsig rb/zip-slip 2023-09-03 17:20:05 +01:00
Alex Ford
ebf2a2e1f5 Ruby: configsig rb/unicode-bypass-validation 2023-09-03 17:20:05 +01:00
Alex Ford
7445fc43f9 Ruby: configsig rb/regexp-injection 2023-09-03 17:20:05 +01:00
Alex Ford
494b7b3fdf Ruby: configsig rb/polynomial-redos 2023-09-03 17:20:05 +01:00
Alex Ford
04d3d04317 Ruby: configsig rb/regex/badly-anchored-regexp 2023-09-03 17:20:05 +01:00
Alex Ford
77f3a70376 Ruby: renames for rb/xpath-injection 2023-09-03 17:20:05 +01:00
Alex Ford
42cd58695d Ruby: configsig rb/url-redirection 2023-09-03 17:20:05 +01:00
Alex Ford
f79796a644 Ruby: configsig rb/shell-command-constructed-from-input 2023-09-03 17:20:05 +01:00
Alex Ford
f03f670312 Ruby: configsig rb/html-constructed-from-input 2023-09-03 17:20:05 +01:00
Alex Ford
8ad6c72ba2 Ruby: configsig rb/unsafe-deserialization 2023-09-03 17:20:05 +01:00
Alex Ford
461bc0d359 Ruby: configsig rb/unsafe-code-construction 2023-09-03 17:20:05 +01:00
Alex Ford
3e23a6e021 Ruby: configsig rb/server-side-template-injection 2023-09-03 17:20:05 +01:00