Commit Graph

85368 Commits

Author SHA1 Message Date
Michael Nebel
c687dcb094 Java: Sync files and make language specific implementation. 2024-06-24 13:07:39 +02:00
Michael Nebel
30249e4f2b Java: Add some spurious source and sink examples. 2024-06-24 13:07:34 +02:00
Michael Nebel
854674a71c C#: Update expected test output. 2024-06-24 13:07:30 +02:00
Michael Nebel
b27a9d948a C#: Exclude APIs with a manual source neutral from source model generation and allow source generation for all source kinds. 2024-06-24 13:07:14 +02:00
Michael Nebel
2657e7f56d C#: Add some source and sink modelling examples where a neutral exist. 2024-06-24 13:05:35 +02:00
Mathias Vorreiter Pedersen
00d772f980 C++: Fix value numbering imports. 2024-06-24 11:53:24 +01:00
Michael Nebel
abc7cc39d4 Merge pull request #16775 from michaelnebel/modelgen/refactorprinting
C#/Java: Parameterized module for model printing.
2024-06-24 12:51:07 +02:00
Alvaro Muñoz
24d69f2ee8 Bump qlpack versions 2024-06-24 12:45:35 +02:00
Alvaro Muñoz
b5dfda27fd Add cargo as poisonable step 2024-06-24 12:45:24 +02:00
Michael Nebel
9cd16fd9d6 Java: Base the model printing on the shared implementation. 2024-06-24 11:52:50 +02:00
Michael Nebel
8630583856 C#/Java: Exclude the model printing implementation form sync files. 2024-06-24 11:50:57 +02:00
Michael Nebel
b7bc540325 C#: Adjust implementation to use the shared model printer. 2024-06-24 11:50:46 +02:00
Michael Nebel
65e150b416 Add parameterized module for MaD model printing. 2024-06-24 11:48:33 +02:00
Owen Mansel-Chan
f04a85e121 Merge pull request #16753 from owen-mc/go/misc-clean-up
Go: a few small clean ups
2024-06-24 10:47:21 +01:00
Michael Nebel
94d12edfdb Merge pull request #16759 from michaelnebel/modelgen/sourcesinkmodelgen
C#/Java: Introduce source and sink model generation sanitisers.
2024-06-24 11:47:11 +02:00
Rasmus Lerchedahl Petersen
4626e134fa Python: update doc to use operations module 2024-06-24 10:56:34 +02:00
Rasmus Lerchedahl Petersen
00fbada41d Python: recognize fabric.operations 2024-06-24 10:54:59 +02:00
Rasmus Lerchedahl Petersen
21a0f8af07 Python: address reviewer comments
- fix wording on `builtins`
- add named argument/parameter access path components
2024-06-24 10:48:53 +02:00
yoff
d603b48884 Apply suggestions from code review
Co-authored-by: Taus <tausbn@github.com>
2024-06-24 10:29:33 +02:00
Alvaro Muñoz
6df70d1a45 Do not consider priv events if runtime data is available 2024-06-23 21:34:30 +02:00
Mathias Vorreiter Pedersen
a1743aa12e Merge pull request #16805 from MathiasVP/tc-in-temp-materialization
C++: Fix missing `asExpr` for temporary materializations with conversions
2024-06-23 13:38:01 +01:00
Porcupiney Hairs
a7cdf0e2fd CPP: Disabled SSL certificate verification
Disable SSL certificate verification can expose the communication to MITM attacks.

This PR adds a query to detect the same. This also include the tests and qhelp for the same.
2024-06-23 14:27:04 +05:30
Owen Mansel-Chan
513ec16691 Merge pull request #16796 from owen-mc/go/fix/package-vendor
Go: Fix bug removing "vendor/" from package paths
2024-06-22 07:54:18 +01:00
Mathias Vorreiter Pedersen
9a2c7d34af C++: Simplify 'parseParens'. 2024-06-21 15:45:43 +01:00
Jonathan Leitschuh
472cca9221 Align Java CommandInjectionRuntimeExec.ql Severity
Align severity with other command injection vulnerabilities:

- 4a448f445e/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql (L8)
- 4a448f445e/go/ql/src/Security/CWE-078/CommandInjection.ql (L7)
- 4a448f445e/swift/ql/src/queries/Security/CWE-078/CommandInjection.ql (L7)
- 4a448f445e/javascript/ql/src/Security/CWE-078/CommandInjection.ql (L7)
2024-06-21 10:29:27 -04:00
Jonathan Leitschuh
1728e5dfd5 Align Ruby NonConstantKernelOpen.ql Severity
Align severity with other command injection vulnerabilities:

 - 4a448f445e/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.ql (L8)
- 4a448f445e/go/ql/src/Security/CWE-078/CommandInjection.ql (L7)
- 4a448f445e/swift/ql/src/queries/Security/CWE-078/CommandInjection.ql (L7)
- 4a448f445e/javascript/ql/src/Security/CWE-078/CommandInjection.ql (L7)
2024-06-21 10:27:47 -04:00
Alvaro Muñoz
4e94c4294c Merge pull request #46 from github/remove_scan_action 2024-06-21 15:26:21 +02:00
Mathias Vorreiter Pedersen
2e74ae448c C++: Accept more test changes. 2024-06-21 14:04:08 +01:00
Mathias Vorreiter Pedersen
40fb59dc0b C++: Add gnu iterator models to regain TP. 2024-06-21 14:04:07 +01:00
Mathias Vorreiter Pedersen
c8f3c1a798 C++: Accept test changes. Nothing exciting to see here. 2024-06-21 14:04:06 +01:00
Mathias Vorreiter Pedersen
f507b51170 C++: Fix Code Scanning errors. 2024-06-21 14:04:05 +01:00
Mathias Vorreiter Pedersen
3e9862391b C++: No need for 'decodeUnknownContent' if we specify the MaD summary rows correctly. This avoids a bad join in a compiler-generated predicate. 2024-06-21 14:04:03 +01:00
Mathias Vorreiter Pedersen
6513c33d26 C++: Accept test changes. 2024-06-21 14:04:02 +01:00
Mathias Vorreiter Pedersen
1bb762bea9 C++: Accept test changes. 2024-06-21 13:35:10 +01:00
Mathias Vorreiter Pedersen
7d41e8ef73 C++: Perform a TC to skip conversions when special-casing materialization of temporaries. 2024-06-21 13:35:09 +01:00
Mathias Vorreiter Pedersen
3b585b4196 C++: Add test with missing flow. 2024-06-21 13:35:08 +01:00
Taus
4a448f445e Merge pull request #15715 from am0o0/am0o0-python-codeExec
Python: New command execution sinks
2024-06-21 14:26:33 +02:00
Anders Schack-Mulligen
accc73d1d0 Dataflow: Add debug graph for pruning stages. 2024-06-21 14:25:32 +02:00
Erik Krogh Kristensen
49f74bacf2 Merge pull request #16729 from mbaluda/main
JS: Extract SAP XSJS file types as Javascript
2024-06-21 14:23:55 +02:00
Taus
6db7e72fb8 Python: Fix bad join in DataFlowDispatch
A case of bad magic. Rather than evaluating separately whether a class
has a method of some name, the compiler opted to magick in the fact
that this was done as part of the `findFunctionAccordingToMro`
predicate. Hilarity ensued.

However, _we_ know that magic really isn't needed in this case (the
number of results is bounded by `Class.getAMethod` since methods have
only a single name), so by factoring it out into a helper predicate, we
can help the join-orderer along.

Before
```
(377s) Starting to evaluate predicate _DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev_DataFlowDispatch::getNextClassInMro/1#__#shared/3@i6#L3#f893bw2h (iteration 6)
(377s) Tuple counts for _DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev_DataFlowDispatch::getNextClassInMro/1#__#shared/3@i6#L3#f893bw2h after 16ms:
33363  ~0%     {2} r1 = SCAN `DataFlowDispatch::getNextClassInMro/1#e1ee596a#prev_delta` OUTPUT In.1, In.0 'arg1'
159696 ~4%     {3}    | JOIN WITH `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev` ON FIRST 1 OUTPUT Rhs.1 'arg0', Lhs.1 'arg1', Rhs.2 'arg2'
               return r1
(377s) Starting to evaluate predicate _Class::Class.getAMethod/0#dispred#66416e47_Function::Function.getName/0#dispred#033700ef_10#join_rh__#antijoin_rhs/3@i6#L4#f893bw2h (iteration 6)
(382s) Tuple counts for _Class::Class.getAMethod/0#dispred#66416e47_Function::Function.getName/0#dispred#033700ef_10#join_rh__#antijoin_rhs/3@i6#L4#f893bw2h after 4.4s:
1770825904 ~4%     {4} r1 = JOIN `_DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev_DataFlowDispatch::getNextClassInMro/1#__#shared` WITH `Function::Function.getName/0#dispred#033700ef_10#join_rhs` ON FIRST 1 OUTPUT Lhs.1 'arg0', Rhs.1, Lhs.0 'arg1', Lhs.2 'arg2'
34558      ~3%     {3}    | JOIN WITH `Class::Class.getAMethod/0#dispred#66416e47` ON FIRST 2 OUTPUT Lhs.0 'arg0', Lhs.2 'arg1', Lhs.3 'arg2'
                   return r1
...
(382s) Starting to evaluate predicate DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3/3@i6#f893b1xh (iteration 6)
(382s)                     - DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3_delta has 125138 rows (order for disjuncts: delta=<standard>).
(382s) Tuple counts for DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3/3@i6#f893b1xh after 12ms:
33363  ~0%     {2} r1 = SCAN `DataFlowDispatch::getNextClassInMro/1#e1ee596a#prev_delta` OUTPUT In.1, In.0 'cls'
159696 ~0%     {3}    | JOIN WITH `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev` ON FIRST 1 OUTPUT Lhs.1 'cls', Rhs.1 'name', Rhs.2 'result'
125138 ~1%     {3}    | AND NOT `_Class::Class.getAMethod/0#dispred#66416e47_Function::Function.getName/0#dispred#033700ef_10#join_rh__#antijoin_rhs`(FIRST 3)

0      ~0%     {3} r2 = JOIN `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev_delta` WITH `DataFlowDispatch::getNextClassInMro/1#e1ee596a#reorder_1_0#prev` ON FIRST 1 OUTPUT Lhs.1 'name', Lhs.2 'result', Rhs.1 'cls'
               {3}    | AND NOT `_Class::Class.getAMethod/0#dispred#66416e47_DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#__#antijoin_rhs`(FIRST 3)
0      ~0%     {3}    | SCAN OUTPUT In.2 'cls', In.0 'name', In.1 'result'

125138 ~1%     {3} r3 = r1 UNION r2
125138 ~1%     {3}    | AND NOT `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev`(FIRST 3)
               return r3
```

And now
```
(18s) Tuple counts for DataFlowDispatch::class_has_method/2#0d2ae9c0/2@ff66c1lr after 18ms:
202279 ~1%     {2} r1 = JOIN `Class::Class.getAMethod/0#dispred#66416e47_10#join_rhs` WITH `Function::Function.getName/0#dispred#033700ef` ON FIRST 1 OUTPUT Lhs.1 'cls', Rhs.1 'name'
               return r1
...
(490s) Tuple counts for DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3/3@i6#48b6c1xi after 54ms:
0      ~0%     {3} r1 = JOIN `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev_delta` WITH `DataFlowDispatch::getNextClassInMro/1#e1ee596a#reorder_1_0#prev` ON FIRST 1 OUTPUT Rhs.1 'cls', Lhs.1 'name', Lhs.2 'result'
0      ~0%     {3}    | AND NOT `DataFlowDispatch::class_has_method/2#0d2ae9c0`(FIRST 2)

33363  ~0%     {2} r2 = SCAN `DataFlowDispatch::getNextClassInMro/1#e1ee596a#prev_delta` OUTPUT In.1, In.0 'cls'
159696 ~0%     {3}    | JOIN WITH `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev` ON FIRST 1 OUTPUT Lhs.1 'cls', Rhs.1 'name', Rhs.2 'result'
125138 ~1%     {3}    | AND NOT `DataFlowDispatch::class_has_method/2#0d2ae9c0`(FIRST 2)

125138 ~1%     {3} r3 = r1 UNION r2
125138 ~1%     {3}    | AND NOT `DataFlowDispatch::findFunctionAccordingToMro/2#a610c0a3#prev`(FIRST 3)
               return r3
```
2024-06-21 12:16:27 +00:00
Anders Schack-Mulligen
bbdae5188d Dataflow: Add ArgNodeEx column to fwdFlowIsEntered. 2024-06-21 14:10:37 +02:00
Anders Schack-Mulligen
fa13861e53 Dataflow: Add Debug module with stage references. 2024-06-21 14:02:07 +02:00
Mathias Vorreiter Pedersen
47309df2a9 C++: Fix 'toString' on parameter and argument positions. 2024-06-21 12:47:46 +01:00
Mathias Vorreiter Pedersen
85da3d2f13 C++: Update MaD models. 2024-06-21 12:47:43 +01:00
Mathias Vorreiter Pedersen
b0bd7a983f C++: Add MaD syntax for an arbitrary number of dereferences. 2024-06-21 12:47:42 +01:00
Mathias Vorreiter Pedersen
4dc13e850e C++: Add summaries for std dequence containers. 2024-06-21 12:47:40 +01:00
Mathias Vorreiter Pedersen
716df0c7ce C++: Support a richer language in MaD summaries for selecting member functions. 2024-06-21 12:47:39 +01:00
Mauro Baluda
b75514c990 Merge branch 'github:main' into main 2024-06-21 13:36:38 +02:00
Chris Smowton
cfb48ace73 Java: document extraction system requirements
Note that a `java` binary is at least highly recommended for Java extraction, and in many circumstances a hard requirement. The same goes for `mvn` and `gradle`.
2024-06-21 11:53:36 +01:00
Kasper Svendsen
988d0671bb Merge pull request #16734 from kaspersv/kaspersv/doc-intern-sets-builtin
Document builtin InternSets module
2024-06-21 12:06:40 +02:00