Commit Graph

17948 Commits

Author SHA1 Message Date
Robert Marsh
413c845e97 Merge branch 'main' into rdmarsh2/cpp/output-iterators-2
Accept test changes for unnamed elements
2020-10-20 15:22:08 -07:00
Rasmus Lerchedahl Petersen
383d846396 Python: address review
- smooth out future merge
- keyword argument for execute
2020-10-21 00:15:05 +02:00
Rasmus Lerchedahl Petersen
e1dfbc0486 Python: address review 2020-10-20 23:59:44 +02:00
Dave Bartolomeo
98e0ae4865 Add tests for member accesses on temporary objects 2020-10-20 17:35:12 -04:00
Dave Bartolomeo
08af0803ff Add examples to QLDoc comment 2020-10-20 17:34:46 -04:00
Erik Krogh Kristensen
3306b59a14 Update python/ql/src/semmle/python/PrintAst.qll
Co-authored-by: yoff <lerchedahl@gmail.com>
2020-10-20 23:19:47 +02:00
Aditya Sharad
f7bd835dd8 JavaScript: Include .github hidden folders in autobuild
These folders are likely to contain GitHub-specific YAML files, such as Actions workflow configurations.
Including them by default allows analysis of such code without further configuration.
User-configured exclusions will still be respected for these folders.
2020-10-20 12:56:07 -07:00
yoff
01845d1278 Update python/ql/src/experimental/semmle/python/frameworks/Django.qll
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
2020-10-20 21:43:15 +02:00
Dave Bartolomeo
c739f98f7d Merge remote-tracking branch 'upstream/main' into work 2020-10-20 13:42:42 -04:00
Dave Bartolomeo
8c8daa38ec Update stats 2020-10-20 13:41:52 -04:00
Erik Krogh Kristensen
996488511c Merge pull request #4520 from erik-krogh/LessTests
JS: Aggregate tests cases
2020-10-20 19:03:47 +02:00
Dave Bartolomeo
4ba281731c Fix IR generation for member access with a prvalue on the RHS
For historical reasons, the extractor marks the temporary object expression used as the qualifier of a member access as a prvalue(load), even though the current C++ standard says that the temporary object materialization results in a glvalue. Added some special handling to ignore the load for both field accesses and member function calls.

This fixes all of the consistency failures in our regular tests, and all of the related failures in `syntax-zoo` other than the ones that deal with pointers-to-member, which aren't really supported yet anyway.
2020-10-20 12:53:47 -04:00
Geoffrey White
17ff34267a C++: Resolve the overlap. 2020-10-20 17:47:49 +01:00
Geoffrey White
7db2b2ce37 C++: Make the two queries more alike. 2020-10-20 17:46:47 +01:00
Geoffrey White
4630c69950 C++: Add a test case resembling the example from ODASA-3940. 2020-10-20 17:39:32 +01:00
Geoffrey White
857a4d8a3f C++: Merge the two tests, so that overlaps are obvious. 2020-10-20 17:33:15 +01:00
Rasmus Wriedt Larsen
6053157b09 Python: Fix QLDoc to not mention sudo method on fabric Group 2020-10-20 17:30:09 +02:00
Taus Brock-Nannestad
0e2ec0dfb4 Python: Remove cartesian product in TKwOverflowNode
With CP:

(0s) Tuple counts for dom#DataFlowPublic::TKwOverflowNode#ff:
1209    ~0%       {2} r1 = JOIN project#AstGenerated::Function_::getKwarg_dispred#ff AS L WITH ObjectAPI::CallableValue::getScope_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, L.<0>
4329    ~0%       {3} r2 = JOIN r1 WITH DataFlowPrivate::ArgumentPassing::connects#bb_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<0>
7819    ~2%       {4} r3 = JOIN r2 WITH Flow::CallNode::getArgByName_dispred#fff AS R ON FIRST 1 OUTPUT r2.<1>, r2.<2>, r2.<0>, R.<1>
7114    ~1%       {4} r4 = r3 AND NOT Function::Function::getArgByName_dispred#fff_01#antijoin_rhs AS R(r3.<0>, r3.<3>)
7114    ~76%      {2} r5 = SCAN r4 OUTPUT r4.<2>, r4.<1>
1123    ~0%       {1} r6 = JOIN project#Exprs::Call::getKwargs_dispred#ff AS L WITH py_flow_bb_node_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
1123    ~0%       {1} r7 = JOIN r6 WITH Flow::CallNode#class#f AS R ON FIRST 1 OUTPUT r6.<0>
1357707 ~0%       {2} r8 = JOIN r7 WITH project#AstGenerated::Function_::getKwarg_dispred#ff AS R CARTESIAN PRODUCT OUTPUT R.<0>, r7.<0>
1357707 ~0%       {2} r9 = JOIN r8 WITH ObjectAPI::CallableValue::getScope_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r8.<1>, R.<1>
1364821 ~0%       {2} r10 = r5 \/ r9
                  return r10

Without CP:

(13s) Tuple counts for dom#DataFlowPublic::TKwOverflowNode#ff:
1209    ~0%       {2} r1 = JOIN project#AstGenerated::Function_::getKwarg_dispred#ff AS L WITH ObjectAPI::CallableValue::getScope_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, L.<0>
19175   ~4%       {3} r2 = JOIN r1 WITH DataFlowPrivate::ArgumentPassing::connects#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<0>
7819    ~2%       {4} r3 = JOIN r2 WITH Flow::CallNode::getArgByName_dispred#fff AS R ON FIRST 1 OUTPUT r2.<1>, r2.<2>, r2.<0>, R.<1>
7114    ~1%       {4} r4 = r3 AND NOT Function::Function::getArgByName_dispred#fff_01#antijoin_rhs AS R(r3.<0>, r3.<3>)
7114    ~76%      {2} r5 = SCAN r4 OUTPUT r4.<2>, r4.<1>
1123    ~0%       {1} r6 = JOIN project#Exprs::Call::getKwargs_dispred#ff AS L WITH py_flow_bb_node_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>
574     ~0%       {2} r7 = JOIN r6 WITH DataFlowPrivate::ArgumentPassing::connects#ff AS R ON FIRST 1 OUTPUT R.<1>, r6.<0>
524     ~1%       {3} r8 = JOIN r7 WITH ObjectAPI::CallableValue::getScope_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r7.<1>, r7.<0>
291     ~0%       {2} r9 = JOIN r8 WITH project#AstGenerated::Function_::getKwarg_dispred#ff AS R ON FIRST 1 OUTPUT r8.<1>, r8.<2>
7405    ~72%      {2} r10 = r5 \/ r9
                  return r10
2020-10-20 17:29:26 +02:00
Rasmus Wriedt Larsen
cd116fc5f2 Python: Fix grammar in QLDoc
Co-authored-by: yoff <lerchedahl@gmail.com>
2020-10-20 17:26:33 +02:00
Geoffrey White
a372578571 C++: Move the SizeCheck*.ql tests to the standard location. 2020-10-20 16:02:54 +01:00
Erik Krogh Kristensen
bdbc8f5c91 add support for OptionalUse in js/missing-await 2020-10-20 16:52:57 +02:00
Geoffrey White
8198b96eb2 C++: Add test cases. 2020-10-20 15:33:57 +01:00
Dave Bartolomeo
735c657326 IR consistency checks for FieldAddress and this arguments that are not actually addresses.
Exposes failures in existing tests. Also added a small test case for `FieldAddress` on a prvalue.
2020-10-20 10:32:28 -04:00
Geoffrey White
540af7866c C++: Test spacing. 2020-10-20 15:23:15 +01:00
CodeQL CI
7ea8652f49 Merge pull request #4521 from erik-krogh/moreMiddle
Approved by asgerf
2020-10-20 07:14:14 -07:00
Geoffrey White
cbf55ce51a Merge branch 'main' into intmultlong 2020-10-20 14:55:53 +01:00
Asger Feldthaus
5436bb154a JS: Mention Xss.ql in change note 2020-10-20 14:49:20 +01:00
Rasmus Wriedt Larsen
6920f3012c Python: Django route handlers in different file now works
Fixed by https://github.com/github/codeql/pull/4514
2020-10-20 15:41:14 +02:00
Rasmus Wriedt Larsen
c8441dc4fb Merge branch 'main' into python-model-django-sources 2020-10-20 15:38:20 +02:00
Erik Krogh Kristensen
e061c6a006 add support for more custom CSRF checking middlewares 2020-10-20 15:16:14 +02:00
yoff
17155b64f5 Merge pull request #4514 from tausbn/python-add-module-boundary-flow-steps
Python: Add module boundary flow steps
2020-10-20 14:36:10 +02:00
Chris Smowton
af6da85ec9 Remove dead LoggerType class
This appears to have been factored into Loggers.qll but left lying around.
2020-10-20 13:32:11 +01:00
Erik Krogh Kristensen
05d4858d4f autoformat 2020-10-20 14:27:09 +02:00
CodeQL CI
d2282fc474 Merge pull request #4517 from erik-krogh/logAssign
Approved by esbena
2020-10-20 05:24:49 -07:00
Erik Krogh Kristensen
1096cb0708 aggregate the tests in library-tests/InterProceduralFlow into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
234cb5c67a aggregate the tests in library-tests/JSLint into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
6b86b53a2c aggregate the tests in library-tests/LocalObjects into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
3e3e9de45f aggregate the tests in library-tests/TaintBarriers into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
f8d38227e8 aggregate the tests in library-tests/TypeInference/AnalyzedModule into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
036187cd70 aggregate the tests in library-tests/Util into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
90bb38b522 aggregate the tests in library-tests/variables into a single .ql file 2020-10-20 14:08:55 +02:00
Erik Krogh Kristensen
2707531ddd aggregate the tests in library-tests/Closure into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
15fe0bc38a aggregate the tests in library-tests/Comprehensions into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
0ac55bd521 aggregate the tests in library-tests/Flow into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
b43e21a4c7 aggregate the tests in library-tests/HTML/HTMLElementAndHTMLAttribute into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
003854ebe7 aggregate the tests in library-tests/SensitiveActions into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
d678cc17ba aggregate the tests in library-tests/Templates into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
ad7844a6ac aggregate the tests in library-tests/ClassNode into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
5d401f98a3 aggregate the tests in library-tests/Externs into a single .ql file 2020-10-20 14:08:54 +02:00
Erik Krogh Kristensen
e461c92708 aggregate the tests in library-tests/JSX into a single .ql file 2020-10-20 14:08:54 +02:00