Commit Graph

17948 Commits

Author SHA1 Message Date
Jonas Jensen
ec85f9f1a1 Merge pull request #2797 from rdmarsh2/rdmarsh/cpp/malloc-alias-locations
C++: Support dynamic memory allocations in IR alias analysis
2020-03-02 08:49:59 +01:00
Jonas Jensen
30b5db3b7f C++: autoformat fixup 2020-03-02 08:48:54 +01:00
Jonas Jensen
bbc57878dd C++: Performance fix for large basic blocks
The code is now quadratic in the number of statements in a basic block,
whereas before it was quadratic in the number of _control-flow nodes_ in
a basic block.
2020-03-02 08:46:58 +01:00
Robert Marsh
28ee756c6a Merge pull request #2934 from geoffw0/add_tests
C++: Test and typos.
2020-02-28 15:12:32 -08:00
Rebecca Valentine
d5f689e041 Adds preliminary modernization 2020-02-28 10:42:27 -08:00
Geoffrey White
c6b0d4bbda C#: Sync identical files. 2020-02-28 17:55:59 +00:00
Geoffrey White
82191102d9 Merge pull request #2930 from jbj/getUnconverted
C++: Add Expr.getUnconverted predicate
2020-02-28 14:25:36 +00:00
Erik Krogh Kristensen
71ff32e930 recognize another prefix check for js/path-injection 2020-02-28 14:55:41 +01:00
Rasmus Wriedt Larsen
ee4190e0d9 Python: Add example if urlsplit(url).path: => missing points-to
I wanted to highlight that it's not the call to `urlsplit` that is a problem, so
that's why I inserted a `check` in-between.
2020-02-28 13:43:10 +01:00
Rasmus Wriedt Larsen
8dd19ca6cd Python: Add example of re.compile missing points-to 2020-02-28 13:41:26 +01:00
Taus Brock-Nannestad
10bacfe8fd Python: Use subscriptUnknown instead of instance check.
Also adds a test for decomposing the unknown value of `a`.
2020-02-28 13:38:54 +01:00
Esben Sparre Andreasen
a589061bee JS: add type-tracking to the fs-module and model the original-fs 2020-02-28 12:54:59 +01:00
Esben Sparre Andreasen
5a3a1c480d JS: add tests for the fs-module and friends 2020-02-28 12:21:10 +01:00
Rasmus Wriedt Larsen
2e7807718f Python: Add a bit of regex docs
and use the canonical way of specifying a ModuleValue
2020-02-28 11:45:39 +01:00
Jonas Jensen
dfe1a7e2f0 C++: Avoid iDominates* in Overflow.qll
The `iDominates` relation is directly on control-flow nodes, and its
transitive closure is far too large. It got compiled into a recursion
rather than `fastTC`, and I've observed that recursion to take about an
hour on a medium-size customer snapshot.

The fix is to check for dominance at the basic-block level.
2020-02-28 10:48:23 +01:00
Geoffrey White
4ca57db553 Merge pull request #2929 from Semmle/rc/1.23
Merge rc/1.23 into master
2020-02-28 09:30:20 +00:00
Erik Krogh Kristensen
5e0ae7b4d0 add end </p> tag 2020-02-28 10:23:03 +01:00
Jonas Jensen
0be13e45f2 Merge remote-tracking branch 'upstream/master' into MissingEnumCaseInSwitch-perf 2020-02-28 09:57:29 +01:00
Erik Krogh Kristensen
ce9cd53bf1 Merge remote-tracking branch 'upstream/master' into UselessCat 2020-02-28 09:56:23 +01:00
Erik Krogh Kristensen
d8a96dd771 change name to suggestion from previous code review 2020-02-28 09:55:15 +01:00
Erik Krogh Kristensen
922779e049 remove double a/an and adjust line lenghts 2020-02-28 09:48:07 +01:00
Erik Krogh Kristensen
17f1974e05 Apply suggestions from code review
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
2020-02-28 09:43:32 +01:00
semmle-qlci
ec90627a64 Merge pull request #2909 from yo-h/experimental
Approved by aschackmull, jbj, max-schaefer, tausbn
2020-02-28 03:15:58 +00:00
yo-h
f8bf055fe1 Merge pull request #2927 from aschackmull/java/taintgettersetter-tests
Java: Add some more taint-getter-setter tests.
2020-02-27 22:12:25 -05:00
yo-h
7dc5f9446a Merge pull request #2920 from aschackmull/java/typeflow-irrelevant-pruning
Java: Remove some irrelevant bounds from TypeFlow.
2020-02-27 22:10:32 -05:00
Rebecca Valentine
19c1ee5427 Adds preliminary modernization 2020-02-27 15:46:51 -08:00
Rebecca Valentine
9601c41fe5 Update python/ql/src/Expressions/IsComparisons.qll
Co-Authored-By: Taus <tausbn@github.com>
2020-02-27 10:46:07 -08:00
Rebecca Valentine
d19957f09d Puts use_of_apply example back into expressions_test to avoid messing up other tests 2020-02-27 10:44:46 -08:00
Dave Bartolomeo
b0fb16c068 C++/C#: Fix formatting 2020-02-27 13:44:02 -05:00
Robert Marsh
ac517b7428 Merge branch 'master' into rdmarsh/cpp/malloc-alias-locations 2020-02-27 08:55:20 -08:00
Taus Brock-Nannestad
5bbf93241b Python: Add test for tuple unpacking with "complicated" value. 2020-02-27 17:34:32 +01:00
Taus Brock-Nannestad
7a3895d661 Python: Fix points-to for a, b = some_unknown_object.
Also rewrites `multi_assignment_points_to` to be a bit more readable.

I'm not entirely sure that we want an unknown instance of `object` rather than
just `UnknownInternal`. The latter gets filtered out in the characteristic
predicate for `Value`, though, so I opted for the slightly more permissive
variant.
2020-02-27 17:26:54 +01:00
Geoffrey White
729c310eb9 C++: More typos. 2020-02-27 15:49:59 +00:00
Jonas Jensen
d686347315 C++: Optimize EnumSwitch.getAMissingCase
The `cpp/missing-case-in-switch` performed badly on some snapshots, to
the extent where it was as slow as the most expensive IR stages
(example: ChakraCore). This commit makes it faster, removing a
`pragma[noopt]` along the way.

The intermediate tuple counts on a customer codebase drop from 84M to
3M, while the content hash of `getAMissingCase` is the same.

Before:

    (124s) Tuple counts for Stmt::EnumSwitch::getAMissingCase#ff#antijoin_rhs:
    20867789 ~0%       {3} r1 = JOIN Stmt::SwitchStmt::getASwitchCase_dispred#ff AS L WITH Stmt::EnumSwitch::getAMissingCase#ff#shared AS R ON FIRST 1 OUTPUT L.<1>, R.<0>, R.<1>
    20122830 ~0%       {3} r2 = JOIN r1 WITH Stmt::SwitchCase::getExpr_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<2>
    20122830 ~0%       {3} r3 = JOIN r2 WITH Expr::Expr::getValue_dispred#ff AS R ON FIRST 1 OUTPUT r2.<2>, r2.<1>, R.<1>
    83961918 ~0%       {4} r4 = JOIN r3 WITH Enum::EnumConstant::getInitializer_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r3.<1>, r3.<0>, r3.<2>
    83961918 ~0%       {4} r5 = JOIN r4 WITH initialisers AS R ON FIRST 1 OUTPUT R.<2>, r4.<3>, r4.<1>, r4.<2>
    234348   ~185%     {2} r6 = JOIN r5 WITH Expr::Expr::getValue_dispred#ff AS R ON FIRST 2 OUTPUT r5.<2>, r5.<3>
                       return r6
    ...
    (124s) Tuple counts for Stmt::EnumSwitch::getAMissingCase#ff:
    663127 ~4%     {2} r1 = Stmt::EnumSwitch::getAMissingCase#ff#shared AS L AND NOT Stmt::EnumSwitch::getAMissingCase#ff#antijoin_rhs AS R(L.<0>, L.<1>)
                   return r1
    (124s) Registering Stmt::EnumSwitch::getAMissingCase#ff + [] with content 2060ff326cvhihcsvoph6k9divuv4
    (124s)  >>> Wrote relation Stmt::EnumSwitch::getAMissingCase#ff with 663127 rows and 2 columns.

After:

    (5s) Tuple counts for Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs:
    746029   ~0%       {2} r1 = JOIN Stmt::EnumSwitch::getAMissingCase_dispred#ff#shared AS L WITH Enum::Enum::getAnEnumConstant_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, L.<1>
    3116197  ~2%       {3} r2 = JOIN r1 WITH Enum::EnumConstant::getInitializer_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<0>
    3116197  ~0%       {3} r3 = JOIN r2 WITH initialisers AS R ON FIRST 1 OUTPUT R.<2>, r2.<1>, r2.<2>
    3116197  ~311%     {3} r4 = JOIN r3 WITH Expr::Expr::getValue_dispred#ff AS R ON FIRST 1 OUTPUT r3.<1>, R.<1>, r3.<2>
    234348   ~185%     {2} r5 = JOIN r4 WITH Stmt::EnumSwitch::matchesValue#ff AS R ON FIRST 2 OUTPUT r4.<0>, r4.<2>
                       return r5
    (5s) Registering Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs + [] with content 173483d71508vl534mvlr1g0ehi12
    (5s)  >>> Wrote relation Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs with 82902 rows and 2 columns.
    (5s) Starting to evaluate predicate Stmt::EnumSwitch::getAMissingCase_dispred#ff/2@ae4c0b
    (5s) Tuple counts for Stmt::EnumSwitch::getAMissingCase_dispred#ff:
    746029 ~2%     {2} r1 = JOIN Stmt::EnumSwitch::getAMissingCase_dispred#ff#shared AS L WITH Enum::Enum::getAnEnumConstant_dispred#ff AS R ON FIRST 1 OUTPUT L.<1>, R.<1>
    663127 ~4%     {2} r2 = r1 AND NOT Stmt::EnumSwitch::getAMissingCase_dispred#ff#antijoin_rhs AS R(r1.<0>, r1.<1>)
                   return r2
    (5s) Registering Stmt::EnumSwitch::getAMissingCase_dispred#ff + [] with content 2060ff326cvhihcsvoph6k9divuv4
    (5s)  >>> Wrote relation Stmt::EnumSwitch::getAMissingCase_dispred#ff with 663127 rows and 2 columns.
2020-02-27 16:27:52 +01:00
Geoffrey White
f8a61ffc4c C++: Expand the test as described in ODASA-640. 2020-02-27 15:26:53 +00:00
Geoffrey White
0a7d9db335 C++: Add example described in ODASA-640. 2020-02-27 15:23:16 +00:00
Geoffrey White
e6d35d314d C++: Fix typo. 2020-02-27 15:23:10 +00:00
Jonas Jensen
c9e56d13f7 C++: Add Expr.getUnconverted predicate
This gets rid of the expensive predicate
`#Cast::Conversion::getExpr_dispred#ffPlus`, I've observed to cause
memory pressure on large databases.
2020-02-27 14:52:42 +01:00
Rasmus Wriedt Larsen
24e9f65a2f Python: Fix documentation of MultiAssignmentDefinition.indexOf
As discussed in person
2020-02-27 14:12:33 +01:00
Anders Schack-Mulligen
67d386b5ba C++/C#: Add synchronization. 2020-02-27 14:10:16 +01:00
Rasmus Wriedt Larsen
4433cc044d Python: Document MultiAssignmentDefinition.indexOf 2020-02-27 13:48:43 +01:00
Asger Feldthaus
52ebe49a0b JS: Flag deep assignments in prototype pollution query 2020-02-27 12:17:55 +00:00
Taus
0da554c701 Merge pull request #2914 from RasmusWL/python-remove-optimize-true-directive
Python: Remove `--optimize: true` from options files
2020-02-27 13:16:59 +01:00
Taus
d9383d0e86 Merge pull request #2902 from RasmusWL/python-use-of-input
Python: Highlight py/use-of-input is for Python 2
2020-02-27 13:15:32 +01:00
Taus
8bd3063d2b Merge pull request #2875 from RasmusWL/python-taint-urlsplit
Python: Add taint for urlsplit
2020-02-27 13:13:47 +01:00
Asger F
b25a4614de Merge pull request #2926 from asger-semmle/js/format-everything
JS: Autoformat everything
2020-02-27 12:11:01 +00:00
Anders Schack-Mulligen
8e2b56cfd0 Java: Include count in messages. 2020-02-27 13:10:42 +01:00
Taus
e09907894d Merge pull request #2817 from BekaValentine/objectapi-to-valueapi-truncateddivision
Python: ObjectAPI to ValueAPI: TruncatedDivision
2020-02-27 12:52:26 +01:00
Erik Krogh Kristensen
a872d7c5c5 add comment about negative optionsArg 2020-02-27 12:42:22 +01:00
Erik Krogh Kristensen
bb911bbbf1 Apply suggestions from code review
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
2020-02-27 12:38:06 +01:00