Commit Graph

17948 Commits

Author SHA1 Message Date
Erik Krogh Kristensen
9f1b3d61b9 add test for numeric separators 2020-09-21 10:50:06 +02:00
Erik Krogh Kristensen
b09015380a add support for String.prototype.replaceAll 2020-09-21 10:50:04 +02:00
Erik Krogh Kristensen
0dbdbfa659 bump extractor version 2020-09-21 10:49:50 +02:00
Erik Krogh Kristensen
87d4e13584 added support for ES2021 assignment operators 2020-09-21 10:49:50 +02:00
Erik Krogh Kristensen
9e7a1934ea add express and HTTP to change-notes 2020-09-21 10:45:43 +02:00
Erik Krogh Kristensen
4dfc0680e2 support non SourceNode receiver for partialInvoke in routeHandlerStep 2020-09-21 10:42:19 +02:00
Erik Krogh Kristensen
4cde48cfb8 change comma to dot in qldoc 2020-09-21 10:23:21 +02:00
Erik Krogh Kristensen
edebbd640e revert change to return-type 2020-09-21 10:18:22 +02:00
Mathias Vorreiter Pedersen
6dd7675a97 Update cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
Co-authored-by: Jonas Jensen <jbj@github.com>
2020-09-21 09:31:30 +02:00
Erik Krogh Kristensen
6c050d3160 revert change of return-type 2020-09-20 22:21:42 +02:00
Erik Krogh Kristensen
ae228cb5b2 move new predicates to a more fitting location 2020-09-20 22:15:03 +02:00
Erik Krogh Kristensen
5fd4c7a422 use PartialInvokeNode 2020-09-20 22:06:48 +02:00
Erik Krogh Kristensen
bef09254ee rename forwardingCall to isAForwardingRouteHandlerCall 2020-09-20 21:59:33 +02:00
Erik Krogh Kristensen
62332121b2 remove getNumParameter constraint 2020-09-20 21:57:55 +02:00
Erik Krogh Kristensen
3aaa2d11a7 rename decoratedRouteHandler to isDecoratedCall 2020-09-20 21:54:56 +02:00
Rasmus Lerchedahl Petersen
9aa0cfb35c Python: class callable -> class call
Only have one type of callable, but have an extra type of call.
A constructor call directs to an init callable
(should also handle `call` overrides at some point).
2020-09-19 22:27:11 +02:00
Rasmus Lerchedahl Petersen
b2f1c435a8 Python: update test expectations 2020-09-19 22:27:11 +02:00
Rasmus Lerchedahl Petersen
e132361736 Python: Add missing .expected file 2020-09-19 22:27:11 +02:00
Rasmus Lerchedahl Petersen
e50b66554d Python: Add explorative test 2020-09-19 22:27:10 +02:00
Rasmus Lerchedahl Petersen
aa28167177 Python: Add malloc nodes 2020-09-19 22:27:10 +02:00
Rasmus Lerchedahl Petersen
27b25565ca Python: Implement field-stores, -reads, and -content 2020-09-19 22:27:10 +02:00
Rasmus Lerchedahl Petersen
a2d006fe47 Python: Tests for field flow 2020-09-19 22:27:10 +02:00
Robert Marsh
6b3557ec58 C++: cache localAdditionalTaintStep 2020-09-18 15:42:14 -07:00
Robert Marsh
bc3e74f7d6 Merge branch 'main' into rdmarsh2/cpp/ir-qualifier-flow
Fix test conflicts
2020-09-18 15:40:43 -07:00
Robert Marsh
12be90a6af C++: remove unneeded cast 2020-09-18 15:00:01 -07:00
Robert Marsh
c179a07fc7 C++: fix constructor models 2020-09-18 14:43:39 -07:00
Robert Marsh
bd7f5a41d1 C++: autoformat 2020-09-18 14:19:29 -07:00
Robert Marsh
b84bf5e9bb C++: QLDoc for IteratorPartialDefinitionNode 2020-09-18 14:18:38 -07:00
Robert Marsh
107e9770da C++: remove accidentally committed test code 2020-09-18 14:12:33 -07:00
Tom Hvitved
d867172d27 Merge pull request #4300 from hvitved/csharp/runtime-checks-bypass-bad-magic
C#: Avoid bad magic in `RuntimeChecksBypass.ql`
2020-09-18 19:40:34 +02:00
Taus Brock-Nannestad
11c85f0fb5 Python: Clean up various jump/local data flow steps
Removes steps from `ModuleVariableNode`s from `essaFlowStep`, and
instead puts them only in `jumpStep`. This cleans up the logic a bit.

This slightly broke the type tracker implementation (as it relied on
`essaFlowStep` being fairly liberal), so I have rewritten it to
explicitly rely on just familiar predicates for local and jump steps.

Additionally, we disallow Essa-to-Essa steps where exactly one of the
two nodes corresponds to a global variable (i.e. only local-local and
global-global steps).
2020-09-18 18:14:47 +02:00
Mathias Vorreiter Pedersen
53da751b15 C++: Accept tests 2020-09-18 17:12:27 +02:00
Mathias Vorreiter Pedersen
b6b17fe95e C++: Add a read and store step that replace ArrayContent with FieldContent when we realize that the target of a store is a field. 2020-09-18 17:12:09 +02:00
Joe
9baf2b9eff Fix cartesian product 2020-09-18 15:42:03 +01:00
Tom Hvitved
dff9f8264b Merge pull request #4296 from hvitved/csharp/useless-upcast-nomagic
C#: Avoid bad magic in `UselessUpcast.ql`
2020-09-18 16:24:20 +02:00
Joe
abb1731be7 Java: Simplify the implementation of ExecTainted 2020-09-18 15:21:03 +01:00
Anders Schack-Mulligen
b3bf570fb7 Merge pull request #4301 from lcartey/java/update-cwe-claims
Java: Update some CWE claims
2020-09-18 16:08:40 +02:00
Joe
3cc38feebc Fix a couple of typos in QLDoc comments 2020-09-18 14:51:38 +01:00
Mathias Vorreiter Pedersen
b4edbe4773 Merge pull request #4298 from MathiasVP/field-conflation-with-array-content
C++: Add test demonstrating field conflation after merging #4230
2020-09-18 15:16:33 +02:00
Anders Schack-Mulligen
4f9d2f118d Merge pull request #4288 from joefarebrother/printAST-java
Java: Add a container node for Imports in the PrintAst view
2020-09-18 14:17:26 +02:00
Tom Hvitved
aac2e0ebfb C#: Avoid bad magic in RuntimeChecksBypass.ql
Before:

```
[2020-09-18 14:03:57] (2587s) Tuple counts for RuntimeChecksBypass::uncheckedWrite#bbf#antijoin_rhs#1:
                      1270       ~8%     {2} r1 = SCAN RuntimeChecksBypass::uncheckedWrite#bbf#shared AS I OUTPUT I.<1>, I.<0>
                      188197390  ~0%     {3} r2 = JOIN r1 WITH #Callable::Callable::calls_dispred#bfPlus AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<0>
                      2425784042 ~1%     {3} r3 = JOIN r2 WITH Expr::Expr::getEnclosingCallable_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r2.<1>, R.<1>, r2.<2>
                      58         ~9%     {2} r4 = JOIN r3 WITH project#RuntimeChecksBypass::checkedWrite#bfff AS R ON FIRST 2 OUTPUT r3.<0>, r3.<2>
                                         return r4
```

After:

```
[2020-09-18 14:08:48] (5s) Tuple counts for RuntimeChecksBypass::uncheckedWrite#fff#antijoin_rhs:
                      24704473 ~2%      {2} r1 = SCAN DataFlowPublic::localExprFlow#ff AS I OUTPUT I.<1>, I.<0>
                      23784154 ~6%      {4} r2 = JOIN r1 WITH Expr::Expr::getEnclosingCallable_dispred#ff AS R ON FIRST 1 OUTPUT r1.<1>, 28, R.<0>, R.<1>
                      201391   ~2%      {2} r3 = JOIN r2 WITH expressions AS R ON FIRST 2 OUTPUT r2.<2>, r2.<3>
                      23784154 ~0%      {3} r4 = JOIN r1 WITH Expr::Expr::getEnclosingCallable_dispred#ff AS R ON FIRST 1 OUTPUT r1.<1>, R.<0>, R.<1>
                      1065242  ~20%     {2} r5 = JOIN r4 WITH expr_value AS R ON FIRST 1 OUTPUT r4.<1>, r4.<2>
                      1266633  ~16%     {2} r6 = r3 \/ r5
                                        return r6
```
2020-09-18 14:15:30 +02:00
Jonas Jensen
6463a94258 Merge pull request #4297 from github/igfoo/compileTimeConstantInt
C++: Improve `compileTimeConstantInt`
2020-09-18 13:58:16 +02:00
lcartey@github.com
2c6f587ee9 Java: Add coverage claim for CWE 193 (off by one) 2020-09-18 12:51:24 +01:00
lcartey@github.com
39200566c3 Java: Update CWE claims for XXE.
This matches the claims in the C# equivalent.
2020-09-18 12:30:52 +01:00
Mathias Vorreiter Pedersen
b40941b89c C++: Add test demonstrating field conflation after merging #4230 2020-09-18 13:23:23 +02:00
Tom Hvitved
4090859207 C#: Avoid bad magic in UselessUpcast.ql 2020-09-18 12:14:52 +02:00
Joe
3258134098 Java: Remove superfluous conjunct 2020-09-18 10:41:06 +01:00
lcartey@github.com
32f43a84be Java: Add CWE 564 (SQL Injection: Hibernate) 2020-09-18 10:20:21 +01:00
Jonas Jensen
c67605f15c Merge pull request #4230 from MathiasVP/mathiasvp/array-field-flow
C++: Replace `field -> object` taint rule with `ArrayContent` dataflow
2020-09-18 10:56:51 +02:00
Mathias Vorreiter Pedersen
8c615ece8a Merge pull request #4292 from MathiasVP/mathiasvp/cache-simpleLocalFlowStep
C++: Cache simpleLocalFlowStep instead of simpleInstructionLocalFlowStep
2020-09-18 10:18:21 +02:00