Commit Graph

19777 Commits

Author SHA1 Message Date
Esben Sparre Andreasen
8a2c81b41c JS: address review comments about duplicated logic 2020-02-04 10:49:23 +01:00
Max Schaefer
43e4ed1e18 JavaScript: Teach resolveMainModule to try adding extensions. 2020-02-04 09:39:04 +00:00
Max Schaefer
e21c24c60e JavaScript: Add failing test case. 2020-02-04 09:39:04 +00:00
Esben Sparre Andreasen
e1180495f5 JS: optimize a prefix-check 2020-02-04 09:48:56 +01:00
semmle-qlci
bd51ef35b7 Merge pull request #2731 from erik-krogh/CVE527
Approved by esbena
2020-02-04 08:38:26 +00:00
Jonas Jensen
b4385c6e60 C++: Don't use GVN in AST DataFlow BarrierNode
It turns out that the evaluator will evaluate the GVN stage even when no
predicate from it is needed after optimization of the subsequent stages.
The GVN library is expensive to evaluate, and it'll become even more
expensive when we switch its implementation to IR.

This PR disables the use of GVN in `DataFlow::BarrierNode` for the AST
data-flow library, which should improve performance when evaluating a
single data-flow query on a snapshot with no cache. Precision decreases
slightly, leading to a new FP in the qltests.

There is no corresponding change for the IR data-flow library since IR
GVN is not very expensive.
2020-02-04 08:40:36 +01:00
Robert Marsh
eafd7b6045 C++: accept test output 2020-02-03 15:27:34 -08:00
Robert Marsh
677f0f090a Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams 2020-02-03 13:06:35 -08:00
Robert Marsh
931c0e982e Merge pull request #2748 from MathiasVP/value-numbering-indirection
C++: Indirection for ValueNumbering
2020-02-03 14:41:58 -05:00
Robert Marsh
f51841ac37 Merge pull request #2736 from jbj/buffer-type-size
C++: Workaround for problem with memcpy flow
2020-02-03 14:31:28 -05:00
Robert Marsh
3bfcf0bf46 Merge branch 'master' into connect-ir-dataflow-models 2020-02-03 11:06:45 -08:00
Cornelius Riemenschneider
36479d3fd6 Support to keep bounds derived on implicit integer casts. 2020-02-03 17:33:06 +01:00
Cornelius Riemenschneider
cf8efbb5a0 Add testcase. 2020-02-03 17:23:24 +01:00
Robert Marsh
2b10cd6228 Merge pull request #2737 from jbj/DefaultTaintTracking-indirect-parameters
C++: Interprocedural indirections in DefaultTaintTracking.qll
2020-02-03 11:12:38 -05:00
Esben Sparre Andreasen
bbd60f52ba JS: add additional flow steps to js/path-injection 2020-02-03 16:36:25 +01:00
Mathias Vorreiter Pedersen
8aae2990d0 C++: Formatting 2020-02-03 16:15:49 +01:00
Mathias Vorreiter Pedersen
a8b3bcb87d C++: Indirection for value numbering 2020-02-03 16:13:32 +01:00
Erik Krogh Kristensen
e3189aaa47 raise syntax error on declaration of private method, and add syntax tests for private fields 2020-02-03 16:00:25 +01:00
semmle-qlci
3a7845e7fc Merge pull request #2653 from erik-krogh/exceptionFPs
Approved by esbena
2020-02-03 14:15:24 +00:00
Rasmus Wriedt Larsen
d30e6d2b69 Python: Value::forString and friends returns StringValue 2020-02-03 14:35:09 +01:00
Rasmus Wriedt Larsen
27a7d09c94 Python: Fix minor problems in security examples 2020-02-03 14:35:09 +01:00
Rasmus Wriedt Larsen
5bc592514a Python: Consistenly use "a user-provided value"
ReflectedXss was the only query that used it with the "a"
2020-02-03 14:35:09 +01:00
Erik Krogh Kristensen
183dd68d6a add qldoc to isPrivateField 2020-02-03 14:23:27 +01:00
Cornelius Riemenschneider
1b68f86d5b Fix bug in CPP range analysis. 2020-02-03 14:16:48 +01:00
Rasmus Wriedt Larsen
cc73352bf6 Merge pull request #2549 from tausbn/python-fix-several-bad-join-orders
Python: Fix several bad join orders.
2020-02-03 13:54:36 +01:00
Calum Grant
be374816c4 C#: Distinguish between local variables extracted in different compilations. 2020-02-03 12:22:49 +00:00
Erik Krogh Kristensen
99d8b48da0 Merge pull request #2712 from asger-semmle/typescript-resolve-imports
TS: Resolve imports using TypeScript
2020-02-03 12:42:17 +01:00
Asger Feldthaus
3c1cbcefa5 TS: Pass virtual source root explicitly to Node.js process 2020-02-03 10:36:36 +00:00
Asger Feldthaus
513854a608 TS: Add upgrade script 2020-02-03 09:32:56 +00:00
Asger Feldthaus
9abf5f06e6 TS: Resolve imports using TypeScript symbols 2020-02-03 09:32:56 +00:00
Asger Feldthaus
abb95135c1 JS: Add UnresolvableImport metric 2020-02-03 09:32:56 +00:00
Erik Krogh Kristensen
5ff958a9cf fix compilation of PrototypePollutionUtility after refactor 2020-02-03 09:39:41 +01:00
Dave Bartolomeo
fd2cafa95f C++: Accept GVN test output 2020-01-31 13:36:14 -07:00
Jonas Jensen
e2da98ae24 C++: Accept autoformat and test changes 2020-01-31 20:58:53 +01:00
Robert Marsh
3e2b0328b7 C++: update test expectations post-merge 2020-01-31 11:48:51 -08:00
Robert Marsh
089dda9090 Merge branch 'buffer-type-size-test' into jbj/buffer-type-size 2020-01-31 11:31:55 -08:00
Robert Marsh
2dd368fd1f C++: add SSA test for void* buffer parameters 2020-01-31 11:31:28 -08:00
Dave Bartolomeo
e27a0fe504 C++: Prevent AliasedVirtualVariable from overlapping string literals
We were hitting a combinatorial explosion in `hasDefinitionAtRank` for functions that contain a large number of string literals. The problem was that every `Chi` instruction for `AliasedVirtualVariable` was treated as a definition of every string literal. We already mark string literals as `isReadOnly()`, but we were allowing `AliasedVirtualVariable` to define read-only locations so that the `AliasedDefinition` instruction would provide the initial definition for all string literals.

To fix this, I've introduced the new `InitializeNonLocal` instruction, which is inserted in the prologue of every function right after `AliasedDefinition`. It provides the initial definition for every non-stack memory location, including read-only locations, but is never written to anywhere else. It is the conterpart of the `AliasedUse` instruction in the function epilogue, which represents the use of all non-stack memory after the function returns. I considered renaming `AliasedUse` to `ReturnNonLocal`, to match the `InitializeXXX`/`ReturnXXX` pattern we already use for parameters and indirections, but held off to avoid unnecessary churn. Any thoughts on whether I should make this name change?

This change has a significant speedup in evaluation time for a few of our troublesome databases:
`attnam/ivan`: 13%
`awslabs/s2n`: 26%
`SinaMostafanejad/OpenRDM`: 7%
`zcoinofficial/zcoin`: 8%
2020-01-31 11:33:46 -07:00
Esben Sparre Andreasen
7f25c1bf47 JS: address doc-review comments 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
c70997febf JS: address review comments for js/unsafe-jquery-plugin 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
eaff78b37e JS: change severity to warning 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
1de1c15919 JS: minor fixups 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
2ad9b843ae JS: fix FP for js/unsafe-jquery-plugin 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
cfd567f01d JS: fix FP for js/unsafe-jquery-plugin 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
9e247921fc JS: add FP tests for js/unsafe-jquery-plugin 2020-01-31 19:33:04 +01:00
Esben Sparre Andreasen
fef918ac13 JS: add query "Unsafe jQuery plugin" 2020-01-31 19:33:04 +01:00
semmle-qlci
d995d5a4a0 Merge pull request #2716 from esbena/js/additional-koa-requests
Approved by erik-krogh
2020-01-31 18:30:42 +00:00
Anders Schack-Mulligen
7647d94068 Java: Add change note for LDAP injection query. 2020-01-31 16:48:35 +01:00
Anders Schack-Mulligen
3b81c3b95c Merge pull request #2651 from ggolawski/java-ldap-injection
Java LDAP Injection (CWE-90)
2020-01-31 16:43:52 +01:00
Geoffrey White
c24651c4f8 Merge pull request #2728 from alexet/remove-recursion
CPP: Avoid uncessary recursion in printf.qll
2020-01-31 15:38:25 +00:00