Commit Graph

19777 Commits

Author SHA1 Message Date
Geoffrey White
a9b953f89a CPP: Flip test output for consistency and easy comparison with the other tests. 2019-07-12 18:18:08 +01:00
Geoffrey White
cd449e1336 CPP: Change note. 2019-07-12 18:00:39 +01:00
Geoffrey White
c2fd2e273e CPP: Model taint flow through std::swap. 2019-07-12 18:00:39 +01:00
Geoffrey White
f132bca06e CPP: Add a taint flow test of 'std::swap'. 2019-07-12 16:37:01 +01:00
semmle-qlci
e1454abaf4 Merge pull request #1582 from xiemaisi/js/more-examples
Approved by asger-semmle
2019-07-12 13:01:46 +01:00
Max Schaefer
a41fb6571c JavaScript: Address review comment. 2019-07-12 10:47:55 +01:00
semmledocs-ac
e1da6e915c Merge pull request #1515 from geoffw0/continuefalseloop
CPP: Improvements to ContinueInFalseLoop.ql
2019-07-12 08:38:22 +01:00
Max Schaefer
0ad51ac273 JavaScript: Add syntax examples in Classes.qll, JSX.qll and Templates.qll. 2019-07-12 08:37:49 +01:00
Dave Bartolomeo
1b38208bab Merge pull request #1567 from jbj/ir-operand-cycles
C++ IR: guard against cycles in operand graph
2019-07-11 13:14:10 -07:00
Dave Bartolomeo
c73b516862 Merge pull request #1541 from jbj/ir-operand-exact
C++ IR: Make instruction operand getters have only exact results
2019-07-11 13:13:20 -07:00
Dave Bartolomeo
00ff2bb6c4 Merge pull request #1554 from jbj/ir-ErrorExpr
C++ IR: support for translating ErrorExpr
2019-07-11 13:05:04 -07:00
Jonas Jensen
23001d5471 Merge pull request #1566 from rdmarsh2/rdmarsh/cpp/pure-functions-effect-model
C++: alias and side effect info for pure functions
2019-07-11 21:21:54 +02:00
Geoffrey White
bfe570399a CPP: Update change note. 2019-07-11 20:06:29 +01:00
Geoffrey White
ed069fe3cc CPP: Upgrade precision/severity. 2019-07-11 20:00:50 +01:00
Geoffrey White
62fb216102 CPP: Fix false positive. 2019-07-11 20:00:50 +01:00
Geoffrey White
629d127174 CPP: QLDoc comments. 2019-07-11 20:00:50 +01:00
Geoffrey White
e1efdd7d47 CPP: Add a test where continue is used in a switch to exit the loop. 2019-07-11 20:00:50 +01:00
Geoffrey White
3337a859aa CPP: Corrections to qhelp. 2019-07-11 20:00:50 +01:00
Geoffrey White
83b0906f67 CPP: Change note. 2019-07-11 20:00:50 +01:00
Geoffrey White
4c4be2d3c2 CPP: Add (basic) qhelp. 2019-07-11 20:00:50 +01:00
Geoffrey White
8a3f8c5c1d CPP: Add precision/tags and adjust severity. 2019-07-11 20:00:50 +01:00
Geoffrey White
83d4b23ae3 CPP: Fix false positives in while/for loops. 2019-07-11 20:00:50 +01:00
Geoffrey White
136ca72297 CPP: Add a test. 2019-07-11 20:00:49 +01:00
Robert Marsh
c195420ba1 C++: respond to PR comments 2019-07-11 11:00:52 -07:00
semmle-qlci
3f464926a2 Merge pull request #1579 from adityasharad/merge/1.20-1.21
Approved by asger-semmle
2019-07-11 17:35:10 +01:00
Geoffrey White
db6be05a92 Merge pull request #1580 from jbj/inconsistent-loop-direction-perf
C++: Fix inconsistent-loop-direction performance
2019-07-11 16:39:05 +01:00
Asger F
ab00da763d JS: Autoformat 2019-07-11 16:24:09 +01:00
Asger F
ec288c1eb1 JS: Update more expected test output 2019-07-11 16:23:48 +01:00
Asger F
5124fae7b4 JS: Add a change note 2019-07-11 16:23:48 +01:00
Asger F
06e9e5ca39 JS: Make FunctionNode and ClassNode use inferred names 2019-07-11 16:23:48 +01:00
Asger F
c44a3b4735 JS: Add ClassDefinition.getInferredName 2019-07-11 16:19:11 +01:00
Asger F
eead67ac6d JS: Add Function.getInferredName() 2019-07-11 16:15:53 +01:00
semmle-qlci
40f6dc1692 Merge pull request #1578 from asger-semmle/splice
Approved by xiemaisi
2019-07-11 15:44:21 +01:00
Jonas Jensen
2324ce77ae C++ IR: Fix soundness of ConstantAnalysis
Now that `PhiInstruction.getAnInput` only has results for congruent
operands, a previous optimization I made to `getConstantValue` is no
longer sound. We have to check that all phi inputs give the same value,
not just the congruent ones. After this change, if there are any
non-congruent operands on a phi instruction, the whole aggregate will
have no result.
2019-07-11 15:51:09 +02:00
Asger F
30265537b2 Update javascript/ql/src/semmle/javascript/dataflow/Nodes.qll
Co-Authored-By: Max Schaefer <max@semmle.com>
2019-07-11 14:38:47 +01:00
Jonas Jensen
7fb43a5a03 C++ IR: getAnyDef -> getDef in RangeUtils.qll
As recommended by Dave in PR review.
2019-07-11 15:35:14 +02:00
ian-semmle
463547f810 Merge pull request #1581 from jbj/revert-noTarget-workaround
Revert "C++: Work around extractor issue CPP-383"
2019-07-11 14:26:15 +01:00
Jonas Jensen
c831c4b58e C++ IR: Fix SignAnalysis after getAnyDef -> getDef
In the `SignAnalysis` abstract interpretation, "unknown sign"
corresponds to the set of _all_ `Sign`, but using `getDef` leads to the
operand having _no_ `Sign`. To fix that, we assign all signs to inexact
operands.
2019-07-11 15:17:55 +02:00
Geoffrey White
59964bd9a4 Merge pull request #1575 from jbj/UncheckedLeapYear-bb
C++: Fix performance of unchecked leap year query
2019-07-11 13:57:07 +01:00
Jonas Jensen
ee5eaef5e4 Revert "C++: Work around extractor issue CPP-383"
The issue is now fixed in the extractor, and I've confirmed that the
workaround is no longer needed for g/an-tao/drogon.

This reverts commit 48a3385809.
2019-07-11 14:18:29 +02:00
Aditya Sharad
e8bacd2816 Merge rc/1.20 into rc/1.21. 2019-07-11 12:10:21 +01:00
Jonas Jensen
e523f93d91 C++: Fix inconsistent-loop-direction performance
This query seems to have been de-optimized by recent optimizer or stats
changes. On libretro/libretro-uae, the query took 1 second on a warm
cache with dist 89ad5f1 but took 9979 seconds with dist a3b9b6eb9.

The slowness was due to a Cartesian product in
`illDefined{Decr,Incr}ForStmt` between all the definitions and all the
uses of `Variable v`. This would be no problem with the right join
order, but that has apparently been lost. This commit factors out a pair
of `pragma[noinline]` helper predicates to make sure the definitions
(`v.getAnAssignedValue()`) and the uses (`v.getAnAccess()`) are queried
and filtered in separate predicates.

The performance problem can be seen in the tuple counts of this pipeline
I interrupted during evaluation of
`inconsistentLoopDirection::illDefinedDecrForStmt#ffff#shared`:

    89716     ~3%     {2} r1 = SCAN Variable::Variable::getAnAssignedValue_dispred#ff OUTPUT FIELDS {Variable::Variable::getAnAssignedValue_dispred#ff.<1>,Variable::Variable::getAnAssignedValue_dispred#ff.<0>}
    89716     ~0%     {3} r2 = JOIN r1 WITH DataFlowUtil::TExprNode#ff@staged_ext ON r1.<0>=DataFlowUtil::TExprNode#ff@staged_ext.<0> OUTPUT FIELDS {r1.<1>,DataFlowUtil::TExprNode#ff@staged_ext.<0>,DataFlowUtil::TExprNode#ff@staged_ext.<1>}
    502539405 ~0%     {4} r3 = JOIN r2 WITH Variable::Variable::getAnAccess_dispred#fb ON r2.<0>=Variable::Variable::getAnAccess_dispred#fb.<0> OUTPUT FIELDS {Variable::Variable::getAnAccess_dispred#fb.<1>,r2.<1>,r2.<2>,r2.<0>}
                      return r3
2019-07-11 12:09:17 +02:00
Asger F
cf23c50f0c JS: Add convenience layer
Adds getASpreadArgument() and defines getCalleeName() for reflective
calls to be the name of the property being invoked, if there is one.
2019-07-11 10:55:28 +01:00
Asger F
83908464e0 JS: more taint steps through array manipulation 2019-07-11 10:55:28 +01:00
semmle-qlci
66464b5c48 Merge pull request #1574 from xiemaisi/js/more-examples
Approved by esben-semmle
2019-07-11 08:09:59 +01:00
Robert Marsh
72f9addd0b C++: move strstr back into main pure str model 2019-07-10 12:27:04 -07:00
yh-semmle
bed1b747e7 Merge pull request #1576 from rneatherway/java/is-not-empty-null-guards-1.21
Java: Add `isNotEmpty` to NullGuards
2019-07-10 13:32:19 -04:00
Robin Neatherway
5c19e00084 Java: Add isNotEmpty to NullGuards 2019-07-10 16:04:45 +01:00
Jonas Jensen
52cfbffb95 C++ IR: Fix calls to non-existent predicates
The last commit introduced calls to two predicates that did not exist. I
created `Instruction.getResultAddress` so it now exists and changed the
other call back to use the predicate that does exist.
2019-07-10 15:18:17 +02:00
Jonas Jensen
6d87c05155 Apply suggestions from code review
Co-Authored-By: Dave Bartolomeo <42150477+dave-bartolomeo@users.noreply.github.com>
2019-07-10 15:07:44 +02:00