Commit Graph

19777 Commits

Author SHA1 Message Date
Geoffrey White
a5a3078b58 C++: Add a test case using a typedef int. 2020-08-27 12:11:56 +01:00
Tom Hvitved
35e1c04b93 Merge pull request #4144 from hvitved/csharp/autobuilder/vsdevcmd
C#: Teach autobuilder about `VsDevCmd.bat`
2020-08-27 12:38:49 +02:00
Geoffrey White
6f62803e1f C++: Taint tests for array and reference assignments. 2020-08-27 11:26:25 +01:00
Rasmus Wriedt Larsen
909bff2313 Python: Make import of python private in shared dataflow 2020-08-27 11:48:56 +02:00
Rasmus Wriedt Larsen
627363d6ea Python: Test taint step for string augmented assignment
Apprently it just works 😕 :magic:
2020-08-27 11:37:56 +02:00
Geoffrey White
111da4c352 C++: Add a model of std::vector::assign. 2020-08-27 10:22:31 +01:00
Rasmus Wriedt Larsen
569e54e7bb Python: Remove symlink from experimental test 2020-08-27 11:19:55 +02:00
Jonas Jensen
e949c167fa C++: Add back getSubBasicBlockStart
It turns out this predicate was used in a test, and that use can't be
replaced with the new `partiallyDefinesVariableAt` predicate since
`partiallyDefinesVariableAt` doesn't hold for a `PartialDefinition` that
defines something other than a variable.
2020-08-27 11:14:47 +02:00
Geoffrey White
0952fb9777 C++: Minor correction in one of the string models. 2020-08-27 10:13:12 +01:00
Geoffrey White
fbac4ce44f C++: Split StdStringCStr and allow reverse flow on data. 2020-08-27 10:11:03 +01:00
Geoffrey White
fbff44ea45 C++: Add reverse taint as well. 2020-08-27 10:09:51 +01:00
Geoffrey White
6ae96baaf6 C++: Model std::vector::data. 2020-08-27 10:08:58 +01:00
Geoffrey White
2235c19593 C++: Add test cases for 'assign' and extra cases for 'data'. 2020-08-27 10:08:42 +01:00
Rasmus Wriedt Larsen
d0081dfbfa Python: Attempt at taint step for list.append/set.add 2020-08-27 10:57:07 +02:00
Rasmus Wriedt Larsen
af20c3e082 Python: Make new taint tracking tests runnable again
since the files was called `collection`, that conflicted with import system :|
2020-08-27 10:44:14 +02:00
Jonas Jensen
f3e98c3bea C++: Fix join order of FlowVar::definedPartiallyAt
This predicate was very slow on kamailio/kamailio:

    (696s) Tuple counts for FlowVar::FlowVar::definedPartiallyAt_dispred#ff:
    703569     ~3%     {3} r1 = SCAN FlowVar::FlowVar_internal::TBlockVar#fff AS I OUTPUT I.<1>, I.<0>, I.<2>
    7679540588 ~3%     {3} r2 = JOIN r1 WITH FlowVar::PartialDefinitions::PartialDefinition::partiallyDefines_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r1.<1>, r1.<2>
    567217     ~2%     {2} r3 = JOIN r2 WITH project#FlowVar::PartialDefinitions::PartialDefinition#class#fff#2 AS R ON FIRST 2 OUTPUT r2.<2>, r2.<0>
                       return r3

After this change, the predicate takes no time at all:

    (22s) Tuple counts for FlowVar::FlowVar::definedPartiallyAt_dispred#ff:
    703569  ~3%     {3} r1 = SCAN FlowVar::FlowVar_internal::TBlockVar#fff AS I OUTPUT I.<1>, I.<0>, I.<2>
    567217  ~2%     {2} r2 = JOIN r1 WITH FlowVar::PartialDefinitions::PartialDefinition::partiallyDefinesVariableAt#fff_120#join_rhs AS R ON FIRST 2 OUTPUT r1.<2>, R.<2>
                    return r2

Looking at the code, it turned out that the predicates
`partiallyDefines` and `getSubBasicBlockStart` were almost always used
together and could therefore be merged into a single predicate to get
better join orderings. The predicate `partiallyDefinesThis` was never
used.
2020-08-27 09:52:22 +02:00
Jonas Jensen
2b720b332b C++: Fix join order in reachesWithoutAssignment
The negation in this predicate did not get pulled into an
`#antijoin_rhs` predicate but got materialized as part of each
iteration, which meant that the temporary `ControlFlowNode` column did
not get projected away. The tuple counts looked like this on
kamailio/kamailio (iteration 20):

    5724      ~13%      {3} r9 = JOIN r8 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r8.<2>, r8.<3>, r8.<1>
    5724      ~12%      {3} r10 = JOIN r8 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r8.<3>, r8.<2>, r8.<1>
    124717061 ~11%      {4} r11 = JOIN r10 WITH project#FlowVar::FlowVar_internal::assignmentLikeOperation#ffff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r10.<2>, r10.<1>, r10.<0>
    66        ~0%       {3} r12 = JOIN r11 WITH project#BasicBlocks::Cached::basic_block_member AS R ON FIRST 2 OUTPUT r11.<2>, r11.<3>, r11.<1>
    66                  {3} r13 = MATERIALIZE r12 AS antijoin_rhs
    5658      ~14%      {3} r14 = r9 AND NOT r13(r9.<0>, r9.<1>, r9.<2>)

After manually pulling out the join inside the negation, the time per
iteration drops from ~30 to <1s. The pipeline above is replaced with

    892394  ~0%      {4} r6 = r5 AND NOT FlowVar::FlowVar_internal::assignsToVar#fb AS R(r5.<3>, r5.<2>)
    892394  ~0%      {4} r7 = SCAN r6 OUTPUT r6.<1>, r6.<3>, r6.<0>, r6.<2>
    5658    ~11%     {3} r8 = JOIN r7 WITH BasicBlocks::Cached::bb_successor_cached#ff@staged_ext AS R ON FIRST 2 OUTPUT r7.<2>, r7.<1>, r7.<3>
2020-08-27 09:52:22 +02:00
Esben Sparre Andreasen
9aa1404646 JS: fix formatting of InsecureCookie.qll 2020-08-27 09:44:45 +02:00
Tom Hvitved
2ac732c50a C#: Teach autobuilder about VsDevCmd.bat 2020-08-27 09:05:37 +02:00
Rasmus Lerchedahl Petersen
09025c2198 Python: Fix test, update results and annotations 2020-08-27 08:40:13 +02:00
Esben Sparre Andreasen
67278d9c93 Merge pull request #4141 from esbena/js/clarify-sanitization
JS: make sanitization a "common" technique rather than "important"
2020-08-27 08:08:17 +02:00
ubuntu
736f76b685 Simplify getQueryCall 2020-08-27 02:12:17 +02:00
ubuntu
30e7f958a8 Highlight API call 2020-08-27 01:42:16 +02:00
Robert Marsh
c0edc08315 C++: Simplify non-member iterator operator models 2020-08-26 16:19:03 -07:00
Robert Marsh
994e845ab0 C++: use set literals in iterator models 2020-08-26 16:08:39 -07:00
ubuntu
7eeec0d765 Correct typo example 2020-08-27 01:07:13 +02:00
ubuntu
cbe879ae73 Correct typo examples 2020-08-27 01:05:49 +02:00
Robert Marsh
6f0cc16979 C++: remove non-existent operators from model 2020-08-26 15:52:53 -07:00
ubuntu
68ff480892 Update .qhelp 2020-08-27 00:51:08 +02:00
ubuntu
13f443d2c3 Update getLdapjsClientDNMethodName 2020-08-27 00:48:29 +02:00
Alessio Della Libera
616113aeff Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
2020-08-27 00:47:29 +02:00
ubuntu
94bd9c6d3e Rename LdapjsDN to LdapjsDNArgument and add it as Sink 2020-08-27 00:43:38 +02:00
ubuntu
7d36b3b4d2 Correct typo 2020-08-27 00:26:54 +02:00
ubuntu
2305a642eb Correct typo 2020-08-27 00:24:50 +02:00
Alessio Della Libera
23287aacee Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
2020-08-27 00:17:55 +02:00
Alessio Della Libera
f12ac8ca60 Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
2020-08-27 00:17:33 +02:00
ubuntu
cd1d50b637 Update expected output 2020-08-26 23:50:15 +02:00
Alessio Della Libera
dcf51c75e9 Update javascript/ql/src/experimental/Security/CWE-614/InsecureCookie.ql
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
2020-08-26 23:33:52 +02:00
Porcupiney Hairs
3f6eef8437 Java: add websocket reads as remote flow source.
Currently, JAX-WS reads are considered as untrusted. However, `java.net.http.WebSocket` reads are not marked as such.

This PR adds support for the same.
2020-08-27 02:45:59 +05:30
Rasmus Wriedt Larsen
bd21fc5601 Python: Autoformat 2020-08-26 20:37:48 +02:00
Rasmus Wriedt Larsen
c24e3452f5 Python: Add more expected collection taint steps 2020-08-26 20:28:33 +02:00
Rasmus Wriedt Larsen
423139bc22 Python: Add additional taint steps for iterable-unpacking 2020-08-26 20:21:15 +02:00
Esben Sparre Andreasen
d27442e846 Apply suggestions from code review
Co-authored-by: Felicity Chapman <felicitymay@github.com>
2020-08-26 20:18:54 +02:00
Rasmus Wriedt Larsen
afb160fbbb Python: Add additional taint steps for for-iteration 2020-08-26 20:18:31 +02:00
Rasmus Wriedt Larsen
e2a89aa296 Python: Add additional taint steps for copy
deepcopy was already handled somehow, don't really know how :D
2020-08-26 19:39:38 +02:00
Rasmus Wriedt Larsen
b974dadca1 Python: Add additional taint steps for containers 2020-08-26 19:39:37 +02:00
Rasmus Wriedt Larsen
b6049765a8 Python: Add a few more collection taint tests 2020-08-26 19:39:36 +02:00
Rasmus Wriedt Larsen
32f9d30136 Python: Add syntactic taint steps for json methods 2020-08-26 19:39:36 +02:00
Rasmus Wriedt Larsen
41e24ae93f Python: Add non-syntactical test for taint of json methods 2020-08-26 19:39:35 +02:00
Rasmus Wriedt Larsen
5f9aa4c3b9 Python: Restructure defaultAdditionalTaintStep tests
This makes it easier to add a new test-case, and makes it easier to work with
the existing files. It does have a downside on making it a bit more annoying
looking at TestTaint.expected, and possible longer runtime, but I think it's
still worth it.
2020-08-26 19:39:33 +02:00