Commit Graph

34755 Commits

Author SHA1 Message Date
Taus
5b0d92d72b Merge pull request #3464 from yoff/UnicodeEscape
Python: Handle more escapes in regexes
2020-06-10 15:47:09 +02:00
Taus
da6736df37 Merge pull request #3668 from RasmusWL/python-random-modernisations
Python: Two small modernisations
2020-06-10 15:45:07 +02:00
Geoffrey White
91b9b78c48 C++: Add a test case for CWE-114 involving pointers and references. 2020-06-10 14:09:46 +01:00
Asger Feldthaus
36c4803694 JS: Add test 2020-06-10 14:08:33 +01:00
Mathias Vorreiter Pedersen
88dabffd2b C++: Add tests that demonstrate flow through custom swap functions 2020-06-10 15:06:57 +02:00
Asger Feldthaus
07e90ff65f JS: Autoformat 2020-06-10 14:03:01 +01:00
semmle-qlci
df79f2adc5 Merge pull request #3655 from asger-semmle/js/string-ops-regexp-test-fix
Approved by esbena
2020-06-10 13:35:22 +01:00
Esben Sparre Andreasen
1d396524a3 JS: add initial version of ServerCrash.ql 2020-06-10 14:25:56 +02:00
semmle-qlci
1b8f3c4b84 Merge pull request #3657 from hvitved/dataflow/hidden-nodes
Approved by aschackmull, jbj
2020-06-10 13:22:09 +01:00
Erik Krogh Kristensen
c4f61134f1 include the source of cryptographically random number in alert message 2020-06-10 13:32:46 +02:00
semmle-qlci
22d50f009e Merge pull request #3667 from aschackmull/java/compiletimeconstant-cast-eval
Approved by aibaars
2020-06-10 12:05:42 +01:00
Bas van Schaik
bf19489501 Update CONTRIBUTING.md 2020-06-10 12:02:24 +01:00
Bas van Schaik
be48daf0d0 Update CONTRIBUTING.md 2020-06-10 11:58:38 +01:00
Erik Krogh Kristensen
7e8fd80327 use steps from InsecureRandomness, and use small-steps 2020-06-10 12:27:50 +02:00
Rasmus Wriedt Larsen
f73876e6ce Python: Modernise ShouldBeContextManager 2020-06-10 11:53:11 +02:00
Rasmus Wriedt Larsen
37cfb5400d Python: Modernise RatioOfDefinitions 2020-06-10 11:51:41 +02:00
Anders Schack-Mulligen
4b3ca13f25 Merge pull request #3491 from luchua-bc/java-insecure-smtp-ssl
Java: CWE-297 insecure JavaMail SSL configuration
2020-06-10 11:02:50 +02:00
Robert Brignull
ded5eec76a rename slow-queries.yml to exclude-slow-queries.yml 2020-06-10 09:59:31 +01:00
Anders Schack-Mulligen
c334d72f11 Java: Fix CompileTimeConstantExpr qldoc and add char cast case. 2020-06-10 10:59:10 +02:00
Erik Krogh Kristensen
9029dbacf5 refactor isAdditionalTaintStep to a utility predicate in InsecureRandomness 2020-06-10 10:55:30 +02:00
Erik Krogh Kristensen
9189f23403 add support for secure-random 2020-06-10 10:39:02 +02:00
Erik Krogh Kristensen
16ec405724 add explanations about modulo by power of 2 2020-06-10 10:38:47 +02:00
Erik Krogh Kristensen
111f6d406c introduce query to detect biased random number generators 2020-06-10 10:00:10 +02:00
Tom Hvitved
70c3ff36f8 C#: Adjust IR imports 2020-06-10 09:54:56 +02:00
Tom Hvitved
d5b8c9728c Update identifal-files.json 2020-06-10 09:40:44 +02:00
Tom Hvitved
3c8735f43f C#: Move IR code into 'experimental' folder 2020-06-10 09:37:30 +02:00
Erik Krogh Kristensen
733e04c1eb Move rest-pattern inside property-pattern step to a taint-step 2020-06-10 09:02:22 +02:00
Erik Krogh Kristensen
2f9124f754 add missing qldoc 2020-06-09 23:32:58 +02:00
luchua-bc
1fd9c7fdec Add all dependent class stubs 2020-06-09 20:12:05 +00:00
Jonas Jensen
ad401e9f21 C++: Copy and adjust Java's correctness argumnt
Instead of a vague reference to a code comment for another language, the
`controlsBlock` predicate now has the whole comment in it directly.

I've adjusted the wording so it should be reasonably correct for C/C++.
As with the other comments in this file, I don't distinguish between the
condition and its block. I think that makes the explanation clearer
without losing any detail we care about.

To make the code fit the wording of the comment, I changed the
`hasBranchEdge/2` predicate into `getBranchSuccessor/1`.
2020-06-09 20:53:56 +02:00
Erik Krogh Kristensen
eb00da5b31 improve readability
Co-authored-by: Asger F <asgerf@github.com>
2020-06-09 20:02:46 +02:00
Asger Feldthaus
a923a404ab JS: Explicitly handle export declarations in PackageExports 2020-06-09 18:28:15 +01:00
Asger Feldthaus
806c9a372e JS: Resolve package.json main module differently 2020-06-09 18:28:15 +01:00
Erik Krogh Kristensen
b8a9ac39f4 add lValueFlowStep for rest-pattern nested inside a property-pattern (and removed old incorrect approach) 2020-06-09 18:16:00 +02:00
Erik Krogh Kristensen
b6e0e6645f Merge pull request #3645 from erik-krogh/infExposure
JS: add query to detect accidential leak of private files
2020-06-09 17:38:31 +02:00
Erik Krogh Kristensen
a7f6f045d2 add taint-steps for copying properties of an object 2020-06-09 17:16:13 +02:00
Erik Krogh Kristensen
7050d9d7bb remove dead FlowLabel 2020-06-09 17:15:55 +02:00
Erik Krogh Kristensen
2af8739bb6 simplify web.DefinePlugin sink 2020-06-09 17:15:35 +02:00
Erik Krogh Kristensen
90596167b1 add taint-step for Array.reduce 2020-06-09 17:15:00 +02:00
Mathias Vorreiter Pedersen
06066f0c5b Merge pull request #3659 from jbj/getFieldSizeOfClass-perf
C++: Performance tweak for 1-field struct loads
2020-06-09 15:53:19 +02:00
Erik Krogh Kristensen
be71ddf7bb introduce basic BuildArtifactLeak query 2020-06-09 15:27:55 +02:00
Erik Krogh Kristensen
896a9b05f6 refactor CleartextLogging to allow for reuse 2020-06-09 15:03:07 +02:00
Jonas Jensen
a341912da9 C++: Performance tweak for 1-field struct loads
On kamailio/kamailio the `DataFlowUtil::simpleInstructionLocalFlowStep`
predicate was slow because of the case for single-field structs, where
there was a large tuple-count bulge when joining with
`getFieldSizeOfClass`:

    3552902   ~2%       {2} r1 = SCAN Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff AS I OUTPUT I.<1>, I.<0>
    2065347   ~2%       {2} r35 = JOIN r1 WITH Operand::NonPhiMemoryOperand::getAnyDef_dispred#3#ff AS R ON FIRST 1 OUTPUT r1.<1>, R.<1>
    2065827   ~2%       {3} r36 = JOIN r35 WITH Instruction::Instruction::getResultType_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r35.<1>, r35.<0>
    2065825   ~3%       {3} r37 = JOIN r36 WITH Type::Type::getSize_dispred#ff AS R ON FIRST 1 OUTPUT r36.<1>, r36.<2>, R.<1>
    2068334   ~2%       {4} r38 = JOIN r37 WITH Instruction::Instruction::getResultType_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r37.<2>, r37.<0>, r37.<1>
    314603817 ~0%       {3} r39 = JOIN r38 WITH DataFlowUtil::getFieldSizeOfClass#fff_120#join_rhs AS R ON FIRST 2 OUTPUT r38.<3>, R.<2>, r38.<2>
    8         ~0%       {2} r40 = JOIN r39 WITH Instruction::Instruction::getResultType_dispred#3#ff AS R ON FIRST 2 OUTPUT r39.<2>, r39.<0>

That's 314M tuples.

Strangely, there is no such bulge on more well-behaved snapshots like
mysql/mysql-server.

With this commit the explosion is gone:

    ...
    2065825  ~0%       {4} r37 = JOIN r36 WITH Type::Type::getSize_dispred#ff AS R ON FIRST 1 OUTPUT r36.<0>, R.<1>, r36.<1>, r36.<2>
    1521     ~1%       {3} r38 = JOIN r37 WITH DataFlowUtil::getFieldSizeOfClass#fff_021#join_rhs AS R ON FIRST 2 OUTPUT r37.<2>, R.<2>, r37.<3>
    8        ~0%       {2} r39 = JOIN r38 WITH Instruction::Instruction::getResultType_dispred#3#ff AS R ON FIRST 2 OUTPUT r38.<0>, r38.<2>
2020-06-09 14:50:02 +02:00
Rasmus Wriedt Larsen
bacd491875 Python: Fix isSequence() and isMapping() 2020-06-09 14:21:02 +02:00
Anders Schack-Mulligen
f77f486c6b Merge pull request #3438 from artem-smotrakov/unsafe-tls
Java: Added a query for unsafe TLS versions
2020-06-09 14:07:17 +02:00
Rasmus Wriedt Larsen
846101d295 Python: Extend isSequence/isMapping test with custom classes 2020-06-09 14:04:14 +02:00
Tom Hvitved
a371205db1 Data flow: Sync files 2020-06-09 13:55:12 +02:00
Tom Hvitved
8c9f85d04f Data flow: Allow nodes to be hidden from path explanations 2020-06-09 13:53:19 +02:00
Erik Krogh Kristensen
b510e470b1 support rest-patterns inside property patterns 2020-06-09 13:28:56 +02:00
Erik Krogh Kristensen
c580ada527 Merge pull request #3643 from erik-krogh/yargs
JS: extend support for yargs for js/indirect-command-line-injection
2020-06-09 13:17:28 +02:00