Skip to content

Commit 19789fa

Browse files
author
Dave Bartolomeo
committed
Merge remote-tracking branch 'upstream/main' into semantic-scratch
2 parents c9f7904 + a274af2 commit 19789fa

File tree

544 files changed

+33736
-8833
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

544 files changed

+33736
-8833
lines changed

‎.github/workflows/ql-for-ql-build.yml

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ jobs:
1616
- uses: actions/checkout@v2
1717
- name: Find codeql
1818
id: find-codeql
19-
uses: github/codeql-action/init@erik-krogh/ql
19+
uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980
2020
with:
2121
languages: javascript # does not matter
22+
tools: latest
2223
- name: Get CodeQL version
2324
id: get-codeql-version
2425
run: |
@@ -159,7 +160,7 @@ jobs:
159160
PACK: ${{ runner.temp }}/pack
160161
- name: Hack codeql-action options
161162
run: |
162-
JSON=$(jq -nc --arg pack "${PACK}" '.resolve.queries=["--search-path", $pack] | .resolve.extractor=["--search-path", $pack] | .database.init=["--search-path", $pack]')
163+
JSON=$(jq -nc --arg pack "${PACK}" '.database."run-queries"=["--search-path", $pack] | .resolve.queries=["--search-path", $pack] | .resolve.extractor=["--search-path", $pack] | .database.init=["--search-path", $pack]')
163164
echo "CODEQL_ACTION_EXTRA_OPTIONS=${JSON}" >> ${GITHUB_ENV}
164165
env:
165166
PACK: ${{ runner.temp }}/pack
@@ -171,22 +172,25 @@ jobs:
171172
echo "paths:" > ${CONF}
172173
echo " - ${FOLDER}" >> ${CONF}
173174
echo "paths-ignore:" >> ${CONF}
174-
echo " - ql/ql/test" >> ${CONF}
175+
echo " - ql/ql/test" >> ${CONF}
176+
echo "disable-default-queries: true" >> ${CONF}
177+
echo "packs:" >> ${CONF}
178+
echo " - codeql/ql" >> ${CONF}
175179
echo "Config file: "
176180
cat ${CONF}
177181
env:
178182
CONF: ./ql-for-ql-config.yml
179183
FOLDER: ${{ matrix.folder }}
180-
181184
- name: Initialize CodeQL
182-
uses: github/codeql-action/init@erik-krogh/ql
185+
uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980
183186
with:
184187
languages: ql
185188
db-location: ${{ runner.temp }}/db
186189
config-file: ./ql-for-ql-config.yml
190+
tools: latest
187191

188192
- name: Perform CodeQL Analysis
189-
uses: github/codeql-action/analyze@erik-krogh/ql
193+
uses: github/codeql-action/analyze@aa93aea877e5fb8841bcb1193f672abf6e9f2980
190194
with:
191195
category: "ql-for-ql-${{ matrix.folder }}"
192196
- name: Copy sarif file to CWD

‎.github/workflows/ql-for-ql-dataset_measure.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626

2727
- name: Find codeql
2828
id: find-codeql
29-
uses: github/codeql-action/init@erik-krogh/ql
29+
uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980
3030
with:
3131
languages: javascript # does not matter
3232
- uses: actions/cache@v2

‎.github/workflows/ql-for-ql-tests.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
- uses: actions/checkout@v2
2121
- name: Find codeql
2222
id: find-codeql
23-
uses: github/codeql-action/init@erik-krogh/ql
23+
uses: github/codeql-action/init@aa93aea877e5fb8841bcb1193f672abf6e9f2980
2424
with:
2525
languages: javascript # does not matter
2626
- uses: actions/cache@v2

‎CONTRIBUTING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
3636

3737
For details, see the [guide on query metadata](docs/query-metadata-style-guide.md).
3838

39-
Make sure the `select` statement is compatible with the query `@kind`. See [About CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
39+
Make sure the `select` statement is compatible with the query `@kind`. See [About CodeQL queries](https://codeql.github.com/docs/writing-codeql-queries/about-codeql-queries/#select-clause) on codeql.github.com.
4040

4141
3. **Formatting**
4242

‎config/identical-files.json

Lines changed: 41 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@
2727
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
2828
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll",
2929
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll",
30-
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll"
30+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll",
31+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForLibraries.qll"
3132
],
3233
"DataFlow Java/C++/C#/Python Common": [
3334
"java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
@@ -54,7 +55,8 @@
5455
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
5556
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
5657
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll",
57-
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
58+
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
59+
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll"
5860
],
5961
"DataFlow Java/C++/C#/Python Consistency checks": [
6062
"java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
@@ -73,13 +75,9 @@
7375
"java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
7476
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
7577
],
76-
"Model as Data Generation Java/C# - Utils": [
77-
"java/ql/src/utils/model-generator/ModelGeneratorUtils.qll",
78-
"csharp/ql/src/utils/model-generator/ModelGeneratorUtils.qll"
79-
],
80-
"Model as Data Generation Java/C# - SummaryModels": [
81-
"java/ql/src/utils/model-generator/CaptureSummaryModels.qll",
82-
"csharp/ql/src/utils/model-generator/CaptureSummaryModels.qll"
78+
"Model as Data Generation Java/C# - CaptureModels": [
79+
"java/ql/src/utils/model-generator/internal/CaptureModels.qll",
80+
"csharp/ql/src/utils/model-generator/internal/CaptureModels.qll"
8381
],
8482
"Sign Java/C#": [
8583
"java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
@@ -480,11 +478,12 @@
480478
"python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll",
481479
"ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll"
482480
],
483-
"ReDoS Exponential Python/JS": [
481+
"ReDoS Exponential Python/JS/Ruby": [
484482
"javascript/ql/lib/semmle/javascript/security/performance/ExponentialBackTracking.qll",
485-
"python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll"
483+
"python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll",
484+
"ruby/ql/lib/codeql/ruby/security/performance/ExponentialBackTracking.qll"
486485
],
487-
"ReDoS Polynomial Python/JS": [
486+
"ReDoS Polynomial Python/JS/Ruby": [
488487
"javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
489488
"python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll",
490489
"ruby/ql/lib/codeql/ruby/security/performance/SuperlinearBackTracking.qll"
@@ -515,5 +514,35 @@
515514
"java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
516515
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
517516
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll"
517+
],
518+
"Concepts Python/Ruby/JS": [
519+
"python/ql/lib/semmle/python/internal/ConceptsShared.qll",
520+
"ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll",
521+
"javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll"
522+
],
523+
"Hostname Regexp queries": [
524+
"javascript/ql/src/Security/CWE-020/HostnameRegexpShared.qll",
525+
"python/ql/src/Security/CWE-020/HostnameRegexpShared.qll",
526+
"ruby/ql/src/queries/security/cwe-020/HostnameRegexpShared.qll"
527+
],
528+
"ApiGraphModels": [
529+
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
530+
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll"
531+
],
532+
"TaintedFormatStringQuery Ruby/JS": [
533+
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringQuery.qll",
534+
"ruby/ql/lib/codeql/ruby/security/TaintedFormatStringQuery.qll"
535+
],
536+
"TaintedFormatStringCustomizations Ruby/JS": [
537+
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringCustomizations.qll",
538+
"ruby/ql/lib/codeql/ruby/security/TaintedFormatStringCustomizations.qll"
539+
],
540+
"HttpToFileAccessQuery JS/Ruby": [
541+
"javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessQuery.qll",
542+
"ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll"
543+
],
544+
"HttpToFileAccessCustomizations JS/Ruby": [
545+
"javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessCustomizations.qll",
546+
"ruby/ql/lib/codeql/ruby/security/HttpToFileAccessCustomizations.qll"
518547
]
519548
}

‎cpp/ql/lib/DefaultOptions.qll

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,13 @@ class Options extends string {
5454
*
5555
* By default, this holds for `exit`, `_exit`, `abort`, `__assert_fail`,
5656
* `longjmp`, `__builtin_unreachable` and any function with a
57-
* `noreturn` attribute.
57+
* `noreturn` attribute or specifier.
5858
*/
5959
predicate exits(Function f) {
6060
f.getAnAttribute().hasName("noreturn")
6161
or
62+
f.getASpecifier().hasName("noreturn")
63+
or
6264
f.hasGlobalOrStdName([
6365
"exit", "_exit", "abort", "__assert_fail", "longjmp", "__builtin_unreachable"
6466
])

‎cpp/ql/lib/Options.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class CustomOptions extends Options {
3939
*
4040
* By default, this holds for `exit`, `_exit`, `abort`, `__assert_fail`,
4141
* `longjmp`, `error`, `__builtin_unreachable` and any function with a
42-
* `noreturn` attribute.
42+
* `noreturn` attribute or specifier.
4343
*/
4444
override predicate exits(Function f) { Options.super.exits(f) }
4545

‎cpp/ql/lib/change-notes/2022-03-14-c11-noreturn.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* `DefaultOptions::exits` now holds for C11 functions with the `_Noreturn` or `noreturn` specifier.

‎cpp/ql/lib/change-notes/2022-03-14-flow-state-barriers.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: feature
3+
---
4+
* The data flow and taint tracking libraries have been extended with versions of `isBarrierIn`, `isBarrierOut`, and `isBarrierGuard`, respectively `isSanitizerIn`, `isSanitizerOut`, and `isSanitizerGuard`, that support flow states.

‎cpp/ql/lib/semmle/code/cpp/Location.qll

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,24 @@ class Location extends @location {
7373

7474
/** Holds if `this` comes on a line strictly before `l`. */
7575
pragma[inline]
76-
predicate isBefore(Location l) {
77-
this.getFile() = l.getFile() and this.getEndLine() < l.getStartLine()
76+
predicate isBefore(Location l) { this.isBefore(l, false) }
77+
78+
/**
79+
* Holds if `this` comes strictly before `l`. The boolean `sameLine` is
80+
* true if `l` is on the same line as `this`, but starts at a later column.
81+
* Otherwise, `sameLine` is false.
82+
*/
83+
pragma[inline]
84+
predicate isBefore(Location l, boolean sameLine) {
85+
this.getFile() = l.getFile() and
86+
(
87+
sameLine = false and
88+
this.getEndLine() < l.getStartLine()
89+
or
90+
sameLine = true and
91+
this.getEndLine() = l.getStartLine() and
92+
this.getEndColumn() < l.getStartColumn()
93+
)
7894
}
7995

8096
/** Holds if location `l` is completely contained within this one. */

0 commit comments

Comments
 (0)