Skip to content

Commit df30d22

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into xxe7
2 parents 94e190c + 762f7bf commit df30d22

File tree

798 files changed

+86628
-15986
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

798 files changed

+86628
-15986
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
"rust-lang.rust",
44
"bungcip.better-toml",
55
"github.vscode-codeql",
6+
"hbenl.vscode-test-explorer",
7+
"ms-vscode.test-adapter-converter",
68
"slevesque.vscode-zipexplorer"
79
],
810
"settings": {

‎CODEOWNERS

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@
55
/python/ @github/codeql-python
66
/ruby/ @github/codeql-ruby
77
/swift/ @github/codeql-c
8+
/java/kotlin-extractor/ @github/codeql-kotlin
9+
/java/kotlin-explorer/ @github/codeql-kotlin
810

911
# ML-powered queries
1012
/javascript/ql/experimental/adaptivethreatmodeling/ @github/codeql-ml-powered-queries-reviewers

‎config/identical-files.json

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -475,20 +475,23 @@
475475
"python/ql/lib/semmle/python/security/internal/SensitiveDataHeuristics.qll",
476476
"ruby/ql/lib/codeql/ruby/security/internal/SensitiveDataHeuristics.qll"
477477
],
478-
"ReDoS Util Python/JS/Ruby": [
478+
"ReDoS Util Python/JS/Ruby/Java": [
479479
"javascript/ql/lib/semmle/javascript/security/performance/ReDoSUtil.qll",
480480
"python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll",
481-
"ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll"
481+
"ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll",
482+
"java/ql/lib/semmle/code/java/security/performance/ReDoSUtil.qll"
482483
],
483-
"ReDoS Exponential Python/JS/Ruby": [
484+
"ReDoS Exponential Python/JS/Ruby/Java": [
484485
"javascript/ql/lib/semmle/javascript/security/performance/ExponentialBackTracking.qll",
485486
"python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll",
486-
"ruby/ql/lib/codeql/ruby/security/performance/ExponentialBackTracking.qll"
487+
"ruby/ql/lib/codeql/ruby/security/performance/ExponentialBackTracking.qll",
488+
"java/ql/lib/semmle/code/java/security/performance/ExponentialBackTracking.qll"
487489
],
488-
"ReDoS Polynomial Python/JS/Ruby": [
490+
"ReDoS Polynomial Python/JS/Ruby/Java": [
489491
"javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
490492
"python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll",
491-
"ruby/ql/lib/codeql/ruby/security/performance/SuperlinearBackTracking.qll"
493+
"ruby/ql/lib/codeql/ruby/security/performance/SuperlinearBackTracking.qll",
494+
"java/ql/lib/semmle/code/java/security/performance/SuperlinearBackTracking.qll"
492495
],
493496
"BadTagFilterQuery Python/JS/Ruby": [
494497
"javascript/ql/lib/semmle/javascript/security/BadTagFilterQuery.qll",

‎cpp/ql/lib/change-notes/2022-05-11-deprecated-analysed-string.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: deprecated
3+
---
4+
* The `AnalysedString` class in the `StringAnalysis` module has been replaced with `AnalyzedString`, to follow our style guide. The old name still exists as a deprecated alias.

‎cpp/ql/lib/semmle/code/cpp/commons/Printf.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1312,7 +1312,7 @@ class FormatLiteral extends Literal {
13121312
len =
13131313
min(int v |
13141314
v = this.getPrecision(n) or
1315-
v = this.getUse().getFormatArgument(n).(AnalysedString).getMaxLength() - 1 // (don't count null terminator)
1315+
v = this.getUse().getFormatArgument(n).(AnalyzedString).getMaxLength() - 1 // (don't count null terminator)
13161316
) and
13171317
reason = TValueFlowAnalysis()
13181318
)

‎cpp/ql/lib/semmle/code/cpp/commons/StringAnalysis.qll

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,14 @@ predicate canValueFlow(Expr fromExpr, Expr toExpr) {
2727
fromExpr = toExpr.(ConditionalExpr).getElse()
2828
}
2929

30+
/** DEPRECATED: Alias for AnalyzedString */
31+
deprecated class AnalysedString = AnalyzedString;
32+
3033
/**
31-
* An analysed null terminated string.
34+
* An analyzed null terminated string.
3235
*/
33-
class AnalysedString extends Expr {
34-
AnalysedString() {
36+
class AnalyzedString extends Expr {
37+
AnalyzedString() {
3538
this.getUnspecifiedType() instanceof ArrayType or
3639
this.getUnspecifiedType() instanceof PointerType
3740
}
@@ -41,15 +44,15 @@ class AnalysedString extends Expr {
4144
* can be calculated.
4245
*/
4346
int getMaxLength() {
44-
// take the longest AnalysedString it's value could 'flow' from; however if even one doesn't
47+
// take the longest AnalyzedString its value could 'flow' from; however if even one doesn't
4548
// return a value (this essentially means 'infinity') we can't return a value either.
4649
result =
47-
max(AnalysedString expr, int toMax |
50+
max(AnalyzedString expr, int toMax |
4851
canValueFlow*(expr, this) and toMax = expr.(StringLiteral).getOriginalLength()
4952
|
5053
toMax
5154
) and // maximum length
52-
forall(AnalysedString expr | canValueFlow(expr, this) | exists(expr.getMaxLength())) // all sources return a value (recursive)
55+
forall(AnalyzedString expr | canValueFlow(expr, this) | exists(expr.getMaxLength())) // all sources return a value (recursive)
5356
}
5457
}
5558

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 60 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1673,10 +1673,24 @@ private module Stage2 {
16731673
storeStepFwd(_, ap, tc, _, _, config)
16741674
}
16751675

1676-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
1676+
private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
16771677
storeStepCand(_, ap, tc, _, _, config)
16781678
}
16791679

1680+
private predicate validAp(Ap ap, Configuration config) {
1681+
revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
1682+
or
1683+
exists(TypedContent head, Ap tail |
1684+
consCand(head, tail, config) and
1685+
ap = apCons(head, tail)
1686+
)
1687+
}
1688+
1689+
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
1690+
revConsCand(tc, ap, config) and
1691+
validAp(ap, config)
1692+
}
1693+
16801694
pragma[noinline]
16811695
private predicate parameterFlow(
16821696
ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
@@ -2495,10 +2509,24 @@ private module Stage3 {
24952509
storeStepFwd(_, ap, tc, _, _, config)
24962510
}
24972511

2498-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
2512+
private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
24992513
storeStepCand(_, ap, tc, _, _, config)
25002514
}
25012515

2516+
private predicate validAp(Ap ap, Configuration config) {
2517+
revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
2518+
or
2519+
exists(TypedContent head, Ap tail |
2520+
consCand(head, tail, config) and
2521+
ap = apCons(head, tail)
2522+
)
2523+
}
2524+
2525+
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
2526+
revConsCand(tc, ap, config) and
2527+
validAp(ap, config)
2528+
}
2529+
25022530
pragma[noinline]
25032531
private predicate parameterFlow(
25042532
ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
@@ -3322,10 +3350,24 @@ private module Stage4 {
33223350
storeStepFwd(_, ap, tc, _, _, config)
33233351
}
33243352

3325-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
3353+
private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
33263354
storeStepCand(_, ap, tc, _, _, config)
33273355
}
33283356

3357+
private predicate validAp(Ap ap, Configuration config) {
3358+
revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
3359+
or
3360+
exists(TypedContent head, Ap tail |
3361+
consCand(head, tail, config) and
3362+
ap = apCons(head, tail)
3363+
)
3364+
}
3365+
3366+
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
3367+
revConsCand(tc, ap, config) and
3368+
validAp(ap, config)
3369+
}
3370+
33293371
pragma[noinline]
33303372
private predicate parameterFlow(
33313373
ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
@@ -3394,17 +3436,28 @@ private Configuration unbindConf(Configuration conf) {
33943436
exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
33953437
}
33963438

3397-
private predicate nodeMayUseSummary(
3398-
NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
3439+
pragma[nomagic]
3440+
private predicate nodeMayUseSummary0(
3441+
NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
33993442
) {
3400-
exists(DataFlowCallable c, AccessPathApprox apa0 |
3401-
Stage4::parameterMayFlowThrough(_, c, apa, _) and
3443+
exists(AccessPathApprox apa0 |
3444+
Stage4::parameterMayFlowThrough(_, c, _, _) and
34023445
Stage4::revFlow(n, state, true, _, apa0, config) and
34033446
Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
34043447
n.getEnclosingCallable() = c
34053448
)
34063449
}
34073450

3451+
pragma[nomagic]
3452+
private predicate nodeMayUseSummary(
3453+
NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
3454+
) {
3455+
exists(DataFlowCallable c |
3456+
Stage4::parameterMayFlowThrough(_, c, apa, config) and
3457+
nodeMayUseSummary0(n, c, state, apa, config)
3458+
)
3459+
}
3460+
34083461
private newtype TSummaryCtx =
34093462
TSummaryCtxNone() or
34103463
TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 60 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1673,10 +1673,24 @@ private module Stage2 {
16731673
storeStepFwd(_, ap, tc, _, _, config)
16741674
}
16751675

1676-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
1676+
private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
16771677
storeStepCand(_, ap, tc, _, _, config)
16781678
}
16791679

1680+
private predicate validAp(Ap ap, Configuration config) {
1681+
revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
1682+
or
1683+
exists(TypedContent head, Ap tail |
1684+
consCand(head, tail, config) and
1685+
ap = apCons(head, tail)
1686+
)
1687+
}
1688+
1689+
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
1690+
revConsCand(tc, ap, config) and
1691+
validAp(ap, config)
1692+
}
1693+
16801694
pragma[noinline]
16811695
private predicate parameterFlow(
16821696
ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
@@ -2495,10 +2509,24 @@ private module Stage3 {
24952509
storeStepFwd(_, ap, tc, _, _, config)
24962510
}
24972511

2498-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
2512+
private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
24992513
storeStepCand(_, ap, tc, _, _, config)
25002514
}
25012515

2516+
private predicate validAp(Ap ap, Configuration config) {
2517+
revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
2518+
or
2519+
exists(TypedContent head, Ap tail |
2520+
consCand(head, tail, config) and
2521+
ap = apCons(head, tail)
2522+
)
2523+
}
2524+
2525+
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
2526+
revConsCand(tc, ap, config) and
2527+
validAp(ap, config)
2528+
}
2529+
25022530
pragma[noinline]
25032531
private predicate parameterFlow(
25042532
ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
@@ -3322,10 +3350,24 @@ private module Stage4 {
33223350
storeStepFwd(_, ap, tc, _, _, config)
33233351
}
33243352

3325-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
3353+
private predicate revConsCand(TypedContent tc, Ap ap, Configuration config) {
33263354
storeStepCand(_, ap, tc, _, _, config)
33273355
}
33283356

3357+
private predicate validAp(Ap ap, Configuration config) {
3358+
revFlow(_, _, _, _, ap, config) and ap instanceof ApNil
3359+
or
3360+
exists(TypedContent head, Ap tail |
3361+
consCand(head, tail, config) and
3362+
ap = apCons(head, tail)
3363+
)
3364+
}
3365+
3366+
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
3367+
revConsCand(tc, ap, config) and
3368+
validAp(ap, config)
3369+
}
3370+
33293371
pragma[noinline]
33303372
private predicate parameterFlow(
33313373
ParamNodeEx p, Ap ap, Ap ap0, DataFlowCallable c, Configuration config
@@ -3394,17 +3436,28 @@ private Configuration unbindConf(Configuration conf) {
33943436
exists(Configuration c | result = pragma[only_bind_into](c) and conf = pragma[only_bind_into](c))
33953437
}
33963438

3397-
private predicate nodeMayUseSummary(
3398-
NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
3439+
pragma[nomagic]
3440+
private predicate nodeMayUseSummary0(
3441+
NodeEx n, DataFlowCallable c, FlowState state, AccessPathApprox apa, Configuration config
33993442
) {
3400-
exists(DataFlowCallable c, AccessPathApprox apa0 |
3401-
Stage4::parameterMayFlowThrough(_, c, apa, _) and
3443+
exists(AccessPathApprox apa0 |
3444+
Stage4::parameterMayFlowThrough(_, c, _, _) and
34023445
Stage4::revFlow(n, state, true, _, apa0, config) and
34033446
Stage4::fwdFlow(n, state, any(CallContextCall ccc), TAccessPathApproxSome(apa), apa0, config) and
34043447
n.getEnclosingCallable() = c
34053448
)
34063449
}
34073450

3451+
pragma[nomagic]
3452+
private predicate nodeMayUseSummary(
3453+
NodeEx n, FlowState state, AccessPathApprox apa, Configuration config
3454+
) {
3455+
exists(DataFlowCallable c |
3456+
Stage4::parameterMayFlowThrough(_, c, apa, config) and
3457+
nodeMayUseSummary0(n, c, state, apa, config)
3458+
)
3459+
}
3460+
34083461
private newtype TSummaryCtx =
34093462
TSummaryCtxNone() or
34103463
TSummaryCtxSome(ParamNodeEx p, FlowState state, AccessPath ap) {

0 commit comments

Comments
 (0)