Skip to content

Commit 1158708

Browse files
aibaarsaibaars
authored
Merge pull request #684 from adityasharad/merge/1.19-next-131218
Merge rc/1.19 into next.
2 parents f1dcec8 + ce8ca59 commit 1158708

File tree

77 files changed

+9637
-992
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

77 files changed

+9637
-992
lines changed

‎change-notes/1.19/analysis-java.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,11 @@ to run queries and explore the data flow in results.
2626

2727
## Changes to QL libraries
2828

29+
* The class `ControlFlowNode` (and by extension `BasicBlock`) has until now
30+
been directly equatable to `Expr` and `Stmt`. Exploiting these equalities,
31+
for example by using casts, is now deprecated, and the conversions
32+
`Expr.getControlFlowNode()` and `Stmt.getControlFlowNode()` should be used
33+
instead.
2934
* The default set of taint sources in the `FlowSources` library is extended to
3035
cover parameters annotated with Spring framework annotations indicating
3136
remote user input from servlets. This affects all security queries, which

‎config/identical-files.json‎

Lines changed: 96 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,98 @@
11
{
2-
"C++ IR Instruction": [
3-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
4-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
5-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll"
6-
],
7-
"C++ IR IRBlock": [
8-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
9-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
10-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll"
11-
],
12-
"C++ IR IRVariable": [
13-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
14-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
15-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll"
16-
],
17-
"C++ IR FunctionIR": [
18-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/FunctionIR.qll",
19-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/FunctionIR.qll",
20-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/FunctionIR.qll"
21-
],
22-
"C++ IR Operand": [
23-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll",
24-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
25-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll"
26-
],
27-
"C++ IR IRImpl": [
28-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll",
29-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
30-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll"
31-
],
32-
"C++ IR IRSanityImpl": [
33-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRSanity.qll",
34-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRSanity.qll",
35-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRSanity.qll"
36-
],
37-
"C++ IR PrintIRImpl": [
38-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
39-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
40-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll"
41-
],
42-
"C++ SSA AliasAnalysis": [
43-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
44-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll"
45-
],
46-
"C++ SSA SSAConstruction": [
47-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
48-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll"
49-
],
50-
"C++ IR ValueNumber": [
51-
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
52-
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
53-
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll"
54-
]
2+
"DataFlow Java/C++": [
3+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll",
4+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll",
5+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
6+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
7+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
8+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplDepr.qll",
9+
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
10+
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
11+
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
12+
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll",
13+
"cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll",
14+
"cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll",
15+
"cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll",
16+
"cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll"
17+
],
18+
"DataFlow Java/C++ Common": [
19+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
20+
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
21+
"cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll"
22+
],
23+
"C++ IR Instruction": [
24+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Instruction.qll",
25+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Instruction.qll",
26+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Instruction.qll"
27+
],
28+
"C++ IR IRBlock": [
29+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRBlock.qll",
30+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRBlock.qll",
31+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRBlock.qll"
32+
],
33+
"C++ IR IRVariable": [
34+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRVariable.qll",
35+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRVariable.qll",
36+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRVariable.qll"
37+
],
38+
"C++ IR FunctionIR": [
39+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/FunctionIR.qll",
40+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/FunctionIR.qll",
41+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/FunctionIR.qll"
42+
],
43+
"C++ IR Operand": [
44+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/Operand.qll",
45+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
46+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll"
47+
],
48+
"C++ IR IRImpl": [
49+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IR.qll",
50+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IR.qll",
51+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IR.qll"
52+
],
53+
"C++ IR IRSanityImpl": [
54+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/IRSanity.qll",
55+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/IRSanity.qll",
56+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/IRSanity.qll"
57+
],
58+
"C++ IR PrintIRImpl": [
59+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/PrintIR.qll",
60+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/PrintIR.qll",
61+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/PrintIR.qll"
62+
],
63+
"C++ SSA AliasAnalysis": [
64+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll",
65+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll"
66+
],
67+
"C++ SSA SSAConstruction": [
68+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
69+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll"
70+
],
71+
"C++ IR ValueNumber": [
72+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
73+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
74+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll"
75+
],
76+
"C++ IR ConstantAnalysis": [
77+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/ConstantAnalysis.qll",
78+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/ConstantAnalysis.qll",
79+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/ConstantAnalysis.qll"
80+
],
81+
"C++ IR PrintConstantAnalysis": [
82+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/constant/PrintConstantAnalysis.qll",
83+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/constant/PrintConstantAnalysis.qll",
84+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/constant/PrintConstantAnalysis.qll"
85+
],
86+
"C++ IR ReachableBlock": [
87+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/ReachableBlock.qll",
88+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/ReachableBlock.qll"
89+
],
90+
"C++ IR PrintReachableBlock": [
91+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/PrintReachableBlock.qll",
92+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/PrintReachableBlock.qll"
93+
],
94+
"C++ IR Dominance": [
95+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/reachability/Dominance.qll",
96+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/reachability/Dominance.qll"
97+
]
5598
}

‎cpp/ql/src/filters/ImportAdditionalLibraries.ql‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,21 @@
99

1010
import cpp
1111

12-
import semmle.code.cpp.dataflow.DataFlow
13-
import semmle.code.cpp.dataflow.DataFlow2
14-
import semmle.code.cpp.dataflow.DataFlow3
15-
import semmle.code.cpp.dataflow.DataFlow4
16-
import semmle.code.cpp.dataflow.TaintTracking
12+
module ASTDataFlow {
13+
import semmle.code.cpp.dataflow.DataFlow
14+
import semmle.code.cpp.dataflow.DataFlow2
15+
import semmle.code.cpp.dataflow.DataFlow3
16+
import semmle.code.cpp.dataflow.DataFlow4
17+
import semmle.code.cpp.dataflow.TaintTracking
18+
}
19+
20+
module IRDataFlow {
21+
import semmle.code.cpp.ir.dataflow.DataFlow
22+
import semmle.code.cpp.ir.dataflow.DataFlow2
23+
import semmle.code.cpp.ir.dataflow.DataFlow3
24+
import semmle.code.cpp.ir.dataflow.DataFlow4
25+
}
26+
1727
import semmle.code.cpp.valuenumbering.HashCons
1828

1929
from File f, string tag

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DataFlow.qll‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
/**
2+
* Provides a library for local (intra-procedural) and global (inter-procedural)
3+
* data flow analysis: deciding whether data can flow from a _source_ to a
4+
* _sink_. This library differs from the one in `semmle.code.cpp.dataflow` in that
5+
* this library uses the IR (Intermediate Representation) library, which provides
6+
* a more precise semantic representation of the program, whereas the other dataflow
7+
* library uses the more syntax-oriented ASTs. This library should provide more accurate
8+
* results than the AST-based library in most scenarios.
9+
*
10+
* Unless configured otherwise, _flow_ means that the exact value of
11+
* the source may reach the sink. We do not track flow across pointer
12+
* dereferences or array indexing.
13+
*
14+
* To use global (interprocedural) data flow, extend the class
15+
* `DataFlow::Configuration` as documented on that class. To use local
16+
* (intraprocedural) data flow, invoke `DataFlow::localFlow` or
17+
* `DataFlow::LocalFlowStep` with arguments of type `DataFlow::Node`.
18+
*/
19+
import cpp
20+
21+
module DataFlow {
22+
import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl
23+
}

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DataFlow2.qll‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Provides a `DataFlow2` module, which is a copy of the `DataFlow` module. Use
3+
* this class when data-flow configurations must depend on each other. Two
4+
* classes extending `DataFlow::Configuration` should never depend on each
5+
* other, but one of them should instead depend on a
6+
* `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
7+
* `DataFlow4::Configuration`.
8+
*
9+
* See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
10+
*/
11+
import cpp
12+
13+
module DataFlow2 {
14+
import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl2
15+
16+
/**
17+
* This class exists to prevent mutual recursion between the user-overridden
18+
* member predicates of `Configuration` and the rest of the data-flow library.
19+
* Good performance cannot be guaranteed in the presence of such recursion, so
20+
* it should be replaced by using more than one copy of the data flow library.
21+
* Four copies are available: `DataFlow` through `DataFlow4`.
22+
*/
23+
private abstract
24+
class ConfigurationRecursionPrevention extends Configuration {
25+
bindingset[this]
26+
ConfigurationRecursionPrevention() { any() }
27+
28+
override predicate hasFlow(Node source, Node sink) {
29+
strictcount(Node n | this.isSource(n)) < 0
30+
or
31+
strictcount(Node n | this.isSink(n)) < 0
32+
or
33+
strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
34+
or
35+
super.hasFlow(source, sink)
36+
}
37+
}
38+
}

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DataFlow3.qll‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Provides a `DataFlow3` module, which is a copy of the `DataFlow` module. Use
3+
* this class when data-flow configurations must depend on each other. Two
4+
* classes extending `DataFlow::Configuration` should never depend on each
5+
* other, but one of them should instead depend on a
6+
* `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
7+
* `DataFlow4::Configuration`.
8+
*
9+
* See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
10+
*/
11+
import cpp
12+
13+
module DataFlow3 {
14+
import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl3
15+
16+
/**
17+
* This class exists to prevent mutual recursion between the user-overridden
18+
* member predicates of `Configuration` and the rest of the data-flow library.
19+
* Good performance cannot be guaranteed in the presence of such recursion, so
20+
* it should be replaced by using more than one copy of the data flow library.
21+
* Four copies are available: `DataFlow` through `DataFlow4`.
22+
*/
23+
private abstract
24+
class ConfigurationRecursionPrevention extends Configuration {
25+
bindingset[this]
26+
ConfigurationRecursionPrevention() { any() }
27+
28+
override predicate hasFlow(Node source, Node sink) {
29+
strictcount(Node n | this.isSource(n)) < 0
30+
or
31+
strictcount(Node n | this.isSink(n)) < 0
32+
or
33+
strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
34+
or
35+
super.hasFlow(source, sink)
36+
}
37+
}
38+
}

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/DataFlow4.qll‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
/**
2+
* Provides a `DataFlow4` module, which is a copy of the `DataFlow` module. Use
3+
* this class when data-flow configurations must depend on each other. Two
4+
* classes extending `DataFlow::Configuration` should never depend on each
5+
* other, but one of them should instead depend on a
6+
* `DataFlow2::Configuration`, a `DataFlow3::Configuration`, or a
7+
* `DataFlow4::Configuration`.
8+
*
9+
* See `semmle.code.cpp.dataflow.DataFlow` for the full documentation.
10+
*/
11+
import cpp
12+
13+
module DataFlow4 {
14+
import semmle.code.cpp.ir.dataflow.internal.DataFlowImpl4
15+
16+
/**
17+
* This class exists to prevent mutual recursion between the user-overridden
18+
* member predicates of `Configuration` and the rest of the data-flow library.
19+
* Good performance cannot be guaranteed in the presence of such recursion, so
20+
* it should be replaced by using more than one copy of the data flow library.
21+
* Four copies are available: `DataFlow` through `DataFlow4`.
22+
*/
23+
private abstract
24+
class ConfigurationRecursionPrevention extends Configuration {
25+
bindingset[this]
26+
ConfigurationRecursionPrevention() { any() }
27+
28+
override predicate hasFlow(Node source, Node sink) {
29+
strictcount(Node n | this.isSource(n)) < 0
30+
or
31+
strictcount(Node n | this.isSink(n)) < 0
32+
or
33+
strictcount(Node n1, Node n2 | this.isAdditionalFlowStep(n1, n2)) < 0
34+
or
35+
super.hasFlow(source, sink)
36+
}
37+
}
38+
}

0 commit comments

Comments
 (0)