Skip to content

Commit 4c31c03

Browse files
author
Dave Bartolomeo
committed
Merge from master 
2 parents 4362bdb + b5f3d77 commit 4c31c03

File tree

66 files changed

+5174
-2380
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

66 files changed

+5174
-2380
lines changed

‎change-notes/1.24/analysis-java.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,11 @@ The following changes in version 1.24 affect Java analysis in all applications.
1010

1111
| **Query** | **Tags** | **Purpose** |
1212
|-----------------------------|-----------|--------------------------------------------------------------------|
13-
| Disabled Spring CSRF protection (`java/spring-disabled-csrf-protection`) | security, external/cwe/cwe-352 | Finds disabled Cross-Site Request Forgery (CSRF) protection in Spring. |
13+
| Disabled Spring CSRF protection (`java/spring-disabled-csrf-protection`) | security, external/cwe/cwe-352 | Finds disabled Cross-Site Request Forgery (CSRF) protection in Spring. Results are shown on LGTM by default. |
1414
| Failure to use HTTPS or SFTP URL in Maven artifact upload/download (`java/maven/non-https-url`) | security, external/cwe/cwe-300, external/cwe/cwe-319, external/cwe/cwe-494, external/cwe/cwe-829 | Finds use of insecure protocols during Maven dependency resolution. Results are shown on LGTM by default. |
15+
| LDAP query built from user-controlled sources (`java/ldap-injection`) | security, external/cwe/cwe-090 | Finds LDAP queries vulnerable to injection of unsanitized user-controlled input. Results are shown on LGTM by default. |
1516
| Left shift by more than the type width (`java/lshift-larger-than-type-width`) | correctness | Finds left shifts of ints by 32 bits or more and left shifts of longs by 64 bits or more. Results are shown on LGTM by default. |
16-
| Suspicious date format (`java/suspicious-date-format`) | correctness | Finds date format patterns that use placeholders that are likely to be incorrect. |
17+
| Suspicious date format (`java/suspicious-date-format`) | correctness | Finds date format patterns that use placeholders that are likely to be incorrect. Results are shown on LGTM by default. |
1718

1819
## Changes to existing queries
1920

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@
4242
| Expression has no effect (`js/useless-expression`) | Fewer false positive results | The query now recognizes block-level flow type annotations and ignores the first statement of a try block. |
4343
| Use of call stack introspection in strict mode (`js/strict-mode-call-stack-introspection`) | Fewer false positive results | The query no longer flags expression statements. |
4444
| Missing CSRF middleware (`js/missing-token-validation`) | Fewer false positive results | The query reports fewer duplicates and only flags handlers that explicitly access cookie data. |
45+
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional ways dangerous paths can be constructed. |
4546

4647
## Changes to libraries
4748

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ private import cpp
66
private import semmle.code.cpp.ir.IR
77
private import semmle.code.cpp.controlflow.IRGuards
88
private import semmle.code.cpp.ir.ValueNumbering
9+
private import semmle.code.cpp.models.interfaces.DataFlow
910

1011
/**
1112
* A newtype wrapper to prevent accidental casts between `Node` and
@@ -289,6 +290,51 @@ private predicate simpleInstructionLocalFlowStep(Instruction iFrom, Instruction
289290
// Flow through the partial operand belongs in the taint-tracking libraries
290291
// for now.
291292
iTo.getAnOperand().(ChiTotalOperand).getDef() = iFrom
293+
or
294+
// Flow through modeled functions
295+
modelFlow(iFrom, iTo)
296+
}
297+
298+
private predicate modelFlow(Instruction iFrom, Instruction iTo) {
299+
exists(
300+
CallInstruction call, DataFlowFunction func, FunctionInput modelIn, FunctionOutput modelOut
301+
|
302+
call.getStaticCallTarget() = func and
303+
func.hasDataFlow(modelIn, modelOut)
304+
|
305+
(
306+
modelOut.isReturnValue() and
307+
iTo = call
308+
or
309+
// TODO: Add write side effects for return values
310+
modelOut.isReturnValueDeref() and
311+
iTo = call
312+
or
313+
exists(WriteSideEffectInstruction outNode |
314+
modelOut.isParameterDeref(outNode.getIndex()) and
315+
iTo = outNode and
316+
outNode.getPrimaryInstruction() = call
317+
)
318+
// TODO: add write side effects for qualifiers
319+
) and
320+
(
321+
exists(int index |
322+
modelIn.isParameter(index) and
323+
iFrom = call.getPositionalArgument(index)
324+
)
325+
or
326+
exists(int index, ReadSideEffectInstruction read |
327+
modelIn.isParameterDeref(index) and
328+
read.getIndex() = index and
329+
read.getPrimaryInstruction() = call and
330+
iFrom = read.getSideEffectOperand().getAnyDef()
331+
)
332+
or
333+
modelIn.isQualifierAddress() and
334+
iFrom = call.getThisArgument()
335+
// TODO: add read side effects for qualifiers
336+
)
337+
)
292338
}
293339

294340
/**

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/defaulttainttracking.cpp‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,4 +77,13 @@ void test_dynamic_cast() {
7777
reinterpret_cast<D2*>(b2)->f(getenv("VAR"));
7878

7979
dynamic_cast<D3*>(b2)->f(getenv("VAR")); // tainted [FALSE POSITIVE]
80+
}
81+
82+
namespace std {
83+
template< class T >
84+
T&& move( T&& t ) noexcept;
85+
}
86+
87+
void test_std_move() {
88+
sink(std::move(getenv("VAR")));
8089
}

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,14 @@
9393
| defaulttainttracking.cpp:79:30:79:35 | call to getenv | defaulttainttracking.cpp:79:30:79:35 | call to getenv |
9494
| defaulttainttracking.cpp:79:30:79:35 | call to getenv | defaulttainttracking.cpp:79:30:79:42 | (const char *)... |
9595
| defaulttainttracking.cpp:79:30:79:35 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
96+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
97+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:84:17:84:17 | t |
98+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:16 | call to move |
99+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (const char *)... |
100+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (reference dereference) |
101+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:23 | call to getenv |
102+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | (reference to) |
103+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
96104
| test_diff.cpp:92:10:92:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
97105
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:1:11:1:20 | p#0 |
98106
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:13 | argv |

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,12 @@
99
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | array to pointer conversion | IR only |
1010
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:51:39:61 | env_pointer | AST only |
1111
| defaulttainttracking.cpp:64:10:64:15 | call to getenv | defaulttainttracking.cpp:52:24:52:24 | p | IR only |
12+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 | IR only |
13+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:16 | call to move | IR only |
14+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (const char *)... | IR only |
15+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:8:88:32 | (reference dereference) | IR only |
16+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | defaulttainttracking.cpp:88:18:88:30 | (reference to) | IR only |
17+
| defaulttainttracking.cpp:88:18:88:23 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 | IR only |
1218
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:11:104:20 | (...) | IR only |
1319
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:36:24:36:24 | p | AST only |
1420
| test_diff.cpp:111:10:111:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_diff.expected‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@
3434
| taint.cpp:352:7:352:7 | taint.cpp:330:6:330:11 | AST only |
3535
| taint.cpp:372:7:372:7 | taint.cpp:365:24:365:29 | AST only |
3636
| taint.cpp:374:7:374:7 | taint.cpp:365:24:365:29 | AST only |
37-
| taint.cpp:382:7:382:7 | taint.cpp:377:23:377:28 | AST only |
3837
| taint.cpp:391:7:391:7 | taint.cpp:385:27:385:32 | AST only |
3938
| taint.cpp:423:7:423:7 | taint.cpp:422:14:422:19 | AST only |
4039
| taint.cpp:424:9:424:17 | taint.cpp:422:14:422:19 | AST only |

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_ir.expected‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,6 @@
1717
| taint.cpp:291:7:291:7 | y | taint.cpp:275:6:275:11 | call to source |
1818
| taint.cpp:337:7:337:7 | t | taint.cpp:330:6:330:11 | call to source |
1919
| taint.cpp:350:7:350:7 | t | taint.cpp:330:6:330:11 | call to source |
20+
| taint.cpp:382:7:382:7 | a | taint.cpp:377:23:377:28 | source |
2021
| taint.cpp:429:7:429:7 | b | taint.cpp:428:13:428:18 | call to source |
2122
| taint.cpp:430:9:430:14 | member | taint.cpp:428:13:428:18 | call to source |

‎cpp/ql/test/library-tests/ir/ir/PrintAST.expected‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5753,9 +5753,9 @@ ir.cpp:
57535753
# 851| 0: [VariableDeclarationEntry] definition of d
57545754
# 851| Type = [Struct] PolymorphicDerived
57555755
# 851| init: [Initializer] initializer for d
5756-
# 851| expr: [ConstructorCall] call to PolymorphicDerived
5757-
# 851| Type = [VoidType] void
5758-
# 851| ValueCategory = prvalue
5756+
#-----| expr: [ConstructorCall] call to PolymorphicDerived
5757+
#-----| Type = [VoidType] void
5758+
#-----| ValueCategory = prvalue
57595759
# 853| 2: [DeclStmt] declaration
57605760
# 853| 0: [VariableDeclarationEntry] definition of pb
57615761
# 853| Type = [PointerType] PolymorphicBase *

0 commit comments

Comments
 (0)