Skip to content

Commit 60a0eff

Browse files
author
Dave Bartolomeo
committed
Merge remote-tracking branch 'upstream/master' into dbartol/Indirections
2 parents 542579d + 97069a7 commit 60a0eff

36 files changed

+2583
-67
lines changed

‎change-notes/1.24/analysis-java.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,15 +10,17 @@ The following changes in version 1.24 affect Java analysis in all applications.
1010

1111
| **Query** | **Tags** | **Purpose** |
1212
|-----------------------------|-----------|--------------------------------------------------------------------|
13+
| Disabled Spring CSRF protection (`java/spring-disabled-csrf-protection`) | security, external/cwe/cwe-352 | Finds disabled Cross-Site Request Forgery (CSRF) protection in Spring. |
1314
| Failure to use HTTPS or SFTP URL in Maven artifact upload/download (`java/maven/non-https-url`) | security, external/cwe/cwe-300, external/cwe/cwe-319, external/cwe/cwe-494, external/cwe/cwe-829 | Finds use of insecure protocols during Maven dependency resolution. Results are shown on LGTM by default. |
15+
| Left shift by more than the type width (`java/lshift-larger-than-type-width`) | correctness | Finds left shifts of ints by 32 bits or more and left shifts of longs by 64 bits or more. Results are shown on LGTM by default. |
1416
| Suspicious date format (`java/suspicious-date-format`) | correctness | Finds date format patterns that use placeholders that are likely to be incorrect. |
1517

1618
## Changes to existing queries
1719

1820
| **Query** | **Expected impact** | **Change** |
1921
|------------------------------|------------------------|-----------------------------------|
2022
| Dereferenced variable may be null (`java/dereferenced-value-may-be-null`) | Fewer false positives | Final fields with a non-null initializer are no longer reported. |
21-
| Expression always evaluates to the same value (`java/evaluation-to-constant`) | Fewer false positives | Expressions of the form `0 * x` are usually intended and no longer reported. |
23+
| Expression always evaluates to the same value (`java/evaluation-to-constant`) | Fewer false positives | Expressions of the form `0 * x` are usually intended and no longer reported. Also left shift of ints by 32 bits and longs by 64 bits are no longer reported as they are not constant, these results are instead reported by the new query `java/lshift-larger-than-type-width`. |
2224
| Useless null check (`java/useless-null-check`) | More true positives | Useless checks on final fields with a non-null initializer are now reported. |
2325

2426
## Changes to libraries

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,14 @@
44
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | defaulttainttracking.cpp:16:8:16:29 | (const char *)... |
55
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | defaulttainttracking.cpp:16:16:16:21 | call to getenv |
66
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | defaulttainttracking.cpp:16:16:16:28 | (const char *)... |
7+
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
78
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | defaulttainttracking.cpp:5:14:5:23 | p#0 |
89
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
910
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | defaulttainttracking.cpp:17:8:17:13 | call to strdup |
1011
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | defaulttainttracking.cpp:17:8:17:28 | (const char *)... |
1112
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | defaulttainttracking.cpp:17:15:17:20 | call to getenv |
1213
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | defaulttainttracking.cpp:17:15:17:27 | (const char *)... |
14+
| defaulttainttracking.cpp:17:15:17:20 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
1315
| defaulttainttracking.cpp:18:27:18:32 | call to getenv | defaulttainttracking.cpp:7:26:7:35 | p#0 |
1416
| defaulttainttracking.cpp:18:27:18:32 | call to getenv | defaulttainttracking.cpp:18:27:18:32 | call to getenv |
1517
| defaulttainttracking.cpp:18:27:18:32 | call to getenv | defaulttainttracking.cpp:18:27:18:39 | (const char *)... |
@@ -19,6 +21,7 @@
1921
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:8:22:33 | (const char *)... |
2022
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:20:22:25 | call to getenv |
2123
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:20:22:32 | (const char *)... |
24+
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 |
2225
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:32:11:32:26 | p#0 |
2326
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:11:38:21 | env_pointer |
2427
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:38:25:38:30 | call to getenv |
@@ -27,3 +30,100 @@
2730
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:26:39:34 | call to inet_addr |
2831
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:50:39:61 | & ... |
2932
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:40:10:40:10 | a |
33+
| test_diff.cpp:92:10:92:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
34+
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:1:11:1:20 | p#0 |
35+
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:13 | argv |
36+
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:16 | (const char *)... |
37+
| test_diff.cpp:92:10:92:13 | argv | test_diff.cpp:92:10:92:16 | access to array |
38+
| test_diff.cpp:94:32:94:35 | argv | defaulttainttracking.cpp:10:11:10:13 | p#0 |
39+
| test_diff.cpp:94:32:94:35 | argv | test_diff.cpp:2:11:2:13 | p#0 |
40+
| test_diff.cpp:94:32:94:35 | argv | test_diff.cpp:94:10:94:36 | reinterpret_cast<int>... |
41+
| test_diff.cpp:94:32:94:35 | argv | test_diff.cpp:94:32:94:35 | argv |
42+
| test_diff.cpp:96:26:96:29 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
43+
| test_diff.cpp:96:26:96:29 | argv | test_diff.cpp:1:11:1:20 | p#0 |
44+
| test_diff.cpp:96:26:96:29 | argv | test_diff.cpp:16:39:16:39 | a |
45+
| test_diff.cpp:96:26:96:29 | argv | test_diff.cpp:17:10:17:10 | a |
46+
| test_diff.cpp:96:26:96:29 | argv | test_diff.cpp:96:26:96:29 | argv |
47+
| test_diff.cpp:96:26:96:29 | argv | test_diff.cpp:96:26:96:32 | (const char *)... |
48+
| test_diff.cpp:96:26:96:29 | argv | test_diff.cpp:96:26:96:32 | access to array |
49+
| test_diff.cpp:98:18:98:21 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
50+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:1:11:1:20 | p#0 |
51+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:16:39:16:39 | a |
52+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:17:10:17:10 | a |
53+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:98:13:98:13 | p |
54+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:98:17:98:21 | & ... |
55+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:98:18:98:21 | argv |
56+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:100:10:100:14 | (const char *)... |
57+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:100:10:100:14 | * ... |
58+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:100:11:100:11 | p |
59+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:100:11:100:14 | access to array |
60+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:102:26:102:30 | (const char *)... |
61+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:102:26:102:30 | * ... |
62+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:102:27:102:27 | p |
63+
| test_diff.cpp:98:18:98:21 | argv | test_diff.cpp:102:27:102:30 | access to array |
64+
| test_diff.cpp:104:12:104:15 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
65+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:1:11:1:20 | p#0 |
66+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:10:104:20 | (const char *)... |
67+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:10:104:20 | * ... |
68+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:11:104:20 | (...) |
69+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:12:104:15 | argv |
70+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:12:104:19 | ... + ... |
71+
| test_diff.cpp:108:10:108:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
72+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:1:11:1:20 | p#0 |
73+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:24:20:24:29 | p#0 |
74+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:29:24:29:24 | p |
75+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:30:14:30:14 | p |
76+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:108:10:108:13 | argv |
77+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:108:10:108:16 | (const char *)... |
78+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:108:10:108:16 | access to array |
79+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:24:20:24:29 | p#0 |
80+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:36:24:36:24 | p |
81+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:111:10:111:13 | argv |
82+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:111:10:111:16 | (const char *)... |
83+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:111:10:111:16 | access to array |
84+
| test_diff.cpp:115:11:115:14 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
85+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:1:11:1:20 | p#0 |
86+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:24:20:24:29 | p#0 |
87+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:41:24:41:24 | p |
88+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:42:14:42:14 | p |
89+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:52:24:52:24 | p |
90+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:53:37:53:37 | p |
91+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:115:11:115:14 | argv |
92+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:115:11:115:17 | (const char *)... |
93+
| test_diff.cpp:115:11:115:14 | argv | test_diff.cpp:115:11:115:17 | access to array |
94+
| test_diff.cpp:118:26:118:29 | argv | test_diff.cpp:60:24:60:24 | p |
95+
| test_diff.cpp:118:26:118:29 | argv | test_diff.cpp:61:34:61:34 | p |
96+
| test_diff.cpp:118:26:118:29 | argv | test_diff.cpp:88:24:88:24 | p |
97+
| test_diff.cpp:118:26:118:29 | argv | test_diff.cpp:118:26:118:29 | argv |
98+
| test_diff.cpp:118:26:118:29 | argv | test_diff.cpp:118:26:118:32 | (const char *)... |
99+
| test_diff.cpp:118:26:118:29 | argv | test_diff.cpp:118:26:118:32 | access to array |
100+
| test_diff.cpp:121:23:121:26 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
101+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:1:11:1:20 | p#0 |
102+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:60:24:60:24 | p |
103+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:61:34:61:34 | p |
104+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:67:24:67:24 | p |
105+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:68:14:68:14 | p |
106+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:121:23:121:26 | argv |
107+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:121:23:121:29 | (const char *)... |
108+
| test_diff.cpp:121:23:121:26 | argv | test_diff.cpp:121:23:121:29 | access to array |
109+
| test_diff.cpp:124:19:124:22 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
110+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:1:11:1:20 | p#0 |
111+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:24:20:24:29 | p#0 |
112+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:76:24:76:24 | p |
113+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:81:24:81:24 | p |
114+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:82:14:82:14 | p |
115+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:124:19:124:22 | argv |
116+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:124:19:124:25 | (const char *)... |
117+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:124:19:124:25 | access to array |
118+
| test_diff.cpp:126:43:126:46 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 |
119+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:1:11:1:20 | p#0 |
120+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:76:24:76:24 | p |
121+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:81:24:81:24 | p |
122+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:82:14:82:14 | p |
123+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:126:43:126:46 | argv |
124+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:126:43:126:49 | (const char *)... |
125+
| test_diff.cpp:126:43:126:46 | argv | test_diff.cpp:126:43:126:49 | access to array |
126+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:76:24:76:24 | p |
127+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:128:44:128:47 | argv |
128+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:128:44:128:50 | (const char *)... |
129+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:128:44:128:50 | access to array |

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.cpp‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
void sink(const char *);
2+
void sink(int);
3+
4+
struct S {
5+
void(*f)(const char*);
6+
7+
void apply(char* p) {
8+
f(p);
9+
}
10+
11+
void (*get())(const char*) {
12+
return f;
13+
}
14+
};
15+
16+
void calls_sink_with_argv(const char* a) {
17+
sink(a);
18+
}
19+
20+
extern int i;
21+
22+
class BaseWithPureVirtual {
23+
public:
24+
virtual void f(const char*) = 0;
25+
};
26+
27+
class DerivedCallsSink : public BaseWithPureVirtual {
28+
public:
29+
void f(const char* p) override {
30+
sink(p);
31+
}
32+
};
33+
34+
class DerivedDoesNotCallSink : public BaseWithPureVirtual {
35+
public:
36+
void f(const char* p) override {}
37+
};
38+
39+
class DerivedCallsSinkDiamond1 : virtual public BaseWithPureVirtual {
40+
public:
41+
void f(const char* p) override {
42+
sink(p);
43+
}
44+
};
45+
46+
class DerivedDoesNotCallSinkDiamond2 : virtual public BaseWithPureVirtual {
47+
public:
48+
void f(const char* p) override {}
49+
};
50+
51+
class DerivesMultiple : public DerivedCallsSinkDiamond1, public DerivedDoesNotCallSinkDiamond2 {
52+
void f(const char* p) override {
53+
DerivedCallsSinkDiamond1::f(p);
54+
}
55+
};
56+
57+
template<typename T>
58+
class CRTP {
59+
public:
60+
void f(const char* p) {
61+
static_cast<T*>(this)->g(p);
62+
}
63+
};
64+
65+
class CRTPCallsSink : public CRTP<CRTPCallsSink> {
66+
public:
67+
void g(const char* p) {
68+
sink(p);
69+
}
70+
};
71+
72+
class Derived1 : public BaseWithPureVirtual {};
73+
74+
class Derived2 : public Derived1 {
75+
public:
76+
void f(const char* p) override {}
77+
};
78+
79+
class Derived3 : public Derived2 {
80+
public:
81+
void f(const char* p) override {
82+
sink(p);
83+
}
84+
};
85+
86+
class CRTPDoesNotCallSink : public CRTP<CRTPDoesNotCallSink> {
87+
public:
88+
void g(const char* p) {}
89+
};
90+
91+
int main(int argc, char *argv[]) {
92+
sink(argv[0]);
93+
94+
sink(reinterpret_cast<int>(argv));
95+
96+
calls_sink_with_argv(argv[1]);
97+
98+
char*** p = &argv;
99+
100+
sink(*p[0]);
101+
102+
calls_sink_with_argv(*p[i]);
103+
104+
sink(*(argv + 1));
105+
106+
BaseWithPureVirtual* b = new DerivedCallsSink;
107+
108+
b->f(argv[1]);
109+
110+
b = new DerivedDoesNotCallSink;
111+
b->f(argv[0]); // no flow [FALSE POSITIVE by AST]
112+
113+
BaseWithPureVirtual* b2 = new DerivesMultiple;
114+
115+
b2->f(argv[i]);
116+
117+
CRTP<CRTPDoesNotCallSink> crtp_not_call_sink;
118+
crtp_not_call_sink.f(argv[0]);
119+
120+
CRTP<CRTPCallsSink> crtp_calls_sink;
121+
crtp_calls_sink.f(argv[0]);
122+
123+
Derived1* calls_sink = new Derived3;
124+
calls_sink->f(argv[1]);
125+
126+
static_cast<Derived2*>(calls_sink)->f(argv[1]);
127+
128+
dynamic_cast<Derived2*>(calls_sink)->f(argv[1]); // flow [NOT DETECTED by IR]
129+
}

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | defaulttainttracking.cpp:9:11:9:20 | p#0 | IR only |
2+
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | defaulttainttracking.cpp:16:8:16:14 | call to _strdup | IR only |
3+
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | defaulttainttracking.cpp:16:8:16:29 | (const char *)... | IR only |
4+
| defaulttainttracking.cpp:16:16:16:21 | call to getenv | test_diff.cpp:1:11:1:20 | p#0 | IR only |
5+
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:3:21:3:22 | s1 | AST only |
6+
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:21:8:21:10 | buf | AST only |
7+
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:22:15:22:17 | buf | AST only |
8+
| defaulttainttracking.cpp:22:20:22:25 | call to getenv | defaulttainttracking.cpp:24:8:24:10 | buf | AST only |
9+
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:31:40:31:53 | dotted_address | AST only |
10+
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:36:39:61 | (const char *)... | AST only |
11+
| defaulttainttracking.cpp:38:25:38:30 | call to getenv | defaulttainttracking.cpp:39:51:39:61 | env_pointer | AST only |
12+
| test_diff.cpp:104:12:104:15 | argv | test_diff.cpp:104:11:104:20 | (...) | IR only |
13+
| test_diff.cpp:108:10:108:13 | argv | test_diff.cpp:36:24:36:24 | p | AST only |
14+
| test_diff.cpp:111:10:111:13 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 | AST only |
15+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:1:11:1:20 | p#0 | AST only |
16+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:29:24:29:24 | p | AST only |
17+
| test_diff.cpp:111:10:111:13 | argv | test_diff.cpp:30:14:30:14 | p | AST only |
18+
| test_diff.cpp:124:19:124:22 | argv | test_diff.cpp:76:24:76:24 | p | IR only |
19+
| test_diff.cpp:128:44:128:47 | argv | defaulttainttracking.cpp:9:11:9:20 | p#0 | AST only |
20+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:1:11:1:20 | p#0 | AST only |
21+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:81:24:81:24 | p | AST only |
22+
| test_diff.cpp:128:44:128:47 | argv | test_diff.cpp:82:14:82:14 | p | AST only |

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.ql‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
import cpp
2+
import semmle.code.cpp.security.Security
3+
import semmle.code.cpp.security.TaintTracking as ASTTaintTracking
4+
import semmle.code.cpp.ir.dataflow.DefaultTaintTracking as IRDefaultTaintTracking
5+
6+
predicate astFlow(Expr source, Element sink) { ASTTaintTracking::tainted(source, sink) }
7+
8+
predicate irFlow(Expr source, Element sink) { IRDefaultTaintTracking::tainted(source, sink) }
9+
10+
from Expr source, Element sink, string note
11+
where
12+
astFlow(source, sink) and
13+
not irFlow(source, sink) and
14+
note = "AST only"
15+
or
16+
irFlow(source, sink) and
17+
not astFlow(source, sink) and
18+
note = "IR only"
19+
select source, sink, note

‎java/ql/src/Complexity/ComplexCondition.ql‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@ import java
1313

1414
predicate nontrivialLogicalOperator(BinaryExpr e) {
1515
e instanceof LogicExpr and
16-
not e.getParent().(Expr).getKind() = e.getKind()
16+
(
17+
not e.getParent().(Expr).getKind() = e.getKind() or
18+
e.isParenthesized()
19+
)
1720
}
1821

1922
Expr getSimpleParent(Expr e) {

‎java/ql/src/Likely Bugs/Arithmetic/ConstantExpAppearsNonConstant.qhelp‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,6 @@ Some expressions always evaluate to the same result, no matter what their subexp
1414
</li>
1515
<li><code>x % 1</code> always evaluates to <code>0</code>.
1616
</li>
17-
<li><code>x &lt;&lt; 64</code> (when <code>x</code> is of type <code>long</code>) always evaluates to <code>0</code>.
18-
</li>
19-
<li><code>x &lt;&lt; 32</code> (when <code>x</code> is not of type <code>long</code>) always evaluates to <code>0</code>.
20-
</li>
2117
<li><code>x &amp; 0</code> always evaluates to <code>0</code>.
2218
</li>
2319
<li><code>x || true</code> always evaluates to <code>true</code>.
@@ -58,7 +54,7 @@ an integer. The correct check is <code>x % 2 == 0</code>.
5854

5955
<li>
6056
The Java Language Specification:
61-
<a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.17.1">Multiplication operator *</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.17.3">Remainder operator %</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.19">Left shift operator &lt;&lt;</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.22.1">Bitwise AND operator &amp;</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.23">Conditional-and operator &amp;&amp;</a> and <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.24">Conditional-or operator ||</a>.
57+
<a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.17.1">Multiplication operator *</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.17.3">Remainder operator %</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.22.1">Bitwise AND operator &amp;</a>, <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.23">Conditional-and operator &amp;&amp;</a> and <a href="http://docs.oracle.com/javase/specs/jls/se7/html/jls-15.html#jls-15.24">Conditional-or operator ||</a>.
6258
</li>
6359

6460

0 commit comments

Comments
 (0)