Skip to content

Commit 967ecba

Browse files
erik-krogherik-krogh
committed
Merge remote-tracking branch 'upstream/master' into promiseAll
2 parents b6106f9 + 38f6f05 commit 967ecba

File tree

101 files changed

+1623
-667
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

101 files changed

+1623
-667
lines changed

‎change-notes/1.24/analysis-cpp.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Improvements to C/C++ analysis
2+
3+
The following changes in version 1.24 affect C/C++ analysis in all applications.
4+
5+
## General improvements
6+
7+
## New queries
8+
9+
| **Query** | **Tags** | **Purpose** |
10+
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
12+
## Changes to existing queries
13+
14+
| **Query** | **Expected impact** | **Change** |
15+
|----------------------------|------------------------|------------------------------------------------------------------|
16+
| No space for zero terminator (`cpp/no-space-for-terminator`) | Fewer false positive results | This query has been modified to be more conservative when identifying which pointers point to null-terminated strings. This approach produces fewer, more accurate results. |
17+
18+
## Changes to libraries
19+
20+
*

‎change-notes/1.24/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
* Support for the following frameworks and libraries has been improved:
66
- [react](https://www.npmjs.com/package/react)
7+
- [Handlebars](https://www.npmjs.com/package/handlebars)
78

89
## New queries
910

‎config/identical-files.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,11 @@
143143
"cpp/ql/src/semmle/code/cpp/ir/implementation/Opcode.qll",
144144
"csharp/ql/src/semmle/code/csharp/ir/implementation/Opcode.qll"
145145
],
146+
"IR SSASanity": [
147+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSASanity.qll",
148+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSASanity.qll",
149+
"csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/SSASanity.qll"
150+
],
146151
"C++ IR InstructionImports": [
147152
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/InstructionImports.qll",
148153
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/InstructionImports.qll",

‎cpp/ql/src/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,28 +16,28 @@
1616

1717
import cpp
1818
import semmle.code.cpp.dataflow.DataFlow
19-
import semmle.code.cpp.models.implementations.Memcpy
19+
import semmle.code.cpp.models.interfaces.ArrayFunction
2020

2121
class MallocCall extends FunctionCall {
2222
MallocCall() { this.getTarget().hasGlobalOrStdName("malloc") }
2323

24-
Expr getAllocatedSize() {
25-
if this.getArgument(0) instanceof VariableAccess
26-
then
27-
exists(LocalScopeVariable v, ControlFlowNode def |
28-
definitionUsePair(v, def, this.getArgument(0)) and
29-
exprDefinition(v, def, result)
30-
)
31-
else result = this.getArgument(0)
32-
}
24+
Expr getAllocatedSize() { result = this.getArgument(0) }
3325
}
3426

3527
predicate terminationProblem(MallocCall malloc, string msg) {
36-
malloc.getAllocatedSize() instanceof StrlenCall and
37-
not exists(FunctionCall fc, MemcpyFunction memcpy, int ix |
38-
DataFlow::localExprFlow(malloc, fc.getArgument(ix)) and
39-
fc.getTarget() = memcpy and
40-
memcpy.hasArrayOutput(ix)
28+
// malloc(strlen(...))
29+
exists(StrlenCall strlen | DataFlow::localExprFlow(strlen, malloc.getAllocatedSize())) and
30+
// flows into a null-terminated string function
31+
exists(ArrayFunction af, FunctionCall fc, int arg |
32+
DataFlow::localExprFlow(malloc, fc.getArgument(arg)) and
33+
fc.getTarget() = af and
34+
(
35+
// null terminated string
36+
af.hasArrayWithNullTerminator(arg)
37+
or
38+
// likely a null terminated string (such as `strcpy`, `strcat`)
39+
af.hasArrayWithUnknownSize(arg)
40+
)
4141
) and
4242
msg = "This allocation does not include space to null-terminate the string."
4343
}

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -464,7 +464,7 @@ private predicate simpleParameterFlow(
464464
) {
465465
throughFlowNodeCand(node, config) and
466466
p = node and
467-
t = getErasedRepr(node.getType()) and
467+
t = getErasedNodeType(node) and
468468
exists(ReturnNode ret, ReturnKind kind |
469469
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
470470
kind = ret.getKind() and
@@ -475,29 +475,29 @@ private predicate simpleParameterFlow(
475475
exists(Node mid |
476476
simpleParameterFlow(p, mid, t, config) and
477477
localFlowStep(mid, node, config) and
478-
compatibleTypes(t, node.getType())
478+
compatibleTypes(t, getErasedNodeType(node))
479479
)
480480
or
481481
throughFlowNodeCand(node, unbind(config)) and
482482
exists(Node mid |
483483
simpleParameterFlow(p, mid, _, config) and
484484
additionalLocalFlowStep(mid, node, config) and
485-
t = getErasedRepr(node.getType())
485+
t = getErasedNodeType(node)
486486
)
487487
or
488488
throughFlowNodeCand(node, unbind(config)) and
489489
exists(Node mid |
490490
simpleParameterFlow(p, mid, t, config) and
491491
localStoreReadStep(mid, node) and
492-
compatibleTypes(t, node.getType())
492+
compatibleTypes(t, getErasedNodeType(node))
493493
)
494494
or
495495
// value flow through a callable
496496
throughFlowNodeCand(node, unbind(config)) and
497497
exists(Node arg |
498498
simpleParameterFlow(p, arg, t, config) and
499499
argumentValueFlowsThrough(arg, node, _) and
500-
compatibleTypes(t, node.getType())
500+
compatibleTypes(t, getErasedNodeType(node))
501501
)
502502
or
503503
// flow through a callable
@@ -989,7 +989,9 @@ private class CastingNode extends Node {
989989
*/
990990
private predicate flowCandFwd(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
991991
flowCandFwd0(node, fromArg, apf, config) and
992-
if node instanceof CastingNode then compatibleTypes(node.getType(), apf.getType()) else any()
992+
if node instanceof CastingNode
993+
then compatibleTypes(getErasedNodeType(node), apf.getType())
994+
else any()
993995
}
994996

995997
/**
@@ -1010,7 +1012,7 @@ private class AccessPathFrontNilNode extends Node {
10101012
}
10111013

10121014
pragma[noinline]
1013-
private DataFlowType getErasedReprType() { result = getErasedRepr(this.getType()) }
1015+
private DataFlowType getErasedReprType() { result = getErasedNodeType(this) }
10141016

10151017
/** Gets the `nil` path front for this node. */
10161018
AccessPathFrontNil getApf() { result = TFrontNil(this.getErasedReprType()) }
@@ -1337,7 +1339,7 @@ private class AccessPathNilNode extends Node {
13371339
AccessPathNilNode() { flowCand(this.(AccessPathFrontNilNode), _, _, _) }
13381340

13391341
pragma[noinline]
1340-
private DataFlowType getErasedReprType() { result = getErasedRepr(this.getType()) }
1342+
private DataFlowType getErasedReprType() { result = getErasedNodeType(this) }
13411343

13421344
/** Gets the `nil` path for this node. */
13431345
AccessPathNil getAp() { result = TNil(this.getErasedReprType()) }
@@ -2076,7 +2078,7 @@ private module FlowExploration {
20762078
TPartialPathNodeMk(Node node, CallContext cc, PartialAccessPath ap, Configuration config) {
20772079
config.isSource(node) and
20782080
cc instanceof CallContextAny and
2079-
ap = TPartialNil(getErasedRepr(node.getType())) and
2081+
ap = TPartialNil(getErasedNodeType(node)) and
20802082
not fullBarrier(node, config) and
20812083
exists(config.explorationLimit())
20822084
or
@@ -2091,7 +2093,9 @@ private module FlowExploration {
20912093
exists(PartialPathNode mid |
20922094
partialPathStep(mid, node, cc, ap, config) and
20932095
not fullBarrier(node, config) and
2094-
if node instanceof CastingNode then compatibleTypes(node.getType(), ap.getType()) else any()
2096+
if node instanceof CastingNode
2097+
then compatibleTypes(getErasedNodeType(node), ap.getType())
2098+
else any()
20952099
)
20962100
}
20972101

@@ -2194,7 +2198,7 @@ private module FlowExploration {
21942198
additionalLocalFlowStep(mid.getNode(), node, config) and
21952199
cc = mid.getCallContext() and
21962200
mid.getAp() instanceof PartialAccessPathNil and
2197-
ap = TPartialNil(getErasedRepr(node.getType())) and
2201+
ap = TPartialNil(getErasedNodeType(node)) and
21982202
config = mid.getConfiguration()
21992203
)
22002204
or
@@ -2206,7 +2210,7 @@ private module FlowExploration {
22062210
additionalJumpStep(mid.getNode(), node, config) and
22072211
cc instanceof CallContextAny and
22082212
mid.getAp() instanceof PartialAccessPathNil and
2209-
ap = TPartialNil(getErasedRepr(node.getType())) and
2213+
ap = TPartialNil(getErasedNodeType(node)) and
22102214
config = mid.getConfiguration()
22112215
or
22122216
partialPathStoreStep(mid, _, _, node, ap) and

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -464,7 +464,7 @@ private predicate simpleParameterFlow(
464464
) {
465465
throughFlowNodeCand(node, config) and
466466
p = node and
467-
t = getErasedRepr(node.getType()) and
467+
t = getErasedNodeType(node) and
468468
exists(ReturnNode ret, ReturnKind kind |
469469
returnNodeGetEnclosingCallable(ret) = p.getEnclosingCallable() and
470470
kind = ret.getKind() and
@@ -475,29 +475,29 @@ private predicate simpleParameterFlow(
475475
exists(Node mid |
476476
simpleParameterFlow(p, mid, t, config) and
477477
localFlowStep(mid, node, config) and
478-
compatibleTypes(t, node.getType())
478+
compatibleTypes(t, getErasedNodeType(node))
479479
)
480480
or
481481
throughFlowNodeCand(node, unbind(config)) and
482482
exists(Node mid |
483483
simpleParameterFlow(p, mid, _, config) and
484484
additionalLocalFlowStep(mid, node, config) and
485-
t = getErasedRepr(node.getType())
485+
t = getErasedNodeType(node)
486486
)
487487
or
488488
throughFlowNodeCand(node, unbind(config)) and
489489
exists(Node mid |
490490
simpleParameterFlow(p, mid, t, config) and
491491
localStoreReadStep(mid, node) and
492-
compatibleTypes(t, node.getType())
492+
compatibleTypes(t, getErasedNodeType(node))
493493
)
494494
or
495495
// value flow through a callable
496496
throughFlowNodeCand(node, unbind(config)) and
497497
exists(Node arg |
498498
simpleParameterFlow(p, arg, t, config) and
499499
argumentValueFlowsThrough(arg, node, _) and
500-
compatibleTypes(t, node.getType())
500+
compatibleTypes(t, getErasedNodeType(node))
501501
)
502502
or
503503
// flow through a callable
@@ -989,7 +989,9 @@ private class CastingNode extends Node {
989989
*/
990990
private predicate flowCandFwd(Node node, boolean fromArg, AccessPathFront apf, Configuration config) {
991991
flowCandFwd0(node, fromArg, apf, config) and
992-
if node instanceof CastingNode then compatibleTypes(node.getType(), apf.getType()) else any()
992+
if node instanceof CastingNode
993+
then compatibleTypes(getErasedNodeType(node), apf.getType())
994+
else any()
993995
}
994996

995997
/**
@@ -1010,7 +1012,7 @@ private class AccessPathFrontNilNode extends Node {
10101012
}
10111013

10121014
pragma[noinline]
1013-
private DataFlowType getErasedReprType() { result = getErasedRepr(this.getType()) }
1015+
private DataFlowType getErasedReprType() { result = getErasedNodeType(this) }
10141016

10151017
/** Gets the `nil` path front for this node. */
10161018
AccessPathFrontNil getApf() { result = TFrontNil(this.getErasedReprType()) }
@@ -1337,7 +1339,7 @@ private class AccessPathNilNode extends Node {
13371339
AccessPathNilNode() { flowCand(this.(AccessPathFrontNilNode), _, _, _) }
13381340

13391341
pragma[noinline]
1340-
private DataFlowType getErasedReprType() { result = getErasedRepr(this.getType()) }
1342+
private DataFlowType getErasedReprType() { result = getErasedNodeType(this) }
13411343

13421344
/** Gets the `nil` path for this node. */
13431345
AccessPathNil getAp() { result = TNil(this.getErasedReprType()) }
@@ -2076,7 +2078,7 @@ private module FlowExploration {
20762078
TPartialPathNodeMk(Node node, CallContext cc, PartialAccessPath ap, Configuration config) {
20772079
config.isSource(node) and
20782080
cc instanceof CallContextAny and
2079-
ap = TPartialNil(getErasedRepr(node.getType())) and
2081+
ap = TPartialNil(getErasedNodeType(node)) and
20802082
not fullBarrier(node, config) and
20812083
exists(config.explorationLimit())
20822084
or
@@ -2091,7 +2093,9 @@ private module FlowExploration {
20912093
exists(PartialPathNode mid |
20922094
partialPathStep(mid, node, cc, ap, config) and
20932095
not fullBarrier(node, config) and
2094-
if node instanceof CastingNode then compatibleTypes(node.getType(), ap.getType()) else any()
2096+
if node instanceof CastingNode
2097+
then compatibleTypes(getErasedNodeType(node), ap.getType())
2098+
else any()
20952099
)
20962100
}
20972101

@@ -2194,7 +2198,7 @@ private module FlowExploration {
21942198
additionalLocalFlowStep(mid.getNode(), node, config) and
21952199
cc = mid.getCallContext() and
21962200
mid.getAp() instanceof PartialAccessPathNil and
2197-
ap = TPartialNil(getErasedRepr(node.getType())) and
2201+
ap = TPartialNil(getErasedNodeType(node)) and
21982202
config = mid.getConfiguration()
21992203
)
22002204
or
@@ -2206,7 +2210,7 @@ private module FlowExploration {
22062210
additionalJumpStep(mid.getNode(), node, config) and
22072211
cc instanceof CallContextAny and
22082212
mid.getAp() instanceof PartialAccessPathNil and
2209-
ap = TPartialNil(getErasedRepr(node.getType())) and
2213+
ap = TPartialNil(getErasedNodeType(node)) and
22102214
config = mid.getConfiguration()
22112215
or
22122216
partialPathStoreStep(mid, _, _, node, ap) and

0 commit comments

Comments
 (0)