Skip to content

Commit b99e234

Browse files
author
Paolo Tranquilli
committed
Merge branch 'main' into redsun82/rust-tweaks
2 parents e89cf30 + 0bebfa6 commit b99e234

File tree

77 files changed

+2419
-579
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

77 files changed

+2419
-579
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -731,11 +731,9 @@ module LocalFlow {
731731
or
732732
node2 = node1.(LocalFunctionCreationNode).getAnAccess(true)
733733
or
734-
node1 =
735-
unique(FlowSummaryNode n1 |
736-
FlowSummaryImpl::Private::Steps::summaryLocalStep(n1.getSummaryNode(),
737-
node2.(FlowSummaryNode).getSummaryNode(), true, _)
738-
)
734+
FlowSummaryImpl::Private::Steps::summaryLocalMustFlowStep(node1
735+
.(FlowSummaryNode)
736+
.getSummaryNode(), node2.(FlowSummaryNode).getSummaryNode())
739737
}
740738
}
741739

‎csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ class ICryptoTransform extends ValueOrRefType {
5252
}
5353

5454
from UnsafeField field
55+
where field.fromSource()
5556
select field,
5657
"Static field '" + field.getName() +
5758
"' contains a 'System.Security.Cryptography.ICryptoTransform' that could be used in an unsafe way."

‎csharp/ql/src/Telemetry/DatabaseQuality.qll‎

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,24 +68,36 @@ module CallTargetStats implements StatsSig {
6868
)
6969
}
7070

71-
private predicate isInitializedWithCollectionInitializer(PropertyCall c) {
71+
private predicate isInitializedWithObjectOrCollectionInitializer(PropertyCall c) {
7272
exists(Property p, AssignExpr assign |
7373
p = c.getProperty() and
7474
assign = c.getParent() and
7575
assign.getLValue() = c and
76-
assign.getRValue() instanceof CollectionInitializer
76+
assign.getRValue() instanceof ObjectOrCollectionInitializer
7777
)
7878
}
7979

80+
private predicate isEventFieldAccess(EventCall c) {
81+
exists(Event e | c.getEvent() = e |
82+
forall(Accessor a | e.getAnAccessor() = a | a.isCompilerGenerated())
83+
)
84+
}
85+
86+
private predicate isTypeParameterInstantiation(ObjectCreation e) {
87+
e.getType() instanceof TypeParameter
88+
}
89+
8090
additional predicate isNotOkCall(Call c) {
8191
not exists(c.getTarget()) and
8292
not c instanceof DelegateCall and
8393
not c instanceof DynamicExpr and
8494
not isNoSetterPropertyCallInConstructor(c) and
8595
not isNoSetterPropertyInitialization(c) and
8696
not isAnonymousObjectMemberDeclaration(c) and
87-
not isInitializedWithCollectionInitializer(c) and
88-
not c.getParent+() instanceof NameOfExpr
97+
not isInitializedWithObjectOrCollectionInitializer(c) and
98+
not c.getParent+() instanceof NameOfExpr and
99+
not isEventFieldAccess(c) and
100+
not isTypeParameterInstantiation(c)
89101
}
90102

91103
int getNumberOfNotOk() { result = count(Call c | isNotOkCall(c)) }

‎csharp/ql/test/query-tests/Telemetry/DatabaseQuality/IsNotOkayCall.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| Quality.cs:26:19:26:26 | access to indexer | Call without target $@. | Quality.cs:26:19:26:26 | access to indexer | access to indexer |
2+
| Quality.cs:29:21:29:27 | access to indexer | Call without target $@. | Quality.cs:29:21:29:27 | access to indexer | access to indexer |
3+
| Quality.cs:32:9:32:21 | access to indexer | Call without target $@. | Quality.cs:32:9:32:21 | access to indexer | access to indexer |
4+
| Quality.cs:34:21:34:25 | object creation of type null | Call without target $@. | Quality.cs:34:21:34:25 | object creation of type null | object creation of type null |

‎csharp/ql/test/query-tests/Telemetry/DatabaseQuality/NoTarget.expected‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,12 @@
44
| Quality.cs:15:24:15:34 | access to property MyProperty3 | Call without target $@. | Quality.cs:15:24:15:34 | access to property MyProperty3 | access to property MyProperty3 |
55
| Quality.cs:15:24:15:46 | access to property MyProperty2 | Call without target $@. | Quality.cs:15:24:15:46 | access to property MyProperty2 | access to property MyProperty2 |
66
| Quality.cs:19:13:19:23 | access to property MyProperty4 | Call without target $@. | Quality.cs:19:13:19:23 | access to property MyProperty4 | access to property MyProperty4 |
7-
| Quality.cs:24:16:24:26 | access to property MyProperty2 | Call without target $@. | Quality.cs:24:16:24:26 | access to property MyProperty2 | access to property MyProperty2 |
7+
| Quality.cs:20:13:20:23 | access to property MyProperty6 | Call without target $@. | Quality.cs:20:13:20:23 | access to property MyProperty6 | access to property MyProperty6 |
8+
| Quality.cs:23:9:23:14 | access to event Event1 | Call without target $@. | Quality.cs:23:9:23:14 | access to event Event1 | access to event Event1 |
9+
| Quality.cs:23:9:23:30 | delegate call | Call without target $@. | Quality.cs:23:9:23:30 | delegate call | delegate call |
10+
| Quality.cs:26:19:26:26 | access to indexer | Call without target $@. | Quality.cs:26:19:26:26 | access to indexer | access to indexer |
11+
| Quality.cs:29:21:29:27 | access to indexer | Call without target $@. | Quality.cs:29:21:29:27 | access to indexer | access to indexer |
12+
| Quality.cs:32:9:32:21 | access to indexer | Call without target $@. | Quality.cs:32:9:32:21 | access to indexer | access to indexer |
13+
| Quality.cs:34:21:34:25 | object creation of type null | Call without target $@. | Quality.cs:34:21:34:25 | object creation of type null | object creation of type null |
14+
| Quality.cs:38:16:38:26 | access to property MyProperty2 | Call without target $@. | Quality.cs:38:16:38:26 | access to property MyProperty2 | access to property MyProperty2 |
15+
| Quality.cs:50:20:50:26 | object creation of type T | Call without target $@. | Quality.cs:50:20:50:26 | object creation of type T | object creation of type T |

‎csharp/ql/test/query-tests/Telemetry/DatabaseQuality/Quality.cs‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,43 @@ public Test()
1616

1717
new Test()
1818
{
19-
MyProperty4 = { 1, 2, 3 }
19+
MyProperty4 = { 1, 2, 3 },
20+
MyProperty6 = { [1] = "" }
2021
};
22+
23+
Event1.Invoke(this, 5);
24+
25+
var str = "abcd";
26+
var sub = str[..3]; // TODO: this is not an indexer call, but rather a `str.Substring(0, 3)` call.
27+
28+
Span<int> sp = null;
29+
var slice = sp[..3]; // TODO: this is not an indexer call, but rather a `sp.Slice(0, 3)` call.
30+
31+
Span<byte> guidBytes = stackalloc byte[16];
32+
guidBytes[08] = 1; // TODO: this indexer call has no target, because the target is a `ref` returning getter.
33+
34+
new MyList([new(), new Test()]); // TODO: the `new()` call has no target, which is unexpected, as we know at compile time, that this is a `new Test()` call.
2135
}
2236

2337
public int MyProperty1 { get; }
2438
public int MyProperty2 { get; } = 42;
2539
public Test MyProperty3 { get; set; }
2640
public List<int> MyProperty4 { get; }
2741
static int MyProperty5 { get; }
42+
public Dictionary<int, string> MyProperty6 { get; }
43+
44+
public event EventHandler<int> Event1;
45+
46+
class Gen<T> where T : new()
47+
{
48+
public static T Factory()
49+
{
50+
return new T();
51+
}
52+
}
53+
54+
class MyList
55+
{
56+
public MyList(IEnumerable<Test> init) { }
57+
}
2858
}

‎go/ql/lib/change-notes/2024-11-17-fix-missing-promoted-fields-and-methods-name-clash.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed a bug which meant that promoted fields and methods were missing when the embedded parent was not promoted due to a name clash.

‎go/ql/lib/semmle/go/Types.qll‎

Lines changed: 19 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -496,14 +496,15 @@ class StructType extends @structtype, CompositeType {
496496
Field getFieldOfEmbedded(Field embeddedParent, string name, int depth, boolean isEmbedded) {
497497
// embeddedParent is a field of 'this' at depth 'depth - 1'
498498
this.hasFieldCand(_, embeddedParent, depth - 1, true) and
499-
// embeddedParent's type has the result field
500-
exists(StructType embeddedType, Type fieldType |
501-
fieldType = embeddedParent.getType().getUnderlyingType() and
502-
pragma[only_bind_into](embeddedType) =
503-
[fieldType, fieldType.(PointerType).getBaseType().getUnderlyingType()]
504-
|
505-
result = embeddedType.getOwnField(name, isEmbedded)
506-
)
499+
// embeddedParent's type has the result field. Note that it is invalid Go
500+
// to have an embedded field with a named type whose underlying type is a
501+
// pointer, so we don't have to have
502+
// `lookThroughPointerType(embeddedParent.getType().getUnderlyingType())`.
503+
result =
504+
lookThroughPointerType(embeddedParent.getType())
505+
.getUnderlyingType()
506+
.(StructType)
507+
.getOwnField(name, isEmbedded)
507508
}
508509

509510
/**
@@ -523,8 +524,12 @@ class StructType extends @structtype, CompositeType {
523524
private predicate hasFieldCand(string name, Field f, int depth, boolean isEmbedded) {
524525
f = this.getOwnField(name, isEmbedded) and depth = 0
525526
or
526-
not this.hasOwnField(_, name, _, _) and
527-
f = this.getFieldOfEmbedded(_, name, depth, isEmbedded)
527+
f = this.getFieldOfEmbedded(_, name, depth, isEmbedded) and
528+
// If this is a cyclic field and this is not the first time we see this embedded field
529+
// then don't include it as a field candidate to avoid non-termination.
530+
not exists(Type t | lookThroughPointerType(t) = lookThroughPointerType(f.getType()) |
531+
this.hasOwnField(_, name, t, _)
532+
)
528533
}
529534

530535
private predicate hasMethodCand(string name, Method m, int depth) {
@@ -541,15 +546,7 @@ class StructType extends @structtype, CompositeType {
541546
predicate hasField(string name, Type tp) {
542547
exists(int mindepth |
543548
mindepth = min(int depth | this.hasFieldCand(name, _, depth, _)) and
544-
tp = unique(Field f | f = this.getFieldCand(name, mindepth, _)).getType()
545-
)
546-
}
547-
548-
private Field getFieldCand(string name, int depth, boolean isEmbedded) {
549-
result = this.getOwnField(name, isEmbedded) and depth = 0
550-
or
551-
exists(Type embedded | this.hasEmbeddedField(embedded, depth - 1) |
552-
result = embedded.getUnderlyingType().(StructType).getOwnField(name, isEmbedded)
549+
tp = unique(Field f | this.hasFieldCand(name, f, mindepth, _)).getType()
553550
)
554551
}
555552

@@ -564,9 +561,9 @@ class StructType extends @structtype, CompositeType {
564561
* The depth of a field `f` declared in this type is zero.
565562
*/
566563
Field getFieldAtDepth(string name, int depth) {
567-
depth = min(int depthCand | exists(this.getFieldCand(name, depthCand, _))) and
568-
result = this.getFieldCand(name, depth, _) and
569-
strictcount(this.getFieldCand(name, depth, _)) = 1
564+
depth = min(int depthCand | this.hasFieldCand(name, _, depthCand, _)) and
565+
this.hasFieldCand(name, result, depth, _) and
566+
strictcount(Field f | this.hasFieldCand(name, f, depth, _)) = 1
570567
}
571568

572569
Method getMethodAtDepth(string name, int depth) {

‎go/ql/test/library-tests/semmle/go/Types/Field_getPackage.expected‎

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@
1313
| depth.go:19:2:19:2 | f | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
1414
| embedded.go:4:2:4:2 | A | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
1515
| embedded.go:8:3:8:5 | Baz | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
16-
| embedded.go:13:2:13:4 | Qux | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
17-
| embedded.go:14:2:14:4 | Baz | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
16+
| embedded.go:12:2:12:4 | Qux | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
17+
| embedded.go:13:2:13:4 | Baz | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
1818
| generic.go:4:2:4:11 | valueField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
1919
| generic.go:5:2:5:13 | pointerField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
2020
| generic.go:6:2:6:11 | arrayField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
@@ -26,6 +26,7 @@
2626
| generic.go:21:2:21:9 | mapField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
2727
| generic.go:25:2:25:12 | structField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
2828
| generic.go:29:2:29:13 | pointerField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
29+
| main.go:18:7:18:15 | NameClash | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
2930
| pkg1/embedding.go:19:23:19:26 | base | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
3031
| pkg1/embedding.go:22:27:22:30 | base | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
3132
| pkg1/embedding.go:25:24:25:31 | embedder | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
@@ -36,20 +37,22 @@
3637
| pkg1/promotedStructs.go:14:2:14:7 | PField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
3738
| pkg1/promotedStructs.go:22:22:22:22 | S | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
3839
| pkg1/promotedStructs.go:25:22:25:22 | P | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
39-
| pkg1/tst.go:4:2:4:2 | f | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
40-
| pkg1/tst.go:5:2:5:4 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
41-
| pkg1/tst.go:6:2:6:4 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
42-
| pkg1/tst.go:10:2:10:4 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
43-
| pkg1/tst.go:11:2:11:4 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
44-
| pkg1/tst.go:15:3:15:5 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
45-
| pkg1/tst.go:16:3:16:5 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
46-
| pkg1/tst.go:20:3:20:5 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
47-
| pkg1/tst.go:21:2:21:4 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
48-
| pkg1/tst.go:25:2:25:4 | val | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
49-
| pkg1/tst.go:26:2:26:5 | flag | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
50-
| pkg1/tst.go:30:2:30:5 | flag | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
40+
| pkg1/tst.go:6:2:6:2 | f | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
41+
| pkg1/tst.go:7:2:7:4 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
42+
| pkg1/tst.go:8:2:8:4 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
43+
| pkg1/tst.go:12:2:12:4 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
44+
| pkg1/tst.go:13:2:13:4 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
45+
| pkg1/tst.go:17:3:17:5 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
46+
| pkg1/tst.go:18:3:18:5 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
47+
| pkg1/tst.go:22:3:22:5 | Foo | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
48+
| pkg1/tst.go:23:2:23:4 | Bar | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
49+
| pkg1/tst.go:27:2:27:4 | val | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
50+
| pkg1/tst.go:28:2:28:5 | flag | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
51+
| pkg1/tst.go:32:2:32:5 | flag | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
52+
| pkg1/tst.go:62:7:62:15 | NameClash | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg1 |
5153
| pkg2/tst.go:4:2:4:2 | g | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg2 |
5254
| pkg2/tst.go:8:2:8:2 | g | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg2 |
55+
| pkg2/tst.go:17:2:17:8 | NCField | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types/pkg2 |
5356
| struct_tags.go:4:2:4:7 | field1 | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
5457
| struct_tags.go:5:2:5:7 | field2 | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |
5558
| struct_tags.go:9:2:9:7 | field1 | package github.com/github/codeql-go/ql/test/library-tests/semmle/go/Types |

0 commit comments

Comments
 (0)