Skip to content

Commit 09d4b3e

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into callderef
2 parents 084e6f6 + 466c22f commit 09d4b3e

File tree

863 files changed

+42836
-9752
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

863 files changed

+42836
-9752
lines changed

‎.github/codeql/codeql-config.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,5 @@ paths-ignore:
77
- '/cpp/'
88
- '/java/'
99
- '/python/'
10+
- '/javascript/ql/test'
11+
- '/javascript/extractor/tests'

‎.vscode/extensions.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
// Extension identifier format: ${publisher}.${name}. Example: vscode.csharp
44
// List of extensions which should be recommended for users of this workspace.
55
"recommendations": [
6-
"github.vscode-codeql"
6+
"GitHub.vscode-codeql"
77
],
88
// List of extensions recommended by VS Code that should not be recommended for users of this workspace.
99
"unwantedRecommendations": []
10-
}
10+
}

‎change-notes/1.26/analysis-cpp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ The following changes in version 1.26 affect C/C++ analysis in all applications.
2525
* The models library now models many more taint flows through `std::string`.
2626
* The models library now models many taint flows through `std::istream` and `std::ostream`.
2727
* The models library now models some taint flows through `std::shared_ptr`, `std::unique_ptr`, `std::make_shared` and `std::make_unique`.
28+
* The models library now models many taint flows through `std::pair`, `std::map`, `std::unordered_map`, `std::set` and `std::unordered_set`.
2829
* The models library now models `bcopy`.
2930
* The `SimpleRangeAnalysis` library now supports multiplications of the form
3031
`e1 * e2` and `x *= e2` when `e1` and `e2` are unsigned or constant.

‎change-notes/1.26/analysis-javascript.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
## General improvements
44

55
* Support for the following frameworks and libraries has been improved:
6+
- [AWS Serverless](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html)
7+
- [Alibaba Serverless](https://www.alibabacloud.com/help/doc-detail/156876.htm)
68
- [bluebird](https://www.npmjs.com/package/bluebird)
79
- [express](https://www.npmjs.com/package/express)
810
- [fast-json-stable-stringify](https://www.npmjs.com/package/fast-json-stable-stringify)
@@ -14,6 +16,7 @@
1416
- [json-stringify-safe](https://www.npmjs.com/package/json-stringify-safe)
1517
- [json3](https://www.npmjs.com/package/json3)
1618
- [lodash](https://www.npmjs.com/package/lodash)
19+
- [needle](https://www.npmjs.com/package/needle)
1720
- [object-inspect](https://www.npmjs.com/package/object-inspect)
1821
- [pretty-format](https://www.npmjs.com/package/pretty-format)
1922
- [stringify-object](https://www.npmjs.com/package/stringify-object)
@@ -39,6 +42,7 @@
3942
| Unsafe shell command constructed from library input (`js/shell-command-constructed-from-input`) | More results | This query now recognizes more commands where colon, dash, and underscore are used. |
4043
| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | More results | This query now detects more unsafe uses of nested option properties. |
4144
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | More results | This query now recognizes some unsafe uses of `importScripts()` inside WebWorkers. |
45+
| Missing CSRF middleware (`js/missing-token-validation`) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
4246

4347

4448
## Changes to libraries

‎config/identical-files.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,14 @@
6262
"java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
6363
"csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
6464
],
65+
"Bound Java/C#": [
66+
"java/ql/src/semmle/code/java/dataflow/Bound.qll",
67+
"csharp/ql/src/semmle/code/csharp/dataflow/Bound.qll"
68+
],
69+
"ModulusAnalysis Java/C#": [
70+
"java/ql/src/semmle/code/java/dataflow/ModulusAnalysis.qll",
71+
"csharp/ql/src/semmle/code/csharp/dataflow/ModulusAnalysis.qll"
72+
],
6573
"C++ SubBasicBlocks": [
6674
"cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
6775
"cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"

‎cpp/autobuilder/Semmle.Autobuild.Cpp.Tests/Semmle.Autobuild.Cpp.Tests.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
<PropertyGroup>
44
<OutputType>Exe</OutputType>
5-
<TargetFramework>netcoreapp3.0</TargetFramework>
5+
<TargetFramework>netcoreapp3.1</TargetFramework>
66
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
77
<RuntimeIdentifiers>win-x64;linux-x64;osx-x64</RuntimeIdentifiers>
88
<Nullable>enable</Nullable>

‎cpp/autobuilder/Semmle.Autobuild.Cpp/Semmle.Autobuild.Cpp.csproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<Project Sdk="Microsoft.NET.Sdk">
22

33
<PropertyGroup>
4-
<TargetFramework>netcoreapp3.0</TargetFramework>
4+
<TargetFramework>netcoreapp3.1</TargetFramework>
55
<AssemblyName>Semmle.Autobuild.Cpp</AssemblyName>
66
<RootNamespace>Semmle.Autobuild.Cpp</RootNamespace>
77
<ApplicationIcon />

‎cpp/change-notes/2020-09-29-range-analysis-rollup.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
lgtm,codescanning
2+
* The `SimpleRangeAnalysis` library has gained support for several language
3+
constructs it did not support previously. These improvements primarily affect
4+
the queries `cpp/constant-comparison`, `cpp/comparison-with-wider-type`, and
5+
`cpp/integer-multiplication-cast-to-long`. The newly supported language
6+
features are:
7+
* Multiplication of unsigned numbers.
8+
* Multiplication by a constant.
9+
* Reference-typed function parameters.
10+
* Comparing a variable not equal to an endpoint of its range, thus narrowing the range by one.
11+
* Using `if (x)` or `if (!x)` or similar to test for equality to zero.
12+
* The `SimpleRangeAnalysis` library can now be extended with custom rules. See
13+
examples in
14+
`cpp/ql/src/experimental/semmle/code/cpp/rangeanalysis/extensions/`.

‎cpp/ql/src/Critical/OverflowDestination.ql‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,7 @@ import semmle.code.cpp.security.TaintTracking
2323
* ```
2424
*/
2525
predicate sourceSized(FunctionCall fc, Expr src) {
26-
exists(string name |
27-
(name = "strncpy" or name = "strncat" or name = "memcpy" or name = "memmove") and
28-
fc.getTarget().hasGlobalOrStdName(name)
29-
) and
26+
fc.getTarget().hasGlobalOrStdName(["strncpy", "strncat", "memcpy", "memmove"]) and
3027
exists(Expr dest, Expr size, Variable v |
3128
fc.getArgument(0) = dest and
3229
fc.getArgument(1) = src and

‎cpp/ql/src/Critical/SizeCheck2.ql‎

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -15,12 +15,7 @@
1515
import cpp
1616

1717
class Allocation extends FunctionCall {
18-
Allocation() {
19-
exists(string name |
20-
this.getTarget().hasGlobalOrStdName(name) and
21-
(name = "malloc" or name = "calloc" or name = "realloc")
22-
)
23-
}
18+
Allocation() { this.getTarget().hasGlobalOrStdName(["malloc", "calloc", "realloc"]) }
2419

2520
private string getName() { this.getTarget().hasGlobalOrStdName(result) }
2621

0 commit comments

Comments
 (0)