Skip to content

Commit 311cbb4

Browse files
RasmusWLRasmusWL
committed
Merge branch 'main' into shared-concepts-scaffolding
2 parents 414764c + ea065b7 commit 311cbb4

File tree

190 files changed

+13622
-1801
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

190 files changed

+13622
-1801
lines changed

‎CONTRIBUTING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
3636

3737
For details, see the [guide on query metadata](docs/query-metadata-style-guide.md).
3838

39-
Make sure the `select` statement is compatible with the query `@kind`. See [About CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
39+
Make sure the `select` statement is compatible with the query `@kind`. See [About CodeQL queries](https://codeql.github.com/docs/writing-codeql-queries/about-codeql-queries/#select-clause) on codeql.github.com.
4040

4141
3. **Formatting**
4242

‎config/identical-files.json

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,8 @@
2727
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
2828
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll",
2929
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll",
30-
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll"
30+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll",
31+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForLibraries.qll"
3132
],
3233
"DataFlow Java/C++/C#/Python Common": [
3334
"java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
@@ -54,7 +55,8 @@
5455
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking2/TaintTrackingImpl.qll",
5556
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
5657
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll",
57-
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
58+
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
59+
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll"
5860
],
5961
"DataFlow Java/C++/C#/Python Consistency checks": [
6062
"java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
@@ -480,11 +482,12 @@
480482
"python/ql/lib/semmle/python/security/performance/ReDoSUtil.qll",
481483
"ruby/ql/lib/codeql/ruby/security/performance/ReDoSUtil.qll"
482484
],
483-
"ReDoS Exponential Python/JS": [
485+
"ReDoS Exponential Python/JS/Ruby": [
484486
"javascript/ql/lib/semmle/javascript/security/performance/ExponentialBackTracking.qll",
485-
"python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll"
487+
"python/ql/lib/semmle/python/security/performance/ExponentialBackTracking.qll",
488+
"ruby/ql/lib/codeql/ruby/security/performance/ExponentialBackTracking.qll"
486489
],
487-
"ReDoS Polynomial Python/JS": [
490+
"ReDoS Polynomial Python/JS/Ruby": [
488491
"javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
489492
"python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll",
490493
"ruby/ql/lib/codeql/ruby/security/performance/SuperlinearBackTracking.qll"
@@ -520,5 +523,29 @@
520523
"python/ql/lib/semmle/python/internal/ConceptsShared.qll",
521524
"ruby/ql/lib/codeql/ruby/internal/ConceptsShared.qll",
522525
"javascript/ql/lib/semmle/javascript/internal/ConceptsShared.qll"
526+
],
527+
"Hostname Regexp queries": [
528+
"javascript/ql/src/Security/CWE-020/HostnameRegexpShared.qll",
529+
"ruby/ql/src/queries/security/cwe-020/HostnameRegexpShared.qll"
530+
],
531+
"ApiGraphModels": [
532+
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
533+
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll"
534+
],
535+
"TaintedFormatStringQuery Ruby/JS": [
536+
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringQuery.qll",
537+
"ruby/ql/lib/codeql/ruby/security/TaintedFormatStringQuery.qll"
538+
],
539+
"TaintedFormatStringCustomizations Ruby/JS": [
540+
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringCustomizations.qll",
541+
"ruby/ql/lib/codeql/ruby/security/TaintedFormatStringCustomizations.qll"
542+
],
543+
"HttpToFileAccessQuery JS/Ruby": [
544+
"javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessQuery.qll",
545+
"ruby/ql/lib/codeql/ruby/security/HttpToFileAccessQuery.qll"
546+
],
547+
"HttpToFileAccessCustomizations JS/Ruby": [
548+
"javascript/ql/lib/semmle/javascript/security/dataflow/HttpToFileAccessCustomizations.qll",
549+
"ruby/ql/lib/codeql/ruby/security/HttpToFileAccessCustomizations.qll"
523550
]
524551
}

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll

Lines changed: 53 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1756,18 +1756,31 @@ private module LocalFlowBigStep {
17561756
* Holds if `node` can be the first node in a maximal subsequence of local
17571757
* flow steps in a dataflow path.
17581758
*/
1759-
predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
1759+
private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
17601760
Stage2::revFlow(node, state, config) and
17611761
(
1762-
sourceNode(node, state, config) or
1763-
jumpStep(_, node, config) or
1764-
additionalJumpStep(_, node, config) or
1765-
additionalJumpStateStep(_, _, node, state, config) or
1766-
node instanceof ParamNodeEx or
1767-
node.asNode() instanceof OutNodeExt or
1768-
store(_, _, node, _, config) or
1769-
read(_, _, node, config) or
1762+
sourceNode(node, state, config)
1763+
or
1764+
jumpStep(_, node, config)
1765+
or
1766+
additionalJumpStep(_, node, config)
1767+
or
1768+
additionalJumpStateStep(_, _, node, state, config)
1769+
or
1770+
node instanceof ParamNodeEx
1771+
or
1772+
node.asNode() instanceof OutNodeExt
1773+
or
1774+
store(_, _, node, _, config)
1775+
or
1776+
read(_, _, node, config)
1777+
or
17701778
node instanceof FlowCheckNode
1779+
or
1780+
exists(FlowState s |
1781+
additionalLocalStateStep(_, s, node, state, config) and
1782+
s != state
1783+
)
17711784
)
17721785
}
17731786

@@ -1787,6 +1800,9 @@ private module LocalFlowBigStep {
17871800
or
17881801
exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
17891802
additionalJumpStateStep(node, state, next, s, config)
1803+
or
1804+
additionalLocalStateStep(node, state, next, s, config) and
1805+
s != state
17901806
)
17911807
or
17921808
Stage2::revFlow(node, state, config) and
@@ -1820,42 +1836,40 @@ private module LocalFlowBigStep {
18201836
*/
18211837
pragma[nomagic]
18221838
private predicate localFlowStepPlus(
1823-
NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
1824-
DataFlowType t, Configuration config, LocalCallContext cc
1839+
NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
1840+
Configuration config, LocalCallContext cc
18251841
) {
18261842
not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
18271843
(
1828-
localFlowEntry(node1, pragma[only_bind_into](state1), pragma[only_bind_into](config)) and
1844+
localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
18291845
(
18301846
localFlowStepNodeCand1(node1, node2, config) and
1831-
state1 = state2 and
18321847
preservesValue = true and
1833-
t = node1.getDataFlowType() // irrelevant dummy value
1848+
t = node1.getDataFlowType() and // irrelevant dummy value
1849+
Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
18341850
or
1835-
additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
1851+
additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
18361852
preservesValue = false and
18371853
t = node2.getDataFlowType()
18381854
) and
18391855
node1 != node2 and
18401856
cc.relevantFor(node1.getEnclosingCallable()) and
1841-
not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
1842-
Stage2::revFlow(node2, pragma[only_bind_into](state2), pragma[only_bind_into](config))
1857+
not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
18431858
or
18441859
exists(NodeEx mid |
1845-
localFlowStepPlus(node1, state1, mid, pragma[only_bind_into](state2), preservesValue, t,
1860+
localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
18461861
pragma[only_bind_into](config), cc) and
18471862
localFlowStepNodeCand1(mid, node2, config) and
18481863
not mid instanceof FlowCheckNode and
1849-
Stage2::revFlow(node2, pragma[only_bind_into](state2), pragma[only_bind_into](config))
1864+
Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
18501865
)
18511866
or
1852-
exists(NodeEx mid, FlowState st |
1853-
localFlowStepPlus(node1, state1, mid, st, _, _, pragma[only_bind_into](config), cc) and
1854-
additionalLocalFlowStepNodeCand2(mid, st, node2, state2, config) and
1867+
exists(NodeEx mid |
1868+
localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
1869+
additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
18551870
not mid instanceof FlowCheckNode and
18561871
preservesValue = false and
1857-
t = node2.getDataFlowType() and
1858-
Stage2::revFlow(node2, state2, pragma[only_bind_into](config))
1872+
t = node2.getDataFlowType()
18591873
)
18601874
)
18611875
}
@@ -1869,9 +1883,19 @@ private module LocalFlowBigStep {
18691883
NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
18701884
AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
18711885
) {
1872-
localFlowStepPlus(node1, state1, node2, state2, preservesValue, apf.getType(), config,
1873-
callContext) and
1874-
localFlowExit(node2, state2, config)
1886+
localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
1887+
localFlowExit(node2, state1, config) and
1888+
state1 = state2
1889+
or
1890+
additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
1891+
state1 != state2 and
1892+
preservesValue = false and
1893+
apf = TFrontNil(node2.getDataFlowType()) and
1894+
callContext.relevantFor(node1.getEnclosingCallable()) and
1895+
not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
1896+
isUnreachableInCallCached(node1.asNode(), call) or
1897+
isUnreachableInCallCached(node2.asNode(), call)
1898+
)
18751899
}
18761900
}
18771901

@@ -2745,10 +2769,10 @@ private module Stage4 {
27452769

27462770
bindingset[node, cc, config]
27472771
private LocalCc getLocalCc(NodeEx node, Cc cc, Configuration config) {
2748-
localFlowEntry(node, _, config) and
27492772
result =
27502773
getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
2751-
node.getEnclosingCallable())
2774+
node.getEnclosingCallable()) and
2775+
exists(config)
27522776
}
27532777

27542778
private predicate localStep(

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll

Lines changed: 53 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1756,18 +1756,31 @@ private module LocalFlowBigStep {
17561756
* Holds if `node` can be the first node in a maximal subsequence of local
17571757
* flow steps in a dataflow path.
17581758
*/
1759-
predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
1759+
private predicate localFlowEntry(NodeEx node, FlowState state, Configuration config) {
17601760
Stage2::revFlow(node, state, config) and
17611761
(
1762-
sourceNode(node, state, config) or
1763-
jumpStep(_, node, config) or
1764-
additionalJumpStep(_, node, config) or
1765-
additionalJumpStateStep(_, _, node, state, config) or
1766-
node instanceof ParamNodeEx or
1767-
node.asNode() instanceof OutNodeExt or
1768-
store(_, _, node, _, config) or
1769-
read(_, _, node, config) or
1762+
sourceNode(node, state, config)
1763+
or
1764+
jumpStep(_, node, config)
1765+
or
1766+
additionalJumpStep(_, node, config)
1767+
or
1768+
additionalJumpStateStep(_, _, node, state, config)
1769+
or
1770+
node instanceof ParamNodeEx
1771+
or
1772+
node.asNode() instanceof OutNodeExt
1773+
or
1774+
store(_, _, node, _, config)
1775+
or
1776+
read(_, _, node, config)
1777+
or
17701778
node instanceof FlowCheckNode
1779+
or
1780+
exists(FlowState s |
1781+
additionalLocalStateStep(_, s, node, state, config) and
1782+
s != state
1783+
)
17711784
)
17721785
}
17731786

@@ -1787,6 +1800,9 @@ private module LocalFlowBigStep {
17871800
or
17881801
exists(NodeEx next, FlowState s | Stage2::revFlow(next, s, config) |
17891802
additionalJumpStateStep(node, state, next, s, config)
1803+
or
1804+
additionalLocalStateStep(node, state, next, s, config) and
1805+
s != state
17901806
)
17911807
or
17921808
Stage2::revFlow(node, state, config) and
@@ -1820,42 +1836,40 @@ private module LocalFlowBigStep {
18201836
*/
18211837
pragma[nomagic]
18221838
private predicate localFlowStepPlus(
1823-
NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
1824-
DataFlowType t, Configuration config, LocalCallContext cc
1839+
NodeEx node1, FlowState state, NodeEx node2, boolean preservesValue, DataFlowType t,
1840+
Configuration config, LocalCallContext cc
18251841
) {
18261842
not isUnreachableInCallCached(node2.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
18271843
(
1828-
localFlowEntry(node1, pragma[only_bind_into](state1), pragma[only_bind_into](config)) and
1844+
localFlowEntry(node1, pragma[only_bind_into](state), pragma[only_bind_into](config)) and
18291845
(
18301846
localFlowStepNodeCand1(node1, node2, config) and
1831-
state1 = state2 and
18321847
preservesValue = true and
1833-
t = node1.getDataFlowType() // irrelevant dummy value
1848+
t = node1.getDataFlowType() and // irrelevant dummy value
1849+
Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
18341850
or
1835-
additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
1851+
additionalLocalFlowStepNodeCand2(node1, state, node2, state, config) and
18361852
preservesValue = false and
18371853
t = node2.getDataFlowType()
18381854
) and
18391855
node1 != node2 and
18401856
cc.relevantFor(node1.getEnclosingCallable()) and
1841-
not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall()) and
1842-
Stage2::revFlow(node2, pragma[only_bind_into](state2), pragma[only_bind_into](config))
1857+
not isUnreachableInCallCached(node1.asNode(), cc.(LocalCallContextSpecificCall).getCall())
18431858
or
18441859
exists(NodeEx mid |
1845-
localFlowStepPlus(node1, state1, mid, pragma[only_bind_into](state2), preservesValue, t,
1860+
localFlowStepPlus(node1, pragma[only_bind_into](state), mid, preservesValue, t,
18461861
pragma[only_bind_into](config), cc) and
18471862
localFlowStepNodeCand1(mid, node2, config) and
18481863
not mid instanceof FlowCheckNode and
1849-
Stage2::revFlow(node2, pragma[only_bind_into](state2), pragma[only_bind_into](config))
1864+
Stage2::revFlow(node2, pragma[only_bind_into](state), pragma[only_bind_into](config))
18501865
)
18511866
or
1852-
exists(NodeEx mid, FlowState st |
1853-
localFlowStepPlus(node1, state1, mid, st, _, _, pragma[only_bind_into](config), cc) and
1854-
additionalLocalFlowStepNodeCand2(mid, st, node2, state2, config) and
1867+
exists(NodeEx mid |
1868+
localFlowStepPlus(node1, state, mid, _, _, pragma[only_bind_into](config), cc) and
1869+
additionalLocalFlowStepNodeCand2(mid, state, node2, state, config) and
18551870
not mid instanceof FlowCheckNode and
18561871
preservesValue = false and
1857-
t = node2.getDataFlowType() and
1858-
Stage2::revFlow(node2, state2, pragma[only_bind_into](config))
1872+
t = node2.getDataFlowType()
18591873
)
18601874
)
18611875
}
@@ -1869,9 +1883,19 @@ private module LocalFlowBigStep {
18691883
NodeEx node1, FlowState state1, NodeEx node2, FlowState state2, boolean preservesValue,
18701884
AccessPathFrontNil apf, Configuration config, LocalCallContext callContext
18711885
) {
1872-
localFlowStepPlus(node1, state1, node2, state2, preservesValue, apf.getType(), config,
1873-
callContext) and
1874-
localFlowExit(node2, state2, config)
1886+
localFlowStepPlus(node1, state1, node2, preservesValue, apf.getType(), config, callContext) and
1887+
localFlowExit(node2, state1, config) and
1888+
state1 = state2
1889+
or
1890+
additionalLocalFlowStepNodeCand2(node1, state1, node2, state2, config) and
1891+
state1 != state2 and
1892+
preservesValue = false and
1893+
apf = TFrontNil(node2.getDataFlowType()) and
1894+
callContext.relevantFor(node1.getEnclosingCallable()) and
1895+
not exists(DataFlowCall call | call = callContext.(LocalCallContextSpecificCall).getCall() |
1896+
isUnreachableInCallCached(node1.asNode(), call) or
1897+
isUnreachableInCallCached(node2.asNode(), call)
1898+
)
18751899
}
18761900
}
18771901

@@ -2745,10 +2769,10 @@ private module Stage4 {
27452769

27462770
bindingset[node, cc, config]
27472771
private LocalCc getLocalCc(NodeEx node, Cc cc, Configuration config) {
2748-
localFlowEntry(node, _, config) and
27492772
result =
27502773
getLocalCallContext(pragma[only_bind_into](pragma[only_bind_out](cc)),
2751-
node.getEnclosingCallable())
2774+
node.getEnclosingCallable()) and
2775+
exists(config)
27522776
}
27532777

27542778
private predicate localStep(

0 commit comments

Comments
 (0)