Skip to content

Commit 3baad89

Browse files
alexrfordalexrford
committed
Merge remote-tracking branch 'origin/main' into rb/sensitive-get-query
2 parents 24dad55 + 7d23170 commit 3baad89

File tree

536 files changed

+6030
-2269
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

536 files changed

+6030
-2269
lines changed

‎.github/workflows/qhelp-pr-preview.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ jobs:
5252
id: changes
5353
run: |
5454
(git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.qhelp$' | grep -z -v '.inc.qhelp';
55-
git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename | xargs --null -rn1 git grep -z -l) |
55+
git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename -z | xargs --null -rn1 git grep -z -l) |
5656
grep -z '.qhelp$' | grep -z -v '^-' | sort -z -u > "${RUNNER_TEMP}/paths.txt"
5757
5858
- name: QHelp preview

‎config/identical-files.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@
7070
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
7171
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll",
7272
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
73-
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforregexp/TaintTrackingImpl.qll",
7473
"swift/ql/lib/codeql/swift/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
7574
],
7675
"DataFlow Java/C++/C#/Python Consistency checks": [

‎cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,9 @@ abstract class Configuration extends string {
163163
/**
164164
* Holds if data may flow from some source to `sink` for this configuration.
165165
*/
166-
predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
166+
predicate hasFlowTo(Node sink) {
167+
sink = any(PathNodeSink n | this = n.getConfiguration()).getNodeEx().asNode()
168+
}
167169

168170
/**
169171
* Holds if data may flow from some source to `sink` for this configuration.
@@ -836,13 +838,13 @@ private module Stage1 implements StageSig {
836838
* by `revFlow`.
837839
*/
838840
pragma[nomagic]
839-
predicate revFlowIsReadAndStored(Content c, Configuration conf) {
841+
additional predicate revFlowIsReadAndStored(Content c, Configuration conf) {
840842
revFlowConsCand(c, conf) and
841843
revFlowStore(c, _, _, conf)
842844
}
843845

844846
pragma[nomagic]
845-
predicate viableReturnPosOutNodeCandFwd1(
847+
additional predicate viableReturnPosOutNodeCandFwd1(
846848
DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
847849
) {
848850
fwdFlowReturnPosition(pos, _, config) and
@@ -858,7 +860,7 @@ private module Stage1 implements StageSig {
858860
}
859861

860862
pragma[nomagic]
861-
predicate viableParamArgNodeCandFwd1(
863+
additional predicate viableParamArgNodeCandFwd1(
862864
DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
863865
) {
864866
viableParamArgEx(call, p, arg) and
@@ -905,7 +907,7 @@ private module Stage1 implements StageSig {
905907
)
906908
}
907909

908-
predicate revFlowState(FlowState state, Configuration config) {
910+
additional predicate revFlowState(FlowState state, Configuration config) {
909911
exists(NodeEx node |
910912
sinkNode(node, state, config) and
911913
revFlow(node, _, pragma[only_bind_into](config)) and
@@ -997,7 +999,7 @@ private module Stage1 implements StageSig {
997999
)
9981000
}
9991001

1000-
predicate stats(
1002+
additional predicate stats(
10011003
boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
10021004
) {
10031005
fwd = true and
@@ -1258,7 +1260,7 @@ private module MkStage<StageSig PrevStage> {
12581260
* argument.
12591261
*/
12601262
pragma[nomagic]
1261-
predicate fwdFlow(
1263+
additional predicate fwdFlow(
12621264
NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
12631265
) {
12641266
fwdFlow0(node, state, cc, argAp, ap, config) and
@@ -1482,7 +1484,7 @@ private module MkStage<StageSig PrevStage> {
14821484
* the access path of the returned value.
14831485
*/
14841486
pragma[nomagic]
1485-
predicate revFlow(
1487+
additional predicate revFlow(
14861488
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
14871489
) {
14881490
revFlow0(node, state, toReturn, returnAp, ap, config) and
@@ -1660,7 +1662,7 @@ private module MkStage<StageSig PrevStage> {
16601662
)
16611663
}
16621664

1663-
predicate revFlow(NodeEx node, FlowState state, Configuration config) {
1665+
additional predicate revFlow(NodeEx node, FlowState state, Configuration config) {
16641666
revFlow(node, state, _, _, _, config)
16651667
}
16661668

@@ -1673,11 +1675,13 @@ private module MkStage<StageSig PrevStage> {
16731675

16741676
// use an alias as a workaround for bad functionality-induced joins
16751677
pragma[nomagic]
1676-
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
1678+
additional predicate revFlowAlias(NodeEx node, Configuration config) {
1679+
revFlow(node, _, _, _, _, config)
1680+
}
16771681

16781682
// use an alias as a workaround for bad functionality-induced joins
16791683
pragma[nomagic]
1680-
predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
1684+
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
16811685
revFlow(node, state, ap, config)
16821686
}
16831687

@@ -1698,7 +1702,7 @@ private module MkStage<StageSig PrevStage> {
16981702
)
16991703
}
17001704

1701-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
1705+
additional predicate consCand(TypedContent tc, Ap ap, Configuration config) {
17021706
revConsCand(tc, ap, config) and
17031707
validAp(ap, config)
17041708
}
@@ -1740,7 +1744,7 @@ private module MkStage<StageSig PrevStage> {
17401744
)
17411745
}
17421746

1743-
predicate stats(
1747+
additional predicate stats(
17441748
boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
17451749
) {
17461750
fwd = true and
@@ -2925,12 +2929,17 @@ abstract private class PathNodeImpl extends PathNode {
29252929
result = this.getASuccessorImpl()
29262930
}
29272931

2928-
final PathNodeImpl getANonHiddenSuccessor() {
2929-
result = this.getASuccessorImpl().getASuccessorIfHidden*() and
2930-
not this.isHidden() and
2932+
pragma[nomagic]
2933+
private PathNodeImpl getANonHiddenSuccessor0() {
2934+
result = this.getASuccessorIfHidden*() and
29312935
not result.isHidden()
29322936
}
29332937

2938+
final PathNodeImpl getANonHiddenSuccessor() {
2939+
result = this.getASuccessorImpl().getANonHiddenSuccessor0() and
2940+
not this.isHidden()
2941+
}
2942+
29342943
abstract NodeEx getNodeEx();
29352944

29362945
predicate isHidden() {

‎cpp/ql/lib/experimental/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll

Lines changed: 25 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,9 @@ abstract class Configuration extends string {
163163
/**
164164
* Holds if data may flow from some source to `sink` for this configuration.
165165
*/
166-
predicate hasFlowTo(Node sink) { this.hasFlow(_, sink) }
166+
predicate hasFlowTo(Node sink) {
167+
sink = any(PathNodeSink n | this = n.getConfiguration()).getNodeEx().asNode()
168+
}
167169

168170
/**
169171
* Holds if data may flow from some source to `sink` for this configuration.
@@ -836,13 +838,13 @@ private module Stage1 implements StageSig {
836838
* by `revFlow`.
837839
*/
838840
pragma[nomagic]
839-
predicate revFlowIsReadAndStored(Content c, Configuration conf) {
841+
additional predicate revFlowIsReadAndStored(Content c, Configuration conf) {
840842
revFlowConsCand(c, conf) and
841843
revFlowStore(c, _, _, conf)
842844
}
843845

844846
pragma[nomagic]
845-
predicate viableReturnPosOutNodeCandFwd1(
847+
additional predicate viableReturnPosOutNodeCandFwd1(
846848
DataFlowCall call, ReturnPosition pos, NodeEx out, Configuration config
847849
) {
848850
fwdFlowReturnPosition(pos, _, config) and
@@ -858,7 +860,7 @@ private module Stage1 implements StageSig {
858860
}
859861

860862
pragma[nomagic]
861-
predicate viableParamArgNodeCandFwd1(
863+
additional predicate viableParamArgNodeCandFwd1(
862864
DataFlowCall call, ParamNodeEx p, ArgNodeEx arg, Configuration config
863865
) {
864866
viableParamArgEx(call, p, arg) and
@@ -905,7 +907,7 @@ private module Stage1 implements StageSig {
905907
)
906908
}
907909

908-
predicate revFlowState(FlowState state, Configuration config) {
910+
additional predicate revFlowState(FlowState state, Configuration config) {
909911
exists(NodeEx node |
910912
sinkNode(node, state, config) and
911913
revFlow(node, _, pragma[only_bind_into](config)) and
@@ -997,7 +999,7 @@ private module Stage1 implements StageSig {
997999
)
9981000
}
9991001

1000-
predicate stats(
1002+
additional predicate stats(
10011003
boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
10021004
) {
10031005
fwd = true and
@@ -1258,7 +1260,7 @@ private module MkStage<StageSig PrevStage> {
12581260
* argument.
12591261
*/
12601262
pragma[nomagic]
1261-
predicate fwdFlow(
1263+
additional predicate fwdFlow(
12621264
NodeEx node, FlowState state, Cc cc, ApOption argAp, Ap ap, Configuration config
12631265
) {
12641266
fwdFlow0(node, state, cc, argAp, ap, config) and
@@ -1482,7 +1484,7 @@ private module MkStage<StageSig PrevStage> {
14821484
* the access path of the returned value.
14831485
*/
14841486
pragma[nomagic]
1485-
predicate revFlow(
1487+
additional predicate revFlow(
14861488
NodeEx node, FlowState state, boolean toReturn, ApOption returnAp, Ap ap, Configuration config
14871489
) {
14881490
revFlow0(node, state, toReturn, returnAp, ap, config) and
@@ -1660,7 +1662,7 @@ private module MkStage<StageSig PrevStage> {
16601662
)
16611663
}
16621664

1663-
predicate revFlow(NodeEx node, FlowState state, Configuration config) {
1665+
additional predicate revFlow(NodeEx node, FlowState state, Configuration config) {
16641666
revFlow(node, state, _, _, _, config)
16651667
}
16661668

@@ -1673,11 +1675,13 @@ private module MkStage<StageSig PrevStage> {
16731675

16741676
// use an alias as a workaround for bad functionality-induced joins
16751677
pragma[nomagic]
1676-
predicate revFlowAlias(NodeEx node, Configuration config) { revFlow(node, _, _, _, _, config) }
1678+
additional predicate revFlowAlias(NodeEx node, Configuration config) {
1679+
revFlow(node, _, _, _, _, config)
1680+
}
16771681

16781682
// use an alias as a workaround for bad functionality-induced joins
16791683
pragma[nomagic]
1680-
predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
1684+
additional predicate revFlowAlias(NodeEx node, FlowState state, Ap ap, Configuration config) {
16811685
revFlow(node, state, ap, config)
16821686
}
16831687

@@ -1698,7 +1702,7 @@ private module MkStage<StageSig PrevStage> {
16981702
)
16991703
}
17001704

1701-
predicate consCand(TypedContent tc, Ap ap, Configuration config) {
1705+
additional predicate consCand(TypedContent tc, Ap ap, Configuration config) {
17021706
revConsCand(tc, ap, config) and
17031707
validAp(ap, config)
17041708
}
@@ -1740,7 +1744,7 @@ private module MkStage<StageSig PrevStage> {
17401744
)
17411745
}
17421746

1743-
predicate stats(
1747+
additional predicate stats(
17441748
boolean fwd, int nodes, int fields, int conscand, int states, int tuples, Configuration config
17451749
) {
17461750
fwd = true and
@@ -2925,12 +2929,17 @@ abstract private class PathNodeImpl extends PathNode {
29252929
result = this.getASuccessorImpl()
29262930
}
29272931

2928-
final PathNodeImpl getANonHiddenSuccessor() {
2929-
result = this.getASuccessorImpl().getASuccessorIfHidden*() and
2930-
not this.isHidden() and
2932+
pragma[nomagic]
2933+
private PathNodeImpl getANonHiddenSuccessor0() {
2934+
result = this.getASuccessorIfHidden*() and
29312935
not result.isHidden()
29322936
}
29332937

2938+
final PathNodeImpl getANonHiddenSuccessor() {
2939+
result = this.getASuccessorImpl().getANonHiddenSuccessor0() and
2940+
not this.isHidden()
2941+
}
2942+
29342943
abstract NodeEx getNodeEx();
29352944

29362945
predicate isHidden() {

0 commit comments

Comments
 (0)