Skip to content

Commit a2a82fc

Browse files
smiddy007smiddy007
authored
Merge branch 'main' into JS-Allow-Truncated-Hash-Forge-NonKeyCipher
2 parents bda0ef3 + 95b8a22 commit a2a82fc

File tree

91 files changed

+3035
-924
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+3035
-924
lines changed

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlow.qll

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,3 +361,52 @@ module MergePathGraph<
361361
}
362362
}
363363
}
364+
365+
/**
366+
* Constructs a `PathGraph` from three `PathGraph`s by disjoint union.
367+
*/
368+
module MergePathGraph3<
369+
PathNodeSig PathNode1, PathNodeSig PathNode2, PathNodeSig PathNode3,
370+
PathGraphSig<PathNode1> Graph1, PathGraphSig<PathNode2> Graph2, PathGraphSig<PathNode3> Graph3>
371+
{
372+
private module MergedInner = MergePathGraph<PathNode1, PathNode2, Graph1, Graph2>;
373+
374+
private module Merged =
375+
MergePathGraph<MergedInner::PathNode, PathNode3, MergedInner::PathGraph, Graph3>;
376+
377+
/** A node in a graph of path explanations that is formed by disjoint union of the three given graphs. */
378+
class PathNode instanceof Merged::PathNode {
379+
/** Gets this as a projection on the first given `PathGraph`. */
380+
PathNode1 asPathNode1() { result = super.asPathNode1().asPathNode1() }
381+
382+
/** Gets this as a projection on the second given `PathGraph`. */
383+
PathNode2 asPathNode2() { result = super.asPathNode1().asPathNode2() }
384+
385+
/** Gets this as a projection on the third given `PathGraph`. */
386+
PathNode3 asPathNode3() { result = super.asPathNode2() }
387+
388+
/** Gets a textual representation of this element. */
389+
string toString() { result = super.toString() }
390+
391+
/**
392+
* Holds if this element is at the specified location.
393+
* The location spans column `startcolumn` of line `startline` to
394+
* column `endcolumn` of line `endline` in file `filepath`.
395+
* For more information, see
396+
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
397+
*/
398+
predicate hasLocationInfo(
399+
string filepath, int startline, int startcolumn, int endline, int endcolumn
400+
) {
401+
super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
402+
}
403+
404+
/** Gets the underlying `Node`. */
405+
Node getNode() { result = super.getNode() }
406+
}
407+
408+
/**
409+
* Provides the query predicates needed to include a graph in a path-problem query.
410+
*/
411+
module PathGraph = Merged::PathGraph;
412+
}

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlow.qll

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,3 +361,52 @@ module MergePathGraph<
361361
}
362362
}
363363
}
364+
365+
/**
366+
* Constructs a `PathGraph` from three `PathGraph`s by disjoint union.
367+
*/
368+
module MergePathGraph3<
369+
PathNodeSig PathNode1, PathNodeSig PathNode2, PathNodeSig PathNode3,
370+
PathGraphSig<PathNode1> Graph1, PathGraphSig<PathNode2> Graph2, PathGraphSig<PathNode3> Graph3>
371+
{
372+
private module MergedInner = MergePathGraph<PathNode1, PathNode2, Graph1, Graph2>;
373+
374+
private module Merged =
375+
MergePathGraph<MergedInner::PathNode, PathNode3, MergedInner::PathGraph, Graph3>;
376+
377+
/** A node in a graph of path explanations that is formed by disjoint union of the three given graphs. */
378+
class PathNode instanceof Merged::PathNode {
379+
/** Gets this as a projection on the first given `PathGraph`. */
380+
PathNode1 asPathNode1() { result = super.asPathNode1().asPathNode1() }
381+
382+
/** Gets this as a projection on the second given `PathGraph`. */
383+
PathNode2 asPathNode2() { result = super.asPathNode1().asPathNode2() }
384+
385+
/** Gets this as a projection on the third given `PathGraph`. */
386+
PathNode3 asPathNode3() { result = super.asPathNode2() }
387+
388+
/** Gets a textual representation of this element. */
389+
string toString() { result = super.toString() }
390+
391+
/**
392+
* Holds if this element is at the specified location.
393+
* The location spans column `startcolumn` of line `startline` to
394+
* column `endcolumn` of line `endline` in file `filepath`.
395+
* For more information, see
396+
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
397+
*/
398+
predicate hasLocationInfo(
399+
string filepath, int startline, int startcolumn, int endline, int endcolumn
400+
) {
401+
super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
402+
}
403+
404+
/** Gets the underlying `Node`. */
405+
Node getNode() { result = super.getNode() }
406+
}
407+
408+
/**
409+
* Provides the query predicates needed to include a graph in a path-problem query.
410+
*/
411+
module PathGraph = Merged::PathGraph;
412+
}

‎cpp/ql/test/query-tests/Critical/MemoryFreed/MemoryFreed.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@
8989
| test_free.cpp:216:10:216:10 | a |
9090
| test_free.cpp:220:10:220:10 | a |
9191
| test_free.cpp:227:24:227:45 | memory_descriptor_list |
92+
| test_free.cpp:233:14:233:15 | * ... |
93+
| test_free.cpp:239:14:239:15 | * ... |
94+
| test_free.cpp:245:10:245:11 | * ... |
9295
| virtual.cpp:18:10:18:10 | a |
9396
| virtual.cpp:19:10:19:10 | c |
9497
| virtual.cpp:38:10:38:10 | b |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/UseAfterFree.expected

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,20 @@ edges
1515
| test_free.cpp:101:10:101:10 | a | test_free.cpp:102:23:102:23 | a |
1616
| test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a |
1717
| test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a |
18+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
19+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
20+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
21+
| test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... |
22+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
23+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
24+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
25+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... |
26+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b |
27+
| test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b |
28+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
29+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
30+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
31+
| test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... |
1832
nodes
1933
| test_free.cpp:11:10:11:10 | a | semmle.label | a |
2034
| test_free.cpp:11:10:11:10 | a | semmle.label | a |
@@ -39,6 +53,19 @@ nodes
3953
| test_free.cpp:152:27:152:27 | a | semmle.label | a |
4054
| test_free.cpp:152:27:152:27 | a | semmle.label | a |
4155
| test_free.cpp:153:5:153:5 | a | semmle.label | a |
56+
| test_free.cpp:233:14:233:15 | * ... | semmle.label | * ... |
57+
| test_free.cpp:233:14:233:15 | * ... | semmle.label | * ... |
58+
| test_free.cpp:236:9:236:10 | * ... | semmle.label | * ... |
59+
| test_free.cpp:236:9:236:10 | * ... | semmle.label | * ... |
60+
| test_free.cpp:239:14:239:15 | * ... | semmle.label | * ... |
61+
| test_free.cpp:239:14:239:15 | * ... | semmle.label | * ... |
62+
| test_free.cpp:241:9:241:10 | * ... | semmle.label | * ... |
63+
| test_free.cpp:241:9:241:10 | * ... | semmle.label | * ... |
64+
| test_free.cpp:241:10:241:10 | b | semmle.label | b |
65+
| test_free.cpp:245:10:245:11 | * ... | semmle.label | * ... |
66+
| test_free.cpp:245:10:245:11 | * ... | semmle.label | * ... |
67+
| test_free.cpp:246:9:246:10 | * ... | semmle.label | * ... |
68+
| test_free.cpp:246:9:246:10 | * ... | semmle.label | * ... |
4269
subpaths
4370
#select
4471
| test_free.cpp:12:5:12:5 | a | test_free.cpp:11:10:11:10 | a | test_free.cpp:12:5:12:5 | a | Memory may have been previously freed by $@. | test_free.cpp:11:5:11:8 | call to free | call to free |
@@ -57,3 +84,17 @@ subpaths
5784
| test_free.cpp:102:23:102:23 | a | test_free.cpp:101:10:101:10 | a | test_free.cpp:102:23:102:23 | a | Memory may have been previously freed by $@. | test_free.cpp:101:5:101:8 | call to free | call to free |
5885
| test_free.cpp:153:5:153:5 | a | test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a | Memory may have been previously freed by $@. | test_free.cpp:152:22:152:25 | call to free | call to free |
5986
| test_free.cpp:153:5:153:5 | a | test_free.cpp:152:27:152:27 | a | test_free.cpp:153:5:153:5 | a | Memory may have been previously freed by $@. | test_free.cpp:152:22:152:25 | call to free | call to free |
87+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
88+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
89+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
90+
| test_free.cpp:236:9:236:10 | * ... | test_free.cpp:233:14:233:15 | * ... | test_free.cpp:236:9:236:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:233:9:233:12 | call to free | call to free |
91+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
92+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
93+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
94+
| test_free.cpp:241:9:241:10 | * ... | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:9:241:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
95+
| test_free.cpp:241:10:241:10 | b | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
96+
| test_free.cpp:241:10:241:10 | b | test_free.cpp:239:14:239:15 | * ... | test_free.cpp:241:10:241:10 | b | Memory may have been previously freed by $@. | test_free.cpp:239:9:239:12 | call to free | call to free |
97+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
98+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
99+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |
100+
| test_free.cpp:246:9:246:10 | * ... | test_free.cpp:245:10:245:11 | * ... | test_free.cpp:246:9:246:10 | * ... | Memory may have been previously freed by $@. | test_free.cpp:245:5:245:8 | call to free | call to free |

‎cpp/ql/test/query-tests/Critical/MemoryFreed/test_free.cpp

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,3 +227,21 @@ void test_ms_free(void * memory_descriptor_list) {
227227
MmFreePagesFromMdl(memory_descriptor_list); //GOOD
228228
ExFreePool(memory_descriptor_list); // GOOD
229229
}
230+
231+
void test_loop3(char ** a, char ** b) {
232+
if (*a) {
233+
free(*a);
234+
a++;
235+
}
236+
use(*a); // GOOD [FALSE POSITIVE]
237+
238+
for (;*b; b++) {
239+
free(*b);
240+
}
241+
use(*b); // GOOD [FALSE POSITIVE]
242+
}
243+
244+
void test_deref(char **a) {
245+
free(*a);
246+
use(*a); // GOOD [FALSE POSITIVE]
247+
}

‎csharp/ql/lib/ext/System.IO.model.yml

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,23 @@ extensions:
44
extensible: sourceModel
55
data:
66
- ["System.IO", "FileStream", False, "FileStream", "", "", "Argument[this]", "file", "manual"]
7+
- ["System.IO", "FileStream", False, "FileStream", "", "", "Argument[this]", "file-write", "manual"]
8+
- ["System.IO", "StreamWriter", False, "StreamWriter", "(System.String)", "", "Argument[this]", "file-write", "manual"]
9+
- ["System.IO", "StreamWriter", False, "StreamWriter", "(System.String,System.Boolean)", "", "Argument[this]", "file-write", "manual"]
10+
- ["System.IO", "StreamWriter", False, "StreamWriter", "(System.String,System.Boolean,System.Text.Encoding)", "", "Argument[this]", "file-write", "manual"]
11+
- ["System.IO", "StreamWriter", False, "StreamWriter", "(System.String,System.Boolean,System.Text.Encoding,System.Int32)", "", "Argument[this]", "file-write", "manual"]
12+
- ["System.IO", "StreamWriter", False, "StreamWriter", "(System.String,System.Text.Encoding,System.IO.FileStreamOptions)", "", "Argument[this]", "file-write", "manual"]
13+
- ["System.IO", "StreamWriter", False, "StreamWriter", "(System.String,System.IO.FileStreamOptions)", "", "Argument[this]", "file-write", "manual"]
14+
- ["System.IO", "File", False, "Open", "", "", "ReturnValue", "file-write", "manual"]
15+
- ["System.IO", "File", False, "OpenWrite", "", "", "ReturnValue", "file-write", "manual"]
16+
- ["System.IO", "File", False, "Create", "", "", "ReturnValue", "file-write", "manual"]
17+
- ["System.IO", "File", False, "CreateText", "", "", "ReturnValue", "file-write", "manual"]
18+
- ["System.IO", "File", False, "AppendText", "", "", "ReturnValue", "file-write", "manual"]
19+
- ["System.IO", "FileInfo", False, "Open", "", "", "ReturnValue", "file-write", "manual"]
20+
- ["System.IO", "FileInfo", False, "OpenWrite", "", "", "ReturnValue", "file-write", "manual"]
21+
- ["System.IO", "FileInfo", False, "Create", "", "", "ReturnValue", "file-write", "manual"]
22+
- ["System.IO", "FileInfo", False, "CreateText", "", "", "ReturnValue", "file-write", "manual"]
23+
- ["System.IO", "FileInfo", False, "AppendText", "", "", "ReturnValue", "file-write", "manual"]
724
- addsTo:
825
pack: codeql/csharp-all
926
extensible: summaryModel

‎csharp/ql/lib/semmle/code/csharp/dataflow/ExternalFlow.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ module ModelValidation {
215215
)
216216
or
217217
exists(string kind | sourceModel(_, _, _, _, _, _, _, kind, _) |
218-
not kind = ["local", "remote", "file"] and
218+
not kind = ["local", "remote", "file", "file-write"] and
219219
result = "Invalid kind \"" + kind + "\" in source model."
220220
)
221221
}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlow.qll

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -361,3 +361,52 @@ module MergePathGraph<
361361
}
362362
}
363363
}
364+
365+
/**
366+
* Constructs a `PathGraph` from three `PathGraph`s by disjoint union.
367+
*/
368+
module MergePathGraph3<
369+
PathNodeSig PathNode1, PathNodeSig PathNode2, PathNodeSig PathNode3,
370+
PathGraphSig<PathNode1> Graph1, PathGraphSig<PathNode2> Graph2, PathGraphSig<PathNode3> Graph3>
371+
{
372+
private module MergedInner = MergePathGraph<PathNode1, PathNode2, Graph1, Graph2>;
373+
374+
private module Merged =
375+
MergePathGraph<MergedInner::PathNode, PathNode3, MergedInner::PathGraph, Graph3>;
376+
377+
/** A node in a graph of path explanations that is formed by disjoint union of the three given graphs. */
378+
class PathNode instanceof Merged::PathNode {
379+
/** Gets this as a projection on the first given `PathGraph`. */
380+
PathNode1 asPathNode1() { result = super.asPathNode1().asPathNode1() }
381+
382+
/** Gets this as a projection on the second given `PathGraph`. */
383+
PathNode2 asPathNode2() { result = super.asPathNode1().asPathNode2() }
384+
385+
/** Gets this as a projection on the third given `PathGraph`. */
386+
PathNode3 asPathNode3() { result = super.asPathNode2() }
387+
388+
/** Gets a textual representation of this element. */
389+
string toString() { result = super.toString() }
390+
391+
/**
392+
* Holds if this element is at the specified location.
393+
* The location spans column `startcolumn` of line `startline` to
394+
* column `endcolumn` of line `endline` in file `filepath`.
395+
* For more information, see
396+
* [Locations](https://codeql.github.com/docs/writing-codeql-queries/providing-locations-in-codeql-queries/).
397+
*/
398+
predicate hasLocationInfo(
399+
string filepath, int startline, int startcolumn, int endline, int endcolumn
400+
) {
401+
super.hasLocationInfo(filepath, startline, startcolumn, endline, endcolumn)
402+
}
403+
404+
/** Gets the underlying `Node`. */
405+
Node getNode() { result = super.getNode() }
406+
}
407+
408+
/**
409+
* Provides the query predicates needed to include a graph in a path-problem query.
410+
*/
411+
module PathGraph = Merged::PathGraph;
412+
}

0 commit comments

Comments
 (0)