Skip to content

Commit c188aa8

Browse files
asgerfasgerf
authored
Merge branch 'main' into js/madman-prep
2 parents a60cace + 7ca0144 commit c188aa8

File tree

487 files changed

+54361
-5435
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

487 files changed

+54361
-5435
lines changed

‎.github/workflows/js-ml-tests.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ on:
1212
paths:
1313
- "javascript/ql/experimental/adaptivethreatmodeling/**"
1414
- .github/workflows/js-ml-tests.yml
15+
workflow_dispatch:
1516

1617
defaults:
1718
run:

‎config/identical-files.json

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -22,21 +22,24 @@
2222
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll",
2323
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll",
2424
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll",
25+
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplForContentDataFlow.qll",
2526
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl.qll",
2627
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl2.qll",
2728
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl3.qll",
2829
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImpl4.qll",
2930
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl.qll",
3031
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImpl2.qll",
31-
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForLibraries.qll"
32+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplForLibraries.qll",
33+
"swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImpl.qll"
3234
],
3335
"DataFlow Java/C++/C#/Python Common": [
3436
"java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll",
3537
"cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll",
3638
"cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll",
3739
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplCommon.qll",
3840
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplCommon.qll",
39-
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll"
41+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplCommon.qll",
42+
"swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImplCommon.qll"
4043
],
4144
"TaintTracking::Configuration Java/C++/C#/Python": [
4245
"cpp/ql/lib/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
@@ -57,15 +60,17 @@
5760
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking3/TaintTrackingImpl.qll",
5861
"python/ql/lib/semmle/python/dataflow/new/internal/tainttracking4/TaintTrackingImpl.qll",
5962
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttracking1/TaintTrackingImpl.qll",
60-
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll"
63+
"ruby/ql/lib/codeql/ruby/dataflow/internal/tainttrackingforlibraries/TaintTrackingImpl.qll",
64+
"swift/ql/lib/codeql/swift/dataflow/internal/tainttracking1/TaintTrackingImpl.qll"
6165
],
6266
"DataFlow Java/C++/C#/Python Consistency checks": [
6367
"java/ql/lib/semmle/code/java/dataflow/internal/DataFlowImplConsistency.qll",
6468
"cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplConsistency.qll",
6569
"cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplConsistency.qll",
6670
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
6771
"python/ql/lib/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll",
68-
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplConsistency.qll"
72+
"ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowImplConsistency.qll",
73+
"swift/ql/lib/codeql/swift/dataflow/internal/DataFlowImplConsistency.qll"
6974
],
7075
"DataFlow Java/C# Flow Summaries": [
7176
"java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
@@ -458,7 +463,8 @@
458463
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
459464
"csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll",
460465
"ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll",
461-
"cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll"
466+
"cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll",
467+
"swift/ql/lib/codeql/swift/dataflow/internal/SsaImplCommon.qll"
462468
],
463469
"CryptoAlgorithms Python/JS/Ruby": [
464470
"javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",
@@ -519,7 +525,8 @@
519525
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll",
520526
"java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
521527
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
522-
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll"
528+
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll",
529+
"python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll"
523530
],
524531
"IncompleteUrlSubstringSanitization": [
525532
"javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll",
@@ -537,7 +544,8 @@
537544
],
538545
"ApiGraphModels": [
539546
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
540-
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll"
547+
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll",
548+
"python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll"
541549
],
542550
"TaintedFormatStringQuery Ruby/JS": [
543551
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringQuery.qll",
@@ -559,4 +567,4 @@
559567
"javascript/ql/src/Expressions/TypoDatabase.qll",
560568
"ql/ql/src/codeql_ql/style/TypoDatabase.qll"
561569
]
562-
}
570+
}

‎cpp/ql/lib/semmle/code/cpp/dataflow/internal/DataFlowImplCommon.qll

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -788,24 +788,31 @@ private module Cached {
788788
cached
789789
predicate readSet(Node node1, ContentSet c, Node node2) { readStep(node1, c, node2) }
790790

791+
cached
792+
predicate storeSet(
793+
Node node1, ContentSet c, Node node2, DataFlowType contentType, DataFlowType containerType
794+
) {
795+
storeStep(node1, c, node2) and
796+
contentType = getNodeDataFlowType(node1) and
797+
containerType = getNodeDataFlowType(node2)
798+
or
799+
exists(Node n1, Node n2 |
800+
n1 = node1.(PostUpdateNode).getPreUpdateNode() and
801+
n2 = node2.(PostUpdateNode).getPreUpdateNode()
802+
|
803+
argumentValueFlowsThrough(n2, TReadStepTypesSome(containerType, c, contentType), n1)
804+
or
805+
readSet(n2, c, n1) and
806+
contentType = getNodeDataFlowType(n1) and
807+
containerType = getNodeDataFlowType(n2)
808+
)
809+
}
810+
791811
private predicate store(
792812
Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
793813
) {
794-
exists(ContentSet cs | c = cs.getAStoreContent() |
795-
storeStep(node1, cs, node2) and
796-
contentType = getNodeDataFlowType(node1) and
797-
containerType = getNodeDataFlowType(node2)
798-
or
799-
exists(Node n1, Node n2 |
800-
n1 = node1.(PostUpdateNode).getPreUpdateNode() and
801-
n2 = node2.(PostUpdateNode).getPreUpdateNode()
802-
|
803-
argumentValueFlowsThrough(n2, TReadStepTypesSome(containerType, cs, contentType), n1)
804-
or
805-
readSet(n2, cs, n1) and
806-
contentType = getNodeDataFlowType(n1) and
807-
containerType = getNodeDataFlowType(n2)
808-
)
814+
exists(ContentSet cs |
815+
c = cs.getAStoreContent() and storeSet(node1, cs, node2, contentType, containerType)
809816
)
810817
}
811818

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplCommon.qll

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -788,24 +788,31 @@ private module Cached {
788788
cached
789789
predicate readSet(Node node1, ContentSet c, Node node2) { readStep(node1, c, node2) }
790790

791+
cached
792+
predicate storeSet(
793+
Node node1, ContentSet c, Node node2, DataFlowType contentType, DataFlowType containerType
794+
) {
795+
storeStep(node1, c, node2) and
796+
contentType = getNodeDataFlowType(node1) and
797+
containerType = getNodeDataFlowType(node2)
798+
or
799+
exists(Node n1, Node n2 |
800+
n1 = node1.(PostUpdateNode).getPreUpdateNode() and
801+
n2 = node2.(PostUpdateNode).getPreUpdateNode()
802+
|
803+
argumentValueFlowsThrough(n2, TReadStepTypesSome(containerType, c, contentType), n1)
804+
or
805+
readSet(n2, c, n1) and
806+
contentType = getNodeDataFlowType(n1) and
807+
containerType = getNodeDataFlowType(n2)
808+
)
809+
}
810+
791811
private predicate store(
792812
Node node1, Content c, Node node2, DataFlowType contentType, DataFlowType containerType
793813
) {
794-
exists(ContentSet cs | c = cs.getAStoreContent() |
795-
storeStep(node1, cs, node2) and
796-
contentType = getNodeDataFlowType(node1) and
797-
containerType = getNodeDataFlowType(node2)
798-
or
799-
exists(Node n1, Node n2 |
800-
n1 = node1.(PostUpdateNode).getPreUpdateNode() and
801-
n2 = node2.(PostUpdateNode).getPreUpdateNode()
802-
|
803-
argumentValueFlowsThrough(n2, TReadStepTypesSome(containerType, cs, contentType), n1)
804-
or
805-
readSet(n2, cs, n1) and
806-
contentType = getNodeDataFlowType(n1) and
807-
containerType = getNodeDataFlowType(n2)
808-
)
814+
exists(ContentSet cs |
815+
c = cs.getAStoreContent() and storeSet(node1, cs, node2, contentType, containerType)
809816
)
810817
}
811818

‎cpp/ql/src/Likely Bugs/Memory Management/PotentialBufferOverflow.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
* @deprecated This query is deprecated, use
1414
* Potentially overrunning write (`cpp/overrunning-write`) and
1515
* Potentially overrunning write with float to string conversion
16-
* (`cpp/overrunning-write-with-float) instead.
16+
* (`cpp/overrunning-write-with-float`) instead.
1717
*/
1818

1919
import cpp

‎cpp/ql/src/experimental/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser.ql

Lines changed: 38 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,36 @@
1717
import cpp
1818
import semmle.code.cpp.dataflow.DataFlow
1919

20+
/**
21+
* A Linux system call.
22+
*/
23+
class SystemCallFunction extends Function {
24+
SystemCallFunction() {
25+
exists(MacroInvocation m |
26+
m.getMacro().getName().matches("SYSCALL\\_DEFINE%") and
27+
this = m.getEnclosingFunction()
28+
)
29+
}
30+
}
31+
32+
/**
33+
* A value that comes from a Linux system call (sources).
34+
*/
35+
class SystemCallSource extends DataFlow::Node {
36+
SystemCallSource() {
37+
exists(FunctionCall fc |
38+
fc.getTarget() instanceof SystemCallFunction and
39+
(
40+
this.asDefiningArgument() = fc.getAnArgument().getAChild*() or
41+
this.asExpr() = fc
42+
)
43+
)
44+
}
45+
}
46+
47+
/**
48+
* Macros used to check the value (barriers).
49+
*/
2050
class WriteAccessCheckMacro extends Macro {
2151
VariableAccess va;
2252

@@ -28,6 +58,9 @@ class WriteAccessCheckMacro extends Macro {
2858
VariableAccess getArgument() { result = va }
2959
}
3060

61+
/**
62+
* The `unsafe_put_user` macro and its uses (sinks).
63+
*/
3164
class UnSafePutUserMacro extends Macro {
3265
PointerDereferenceExpr writeUserPtr;
3366

@@ -42,15 +75,13 @@ class UnSafePutUserMacro extends Macro {
4275
}
4376
}
4477

45-
class ExploitableUserModePtrParam extends Parameter {
78+
class ExploitableUserModePtrParam extends SystemCallSource {
4679
ExploitableUserModePtrParam() {
47-
not exists(WriteAccessCheckMacro writeAccessCheck |
48-
DataFlow::localFlow(DataFlow::parameterNode(this),
49-
DataFlow::exprNode(writeAccessCheck.getArgument()))
50-
) and
5180
exists(UnSafePutUserMacro unsafePutUser |
52-
DataFlow::localFlow(DataFlow::parameterNode(this),
53-
DataFlow::exprNode(unsafePutUser.getUserModePtr()))
81+
DataFlow::localFlow(this, DataFlow::exprNode(unsafePutUser.getUserModePtr()))
82+
) and
83+
not exists(WriteAccessCheckMacro writeAccessCheck |
84+
DataFlow::localFlow(this, DataFlow::exprNode(writeAccessCheck.getArgument()))
5485
)
5586
}
5687
}

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/NoCheckBeforeUnsafePutUser.expected

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
1-
| test.cpp:14:16:14:16 | p | unsafe_put_user write user-mode pointer $@ without check. | test.cpp:14:16:14:16 | p | p |
1+
| test.cpp:20:21:20:22 | ref arg & ... | unsafe_put_user write user-mode pointer $@ without check. | test.cpp:20:21:20:22 | ref arg & ... | ref arg & ... |
2+
| test.cpp:41:21:41:22 | ref arg & ... | unsafe_put_user write user-mode pointer $@ without check. | test.cpp:41:21:41:22 | ref arg & ... | ref arg & ... |
3+
| test.cpp:69:21:69:27 | ref arg & ... | unsafe_put_user write user-mode pointer $@ without check. | test.cpp:69:21:69:27 | ref arg & ... | ref arg & ... |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-020/NoCheckBeforeUnsafePutUser/test.cpp

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11

22
typedef unsigned long size_t;
33

4-
void SYSC_SOMESYSTEMCALL(void *param);
4+
#define SYSCALL_DEFINE(name, ...) \
5+
void do_sys_##name(); \
6+
void sys_##name(...) { do_sys_##name(); } \
7+
void do_sys_##name()
8+
SYSCALL_DEFINE(somesystemcall, void *param) {};
59

610
bool user_access_begin_impl(const void *where, size_t sz);
711
void user_access_end_impl();
@@ -13,14 +17,14 @@ void unsafe_put_user_impl(int what, const void *where, size_t sz);
1317

1418
void test1(int p)
1519
{
16-
SYSC_SOMESYSTEMCALL(&p);
20+
sys_somesystemcall(&p);
1721

1822
unsafe_put_user(123, &p); // BAD
1923
}
2024

2125
void test2(int p)
2226
{
23-
SYSC_SOMESYSTEMCALL(&p);
27+
sys_somesystemcall(&p);
2428

2529
if (user_access_begin(&p, sizeof(p)))
2630
{
@@ -34,16 +38,16 @@ void test3()
3438
{
3539
int v;
3640

37-
SYSC_SOMESYSTEMCALL(&v);
41+
sys_somesystemcall(&v);
3842

39-
unsafe_put_user(123, &v); // BAD [NOT DETECTED]
43+
unsafe_put_user(123, &v); // BAD
4044
}
4145

4246
void test4()
4347
{
4448
int v;
4549

46-
SYSC_SOMESYSTEMCALL(&v);
50+
sys_somesystemcall(&v);
4751

4852
if (user_access_begin(&v, sizeof(v)))
4953
{
@@ -62,16 +66,16 @@ void test5()
6266
{
6367
data myData;
6468

65-
SYSC_SOMESYSTEMCALL(&myData);
69+
sys_somesystemcall(&myData);
6670

67-
unsafe_put_user(123, &(myData.x)); // BAD [NOT DETECTED]
71+
unsafe_put_user(123, &(myData.x)); // BAD
6872
}
6973

7074
void test6()
7175
{
7276
data myData;
7377

74-
SYSC_SOMESYSTEMCALL(&myData);
78+
sys_somesystemcall(&myData);
7579

7680
if (user_access_begin(&myData, sizeof(myData)))
7781
{

‎csharp/documentation/library-coverage/coverage.csv

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,27 @@
11
package,sink,source,summary,sink:code,sink:html,sink:remote,sink:sql,sink:xss,source:local,summary:taint,summary:value
22
Dapper,55,,,,,,55,,,,
3+
JsonToItemsTaskFactory,,,7,,,,,,,7,
34
Microsoft.ApplicationBlocks.Data,28,,,,,,28,,,,
5+
Microsoft.CSharp,,,24,,,,,,,24,
46
Microsoft.EntityFrameworkCore,6,,,,,,6,,,,
5-
Microsoft.Extensions.Primitives,,,54,,,,,,,54,
6-
Microsoft.VisualBasic,,,4,,,,,,,,4
7+
Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,15,
8+
Microsoft.Extensions.Caching.Memory,,,46,,,,,,,45,1
9+
Microsoft.Extensions.Configuration,,,83,,,,,,,80,3
10+
Microsoft.Extensions.DependencyInjection,,,62,,,,,,,62,
11+
Microsoft.Extensions.DependencyModel,,,12,,,,,,,12,
12+
Microsoft.Extensions.FileProviders,,,15,,,,,,,15,
13+
Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,13,2
14+
Microsoft.Extensions.Hosting,,,17,,,,,,,16,1
15+
Microsoft.Extensions.Http,,,10,,,,,,,10,
16+
Microsoft.Extensions.Logging,,,37,,,,,,,37,
17+
Microsoft.Extensions.Options,,,8,,,,,,,8,
18+
Microsoft.Extensions.Primitives,,,63,,,,,,,63,
19+
Microsoft.Interop,,,27,,,,,,,27,
20+
Microsoft.NET.Build.Tasks,,,1,,,,,,,1,
21+
Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,4,
22+
Microsoft.VisualBasic,,,9,,,,,,,5,4
23+
Microsoft.Win32,,,8,,,,,,,8,
724
MySql.Data.MySqlClient,48,,,,,,48,,,,
825
Newtonsoft.Json,,,91,,,,,,,73,18
926
ServiceStack,194,,7,27,,75,92,,,7,
10-
System,28,3,2336,,4,,23,1,3,611,1725
27+
System,28,3,12038,,4,,23,1,3,10096,1942

‎csharp/documentation/library-coverage/coverage.rst

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ C# framework & library support
88

99
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
1010
`ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
11-
System,"``System.*``, ``System``",3,2336,28,5
12-
Others,"``Dapper``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Primitives``, ``Microsoft.VisualBasic``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``",,149,137,
13-
Totals,,3,2492,359,5
11+
System,"``System.*``, ``System``",3,12038,28,5
12+
Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``",,554,137,
13+
Totals,,3,12599,359,5
1414

0 commit comments

Comments
 (0)