Skip to content

Commit c67c25d

Browse files
thiggy1342thiggy1342
authored
Merge branch 'main' into experimental-archive-api
2 parents ae86e0d + b16124d commit c67c25d

File tree

383 files changed

+5046
-758
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

383 files changed

+5046
-758
lines changed

‎.github/workflows/swift-codegen.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
run: |
2323
bazel run //swift/codegen
2424
git add swift
25-
git diff --exit-code --stat HEAD
25+
git diff --exit-code HEAD
2626
- name: Generate C++ files
2727
run: |
2828
bazel run //swift/codegen:codegen -- --generate=trap,cpp --cpp-output=$PWD/swift-generated-headers

‎config/identical-files.json

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,8 @@
7575
"DataFlow Java/C# Flow Summaries": [
7676
"java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
7777
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll",
78-
"ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll"
78+
"ruby/ql/lib/codeql/ruby/dataflow/internal/FlowSummaryImpl.qll",
79+
"swift/ql/lib/codeql/swift/dataflow/internal/FlowSummaryImpl.qll"
7980
],
8081
"SsaReadPosition Java/C#": [
8182
"java/ql/lib/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
@@ -527,7 +528,8 @@
527528
"java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
528529
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
529530
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll",
530-
"python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll"
531+
"python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll",
532+
"swift/ql/lib/codeql/swift/dataflow/internal/AccessPathSyntax.qll"
531533
],
532534
"IncompleteUrlSubstringSanitization": [
533535
"javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll",

‎cpp/ql/test/library-tests/dataflow/dataflow-tests/dataflow-ir-consistency.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -218,10 +218,10 @@ postWithInFlow
218218
| lambdas.cpp:20:11:20:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
219219
| lambdas.cpp:20:11:20:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
220220
| lambdas.cpp:20:11:20:11 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
221+
| lambdas.cpp:23:3:23:3 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
221222
| lambdas.cpp:23:3:23:14 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
222223
| lambdas.cpp:23:3:23:14 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
223224
| lambdas.cpp:23:3:23:14 | v [post update] | PostUpdateNode should not be the target of local flow. |
224-
| lambdas.cpp:23:15:23:15 | (reference dereference) [post update] | PostUpdateNode should not be the target of local flow. |
225225
| lambdas.cpp:28:7:28:7 | VariableAddress [post update] | PostUpdateNode should not be the target of local flow. |
226226
| lambdas.cpp:28:10:31:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |
227227
| lambdas.cpp:28:10:31:2 | FieldAddress [post update] | PostUpdateNode should not be the target of local flow. |

‎cpp/ql/test/library-tests/ir/ir/operand_locations.expected

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4833,6 +4833,9 @@
48334833
| ir.cpp:1043:24:1043:24 | SideEffect | ~m1043_20 |
48344834
| ir.cpp:1043:31:1043:31 | Address | &:r1043_9 |
48354835
| ir.cpp:1043:36:1043:55 | Address | &:r1043_11 |
4836+
| ir.cpp:1043:43:1043:43 | Address | &:r1043_16 |
4837+
| ir.cpp:1043:43:1043:43 | Arg(this) | this:r1043_16 |
4838+
| ir.cpp:1043:43:1043:43 | SideEffect | ~m1043_20 |
48364839
| ir.cpp:1043:43:1043:54 | Address | &:r1043_22 |
48374840
| ir.cpp:1043:43:1043:54 | Address | &:r1043_24 |
48384841
| ir.cpp:1043:43:1043:54 | Address | &:r1043_25 |
@@ -4853,11 +4856,8 @@
48534856
| ir.cpp:1043:45:1043:49 | SideEffect | ~m1043_4 |
48544857
| ir.cpp:1043:45:1043:49 | Unary | r1043_13 |
48554858
| ir.cpp:1043:45:1043:49 | Unary | r1043_15 |
4856-
| ir.cpp:1043:52:1043:52 | Address | &:r1043_16 |
4857-
| ir.cpp:1043:52:1043:52 | Arg(this) | this:r1043_16 |
4858-
| ir.cpp:1043:52:1043:52 | SideEffect | ~m1043_20 |
4859-
| ir.cpp:1043:54:1043:54 | Load | ~m1043_20 |
4860-
| ir.cpp:1043:54:1043:54 | Right | r1043_26 |
4859+
| ir.cpp:1043:53:1043:53 | Load | ~m1043_20 |
4860+
| ir.cpp:1043:53:1043:53 | Right | r1043_26 |
48614861
| ir.cpp:1043:58:1043:58 | ChiPartial | partial:m1043_9 |
48624862
| ir.cpp:1043:58:1043:58 | ChiTotal | total:m1043_3 |
48634863
| ir.cpp:1043:58:1043:58 | StoreValue | r1043_8 |
@@ -4972,6 +4972,9 @@
49724972
| ir.cpp:1047:34:1047:34 | SideEffect | ~m1047_20 |
49734973
| ir.cpp:1047:41:1047:41 | Address | &:r1047_9 |
49744974
| ir.cpp:1047:46:1047:65 | Address | &:r1047_11 |
4975+
| ir.cpp:1047:53:1047:53 | Address | &:r1047_16 |
4976+
| ir.cpp:1047:53:1047:53 | Arg(this) | this:r1047_16 |
4977+
| ir.cpp:1047:53:1047:53 | SideEffect | ~m1047_20 |
49754978
| ir.cpp:1047:53:1047:64 | Address | &:r1047_23 |
49764979
| ir.cpp:1047:53:1047:64 | Load | ~m1047_20 |
49774980
| ir.cpp:1047:53:1047:64 | StoreValue | r1047_24 |
@@ -4986,9 +4989,6 @@
49864989
| ir.cpp:1047:55:1047:59 | SideEffect | ~m1047_4 |
49874990
| ir.cpp:1047:55:1047:59 | Unary | r1047_13 |
49884991
| ir.cpp:1047:55:1047:59 | Unary | r1047_15 |
4989-
| ir.cpp:1047:62:1047:62 | Address | &:r1047_16 |
4990-
| ir.cpp:1047:62:1047:62 | Arg(this) | this:r1047_16 |
4991-
| ir.cpp:1047:62:1047:62 | SideEffect | ~m1047_20 |
49924992
| ir.cpp:1047:63:1047:63 | Right | r1047_22 |
49934993
| ir.cpp:1047:68:1047:68 | StoreValue | r1047_8 |
49944994
| ir.cpp:1047:68:1047:68 | Unary | r1047_7 |
@@ -5097,6 +5097,9 @@
50975097
| ir.cpp:1051:39:1051:39 | SideEffect | ~m1051_20 |
50985098
| ir.cpp:1051:46:1051:46 | Address | &:r1051_9 |
50995099
| ir.cpp:1051:51:1051:70 | Address | &:r1051_11 |
5100+
| ir.cpp:1051:58:1051:58 | Address | &:r1051_16 |
5101+
| ir.cpp:1051:58:1051:58 | Arg(this) | this:r1051_16 |
5102+
| ir.cpp:1051:58:1051:58 | SideEffect | ~m1051_20 |
51005103
| ir.cpp:1051:58:1051:69 | Address | &:r1051_22 |
51015104
| ir.cpp:1051:58:1051:69 | Address | &:r1051_24 |
51025105
| ir.cpp:1051:58:1051:69 | Address | &:r1051_26 |
@@ -5117,9 +5120,6 @@
51175120
| ir.cpp:1051:60:1051:64 | SideEffect | ~m1051_4 |
51185121
| ir.cpp:1051:60:1051:64 | Unary | r1051_13 |
51195122
| ir.cpp:1051:60:1051:64 | Unary | r1051_15 |
5120-
| ir.cpp:1051:67:1051:67 | Address | &:r1051_16 |
5121-
| ir.cpp:1051:67:1051:67 | Arg(this) | this:r1051_16 |
5122-
| ir.cpp:1051:67:1051:67 | SideEffect | ~m1051_20 |
51235123
| ir.cpp:1051:73:1051:73 | ChiPartial | partial:m1051_9 |
51245124
| ir.cpp:1051:73:1051:73 | ChiTotal | total:m1051_3 |
51255125
| ir.cpp:1051:73:1051:73 | StoreValue | r1051_8 |
@@ -5184,6 +5184,9 @@
51845184
| ir.cpp:1054:49:1054:49 | SideEffect | ~m1054_20 |
51855185
| ir.cpp:1054:56:1054:56 | Address | &:r1054_9 |
51865186
| ir.cpp:1054:61:1054:88 | Address | &:r1054_11 |
5187+
| ir.cpp:1054:68:1054:68 | Address | &:r1054_16 |
5188+
| ir.cpp:1054:68:1054:68 | Arg(this) | this:r1054_16 |
5189+
| ir.cpp:1054:68:1054:68 | SideEffect | ~m1054_20 |
51875190
| ir.cpp:1054:68:1054:87 | Address | &:r1054_37 |
51885191
| ir.cpp:1054:68:1054:87 | Load | ~m1054_20 |
51895192
| ir.cpp:1054:68:1054:87 | StoreValue | r1054_38 |
@@ -5198,9 +5201,6 @@
51985201
| ir.cpp:1054:70:1054:74 | SideEffect | ~m1054_4 |
51995202
| ir.cpp:1054:70:1054:74 | Unary | r1054_13 |
52005203
| ir.cpp:1054:70:1054:74 | Unary | r1054_15 |
5201-
| ir.cpp:1054:77:1054:77 | Address | &:r1054_16 |
5202-
| ir.cpp:1054:77:1054:77 | Arg(this) | this:r1054_16 |
5203-
| ir.cpp:1054:77:1054:77 | SideEffect | ~m1054_20 |
52045204
| ir.cpp:1054:78:1054:82 | Address | &:r1054_22 |
52055205
| ir.cpp:1054:78:1054:82 | Address | &:r1054_24 |
52065206
| ir.cpp:1054:78:1054:82 | Left | r1054_25 |

‎cpp/ql/test/library-tests/lambdas/captures/elements.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,10 +156,10 @@
156156
| captures.cpp:23:12:23:16 | x |
157157
| captures.cpp:23:12:23:16 | y |
158158
| captures.cpp:23:12:23:20 | ... + ... |
159+
| captures.cpp:23:16:23:16 | (reference dereference) |
159160
| captures.cpp:23:16:23:16 | definition of y |
160161
| captures.cpp:23:16:23:16 | y |
161162
| captures.cpp:23:16:23:16 | y |
162-
| captures.cpp:23:18:23:18 | (reference dereference) |
163163
| captures.cpp:23:20:23:20 | z |
164164
| captures.cpp:26:3:26:24 | return ... |
165165
| captures.cpp:26:10:26:17 | (const lambda [] type at line 22, col. 19)... |

‎java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,15 +83,33 @@ open class KotlinUsesExtractor(
8383
makeDescription(StandardNames.FqNames.map, "<get-values>") to "values",
8484
makeDescription(FqName("java.util.Map"), "<get-values>") to "values",
8585
makeDescription(StandardNames.FqNames.map, "<get-entries>") to "entrySet",
86-
makeDescription(FqName("java.util.Map"), "<get-entries>") to "entrySet"
86+
makeDescription(FqName("java.util.Map"), "<get-entries>") to "entrySet",
87+
makeDescription(StandardNames.FqNames.mutableList, "removeAt") to "remove",
88+
makeDescription(FqName("java.util.List"), "removeAt") to "remove",
89+
makeDescription(StandardNames.FqNames._enum.toSafe(), "<get-ordinal>") to "ordinal",
90+
makeDescription(FqName("java.lang.Enum"), "<get-ordinal>") to "ordinal",
91+
makeDescription(StandardNames.FqNames._enum.toSafe(), "<get-name>") to "name",
92+
makeDescription(FqName("java.lang.Enum"), "<get-name>") to "name",
93+
makeDescription(StandardNames.FqNames.number.toSafe(), "toByte") to "byteValue",
94+
makeDescription(FqName("java.lang.Number"), "toByte") to "byteValue",
95+
makeDescription(StandardNames.FqNames.number.toSafe(), "toShort") to "shortValue",
96+
makeDescription(FqName("java.lang.Number"), "toShort") to "shortValue",
97+
makeDescription(StandardNames.FqNames.number.toSafe(), "toInt") to "intValue",
98+
makeDescription(FqName("java.lang.Number"), "toInt") to "intValue",
99+
makeDescription(StandardNames.FqNames.number.toSafe(), "toLong") to "longValue",
100+
makeDescription(FqName("java.lang.Number"), "toLong") to "longValue",
101+
makeDescription(StandardNames.FqNames.number.toSafe(), "toFloat") to "floatValue",
102+
makeDescription(FqName("java.lang.Number"), "toFloat") to "floatValue",
103+
makeDescription(StandardNames.FqNames.number.toSafe(), "toDouble") to "doubleValue",
104+
makeDescription(FqName("java.lang.Number"), "toDouble") to "doubleValue",
87105
)
88106

89107
private val specialFunctionShortNames = specialFunctions.keys.map { it.functionName }.toSet()
90108

91109
fun getSpecialJvmName(f: IrFunction): String? {
92110
if (specialFunctionShortNames.contains(f.name) && f is IrSimpleFunction) {
93111
f.allOverridden(true).forEach { overriddenFunc ->
94-
overriddenFunc.parentAsClass.fqNameWhenAvailable?.let { parentFqName ->
112+
overriddenFunc.parentClassOrNull?.fqNameWhenAvailable?.let { parentFqName ->
95113
specialFunctions[MethodKey(parentFqName, f.name)]?.let {
96114
return it
97115
}

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -304,6 +304,33 @@ class ContentSet instanceof Content {
304304
}
305305
}
306306

307+
/**
308+
* Holds if the guard `g` validates the expression `e` upon evaluating to `branch`.
309+
*
310+
* The expression `e` is expected to be a syntactic part of the guard `g`.
311+
* For example, the guard `g` might be a call `isSafe(x)` and the expression `e`
312+
* the argument `x`.
313+
*/
314+
signature predicate guardChecksSig(Guard g, Expr e, boolean branch);
315+
316+
/**
317+
* Provides a set of barrier nodes for a guard that validates an expression.
318+
*
319+
* This is expected to be used in `isBarrier`/`isSanitizer` definitions
320+
* in data flow and taint tracking.
321+
*/
322+
module BarrierGuard<guardChecksSig/3 guardChecks> {
323+
/** Gets a node that is safely guarded by the given guard check. */
324+
Node getABarrierNode() {
325+
exists(Guard g, SsaVariable v, boolean branch, RValue use |
326+
guardChecks(g, v.getAUse(), branch) and
327+
use = v.getAUse() and
328+
g.controls(use.getBasicBlock(), branch) and
329+
result.asExpr() = use
330+
)
331+
}
332+
}
333+
307334
/**
308335
* A guard that validates some expression.
309336
*

‎java/ql/src/Security/CWE/CWE-022/TaintedPath.ql

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,13 @@ import semmle.code.java.security.PathCreation
1919
import DataFlow::PathGraph
2020
import TaintedPathCommon
2121

22-
class ContainsDotDotSanitizer extends DataFlow::BarrierGuard {
23-
ContainsDotDotSanitizer() {
24-
this.(MethodAccess).getMethod().hasName("contains") and
25-
this.(MethodAccess).getAnArgument().(StringLiteral).getValue() = ".."
26-
}
27-
28-
override predicate checks(Expr e, boolean branch) {
29-
e = this.(MethodAccess).getQualifier() and branch = false
30-
}
22+
predicate containsDotDotSanitizer(Guard g, Expr e, boolean branch) {
23+
exists(MethodAccess contains | g = contains |
24+
contains.getMethod().hasName("contains") and
25+
contains.getAnArgument().(StringLiteral).getValue() = ".." and
26+
e = contains.getQualifier() and
27+
branch = false
28+
)
3129
}
3230

3331
class TaintedPathConfig extends TaintTracking::Configuration {
@@ -41,10 +39,8 @@ class TaintedPathConfig extends TaintTracking::Configuration {
4139

4240
override predicate isSanitizer(DataFlow::Node node) {
4341
exists(Type t | t = node.getType() | t instanceof BoxedType or t instanceof PrimitiveType)
44-
}
45-
46-
override predicate isSanitizerGuard(DataFlow::BarrierGuard guard) {
47-
guard instanceof ContainsDotDotSanitizer
42+
or
43+
node = DataFlow::BarrierGuard<containsDotDotSanitizer/3>::getABarrierNode()
4844
}
4945
}
5046

‎java/ql/test/kotlin/library-tests/enum/enumUser.kt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
fun usesEnum(e: Enum<*>) = e.ordinal.toString() + e.name

‎java/ql/test/kotlin/library-tests/enum/test.expected

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
| addAll |
2+
| addRange |
3+
| allOf |
4+
| asIterator |
5+
| clone |
6+
| compareTo |
7+
| complement |
8+
| complementOf |
9+
| copyOf |
10+
| describeConstable |
11+
| equals |
12+
| finalize |
13+
| getDeclaringClass |
14+
| hasMoreElements |
15+
| hashCode |
16+
| name |
17+
| nextElement |
18+
| noneOf |
19+
| of |
20+
| ordinal |
21+
| range |
22+
| resolveConstantDesc |
23+
| toString |
24+
| typeCheck |
25+
| usesEnum |
26+
| valueOf |
27+
| writeReplace |

0 commit comments

Comments
 (0)