Skip to content

Commit 389df35

Browse files
jketemajketema
authored
Merge branch 'main' into child-stmt
2 parents 05819a5 + aa80dd4 commit 389df35

File tree

37 files changed

+854
-355
lines changed

37 files changed

+854
-355
lines changed

‎cpp/ql/src/experimental/Security/CWE/CWE-125/DangerousWorksWithMultibyteOrWideCharacters.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ predicate exprMayBeString(Expr exp) {
2424
fctmp.getAnArgument().(VariableAccess).getTarget() = exp.(VariableAccess).getTarget() or
2525
globalValueNumber(fctmp.getAnArgument()) = globalValueNumber(exp)
2626
) and
27-
fctmp.getTarget().hasName(["strlen", "strcat", "strncat", "strcpy", "sptintf", "printf"])
27+
fctmp.getTarget().hasName(["strlen", "strcat", "strncat", "strcpy", "sprintf", "printf"])
2828
)
2929
or
3030
exists(AssignExpr astmp |

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DependencyManager.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -191,6 +191,7 @@ void exitCallback(int ret, string msg, bool silent)
191191

192192
private HashSet<string> AddFrameworkDlls(HashSet<AssemblyLookupLocation> dllLocations)
193193
{
194+
logger.LogInfo("Adding .NET Framework DLLs");
194195
var frameworkLocations = new HashSet<string>();
195196

196197
var frameworkReferences = Environment.GetEnvironmentVariable(EnvironmentVariableNames.DotnetFrameworkReferences);

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNet.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,9 +91,9 @@ public bool AddPackage(string folder, string package)
9191
return dotnetCliInvoker.RunCommand(args);
9292
}
9393

94-
public IList<string> GetListedRuntimes() => GetResultList("--list-runtimes", null, false);
94+
public IList<string> GetListedRuntimes() => GetResultList("--list-runtimes");
9595

96-
public IList<string> GetListedSdks() => GetResultList("--list-sdks", null, false);
96+
public IList<string> GetListedSdks() => GetResultList("--list-sdks");
9797

9898
private IList<string> GetResultList(string args, string? workingDirectory = null, bool silent = true)
9999
{

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/DotNetCliInvoker.cs

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ public DotNetCliInvoker(ILogger logger, string exec)
1919
{
2020
this.logger = logger;
2121
this.Exec = exec;
22+
logger.LogInfo($"Using .NET CLI executable: '{Exec}'");
2223
}
2324

2425
private ProcessStartInfo MakeDotnetStartInfo(string args, string? workingDirectory)
@@ -43,15 +44,15 @@ private ProcessStartInfo MakeDotnetStartInfo(string args, string? workingDirecto
4344
private bool RunCommandAux(string args, string? workingDirectory, out IList<string> output, bool silent)
4445
{
4546
var dirLog = string.IsNullOrWhiteSpace(workingDirectory) ? "" : $" in {workingDirectory}";
46-
logger.LogInfo($"Running {Exec} {args}{dirLog}");
47+
logger.LogInfo($"Running '{Exec} {args}'{dirLog}");
4748
var pi = MakeDotnetStartInfo(args, workingDirectory);
4849
var threadId = Environment.CurrentManagedThreadId;
4950
void onOut(string s) => logger.Log(silent ? Severity.Debug : Severity.Info, s, threadId);
5051
void onError(string s) => logger.LogError(s, threadId);
5152
var exitCode = pi.ReadOutput(out output, onOut, onError);
5253
if (exitCode != 0)
5354
{
54-
logger.LogError($"Command {Exec} {args}{dirLog} failed with exit code {exitCode}");
55+
logger.LogError($"Command '{Exec} {args}'{dirLog} failed with exit code {exitCode}");
5556
return false;
5657
}
5758
return true;

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/FileProvider.cs

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public class FileProvider
2121
private readonly Lazy<string[]> dlls;
2222
private readonly Lazy<string[]> nugetConfigs;
2323
private readonly Lazy<string[]> globalJsons;
24+
private readonly Lazy<string[]> packagesConfigs;
2425
private readonly Lazy<string[]> razorViews;
2526
private readonly Lazy<string[]> resources;
2627
private readonly Lazy<string?> rootNugetConfig;
@@ -32,31 +33,38 @@ public FileProvider(DirectoryInfo sourceDir, ILogger logger)
3233

3334
all = GetAllFiles();
3435
allNonBinary = new Lazy<FileInfo[]>(() => all.Where(f => !binaryFileExtensions.Contains(f.Extension.ToLowerInvariant())).ToArray());
35-
smallNonBinary = new Lazy<string[]>(() =>
36-
{
37-
var ret = SelectSmallFiles(allNonBinary.Value).SelectFileNames().ToArray();
38-
logger.LogInfo($"Found {ret.Length} small non-binary files in {SourceDir}.");
39-
return ret;
40-
});
36+
smallNonBinary = new Lazy<string[]>(() => ReturnAndLogFiles("small non-binary", SelectSmallFiles(allNonBinary.Value).SelectFileNames().ToArray()));
4137
sources = new Lazy<string[]>(() => SelectTextFileNamesByExtension("source", ".cs"));
4238
projects = new Lazy<string[]>(() => SelectTextFileNamesByExtension("project", ".csproj"));
4339
solutions = new Lazy<string[]>(() => SelectTextFileNamesByExtension("solution", ".sln"));
4440
dlls = new Lazy<string[]>(() => SelectBinaryFileNamesByExtension("DLL", ".dll"));
45-
nugetConfigs = new Lazy<string[]>(() => allNonBinary.Value.SelectFileNamesByName("nuget.config").ToArray());
46-
globalJsons = new Lazy<string[]>(() => allNonBinary.Value.SelectFileNamesByName("global.json").ToArray());
41+
nugetConfigs = new Lazy<string[]>(() => SelectTextFileNamesByName("nuget.config"));
42+
globalJsons = new Lazy<string[]>(() => SelectTextFileNamesByName("global.json"));
43+
packagesConfigs = new Lazy<string[]>(() => SelectTextFileNamesByName("packages.config"));
4744
razorViews = new Lazy<string[]>(() => SelectTextFileNamesByExtension("razor view", ".cshtml", ".razor"));
4845
resources = new Lazy<string[]>(() => SelectTextFileNamesByExtension("resource", ".resx"));
4946

5047
rootNugetConfig = new Lazy<string?>(() => all.SelectRootFiles(SourceDir).SelectFileNamesByName("nuget.config").FirstOrDefault());
5148
}
5249

53-
private string[] SelectTextFileNamesByExtension(string filetype, params string[] extensions)
50+
private string[] ReturnAndLogFiles(string filetype, IEnumerable<string> files)
5451
{
55-
var ret = allNonBinary.Value.SelectFileNamesByExtension(extensions).ToArray();
52+
var ret = files.ToArray();
5653
logger.LogInfo($"Found {ret.Length} {filetype} files in {SourceDir}.");
5754
return ret;
5855
}
5956

57+
private string[] SelectTextFileNamesByExtension(string filetype, params string[] extensions)
58+
=> ReturnAndLogFiles(filetype, allNonBinary.Value.SelectFileNamesByExtension(extensions));
59+
60+
private string[] SelectTextFileNamesByName(string name)
61+
{
62+
var ret = allNonBinary.Value.SelectFileNamesByName(name).ToArray();
63+
var ending = ret.Length == 0 ? "." : $": {string.Join(", ", ret.OrderBy(s => s))}.";
64+
logger.LogInfo($"Found {ret.Length} {name} files in {SourceDir}{ending}");
65+
return ret;
66+
}
67+
6068
private string[] SelectBinaryFileNamesByExtension(string filetype, params string[] extensions)
6169
{
6270
var ret = all.SelectFileNamesByExtension(extensions).ToArray();
@@ -117,6 +125,7 @@ private FileInfo[] GetAllFiles()
117125
public ICollection<string> NugetConfigs => nugetConfigs.Value;
118126
public string? RootNugetConfig => rootNugetConfig.Value;
119127
public IEnumerable<string> GlobalJsons => globalJsons.Value;
128+
public ICollection<string> PackagesConfigs => packagesConfigs.Value;
120129
public ICollection<string> RazorViews => razorViews.Value;
121130
public ICollection<string> Resources => resources.Value;
122131
}

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetExeWrapper.cs

Lines changed: 9 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ internal class NugetExeWrapper : IDisposable
2020
/// <summary>
2121
/// The list of package files.
2222
/// </summary>
23-
private readonly FileInfo[] packageFiles;
23+
private readonly ICollection<string> packageFiles;
2424

25-
public int PackageCount => packageFiles.Length;
25+
public int PackageCount => packageFiles.Count;
2626

2727
private readonly string? backupNugetConfig;
2828
private readonly string? nugetConfigPath;
@@ -37,23 +37,21 @@ internal class NugetExeWrapper : IDisposable
3737
/// <summary>
3838
/// Create the package manager for a specified source tree.
3939
/// </summary>
40-
public NugetExeWrapper(string sourceDir, TemporaryDirectory packageDirectory, Util.Logging.ILogger logger)
40+
public NugetExeWrapper(FileProvider fileProvider, TemporaryDirectory packageDirectory, Util.Logging.ILogger logger)
4141
{
4242
this.packageDirectory = packageDirectory;
4343
this.logger = logger;
4444

45-
packageFiles = new DirectoryInfo(sourceDir)
46-
.EnumerateFiles("packages.config", SearchOption.AllDirectories)
47-
.ToArray();
45+
packageFiles = fileProvider.PackagesConfigs;
4846

49-
if (packageFiles.Length > 0)
47+
if (packageFiles.Count > 0)
5048
{
51-
logger.LogInfo($"Found {packageFiles.Length} packages.config files, trying to use nuget.exe for package restore");
52-
nugetExe = ResolveNugetExe(sourceDir);
49+
logger.LogInfo($"Found packages.config files, trying to use nuget.exe for package restore");
50+
nugetExe = ResolveNugetExe(fileProvider.SourceDir.FullName);
5351
if (HasNoPackageSource())
5452
{
5553
// We only modify or add a top level nuget.config file
56-
nugetConfigPath = Path.Combine(sourceDir, "nuget.config");
54+
nugetConfigPath = Path.Combine(fileProvider.SourceDir.FullName, "nuget.config");
5755
try
5856
{
5957
if (File.Exists(nugetConfigPath))
@@ -86,10 +84,6 @@ public NugetExeWrapper(string sourceDir, TemporaryDirectory packageDirectory, Ut
8684
}
8785
}
8886
}
89-
else
90-
{
91-
logger.LogInfo("Found no packages.config file");
92-
}
9387
}
9488

9589
/// <summary>
@@ -195,7 +189,7 @@ private bool TryRestoreNugetPackage(string package)
195189
/// </summary>
196190
public int InstallPackages()
197191
{
198-
return packageFiles.Count(package => TryRestoreNugetPackage(package.FullName));
192+
return packageFiles.Count(package => TryRestoreNugetPackage(package));
199193
}
200194

201195
private bool HasNoPackageSource()

‎csharp/extractor/Semmle.Extraction.CSharp.DependencyFetching/NugetPackageRestorer.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ public HashSet<AssemblyLookupLocation> Restore()
105105
: [unresponsiveMissingPackageLocation];
106106
}
107107

108-
using (var nuget = new NugetExeWrapper(fileProvider.SourceDir.FullName, legacyPackageDirectory, logger))
108+
using (var nuget = new NugetExeWrapper(fileProvider, legacyPackageDirectory, logger))
109109
{
110110
var count = nuget.InstallPackages();
111111

@@ -178,7 +178,7 @@ private List<string> GetReachableFallbackNugetFeeds()
178178
logger.LogInfo($"No fallback Nuget feeds specified. Using default feed: {PublicNugetOrgFeed}");
179179
}
180180

181-
logger.LogInfo($"Checking fallback Nuget feed reachability on feeds: {string.Join(", ", fallbackFeeds.OrderBy(f => f))}");
181+
logger.LogInfo($"Checking fallback Nuget feed reachability on feeds: {string.Join(", ", fallbackFeeds.OrderBy(f => f))}");
182182
var (initialTimeout, tryCount) = GetFeedRequestSettings(isFallback: true);
183183
var reachableFallbackFeeds = fallbackFeeds.Where(feed => IsFeedReachable(feed, initialTimeout, tryCount, allowExceptions: false)).ToList();
184184
if (reachableFallbackFeeds.Count == 0)

‎csharp/extractor/Semmle.Extraction.CSharp.Standalone/Extractor.cs

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,17 +121,20 @@ public void Started(int item, int total, string source)
121121

122122
public void MissingType(string type)
123123
{
124-
logger.Log(Severity.Debug, "Missing type {0}", type);
124+
logger.LogDebug($"Missing type {type}");
125125
}
126126

127127
public void MissingNamespace(string @namespace)
128128
{
129-
logger.Log(Severity.Info, "Missing namespace {0}", @namespace);
129+
logger.LogInfo($"Missing namespace {@namespace}");
130130
}
131131

132132
public void MissingSummary(int missingTypes, int missingNamespaces)
133133
{
134-
logger.Log(Severity.Info, "Failed to resolve {0} types in {1} namespaces", missingTypes, missingNamespaces);
134+
if (missingTypes > 0 || missingNamespaces > 0)
135+
{
136+
logger.LogInfo($"Failed to resolve {missingTypes} types in {missingNamespaces} namespaces");
137+
}
135138
}
136139
}
137140

‎docs/codeql/codeql-overview/codeql-changelog/codeql-cli-2.17.1.rst

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
.. _codeql-cli-2.17.1:
2+
3+
==========================
4+
CodeQL 2.17.1 (2024-04-24)
5+
==========================
6+
7+
.. contents:: Contents
8+
:depth: 2
9+
:local:
10+
:backlinks: none
11+
12+
This is an overview of changes in the CodeQL CLI and relevant CodeQL query and library packs. For additional updates on changes to the CodeQL code scanning experience, check out the `code scanning section on the GitHub blog <https://github.blog/tag/code-scanning/>`__, `relevant GitHub Changelog updates <https://github.blog/changelog/label/code-scanning/>`__, `changes in the CodeQL extension for Visual Studio Code <https://marketplace.visualstudio.com/items/GitHub.vscode-codeql/changelog>`__, and the `CodeQL Action changelog <https://github.com/github/codeql-action/blob/main/CHANGELOG.md>`__.
13+
14+
Security Coverage
15+
-----------------
16+
17+
CodeQL 2.17.1 runs a total of 412 security queries when configured with the Default suite (covering 160 CWE). The Extended suite enables an additional 130 queries (covering 34 more CWE). 2 security queries have been added with this release.
18+
19+
CodeQL CLI
20+
----------
21+
22+
Deprecations
23+
~~~~~~~~~~~~
24+
25+
* The :code:`--mode` option and :code:`-m` alias to :code:`codeql database create`,
26+
:code:`codeql database cleanup`, and :code:`codeql dataset cleanup` has been deprecated. Instead, use the new :code:`--cache-cleanup` option, which has identical behavior.
27+
28+
Improvements
29+
~~~~~~~~~~~~
30+
31+
* Improved the diagnostic message produced when no code is processed when creating a database. If a build mode was specified using
32+
:code:`--build-mode`, the message is now tailored to your build mode.
33+
34+
Miscellaneous
35+
~~~~~~~~~~~~~
36+
37+
* The :code:`scc` tool used by the CodeQL CLI to calculate source code baseline information has been updated to version `3.2.0 <https://github.com/boyter/scc/releases/tag/v3.2.0>`__.
38+
39+
Query Packs
40+
-----------
41+
42+
Minor Analysis Improvements
43+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
44+
45+
Java
46+
""""
47+
48+
* The :code:`java/unknown-javadoc-parameter` now accepts :code:`@param` tags that apply to the parameters of a record.
49+
50+
JavaScript/TypeScript
51+
"""""""""""""""""""""
52+
53+
* :code:`API::Node#getInstance()` now includes instances of subclasses, include transitive subclasses.
54+
The same changes applies to uses of the :code:`Instance` token in data extensions.
55+
56+
New Queries
57+
~~~~~~~~~~~
58+
59+
Ruby
60+
""""
61+
62+
* Added a new query, :code:`rb/insecure-mass-assignment`, for finding instances of mass assignment operations accepting arbitrary parameters from remote user input.
63+
* Added a new query, :code:`rb/csrf-protection-not-enabled`, to detect cases where Cross-Site Request Forgery protection is not enabled in Ruby on Rails controllers.
64+
65+
Language Libraries
66+
------------------
67+
68+
Minor Analysis Improvements
69+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
70+
71+
C#
72+
""
73+
74+
* Extracting suppress nullable warning expressions did not work when applied directly to a method call (like :code:`System.Console.Readline()!`). This has been fixed.
75+
76+
Golang
77+
""""""
78+
79+
* Data flow through variables declared in statements of the form :code:`x := y.(type)` at the beginning of type switches has been fixed, which may result in more alerts.
80+
* Added strings.ReplaceAll, http.ParseMultipartForm sanitizers and remove path sanitizer.
81+
82+
Java
83+
""""
84+
85+
* About 6,700 summary models and 6,800 neutral summary models for the JDK that were generated using data flow have been added. This may lead to new alerts being reported.
86+
87+
Python
88+
""""""
89+
90+
* Improved the type-tracking capabilities (and therefore also API graphs) to allow tracking items in tuples and dictionaries.
91+
92+
Shared Libraries
93+
----------------
94+
95+
New Features
96+
~~~~~~~~~~~~
97+
98+
Dataflow Analysis
99+
"""""""""""""""""
100+
101+
* The :code:`PathGraph` result of a data flow computation has been augmented with model provenance information for each of the flow steps. Any qltests that include the edges relation in their output (for example, :code:`.qlref`\ s that reference path-problem queries) will need to be have their expected output updated accordingly.
102+
103+
Type-flow Analysis
104+
""""""""""""""""""
105+
106+
* Initial release. Adds a library to implement type-flow analysis.

‎docs/codeql/codeql-overview/codeql-changelog/index.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ A list of queries for each suite and language `is available here <https://docs.g
1111
.. toctree::
1212
:maxdepth: 1
1313

14+
codeql-cli-2.17.1
1415
codeql-cli-2.17.0
1516
codeql-cli-2.16.6
1617
codeql-cli-2.16.5

0 commit comments

Comments
 (0)