Skip to content

Commit 80919e3

Browse files
erik-krogherik-krogh
committed
Merge branch 'main' into extractBigReg
2 parents 9a11c13 + b5cf4c2 commit 80919e3

File tree

286 files changed

+13046
-4401
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

286 files changed

+13046
-4401
lines changed

‎.github/actions/fetch-codeql/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ runs:
88
run: |
99
LATEST=$(gh release list --repo https://github.com/github/codeql-cli-binaries | cut -f 1 | grep -v beta | sort --version-sort | tail -1)
1010
gh release download --repo https://github.com/github/codeql-cli-binaries --pattern codeql-linux64.zip "$LATEST"
11-
unzip -q codeql-linux64.zip
12-
echo "${{ github.workspace }}/codeql" >> $GITHUB_PATH
11+
unzip -q -d "${RUNNER_TEMP}" codeql-linux64.zip
12+
echo "${RUNNER_TEMP}/codeql" >> "${GITHUB_PATH}"
1313
env:
1414
GITHUB_TOKEN: ${{ github.token }}

‎.github/workflows/post-pr-comment.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Post pull-request comment
2+
on:
3+
workflow_run:
4+
workflows: ["Query help preview"]
5+
types:
6+
- completed
7+
8+
permissions:
9+
pull-requests: write
10+
11+
jobs:
12+
post_comment:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Download artifact
16+
run: gh run download "${WORKFLOW_RUN_ID}" --repo "${GITHUB_REPOSITORY}" --name "comment"
17+
env:
18+
GITHUB_TOKEN: ${{ github.token }}
19+
WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }}
20+
- run: |
21+
PR="$(grep -o '^[0-9]\+$' pr.txt)"
22+
PR_HEAD_SHA="$(gh api "/repos/${GITHUB_REPOSITORY}/pulls/${PR}" --jq .head.sha)"
23+
# Check that the pull-request head SHA matches the head SHA of the workflow run
24+
if [ "${WORKFLOW_RUN_HEAD_SHA}" != "${PR_HEAD_SHA}" ]; then
25+
echo "PR head SHA ${PR_HEAD_SHA} does not match workflow_run event SHA ${WORKFLOW_RUN_HEAD_SHA}. Stopping." 1>&2
26+
exit 1
27+
fi
28+
gh pr comment "${PR}" --repo "${GITHUB_REPOSITORY}" -F comment.txt
29+
env:
30+
GITHUB_TOKEN: ${{ github.token }}
31+
WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_commit.id }}

‎.github/workflows/qhelp-pr-preview.yml

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,63 @@
11
name: Query help preview
22

3+
permissions:
4+
contents: read
5+
36
on:
47
pull_request:
58
branches:
69
- main
7-
- 'rc/*'
10+
- "rc/*"
811
paths:
912
- "ruby/**/*.qhelp"
1013

1114
jobs:
1215
qhelp:
1316
runs-on: ubuntu-latest
1417
steps:
18+
- run: echo "${{ github.event.number }}" > pr.txt
19+
- uses: actions/upload-artifact@v2
20+
with:
21+
name: comment
22+
path: pr.txt
23+
retention-days: 1
1524
- uses: actions/checkout@v2
1625
with:
1726
fetch-depth: 2
27+
persist-credentials: false
28+
- uses: ./.github/actions/fetch-codeql
1829
- name: Determine changed files
1930
id: changes
2031
run: |
21-
echo -n "::set-output name=qhelp_files::"
22-
(git diff --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep .qhelp$ | grep -v .inc.qhelp;
23-
git diff --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep .inc.qhelp$ | xargs -d '\n' -rn1 basename | xargs -d '\n' -rn1 git grep -l) |
24-
sort -u | xargs -d '\n' -n1 printf "'%s' "
25-
26-
- uses: ./.github/actions/fetch-codeql
32+
(git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.qhelp$' | grep -z -v '.inc.qhelp';
33+
git diff -z --name-only --diff-filter=ACMRT HEAD~1 HEAD | grep -z '.inc.qhelp$' | xargs --null -rn1 basename | xargs --null -rn1 git grep -z -l) |
34+
grep -z '.qhelp$' | grep -z -v '^-' | sort -z -u > "${RUNNER_TEMP}/paths.txt"
2735
2836
- name: QHelp preview
29-
if: ${{ steps.changes.outputs.qhelp_files }}
3037
run: |
31-
( echo "QHelp previews:";
32-
for path in ${{ steps.changes.outputs.qhelp_files }} ; do
38+
EXIT_CODE=0
39+
echo "QHelp previews:" > comment.txt
40+
while read -r -d $'\0' path; do
41+
if [ ! -f "${path}" ]; then
42+
exit 1
43+
fi
3344
echo "<details> <summary>${path}</summary>"
3445
echo
35-
codeql generate query-help --format=markdown ${path}
46+
codeql generate query-help --format=markdown -- "./${path}" 2> errors.txt || EXIT_CODE="$?"
47+
if [ -s errors.txt ]; then
48+
echo "# errors/warnings:"
49+
echo '```'
50+
cat errors.txt
51+
cat errors.txt 1>&2
52+
echo '```'
53+
fi
3654
echo "</details>"
37-
done) | gh pr comment "${{ github.event.pull_request.number }}" -F -
38-
env:
39-
GITHUB_TOKEN: ${{ github.token }}
55+
done < "${RUNNER_TEMP}/paths.txt" >> comment.txt
56+
exit "${EXIT_CODE}"
57+
58+
- if: always()
59+
uses: actions/upload-artifact@v2
60+
with:
61+
name: comment
62+
path: comment.txt
63+
retention-days: 1

‎.github/workflows/ruby-build.yml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,18 @@ name: "Ruby: Build"
33
on:
44
push:
55
paths:
6-
- 'ruby/**'
6+
- "ruby/**"
7+
- .github/workflows/ruby-build.yml
78
branches:
89
- main
9-
- 'rc/*'
10+
- "rc/*"
1011
pull_request:
1112
paths:
12-
- 'ruby/**'
13+
- "ruby/**"
14+
- .github/workflows/ruby-build.yml
1315
branches:
1416
- main
15-
- 'rc/*'
17+
- "rc/*"
1618
workflow_dispatch:
1719
inputs:
1820
tag:

‎.github/workflows/ruby-dataset-measure.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,17 @@ on:
44
push:
55
branches:
66
- main
7-
- 'rc/*'
7+
- "rc/*"
88
paths:
99
- ruby/ql/lib/ruby.dbscheme
10+
- .github/workflows/ruby-dataset-measure.yml
1011
pull_request:
1112
branches:
1213
- main
13-
- 'rc/*'
14+
- "rc/*"
1415
paths:
1516
- ruby/ql/lib/ruby.dbscheme
17+
- .github/workflows/ruby-dataset-measure.yml
1618
workflow_dispatch:
1719

1820
jobs:

‎.github/workflows/ruby-qltest.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,18 @@ name: "Ruby: Run QL Tests"
33
on:
44
push:
55
paths:
6-
- 'ruby/**'
6+
- "ruby/**"
7+
- .github/workflows/ruby-qltest.yml
78
branches:
89
- main
9-
- 'rc/*'
10+
- "rc/*"
1011
pull_request:
1112
paths:
12-
- 'ruby/**'
13+
- "ruby/**"
14+
- .github/workflows/ruby-qltest.yml
1315
branches:
1416
- main
15-
- 'rc/*'
17+
- "rc/*"
1618

1719
env:
1820
CARGO_TERM_COLOR: always
@@ -44,5 +46,5 @@ jobs:
4446
run: |
4547
echo >empty.trap
4648
codeql dataset import -S ql/lib/upgrades/initial/ruby.dbscheme testdb empty.trap
47-
codeql dataset upgrade testdb --additional-packs ql/lib/upgrades
49+
codeql dataset upgrade testdb --additional-packs ql/lib
4850
diff -q testdb/ruby.dbscheme ql/lib/ruby.dbscheme

‎config/identical-files.json

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -449,7 +449,8 @@
449449
"csharp/ql/lib/semmle/code/csharp/controlflow/internal/pressa/SsaImplCommon.qll",
450450
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/basessa/SsaImplCommon.qll",
451451
"csharp/ql/lib/semmle/code/cil/internal/SsaImplCommon.qll",
452-
"ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll"
452+
"ruby/ql/lib/codeql/ruby/dataflow/internal/SsaImplCommon.qll",
453+
"cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaImplCommon.qll"
453454
],
454455
"CryptoAlgorithms Python/JS": [
455456
"javascript/ql/lib/semmle/javascript/security/CryptoAlgorithms.qll",

‎cpp/ql/lib/semmle/code/cpp/commons/NullTermination.qll

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,14 @@ private import semmle.code.cpp.models.interfaces.ArrayFunction
33
private import semmle.code.cpp.models.implementations.Strcat
44
import semmle.code.cpp.dataflow.DataFlow
55

6-
private predicate mayAddNullTerminatorHelper(Expr e, VariableAccess va, Expr e0) {
7-
exists(StackVariable v0, Expr val |
8-
exprDefinition(v0, e, val) and
9-
val.getAChild*() = va and
10-
mayAddNullTerminator(e0, v0.getAnAccess())
6+
/**
7+
* Holds if the expression `e` assigns something including `va` to a
8+
* stack variable `v0`.
9+
*/
10+
private predicate mayAddNullTerminatorHelper(Expr e, VariableAccess va, StackVariable v0) {
11+
exists(Expr val |
12+
exprDefinition(v0, e, val) and // `e` is `v0 := val`
13+
val.getAChild*() = va
1114
)
1215
}
1316

@@ -25,8 +28,8 @@ private predicate controlFlowNodeSuccessorTransitive(ControlFlowNode n1, Control
2528
}
2629

2730
/**
28-
* Holds if the expression `e` may add a null terminator to the string in
29-
* variable `v`.
31+
* Holds if the expression `e` may add a null terminator to the string
32+
* accessed by `va`.
3033
*/
3134
predicate mayAddNullTerminator(Expr e, VariableAccess va) {
3235
// Assignment: dereferencing or array access
@@ -43,8 +46,9 @@ predicate mayAddNullTerminator(Expr e, VariableAccess va) {
4346
)
4447
or
4548
// Assignment to another stack variable
46-
exists(Expr e0 |
47-
mayAddNullTerminatorHelper(pragma[only_bind_into](e), va, pragma[only_bind_into](e0)) and
49+
exists(StackVariable v0, Expr e0 |
50+
mayAddNullTerminatorHelper(e, va, v0) and
51+
mayAddNullTerminator(pragma[only_bind_into](e0), pragma[only_bind_into](v0.getAnAccess())) and
4852
controlFlowNodeSuccessorTransitive(e, e0)
4953
)
5054
or

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/DefaultTaintTracking.qll

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -474,6 +474,24 @@ module TaintedWithPath {
474474
}
475475
}
476476

477+
/**
478+
* INTERNAL: Do not use.
479+
*/
480+
module Private {
481+
/** Gets a predecessor `PathNode` of `pathNode`, if any. */
482+
PathNode getAPredecessor(PathNode pathNode) { edges(result, pathNode) }
483+
484+
/** Gets the element that `pathNode` wraps, if any. */
485+
Element getElementFromPathNode(PathNode pathNode) {
486+
exists(DataFlow::Node node | node = pathNode.(WrapPathNode).inner().getNode() |
487+
result = node.asExpr() or
488+
result = node.asParameter()
489+
)
490+
or
491+
result = pathNode.(EndpointPathNode).inner()
492+
}
493+
}
494+
477495
private class WrapPathNode extends PathNode, TWrapPathNode {
478496
DataFlow3::PathNode inner() { this = TWrapPathNode(result) }
479497

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowDispatch.qll

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,10 @@ private module VirtualDispatch {
6363
|
6464
// Call argument
6565
exists(DataFlowCall call, int i |
66-
other.(DataFlow::ParameterNode).isParameterOf(call.getStaticCallTarget(), i) and
67-
src.(ArgumentNode).argumentOf(call, i)
66+
other
67+
.(DataFlow::ParameterNode)
68+
.isParameterOf(pragma[only_bind_into](call).getStaticCallTarget(), i) and
69+
src.(ArgumentNode).argumentOf(call, pragma[only_bind_into](pragma[only_bind_out](i)))
6870
) and
6971
allowOtherFromArg = true and
7072
allowFromArg = true
@@ -128,6 +130,7 @@ private module VirtualDispatch {
128130
*
129131
* Used to fix a join ordering issue in flowsFrom.
130132
*/
133+
pragma[noinline]
131134
private predicate returnNodeWithKindAndEnclosingCallable(
132135
ReturnNode node, ReturnKind kind, DataFlowCallable callable
133136
) {

0 commit comments

Comments
 (0)