Skip to content

Commit efcffc5

Browse files
paldepindpaldepind
committed
Merge branch 'main' into rust-ti-refactor
2 parents 54e7bb7 + c3bc651 commit efcffc5

File tree

74 files changed

+7065
-858
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+7065
-858
lines changed

‎docs/codeql/writing-codeql-queries/metadata-for-codeql-queries.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ The following properties are supported by all query files:
3030
+-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
3131
| ``@id`` | ``<text>`` | A sequence of words composed of lowercase letters or digits, delimited by ``/`` or ``-``, identifying and classifying the query. Each query must have a **unique** ID. To ensure this, it may be helpful to use a fixed structure for each ID. For example, the standard CodeQL queries have the following format: ``<language>/<brief-description>``. |
3232
+-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
33+
| ``@previous-id`` | ``<text>`` | Indicates that query results were previously reported on a different query. The previous id should be a sequence of words composed of lowercase letters or digits, delimited by ``/`` or ``-``, identifying and classifying the previous query. |
34+
+-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
3335
| ``@kind`` | | ``problem`` | Identifies the query is an alert (``@kind problem``) or a path (``@kind path-problem``). For more information on these query types, see ":doc:`About CodeQL queries <about-codeql-queries>`." |
3436
| | | ``path-problem`` | |
3537
+-----------------------+---------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

‎docs/query-metadata-style-guide.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,10 @@ Note, `@id` properties should be consistent for queries that highlight the same
9393
* `@id java/tainted-format-string`
9494
* `@id cpp/tainted-format-string`
9595

96+
#### Query previous ID `@previous-id`
97+
98+
Queries with alerts that used to be reported on a different query should also have an `@previous-id` property to refer back to the query where the alerts were originally reported. For example, if alerts from `java/query-one` are now reported on `java/query-two`, then the metadata for `java/query-two` should contain: `@previous-id java/query-one`.
99+
96100

97101
### Query type `@kind`
98102

@@ -113,7 +117,7 @@ Alert queries (`@kind problem` or `path-problem`) support two further properties
113117
* `medium`
114118
* `high`
115119
* `very-high`
116-
* `@problem.severity`–defines the likelihood that an alert, either security-related or not, causes an actual problem such as incorrect program behavior:
120+
* `@problem.severity`–defines the likelihood that an alert, either security-related or not, causes an actual problem such as incorrect program behavior:
117121
* `error`–an issue that is likely to cause incorrect program behavior, for example a crash or vulnerability.
118122
* `warning`–an issue that indicates a potential problem in the code, or makes the code fragile if another (unrelated) part of code is changed.
119123
* `recommendation`–an issue where the code behaves correctly, but it could be improved.

‎go/ql/lib/change-notes/2025-03-03-couchbase-source-models.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* `database` source models have been added for v1 and v2 of the `github.com/couchbase/gocb` package.
5+

‎go/ql/lib/ext/github.com.couchbase.gocb.model.yml

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,32 @@ extensions:
99
- ["gocb2", "github.com/couchbase/gocb/v2"]
1010
- ["gocb2", "gopkg.in/couchbase/gocb.v2"]
1111
- ["gocb2", "github.com/couchbaselabs/gocb/v2"]
12+
- addsTo:
13+
pack: codeql/go-all
14+
extensible: sourceModel
15+
data:
16+
- ["group:gocb1", "Cluster", True, "ExecuteAnalyticsQuery", "", "", "ReturnValue[0]", "database", "manual"]
17+
- ["group:gocb1", "Cluster", True, "ExecuteN1qlQuery", "", "", "ReturnValue[0]", "database", "manual"]
18+
- ["group:gocb1", "Cluster", True, "ExecuteSearchQuery", "", "", "ReturnValue[0]", "database", "manual"]
19+
- ["group:gocb2", "Cluster", True, "AnalyticsQuery", "", "", "ReturnValue[0]", "database", "manual"]
20+
- ["group:gocb2", "Cluster", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
21+
- ["group:gocb2", "Collection", True, "Get", "", "", "ReturnValue[0]", "database", "manual"]
22+
- ["group:gocb2", "Collection", True, "GetAndLock", "", "", "ReturnValue[0]", "database", "manual"]
23+
- ["group:gocb2", "Collection", True, "GetAndTouch", "", "", "ReturnValue[0]", "database", "manual"]
24+
- ["group:gocb2", "Collection", True, "GetAnyReplica", "", "", "ReturnValue[0]", "database", "manual"]
25+
- ["group:gocb2", "Collection", True, "LookupIn", "", "", "ReturnValue[0]", "database", "manual"]
26+
- ["group:gocb2", "Collection", True, "LookupInAllReplicas", "", "", "ReturnValue[0]", "database", "manual"]
27+
- ["group:gocb2", "Collection", True, "LookupInAnyReplica", "", "", "ReturnValue[0]", "database", "manual"]
28+
- ["group:gocb2", "Collection", True, "Scan", "", "", "ReturnValue[0]", "database", "manual"]
29+
- ["group:gocb2", "Scope", True, "AnalyticsQuery", "", "", "ReturnValue[0]", "database", "manual"]
30+
- ["group:gocb2", "Scope", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
31+
- ["group:gocb2", "TransactionAttemptContext", True, "Get", "", "", "ReturnValue[0]", "database", "manual"]
32+
- ["group:gocb2", "TransactionAttemptContext", True, "GetReplicaFromPreferredServerGroup", "", "", "ReturnValue[0]", "database", "manual"]
33+
- ["group:gocb2", "TransactionAttemptContext", True, "Insert", "", "", "ReturnValue[0]", "database", "manual"]
34+
- ["group:gocb2", "TransactionAttemptContext", True, "Query", "", "", "ReturnValue[0]", "database", "manual"]
35+
- ["group:gocb2", "TransactionAttemptContext", True, "Replace", "", "", "ReturnValue[0]", "database", "manual"]
36+
- ["group:gocb2", "ViewIndexManager", True, "GetAllDesignDocuments", "", "", "ReturnValue[0]", "database", "manual"]
37+
- ["group:gocb2", "ViewIndexManager", True, "GetDesignDocument", "", "", "ReturnValue[0]", "database", "manual"]
1238
- addsTo:
1339
pack: codeql/go-all
1440
extensible: sinkModel
@@ -27,6 +53,9 @@ extensions:
2753
data:
2854
- ["group:gocb1", "", False, "NewAnalyticsQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
2955
- ["group:gocb1", "", False, "NewN1qlQuery", "", "", "Argument[0]", "ReturnValue", "taint", "manual"]
56+
- ["group:gocb1", "AnalyticsResults", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
57+
- ["group:gocb1", "AnalyticsResults", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
58+
- ["group:gocb1", "AnalyticsResults", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3059
- ["group:gocb1", "AnalyticsQuery", True, "ContextId", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3160
- ["group:gocb1", "AnalyticsQuery", True, "Deferred", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
3261
- ["group:gocb1", "AnalyticsQuery", True, "Pretty", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
@@ -43,3 +72,30 @@ extensions:
4372
- ["group:gocb1", "N1qlQuery", True, "ReadOnly", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
4473
- ["group:gocb1", "N1qlQuery", True, "ScanCap", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
4574
- ["group:gocb1", "N1qlQuery", True, "Timeout", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
75+
- ["group:gocb1", "QueryResults", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
76+
- ["group:gocb1", "QueryResults", True, "Next", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
77+
- ["group:gocb1", "QueryResults", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
78+
- ["group:gocb1", "SearchResults", True, "Hits", "", "", "Argument[receiver]", "ReturnValue.ArrayElement", "taint", "manual"]
79+
- ["group:gocb2", "AnalyticsResult", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
80+
- ["group:gocb2", "AnalyticsResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
81+
- ["group:gocb2", "AnalyticsResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
82+
- ["group:gocb2", "AnalyticsResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
83+
- ["group:gocb2", "GetResult", True, "Content", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
84+
- ["group:gocb2", "LookupInAllReplicasResult", True, "Next", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
85+
- ["group:gocb2", "LookupInResult", True, "ContentAt", "", "", "Argument[receiver]", "Argument[1]", "taint", "manual"]
86+
- ["group:gocb2", "MutateInResult", True, "ContentAt", "", "", "Argument[receiver]", "Argument[1]", "taint", "manual"]
87+
- ["group:gocb2", "QueryResult", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
88+
- ["group:gocb2", "QueryResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
89+
- ["group:gocb2", "QueryResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
90+
- ["group:gocb2", "QueryResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
91+
- ["group:gocb2", "ScanResult", True, "Next", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
92+
- ["group:gocb2", "ScanResultItem", True, "Content", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
93+
- ["group:gocb2", "SearchResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
94+
- ["group:gocb2", "SearchResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
95+
- ["group:gocb2", "SearchResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
96+
- ["group:gocb2", "TransactionGetResult", True, "Content", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
97+
- ["group:gocb2", "TransactionQueryResult", True, "One", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
98+
- ["group:gocb2", "TransactionQueryResult", True, "Row", "", "", "Argument[receiver]", "Argument[0]", "taint", "manual"]
99+
- ["group:gocb2", "ViewResult", True, "Raw", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
100+
- ["group:gocb2", "ViewResult", True, "Row", "", "", "Argument[receiver]", "ReturnValue", "taint", "manual"]
101+
- ["group:gocb2", "ViewResultRaw", True, "NextBytes", "", "", "Argument[receiver]", "ReturnValue[0]", "taint", "manual"]

‎go/ql/lib/semmle/go/Concepts.qll

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -357,6 +357,23 @@ module RegexpReplaceFunction {
357357
class LoggerCall extends DataFlow::Node instanceof LoggerCall::Range {
358358
/** Gets a node that is a part of the logged message. */
359359
DataFlow::Node getAMessageComponent() { result = super.getAMessageComponent() }
360+
361+
/**
362+
* Gets a node whose value is a part of the logged message.
363+
*
364+
* Components corresponding to the format specifier "%T" are excluded as
365+
* their type is logged rather than their value.
366+
*/
367+
DataFlow::Node getAValueFormattedMessageComponent() {
368+
result = this.getAMessageComponent() and
369+
not exists(string formatSpecifier |
370+
result = this.(StringOps::Formatting::StringFormatCall).getOperand(_, formatSpecifier) and
371+
// We already know that `formatSpecifier` starts with `%`, so we check
372+
// that it ends with `T` to confirm that it is `%T` or possibly some
373+
// variation on it.
374+
formatSpecifier.matches("%T")
375+
)
376+
}
360377
}
361378

362379
/** Provides a class for modeling new logging APIs. */

‎go/ql/lib/semmle/go/security/CleartextLoggingCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ module CleartextLogging {
4040
* An argument to a logging mechanism.
4141
*/
4242
class LoggerSink extends Sink {
43-
LoggerSink() { this = any(LoggerCall log).getAMessageComponent() }
43+
LoggerSink() { this = any(LoggerCall log).getAValueFormattedMessageComponent() }
4444
}
4545

4646
/**

‎go/ql/lib/semmle/go/security/LogInjectionCustomizations.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ module LogInjection {
3535

3636
/** An argument to a logging mechanism. */
3737
class LoggerSink extends Sink {
38-
LoggerSink() { this = any(LoggerCall log).getAMessageComponent() }
38+
LoggerSink() { this = any(LoggerCall log).getAValueFormattedMessageComponent() }
3939
}
4040

4141
/**

‎go/ql/src/Security/CWE-352/ConstantOauth2State.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,9 @@ predicate privateUrlFlowsToAuthCodeUrlCall(DataFlow::CallNode call) {
138138

139139
module FlowToPrintConfig implements DataFlow::ConfigSig {
140140
additional predicate isSinkCall(DataFlow::Node sink, DataFlow::CallNode call) {
141-
exists(LoggerCall logCall | call = logCall | sink = logCall.getAMessageComponent())
141+
exists(LoggerCall logCall | call = logCall |
142+
sink = logCall.getAValueFormattedMessageComponent()
143+
)
142144
}
143145

144146
predicate isSource(DataFlow::Node source) { source = any(AuthCodeUrl m).getACall().getResult() }

‎go/ql/src/change-notes/2025-03-20-logging-false-positive-type-format-specifier.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* False positives in "Log entries created from user input" (`go/log-injection`) and "Clear-text logging of sensitive information" (`go/clear-text-logging`) which involved the verb `%T` in a format specifier have been fixed. As a result, some users may also see more alerts from the "Use of constant `state` value in OAuth 2.0 URL" (`go/constant-oauth2-state`) query.

‎go/ql/test/library-tests/semmle/go/concepts/LoggerCall/LoggerCall.ql

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,20 @@ import ModelValidation
44
import utils.test.InlineExpectationsTest
55

66
module LoggerTest implements TestSig {
7-
string getARelevantTag() { result = "logger" }
7+
string getARelevantTag() { result = ["type-logger", "logger"] }
88

99
predicate hasActualResult(Location location, string element, string tag, string value) {
1010
exists(LoggerCall log |
1111
log.getLocation() = location and
1212
element = log.toString() and
13-
value = log.getAMessageComponent().toString() and
14-
tag = "logger"
13+
(
14+
value = log.getAValueFormattedMessageComponent().toString() and
15+
tag = "logger"
16+
or
17+
value = log.getAMessageComponent().toString() and
18+
not value = log.getAValueFormattedMessageComponent().toString() and
19+
tag = "type-logger"
20+
)
1521
)
1622
}
1723
}

0 commit comments

Comments
 (0)