Skip to content

Commit 8811455

Browse files
erik-krogherik-krogh
committed
Merge remote-tracking branch 'upstream/master' into XssDom
2 parents 76503d3 + 1b88c97 commit 8811455

File tree

109 files changed

+4819
-398
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

109 files changed

+4819
-398
lines changed

‎change-notes/1.24/analysis-cpp.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ The following changes in version 1.24 affect C/C++ analysis in all applications.
2525
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | | This query is no longer run on LGTM. |
2626
| No space for zero terminator (`cpp/no-space-for-terminator`) | Fewer false positive results | This query has been modified to be more conservative when identifying which pointers point to null-terminated strings. This approach produces fewer, more accurate results. |
2727
| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | Cases where the tainted allocation size is range checked are now more reliably excluded. |
28+
| Overflow in uncontrolled allocation size (`cpp/uncontrolled-allocation-size`) | Fewer false positive results | The query now produces fewer, more accurate results. |
2829
| Overloaded assignment does not return 'this' (`cpp/assignment-does-not-return-this`) | Fewer false positive results | This query no longer reports incorrect results in template classes. |
2930
| Unsafe array for days of the year (`cpp/leap-year/unsafe-array-for-days-of-the-year`) | | This query is no longer run on LGTM. |
3031
| Unsigned comparison to zero (`cpp/unsigned-comparison-zero`) | More correct results | This query now also looks for comparisons of the form `0 <= x`. |

‎change-notes/1.24/analysis-javascript.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@
8686
| Useless regular-expression character escape (`js/useless-regexp-character-escape`) | Fewer false positive results | This query now distinguishes escapes in strings and regular expression literals. |
8787
| Identical operands (`js/redundant-operation`) | Fewer results | This query now recognizes cases where the operands change a value using ++/-- expressions. |
8888
| Superfluous trailing arguments (`js/superfluous-trailing-arguments`) | Fewer results | This query now recognizes cases where a function uses the `Function.arguments` value to process a variable number of parameters. |
89-
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes more variations of URL scheme checks. |
89+
| Incomplete URL scheme check (`js/incomplete-url-scheme-check`) | More results | This query now recognizes additional variations of URL scheme checks. |
9090

9191
## Changes to libraries
9292

‎change-notes/1.25/analysis-javascript.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Improvements to JavaScript analysis
2+
3+
## General improvements
4+
5+
6+
## New queries
7+
8+
| **Query** | **Tags** | **Purpose** |
9+
|---------------------------------------------------------------------------------|-------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
10+
11+
12+
## Changes to existing queries
13+
14+
| **Query** | **Expected impact** | **Change** |
15+
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
16+
| Misspelled variable name (`js/misspelled-variable-name`) | Message changed | The message for this query now correctly identifies the misspelled variable in additional cases. |
17+
| Uncontrolled data used in path expression (`js/path-injection`) | More results | This query now recognizes additional file system calls. |
18+
| Uncontrolled command line (`js/command-line-injection`) | More results | This query now recognizes additional command execution calls. |
19+
20+
## Changes to libraries
21+
22+
* Added data flow for `Map` and `Set`, and added matching type-tracking steps that can accessed using the `CollectionsTypeTracking` module.

‎cpp/ql/src/Security/CWE/CWE-190/TaintedAllocationSize.ql

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,31 +15,31 @@ import cpp
1515
import semmle.code.cpp.security.TaintTracking
1616
import TaintedWithPath
1717

18-
predicate taintedChild(Expr e, Expr tainted) {
19-
(
20-
isAllocationExpr(e)
21-
or
22-
any(MulExpr me | me.getAChild() instanceof SizeofOperator) = e
23-
) and
24-
tainted = e.getAChild() and
18+
/**
19+
* Holds if `alloc` is an allocation, and `tainted` is a child of it that is a
20+
* taint sink.
21+
*/
22+
predicate allocSink(Expr alloc, Expr tainted) {
23+
isAllocationExpr(alloc) and
24+
tainted = alloc.getAChild() and
2525
tainted.getUnspecifiedType() instanceof IntegralType
2626
}
2727

2828
class TaintedAllocationSizeConfiguration extends TaintTrackingConfiguration {
29-
override predicate isSink(Element tainted) { taintedChild(_, tainted) }
29+
override predicate isSink(Element tainted) { allocSink(_, tainted) }
3030
}
3131

3232
predicate taintedAllocSize(
33-
Expr e, Expr source, PathNode sourceNode, PathNode sinkNode, string taintCause
33+
Expr source, Expr alloc, PathNode sourceNode, PathNode sinkNode, string taintCause
3434
) {
3535
isUserInput(source, taintCause) and
3636
exists(Expr tainted |
37-
taintedChild(e, tainted) and
37+
allocSink(alloc, tainted) and
3838
taintedWithPath(source, tainted, sourceNode, sinkNode)
3939
)
4040
}
4141

42-
from Expr e, Expr source, PathNode sourceNode, PathNode sinkNode, string taintCause
43-
where taintedAllocSize(e, source, sourceNode, sinkNode, taintCause)
44-
select e, sourceNode, sinkNode, "This allocation size is derived from $@ and might overflow",
42+
from Expr source, Expr alloc, PathNode sourceNode, PathNode sinkNode, string taintCause
43+
where taintedAllocSize(source, alloc, sourceNode, sinkNode, taintCause)
44+
select alloc, sourceNode, sinkNode, "This allocation size is derived from $@ and might overflow",
4545
source, "user input (" + taintCause + ")"

‎cpp/ql/src/semmle/code/cpp/Type.qll

Lines changed: 181 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -697,28 +697,188 @@ class Int128Type extends IntegralType {
697697
override string getCanonicalQLClass() { result = "Int128Type" }
698698
}
699699

700+
private newtype TTypeDomain =
701+
TRealDomain() or
702+
TComplexDomain() or
703+
TImaginaryDomain()
704+
700705
/**
701-
* The C/C++ floating point types. See 4.5. This includes `float`,
702-
* `double` and `long double` types.
703-
* ```
704-
* float f;
705-
* double d;
706-
* long double ld;
707-
* ```
706+
* The type domain of a floating-point type. One of `RealDomain`, `ComplexDomain`, or
707+
* `ImaginaryDomain`.
708+
*/
709+
class TypeDomain extends TTypeDomain {
710+
/** Gets a textual representation of this type domain. */
711+
string toString() { none() }
712+
}
713+
714+
/**
715+
* The type domain of a floating-point type that represents a real number.
716+
*/
717+
class RealDomain extends TypeDomain, TRealDomain {
718+
final override string toString() { result = "real" }
719+
}
720+
721+
/**
722+
* The type domain of a floating-point type that represents a complex number.
723+
*/
724+
class ComplexDomain extends TypeDomain, TComplexDomain {
725+
final override string toString() { result = "complex" }
726+
}
727+
728+
/**
729+
* The type domain of a floating-point type that represents an imaginary number.
730+
*/
731+
class ImaginaryDomain extends TypeDomain, TImaginaryDomain {
732+
final override string toString() { result = "imaginary" }
733+
}
734+
735+
/**
736+
* Data for floating-point types.
737+
*
738+
* kind: The original type kind. Can be any floating-point type kind.
739+
* base: The numeric base of the number's representation. Can be 2 (binary) or 10 (decimal).
740+
* domain: The type domain of the type. Can be `RealDomain`, `ComplexDomain`, or `ImaginaryDomain`.
741+
* realKind: The type kind of the corresponding real type. For example, the corresponding real type
742+
* of `_Complex double` is `double`.
743+
* extended: `true` if the number is an extended-precision floating-point number, such as
744+
* `_Float32x`.
745+
*/
746+
private predicate floatingPointTypeMapping(
747+
int kind, int base, TTypeDomain domain, int realKind, boolean extended
748+
) {
749+
// float
750+
kind = 24 and base = 2 and domain = TRealDomain() and realKind = 24 and extended = false
751+
or
752+
// double
753+
kind = 25 and base = 2 and domain = TRealDomain() and realKind = 25 and extended = false
754+
or
755+
// long double
756+
kind = 26 and base = 2 and domain = TRealDomain() and realKind = 26 and extended = false
757+
or
758+
// _Complex float
759+
kind = 27 and base = 2 and domain = TComplexDomain() and realKind = 24 and extended = false
760+
or
761+
// _Complex double
762+
kind = 28 and base = 2 and domain = TComplexDomain() and realKind = 25 and extended = false
763+
or
764+
// _Complex long double
765+
kind = 29 and base = 2 and domain = TComplexDomain() and realKind = 26 and extended = false
766+
or
767+
// _Imaginary float
768+
kind = 30 and base = 2 and domain = TImaginaryDomain() and realKind = 24 and extended = false
769+
or
770+
// _Imaginary double
771+
kind = 31 and base = 2 and domain = TImaginaryDomain() and realKind = 25 and extended = false
772+
or
773+
// _Imaginary long double
774+
kind = 32 and base = 2 and domain = TImaginaryDomain() and realKind = 26 and extended = false
775+
or
776+
// __float128
777+
kind = 38 and base = 2 and domain = TRealDomain() and realKind = 38 and extended = false
778+
or
779+
// _Complex __float128
780+
kind = 39 and base = 2 and domain = TComplexDomain() and realKind = 38 and extended = false
781+
or
782+
// _Decimal32
783+
kind = 40 and base = 10 and domain = TRealDomain() and realKind = 40 and extended = false
784+
or
785+
// _Decimal64
786+
kind = 41 and base = 10 and domain = TRealDomain() and realKind = 41 and extended = false
787+
or
788+
// _Decimal128
789+
kind = 42 and base = 10 and domain = TRealDomain() and realKind = 42 and extended = false
790+
or
791+
// _Float32
792+
kind = 45 and base = 2 and domain = TRealDomain() and realKind = 45 and extended = false
793+
or
794+
// _Float32x
795+
kind = 46 and base = 2 and domain = TRealDomain() and realKind = 46 and extended = true
796+
or
797+
// _Float64
798+
kind = 47 and base = 2 and domain = TRealDomain() and realKind = 47 and extended = false
799+
or
800+
// _Float64x
801+
kind = 48 and base = 2 and domain = TRealDomain() and realKind = 48 and extended = true
802+
or
803+
// _Float128
804+
kind = 49 and base = 2 and domain = TRealDomain() and realKind = 49 and extended = false
805+
or
806+
// _Float128x
807+
kind = 50 and base = 2 and domain = TRealDomain() and realKind = 50 and extended = true
808+
}
809+
810+
/**
811+
* The C/C++ floating point types. See 4.5. This includes `float`, `double` and `long double`, the
812+
* fixed-size floating-point types like `_Float32`, the extended-precision floating-point types like
813+
* `_Float64x`, and the decimal floating-point types like `_Decimal32`. It also includes the complex
814+
* and imaginary versions of all of these types.
708815
*/
709816
class FloatingPointType extends ArithmeticType {
817+
final int base;
818+
final TypeDomain domain;
819+
final int realKind;
820+
final boolean extended;
821+
710822
FloatingPointType() {
711823
exists(int kind |
712824
builtintypes(underlyingElement(this), _, kind, _, _, _) and
713-
(
714-
kind >= 24 and kind <= 32
715-
or
716-
kind >= 38 and kind <= 42
717-
or
718-
kind >= 45 and kind <= 50
719-
)
825+
floatingPointTypeMapping(kind, base, domain, realKind, extended)
720826
)
721827
}
828+
829+
/** Gets the numeric base of this type's representation: 2 (binary) or 10 (decimal). */
830+
final int getBase() { result = base }
831+
832+
/**
833+
* Gets the type domain of this type. Can be `RealDomain`, `ComplexDomain`, or `ImaginaryDomain`.
834+
*/
835+
final TypeDomain getDomain() { result = domain }
836+
837+
/**
838+
* Gets the corresponding real type of this type. For example, the corresponding real type of
839+
* `_Complex double` is `double`.
840+
*/
841+
final RealNumberType getRealType() {
842+
builtintypes(unresolveElement(result), _, realKind, _, _, _)
843+
}
844+
845+
/** Holds if this type is an extended precision floating-point type, such as `_Float32x`. */
846+
final predicate isExtendedPrecision() { extended = true }
847+
}
848+
849+
/**
850+
* A floating-point type representing a real number.
851+
*/
852+
class RealNumberType extends FloatingPointType {
853+
RealNumberType() { domain instanceof RealDomain }
854+
}
855+
856+
/**
857+
* A floating-point type representing a complex number.
858+
*/
859+
class ComplexNumberType extends FloatingPointType {
860+
ComplexNumberType() { domain instanceof ComplexDomain }
861+
}
862+
863+
/**
864+
* A floating-point type representing an imaginary number.
865+
*/
866+
class ImaginaryNumberType extends FloatingPointType {
867+
ImaginaryNumberType() { domain instanceof ImaginaryDomain }
868+
}
869+
870+
/**
871+
* A floating-point type whose representation is base 2.
872+
*/
873+
class BinaryFloatingPointType extends FloatingPointType {
874+
BinaryFloatingPointType() { base = 2 }
875+
}
876+
877+
/**
878+
* A floating-point type whose representation is base 10.
879+
*/
880+
class DecimalFloatingPointType extends FloatingPointType {
881+
DecimalFloatingPointType() { base = 10 }
722882
}
723883

724884
/**
@@ -727,7 +887,7 @@ class FloatingPointType extends ArithmeticType {
727887
* float f;
728888
* ```
729889
*/
730-
class FloatType extends FloatingPointType {
890+
class FloatType extends RealNumberType, BinaryFloatingPointType {
731891
FloatType() { builtintypes(underlyingElement(this), _, 24, _, _, _) }
732892

733893
override string getCanonicalQLClass() { result = "FloatType" }
@@ -739,7 +899,7 @@ class FloatType extends FloatingPointType {
739899
* double d;
740900
* ```
741901
*/
742-
class DoubleType extends FloatingPointType {
902+
class DoubleType extends RealNumberType, BinaryFloatingPointType {
743903
DoubleType() { builtintypes(underlyingElement(this), _, 25, _, _, _) }
744904

745905
override string getCanonicalQLClass() { result = "DoubleType" }
@@ -751,7 +911,7 @@ class DoubleType extends FloatingPointType {
751911
* long double ld;
752912
* ```
753913
*/
754-
class LongDoubleType extends FloatingPointType {
914+
class LongDoubleType extends RealNumberType, BinaryFloatingPointType {
755915
LongDoubleType() { builtintypes(underlyingElement(this), _, 26, _, _, _) }
756916

757917
override string getCanonicalQLClass() { result = "LongDoubleType" }
@@ -763,7 +923,7 @@ class LongDoubleType extends FloatingPointType {
763923
* __float128 f128;
764924
* ```
765925
*/
766-
class Float128Type extends FloatingPointType {
926+
class Float128Type extends RealNumberType, BinaryFloatingPointType {
767927
Float128Type() { builtintypes(underlyingElement(this), _, 38, _, _, _) }
768928

769929
override string getCanonicalQLClass() { result = "Float128Type" }
@@ -775,7 +935,7 @@ class Float128Type extends FloatingPointType {
775935
* _Decimal32 d32;
776936
* ```
777937
*/
778-
class Decimal32Type extends FloatingPointType {
938+
class Decimal32Type extends RealNumberType, DecimalFloatingPointType {
779939
Decimal32Type() { builtintypes(underlyingElement(this), _, 40, _, _, _) }
780940

781941
override string getCanonicalQLClass() { result = "Decimal32Type" }
@@ -787,7 +947,7 @@ class Decimal32Type extends FloatingPointType {
787947
* _Decimal64 d64;
788948
* ```
789949
*/
790-
class Decimal64Type extends FloatingPointType {
950+
class Decimal64Type extends RealNumberType, DecimalFloatingPointType {
791951
Decimal64Type() { builtintypes(underlyingElement(this), _, 41, _, _, _) }
792952

793953
override string getCanonicalQLClass() { result = "Decimal64Type" }
@@ -799,7 +959,7 @@ class Decimal64Type extends FloatingPointType {
799959
* _Decimal128 d128;
800960
* ```
801961
*/
802-
class Decimal128Type extends FloatingPointType {
962+
class Decimal128Type extends RealNumberType, DecimalFloatingPointType {
803963
Decimal128Type() { builtintypes(underlyingElement(this), _, 42, _, _, _) }
804964

805965
override string getCanonicalQLClass() { result = "Decimal128Type" }

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,12 @@ private class ArrayContent extends Content, TArrayContent {
186186
* value of `node1`.
187187
*/
188188
predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
189-
none() // stub implementation
189+
exists(FieldAddressInstruction fa, StoreInstruction store |
190+
node1.asInstruction() = store and
191+
store.getDestinationAddress() = fa and
192+
node2.asInstruction().(ChiInstruction).getPartial() = store and
193+
f.(FieldContent).getField() = fa.getField()
194+
)
190195
}
191196

192197
/**
@@ -195,7 +200,12 @@ predicate storeStep(Node node1, Content f, PostUpdateNode node2) {
195200
* `node2`.
196201
*/
197202
predicate readStep(Node node1, Content f, Node node2) {
198-
none() // stub implementation
203+
exists(FieldAddressInstruction fa, LoadInstruction load |
204+
load.getSourceAddress() = fa and
205+
node1.asInstruction() = load.getSourceValueOperand().getAnyDef() and
206+
fa.getField() = f.(FieldContent).getField() and
207+
load = node2.asInstruction()
208+
)
199209
}
200210

201211
/**

0 commit comments

Comments
 (0)