Skip to content

Commit 896cdf9

Browse files
raulgarciamsftraulgarciamsft
committed
Merge branch 'master' of https://github.com/github/codeql 
2 parents f051f46 + dcff87f commit 896cdf9

File tree

2,889 files changed

+155787
-78442
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,889 files changed

+155787
-78442
lines changed

‎.devcontainer/devcontainer.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"extensions": [
3+
"github.vscode-codeql",
4+
"slevesque.vscode-zipexplorer"
5+
],
6+
"settings": {
7+
"codeQL.experimentalBqrsParsing": true
8+
}
9+
}

‎.github/codeql/codeql-config.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
name: "CodeQL config"
2+
3+
queries:
4+
- uses: security-and-quality
5+
6+
paths-ignore:
7+
- '/cpp/'
8+
- '/java/'
9+
- '/python/'

‎.github/workflows/codeql-analysis.yml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "Code scanning - action"
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: '0 9 * * 1'
8+
9+
jobs:
10+
CodeQL-Build:
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v2
17+
with:
18+
# We must fetch at least the immediate parents so that if this is
19+
# a pull request then we can checkout the head.
20+
fetch-depth: 2
21+
22+
# If this run was triggered by a pull request event, then checkout
23+
# the head of the pull request instead of the merge commit.
24+
- run: git checkout HEAD^2
25+
if: ${{ github.event_name == 'pull_request' }}
26+
27+
# Initializes the CodeQL tools for scanning.
28+
- name: Initialize CodeQL
29+
uses: github/codeql-action/init@v1
30+
# Override language selection by uncommenting this and choosing your languages
31+
with:
32+
languages: csharp
33+
config-file: ./.github/codeql/codeql-config.yml
34+
35+
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
36+
# If this step fails, then you should remove it and run the build manually (see below)
37+
- name: Autobuild
38+
uses: github/codeql-action/autobuild@v1
39+
40+
# ℹ️ Command-line programs to run using the OS shell.
41+
# 📚 https://git.io/JvXDl
42+
43+
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
44+
# and modify them (or add more) to build your code if your project
45+
# uses a compiled language
46+
47+
#- run: |
48+
# make bootstrap
49+
# make release
50+
51+
- name: Perform CodeQL Analysis
52+
uses: github/codeql-action/analyze@v1

‎CONTRIBUTING.md

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
We welcome contributions to our CodeQL libraries and queries. Got an idea for a new check, or how to improve an existing query? Then please go ahead and open a pull request! Contributions to this project are [released](https://help.github.com/articles/github-terms-of-service/#6-contributions-under-repository-license) to the public under the [project's open source license](LICENSE).
44

5-
There is lots of useful documentation to help you write queries, ranging from information about query file structure to tutorials for specific target languages. For more information on the documentation available, see [Writing CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
5+
There is lots of useful documentation to help you write queries, ranging from information about query file structure to tutorials for specific target languages. For more information on the documentation available, see [CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/writing-queries.html) on [help.semmle.com](https://help.semmle.com).
66

77

88
## Submitting a new experimental query
@@ -32,7 +32,7 @@ If you have an idea for a query that you would like to share with other CodeQL u
3232

3333
For details, see the [guide on query metadata](docs/query-metadata-style-guide.md).
3434

35-
Make sure the `select` statement is compatible with the query `@kind`. See [Introduction to query files](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
35+
Make sure the `select` statement is compatible with the query `@kind`. See [About CodeQL queries](https://help.semmle.com/QL/learn-ql/writing-queries/introduction-to-queries.html#select-clause) on help.semmle.com.
3636

3737
3. **Formatting**
3838

@@ -53,14 +53,6 @@ After the experimental query is merged, we welcome pull requests to improve it.
5353

5454
## Using your personal data
5555

56-
If you contribute to this project, we will record your name and email
57-
address (as provided by you with your contributions) as part of the code
58-
repositories, which are public. We might also use this information
59-
to contact you in relation to your contributions, as well as in the
60-
normal course of software development. We also store records of your
61-
CLA agreements. Under GDPR legislation, we do this
62-
on the basis of our legitimate interest in creating the CodeQL product.
63-
64-
Please do get in touch ([email protected]) if you have any questions about
65-
this or our data protection policies.
56+
If you contribute to this project, we will record your name and email address (as provided by you with your contributions) as part of the code repositories, which are public. We might also use this information to contact you in relation to your contributions, as well as in the normal course of software development. We also store records of CLA agreements signed in the past, but no longer require contributors to sign a CLA. Under GDPR legislation, we do this on the basis of our legitimate interest in creating the CodeQL product.
6657

58+
Please do get in touch ([email protected]) if you have any questions about this or our data protection policies.

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# CodeQL
22

3-
This open source repository contains the standard CodeQL libraries and queries that power [LGTM](https://lgtm.com) and the other CodeQL products that [GitHub](https://github.com) makes available to its customers worldwide.
3+
This open source repository contains the standard CodeQL libraries and queries that power [LGTM](https://lgtm.com) and the other CodeQL products that [GitHub](https://github.com) makes available to its customers worldwide. For the queries, libraries, and extractor that power Go analysis, visit the [CodeQL for Go repository](https://github.com/github/codeql-go).
44

55
## How do I learn CodeQL and run queries?
66

‎change-notes/1.25/analysis-cpp.md

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Improvements to C/C++ analysis
2+
3+
The following changes in version 1.25 affect C/C++ analysis in all applications.
4+
5+
## General improvements
6+
7+
## New queries
8+
9+
| **Query** | **Tags** | **Purpose** |
10+
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
12+
## Changes to existing queries
13+
14+
| **Query** | **Expected impact** | **Change** |
15+
|----------------------------|------------------------|------------------------------------------------------------------|
16+
| Uncontrolled format string (`cpp/tainted-format-string`) | | This query is now displayed by default on LGTM. |
17+
| Uncontrolled format string (through global variable) (`cpp/tainted-format-string-through-global`) | | This query is now displayed by default on LGTM. |
18+
19+
## Changes to libraries
20+
21+
* The library `VCS.qll` and all queries that imported it have been removed.
22+
* The data-flow library has been improved, which affects most security queries by potentially
23+
adding more results. Flow through functions now takes nested field reads/writes into account.
24+
For example, the library is able to track flow from `taint()` to `sink()` via the method
25+
`getf2f1()` in
26+
```c
27+
struct C {
28+
int f1;
29+
};
30+
31+
struct C2
32+
{
33+
C f2;
34+
35+
int getf2f1() {
36+
return f2.f1; // Nested field read
37+
}
38+
39+
void m() {
40+
f2.f1 = taint();
41+
sink(getf2f1()); // NEW: taint() reaches here
42+
}
43+
};
44+
```
45+
* The security pack taint tracking library (`semmle.code.cpp.security.TaintTracking`) now considers that equality checks may block the flow of taint. This results in fewer false positive results from queries that use this library.
46+
* The length of a tainted string (such as the return value of a call to `strlen` or `strftime` with tainted parameters) is no longer itself considered tainted by the `models` library. This leads to fewer false positive results in queries that use any of our taint libraries.

‎change-notes/1.25/analysis-csharp.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Improvements to C# analysis
2+
3+
The following changes in version 1.25 affect C# analysis in all applications.
4+
5+
## New queries
6+
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
10+
11+
## Changes to existing queries
12+
13+
| **Query** | **Expected impact** | **Change** |
14+
|------------------------------|------------------------|-----------------------------------|
15+
16+
17+
## Removal of old queries
18+
19+
## Changes to code extraction
20+
21+
* Index initializers, of the form `{ [1] = "one" }`, are extracted correctly. Previously, the kind of the
22+
expression was incorrect, and the index was not extracted.
23+
24+
## Changes to libraries
25+
26+
* The class `UnboundGeneric` has been refined to only be those declarations that actually
27+
have type parameters. This means that non-generic nested types inside constructed types,
28+
such as `A<int>.B`, no longer are considered unbound generics. (Such nested types do,
29+
however, still have relevant `.getSourceDeclaration()`s, for example `A<>.B`.)
30+
* The data-flow library has been improved, which affects most security queries by potentially
31+
adding more results. Flow through methods now takes nested field reads/writes into account.
32+
For example, the library is able to track flow from `"taint"` to `Sink()` via the method
33+
`GetF2F1()` in
34+
```csharp
35+
class C1
36+
{
37+
string F1;
38+
}
39+
40+
class C2
41+
{
42+
C1 F2;
43+
44+
string GetF2F1() => F2.F1; // Nested field read
45+
46+
void M()
47+
{
48+
F2 = new C1() { F1 = "taint" };
49+
Sink(GetF2F1()); // NEW: "taint" reaches here
50+
}
51+
}
52+
```
53+
54+
## Changes to autobuilder

‎change-notes/1.25/analysis-java.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
# Improvements to Java analysis
2+
3+
The following changes in version 1.25 affect Java analysis in all applications.
4+
5+
## General improvements
6+
7+
## New queries
8+
9+
| **Query** | **Tags** | **Purpose** |
10+
|-----------------------------|-----------|--------------------------------------------------------------------|
11+
12+
13+
## Changes to existing queries
14+
15+
| **Query** | **Expected impact** | **Change** |
16+
|------------------------------|------------------------|-----------------------------------|
17+
18+
19+
## Changes to libraries
20+
21+
* The data-flow library has been improved, which affects most security queries by potentially
22+
adding more results. Flow through methods now takes nested field reads/writes into account.
23+
For example, the library is able to track flow from `"taint"` to `sink()` via the method
24+
`getF2F1()` in
25+
```java
26+
class C1 {
27+
String f1;
28+
C1(String f1) { this.f1 = f1; }
29+
}
30+
31+
class C2 {
32+
C1 f2;
33+
String getF2F1() {
34+
return this.f2.f1; // Nested field read
35+
}
36+
void m() {
37+
this.f2 = new C1("taint");
38+
sink(this.getF2F1()); // NEW: "taint" reaches here
39+
}
40+
}
41+
```

0 commit comments

Comments
 (0)