Skip to content

Commit d38700a

Browse files
jbjjbj
committed
Merge remote-tracking branch 'upstream/master' into mergeback-2020-05-19
Conflicts: cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected
2 parents 5318d42 + 26dfca8 commit d38700a

28 files changed

+73
-89
lines changed

‎change-notes/1.25/analysis-javascript.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,29 @@
4343
| Zip Slip (`js/zipslip`) | More results | This query now recognizes additional vulnerabilities. |
4444
| Unused property (`js/unused-property`) | Less results | This query no longer flags properties of objects that are operands of `yield` expressions. |
4545

46+
The following low-precision queries are no longer run by default on LGTM (their results already were not displayed):
47+
48+
- `js/angular/dead-event-listener`
49+
- `js/angular/unused-dependency`
50+
- `js/conflicting-html-attribute`
51+
- `js/useless-assignment-to-global`
52+
- `js/too-many-parameters`
53+
- `js/unused-property`
54+
- `js/bitwise-sign-check`
55+
- `js/comparison-of-identical-expressions`
56+
- `js/misspelled-identifier`
57+
- `js/jsdoc/malformed-param-tag`
58+
- `js/jsdoc/unknown-parameter`
59+
- `js/jsdoc/missing-parameter`
60+
- `js/omitted-array-element`
61+
- `js/ignored-setter-parameter`
62+
- `js/json-in-javascript-file`
63+
- `js/node/cyclic-import`
64+
- `js/node/unused-npm-dependency`
65+
- `js/single-run-loop`
66+
- `js/nested-loops-with-same-variable`
67+
- `js/return-outside-function`
68+
4669
## Changes to libraries
4770

4871
* A library `semmle.javascript.explore.CallGraph` has been added to help write queries for exploring the call graph.

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/defaulttainttracking.cpp

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -99,21 +99,21 @@ void test_outparams() {
9999
}
100100

101101

102-
void *memcpy(void *dst, void *src, int size);
103102

104-
struct ContainsArray {
105-
int arr[16];
103+
104+
struct XY {
106105
int x;
106+
int y;
107107
};
108108

109-
void taint_array(ContainsArray *ca, int offset) {
109+
void taint_y(XY *xyp) {
110110
int tainted = getenv("VAR")[0];
111-
memcpy(ca->arr + offset, &tainted, sizeof(int));
111+
xyp->y = tainted;
112112
}
113113

114-
void test_conflated_fields3(int arbitrary) {
115-
ContainsArray ca;
116-
ca.x = 0;
117-
taint_array(&ca, arbitrary);
118-
sink(ca.x); // not tainted [FALSE POSITIVE]
114+
void test_conflated_fields3() {
115+
XY xy;
116+
xy.x = 0;
117+
taint_y(&xy);
118+
sink(xy.x); // not tainted [FALSE POSITIVE]
119119
}

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,14 +98,11 @@
9898
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:98:10:98:11 | (const char *)... |
9999
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:98:10:98:11 | p2 |
100100
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | shared.h:5:23:5:31 | sinkparam |
101-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:102:31:102:33 | src |
102101
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:110:7:110:13 | tainted |
103102
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:110:17:110:22 | call to getenv |
104103
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:110:17:110:32 | (int)... |
105104
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:110:17:110:32 | access to array |
106-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:3:111:8 | call to memcpy |
107-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:28:111:35 | & ... |
108-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:28:111:35 | (void *)... |
105+
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:12:111:18 | tainted |
109106
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:118:11:118:11 | x |
110107
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | shared.h:6:15:6:23 | sinkparam |
111108
| dispatch.cpp:28:29:28:34 | call to getenv | dispatch.cpp:28:24:28:27 | call to atoi |

‎cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,7 @@
2020
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:98:10:98:11 | (const char *)... | IR only |
2121
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | defaulttainttracking.cpp:98:10:98:11 | p2 | IR only |
2222
| defaulttainttracking.cpp:97:27:97:32 | call to getenv | shared.h:5:23:5:31 | sinkparam | IR only |
23-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:102:20:102:22 | dst | AST only |
24-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:10:111:25 | ... + ... | AST only |
25-
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:29:111:35 | tainted | AST only |
23+
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:111:8:111:8 | y | AST only |
2624
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | defaulttainttracking.cpp:118:11:118:11 | x | IR only |
2725
| defaulttainttracking.cpp:110:17:110:22 | call to getenv | shared.h:6:15:6:23 | sinkparam | IR only |
2826
| globals.cpp:13:15:13:20 | call to getenv | globals.cpp:13:5:13:11 | global1 | AST only |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/TaintedAllocationSize.expected

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
edges
2-
| field_conflation.c:12:22:12:27 | call to getenv | field_conflation.c:13:10:13:25 | Chi |
3-
| field_conflation.c:12:22:12:34 | (const char *)... | field_conflation.c:13:10:13:25 | Chi |
4-
| field_conflation.c:13:10:13:25 | Chi | field_conflation.c:19:15:19:17 | taint_array output argument |
2+
| field_conflation.c:12:22:12:27 | call to getenv | field_conflation.c:13:3:13:18 | Chi |
3+
| field_conflation.c:12:22:12:34 | (const char *)... | field_conflation.c:13:3:13:18 | Chi |
4+
| field_conflation.c:13:3:13:18 | Chi | field_conflation.c:19:15:19:17 | taint_array output argument |
55
| field_conflation.c:19:15:19:17 | taint_array output argument | field_conflation.c:20:10:20:13 | (unsigned long)... |
66
| field_conflation.c:19:15:19:17 | taint_array output argument | field_conflation.c:20:13:20:13 | x |
77
| field_conflation.c:19:15:19:17 | taint_array output argument | field_conflation.c:20:13:20:13 | x |
@@ -71,7 +71,7 @@ edges
7171
nodes
7272
| field_conflation.c:12:22:12:27 | call to getenv | semmle.label | call to getenv |
7373
| field_conflation.c:12:22:12:34 | (const char *)... | semmle.label | (const char *)... |
74-
| field_conflation.c:13:10:13:25 | Chi | semmle.label | Chi |
74+
| field_conflation.c:13:3:13:18 | Chi | semmle.label | Chi |
7575
| field_conflation.c:19:15:19:17 | taint_array output argument | semmle.label | taint_array output argument |
7676
| field_conflation.c:20:10:20:13 | (unsigned long)... | semmle.label | (unsigned long)... |
7777
| field_conflation.c:20:10:20:13 | (unsigned long)... | semmle.label | (unsigned long)... |

‎cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/TaintedAllocationSize/field_conflation.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,21 @@
11
int atoi(const char *nptr);
22
void *malloc(unsigned long size);
33
char *getenv(const char *name);
4-
void *memcpy(void *dst, void *src, unsigned long size);
54

6-
struct ContainsArray {
7-
int arr[16];
5+
6+
struct XY {
87
int x;
8+
int y;
99
};
1010

11-
void taint_array(struct ContainsArray *ca, int offset) {
11+
void taint_array(struct XY *xyp) {
1212
int tainted = atoi(getenv("VAR"));
13-
memcpy(ca->arr + offset, &tainted, sizeof(int));
13+
xyp->y = tainted;
1414
}
1515

16-
void test_conflated_fields3(int arbitrary) {
17-
struct ContainsArray ca;
18-
ca.x = 4;
19-
taint_array(&ca, arbitrary);
20-
malloc(ca.x); // not tainted [FALSE POSITIVE]
16+
void test_conflated_fields3(void) {
17+
struct XY xy;
18+
xy.x = 4;
19+
taint_array(&xy);
20+
malloc(xy.x); // not tainted [FALSE POSITIVE]
2121
}

‎java/ql/src/semmle/code/FileSystem.qll

Lines changed: 0 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -151,33 +151,6 @@ class Container extends @container, Top {
151151
* This is the absolute path of the container.
152152
*/
153153
override string toString() { result = getAbsolutePath() }
154-
155-
/**
156-
* DEPRECATED: use `getAbsolutePath()`, `getBaseName()` or `getStem()` instead.
157-
*
158-
* Gets the name of this container.
159-
*/
160-
deprecated string getName() { result = getAbsolutePath() }
161-
162-
/**
163-
* DEPRECATED: use `getBaseName()` or `getStem()` instead.
164-
*
165-
* The short name of this container, excluding its path and (for files) extension.
166-
*
167-
* For folders, the short name includes the extension (if any), so the short name
168-
* of the folder with absolute path `/home/user/.m2` is `.m2`.
169-
*/
170-
deprecated string getShortName() {
171-
folders(this, _, result) or
172-
files(this, _, result, _, _)
173-
}
174-
175-
/**
176-
* DEPRECATED: use `getAbsolutePath()` instead.
177-
*
178-
* Gets the full name of this container, including its path and extension (if any).
179-
*/
180-
deprecated string getFullName() { result = getAbsolutePath() }
181154
}
182155

183156
/** A folder. */
@@ -198,13 +171,6 @@ class File extends Container, @file {
198171

199172
/** Gets the URL of this file. */
200173
override string getURL() { result = "file://" + this.getAbsolutePath() + ":0:0:0:0" }
201-
202-
/**
203-
* DEPRECATED: use `getAbsolutePath()`, `getBaseName()` or `getStem()` instead.
204-
*
205-
* Holds if this file has the specified `name`.
206-
*/
207-
deprecated predicate hasName(string name) { name = this.getAbsolutePath() }
208174
}
209175

210176
/**

‎java/ql/src/semmle/code/java/Statement.qll

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ class IfStmt extends ConditionalStmt, @ifstmt {
117117
* Gets the statement that is executed whenever the condition
118118
* of this branch statement evaluates to `true`.
119119
*/
120-
override Stmt getTrueSuccessor() { result = getThen() }
120+
deprecated override Stmt getTrueSuccessor() { result = getThen() }
121121

122122
/** Gets the `else` branch of this `if` statement. */
123123
Stmt getElse() { result.isNthChildOf(this, 2) }
@@ -168,7 +168,7 @@ class ForStmt extends ConditionalStmt, @forstmt {
168168
* Gets the statement that is executed whenever the condition
169169
* of this branch statement evaluates to true.
170170
*/
171-
override Stmt getTrueSuccessor() { result = getStmt() }
171+
deprecated override Stmt getTrueSuccessor() { result = getStmt() }
172172

173173
/**
174174
* Gets a variable that is used as an iteration variable: it is defined,
@@ -228,7 +228,7 @@ class WhileStmt extends ConditionalStmt, @whilestmt {
228228
* Gets the statement that is executed whenever the condition
229229
* of this branch statement evaluates to true.
230230
*/
231-
override Stmt getTrueSuccessor() { result = getStmt() }
231+
deprecated override Stmt getTrueSuccessor() { result = getStmt() }
232232

233233
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
234234
override string pp() { result = "while (...) " + this.getStmt().pp() }
@@ -249,7 +249,7 @@ class DoStmt extends ConditionalStmt, @dostmt {
249249
* Gets the statement that is executed whenever the condition
250250
* of this branch statement evaluates to `true`.
251251
*/
252-
override Stmt getTrueSuccessor() { result = getStmt() }
252+
deprecated override Stmt getTrueSuccessor() { result = getStmt() }
253253

254254
/** Gets a printable representation of this statement. May include more detail than `toString()`. */
255255
override string pp() { result = "do " + this.getStmt().pp() + " while (...)" }

‎javascript/ql/src/AngularJS/DeadAngularJSEventListener.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description An AngularJS event listener that listens for a non-existent event has no effect.
44
* @kind problem
55
* @problem.severity warning
6-
* @precision medium
6+
* @precision low
77
* @id js/angular/dead-event-listener
88
* @tags correctness
99
* frameworks/angularjs

‎javascript/ql/src/AngularJS/UnusedAngularDependency.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* @description Unused dependencies are confusing, and should be removed.
44
* @kind problem
55
* @problem.severity recommendation
6-
* @precision high
6+
* @precision low
77
* @id js/angular/unused-dependency
88
* @tags maintainability
99
* frameworks/angularjs

0 commit comments

Comments
 (0)