Skip to content

Commit fa0f5d0

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into toctou2
2 parents 473198a + 73ee740 commit fa0f5d0

File tree

1,584 files changed

+105460
-28466
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,584 files changed

+105460
-28466
lines changed

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,19 +49,23 @@ jobs:
4949
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
5050
- name: Unzip CodeQL CLI
5151
run: unzip -d codeql-cli codeql-linux64.zip
52-
- name: Generate CSV files on merge and base of the PR
52+
- name: Generate CSV files on merge commit of the PR
5353
run: |
5454
echo "Running generator on merge"
5555
PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
5656
mkdir out_merge
5757
cp framework-coverage-*.csv out_merge/
5858
cp framework-coverage-*.rst out_merge/
59-
59+
- name: Generate CSV files on base commit of the PR
60+
run: |
6061
echo "Running generator on base"
6162
PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
6263
mkdir out_base
6364
cp framework-coverage-*.csv out_base/
6465
cp framework-coverage-*.rst out_base/
66+
- name: Generate diff of coverage reports
67+
run: |
68+
python base/misc/scripts/library-coverage/compare-folders.py out_base out_merge comparison.md
6569
- name: Upload CSV package list
6670
uses: actions/upload-artifact@v2
6771
with:
@@ -76,6 +80,12 @@ jobs:
7680
path: |
7781
out_base/framework-coverage-*.csv
7882
out_base/framework-coverage-*.rst
83+
- name: Upload comparison results
84+
uses: actions/upload-artifact@v2
85+
with:
86+
name: comparison
87+
path: |
88+
comparison.md
7989
- name: Save PR number
8090
run: |
8191
mkdir -p pr

‎.github/workflows/csv-coverage-pr-comment.yml

Lines changed: 2 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -26,40 +26,9 @@ jobs:
2626
with:
2727
python-version: 3.8
2828

29-
# download artifacts from the PR job:
30-
31-
- name: Download artifact - MERGE
29+
- name: Check coverage difference file and comment
3230
env:
3331
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3432
RUN_ID: ${{ github.event.workflow_run.id }}
3533
run: |
36-
gh run download --name "csv-framework-coverage-merge" --dir "out_merge" "$RUN_ID"
37-
38-
- name: Download artifact - BASE
39-
env:
40-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41-
RUN_ID: ${{ github.event.workflow_run.id }}
42-
run: |
43-
gh run download --name "csv-framework-coverage-base" --dir "out_base" "$RUN_ID"
44-
45-
- name: Download artifact - PR
46-
env:
47-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48-
RUN_ID: ${{ github.event.workflow_run.id }}
49-
run: |
50-
gh run download --name "pr" --dir "pr" "$RUN_ID"
51-
52-
- name: Check coverage files
53-
env:
54-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55-
RUN_ID: ${{ github.event.workflow_run.id }}
56-
run: |
57-
PR=$(cat "pr/NR")
58-
python misc/scripts/library-coverage/compare-files-comment-pr.py \
59-
out_base out_merge comparison.md "$GITHUB_REPOSITORY" "$PR" "$RUN_ID"
60-
- name: Upload comparison results
61-
uses: actions/upload-artifact@v2
62-
with:
63-
name: comparison
64-
path: |
65-
comparison.md
34+
python misc/scripts/library-coverage/comment-pr.py "$GITHUB_REPOSITORY" "$RUN_ID"

‎.github/workflows/csv-coverage-update.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Update framework coverage reports
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 0 * * *"
7+
8+
jobs:
9+
update:
10+
name: Update framework coverage report
11+
if: github.event.repository.fork == false
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Dump GitHub context
16+
env:
17+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
18+
run: echo "$GITHUB_CONTEXT"
19+
- name: Clone self (github/codeql)
20+
uses: actions/checkout@v2
21+
with:
22+
path: ql
23+
fetch-depth: 0
24+
- name: Set up Python 3.8
25+
uses: actions/setup-python@v2
26+
with:
27+
python-version: 3.8
28+
- name: Download CodeQL CLI
29+
env:
30+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
run: |
32+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
33+
- name: Unzip CodeQL CLI
34+
run: unzip -d codeql-cli codeql-linux64.zip
35+
36+
- name: Generate coverage files
37+
run: |
38+
PATH="$PATH:codeql-cli/codeql" python ql/misc/scripts/library-coverage/generate-report.py ci ql ql
39+
40+
- name: Create pull request with changes
41+
env:
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
run: |
44+
python ql/misc/scripts/library-coverage/create-pr.py ql "$GITHUB_REPOSITORY"

‎CODEOWNERS

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,9 @@
1717
/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @github/codeql-java @github/codeql-go
1818
/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
1919
/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
20+
21+
# CodeQL tools and associated docs
22+
/docs/codeql-cli/ @github/codeql-cli-reviewers
23+
/docs/codeql-for-visual-studio-code/ @github/codeql-vscode-reviewers
24+
/docs/ql-language-reference/ @github/codeql-frontend-reviewers
25+
/docs/query-*-style-guide.md @github/codeql-analysis-reviewers

‎config/identical-files.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -448,5 +448,17 @@
448448
"SensitiveDataHeuristics Python/JS": [
449449
"javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
450450
"python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll"
451+
],
452+
"ReDoS Util Python/JS": [
453+
"javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll",
454+
"python/ql/src/semmle/python/security/performance/ReDoSUtil.qll"
455+
],
456+
"ReDoS Exponential Python/JS": [
457+
"javascript/ql/src/semmle/javascript/security/performance/ExponentialBackTracking.qll",
458+
"python/ql/src/semmle/python/security/performance/ExponentialBackTracking.qll"
459+
],
460+
"ReDoS Polynomial Python/JS": [
461+
"javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
462+
"python/ql/src/semmle/python/security/performance/SuperlinearBackTracking.qll"
451463
]
452464
}

‎cpp/change-notes/2021-06-24-dataflow-implicit-reads.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The DataFlow libraries have been augmented with support for `Configuration`-specific in-place read steps at, for example, sinks and custom taint steps. This means that it is now possible to specify sinks that accept flow with non-empty access paths.

‎cpp/change-notes/2021-06-24-uncontrolled-arithmetic.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The 'Uncontrolled data in arithmetic expression' (cpp/uncontrolled-arithmetic) query now recognizes more sources of randomness.

‎cpp/change-notes/2021-06-30-wrong-type-format-argument.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Wrong type of arguments to formatting function' (cpp/wrong-type-format-argument) query is now more accepting of the string and character formatting differences between Microsoft and non-Microsoft platforms. There are now fewer false positive results.

‎cpp/ql/src/Diagnostics/FailedExtractorInvocations.ql

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,6 @@
77

88
import cpp
99

10-
class AnonymousCompilation extends Compilation {
11-
override string toString() { result = "<compilation>" }
12-
}
13-
1410
string describe(Compilation c) {
1511
if c.getArgument(1) = "--mimic"
1612
then result = "compiler invocation " + concat(int i | i > 1 | c.getArgument(i), " " order by i)
@@ -19,4 +15,4 @@ string describe(Compilation c) {
1915

2016
from Compilation c
2117
where not c.normalTermination()
22-
select c, "Extraction aborted for " + describe(c), 2
18+
select "Extraction aborted for " + describe(c)

‎cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql

Lines changed: 29 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -19,28 +19,32 @@ import cpp
1919
* Holds if the argument corresponding to the `pos` conversion specifier
2020
* of `ffc` is expected to have type `expected`.
2121
*/
22-
pragma[noopt]
2322
private predicate formattingFunctionCallExpectedType(
2423
FormattingFunctionCall ffc, int pos, Type expected
2524
) {
26-
exists(FormattingFunction f, int i, FormatLiteral fl |
27-
ffc instanceof FormattingFunctionCall and
28-
ffc.getTarget() = f and
29-
f.getFormatParameterIndex() = i and
30-
ffc.getArgument(i) = fl and
31-
fl.getConversionType(pos) = expected
32-
)
25+
ffc.getFormat().(FormatLiteral).getConversionType(pos) = expected
26+
}
27+
28+
/**
29+
* Holds if the argument corresponding to the `pos` conversion specifier
30+
* of `ffc` could alternatively have type `expected`, for example on a different
31+
* platform.
32+
*/
33+
private predicate formattingFunctionCallAlternateType(
34+
FormattingFunctionCall ffc, int pos, Type expected
35+
) {
36+
ffc.getFormat().(FormatLiteral).getConversionTypeAlternate(pos) = expected
3337
}
3438

3539
/**
3640
* Holds if the argument corresponding to the `pos` conversion specifier
37-
* of `ffc` is expected to have type `expected` and the corresponding
38-
* argument `arg` has type `actual`.
41+
* of `ffc` is `arg` and has type `actual`.
3942
*/
4043
pragma[noopt]
41-
predicate formatArgType(FormattingFunctionCall ffc, int pos, Type expected, Expr arg, Type actual) {
44+
predicate formattingFunctionCallActualType(
45+
FormattingFunctionCall ffc, int pos, Expr arg, Type actual
46+
) {
4247
exists(Expr argConverted |
43-
formattingFunctionCallExpectedType(ffc, pos, expected) and
4448
ffc.getConversionArgument(pos) = arg and
4549
argConverted = arg.getFullyConverted() and
4650
actual = argConverted.getType()
@@ -72,7 +76,8 @@ class ExpectedType extends Type {
7276
ExpectedType() {
7377
exists(Type t |
7478
(
75-
formatArgType(_, _, t, _, _) or
79+
formattingFunctionCallExpectedType(_, _, t) or
80+
formattingFunctionCallAlternateType(_, _, t) or
7681
formatOtherArgType(_, _, t, _, _)
7782
) and
7883
this = t.getUnspecifiedType()
@@ -91,7 +96,11 @@ class ExpectedType extends Type {
9196
*/
9297
predicate trivialConversion(ExpectedType expected, Type actual) {
9398
exists(Type exp, Type act |
94-
formatArgType(_, _, exp, _, act) and
99+
(
100+
formattingFunctionCallExpectedType(_, _, exp) or
101+
formattingFunctionCallAlternateType(_, _, exp)
102+
) and
103+
formattingFunctionCallActualType(_, _, _, act) and
95104
expected = exp.getUnspecifiedType() and
96105
actual = act.getUnspecifiedType()
97106
) and
@@ -146,9 +155,13 @@ int sizeof_IntType() { exists(IntType it | result = it.getSize()) }
146155
from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
147156
where
148157
(
149-
formatArgType(ffc, n, expected, arg, actual) and
158+
formattingFunctionCallExpectedType(ffc, n, expected) and
159+
formattingFunctionCallActualType(ffc, n, arg, actual) and
150160
not exists(Type anyExpected |
151-
formatArgType(ffc, n, anyExpected, arg, actual) and
161+
(
162+
formattingFunctionCallExpectedType(ffc, n, anyExpected) or
163+
formattingFunctionCallAlternateType(ffc, n, anyExpected)
164+
) and
152165
trivialConversion(anyExpected.getUnspecifiedType(), actual.getUnspecifiedType())
153166
)
154167
or

0 commit comments

Comments
 (0)