Skip to content

Commit 7883bff

Browse files
smowtonsmowton
authored
Merge branch 'main' into goSqlInjection
2 parents 15c58de + ef9b503 commit 7883bff

File tree

62 files changed

+4172
-3674
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

62 files changed

+4172
-3674
lines changed

‎.github/workflows/csharp-qltest.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ jobs:
6767
mv "$CODEQL_PATH/csharp/tools/extractor-asp.jar" "${{ github.workspace }}/csharp/extractor-pack/tools"
6868
# Safe guard against using the bundled extractor
6969
rm -rf "$CODEQL_PATH/csharp"
70-
codeql test run --threads=0 --ram 52000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/csharp/extractor-pack" --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
70+
codeql test run --threads=0 --ram 50000 --slice ${{ matrix.slice }} --search-path "${{ github.workspace }}/csharp/extractor-pack" --check-databases --check-undefined-labels --check-repeated-labels --check-redefined-labels --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
7171
env:
7272
GITHUB_TOKEN: ${{ github.token }}
7373
unit-tests:

‎.github/workflows/js-ml-tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
run: |
4848
codeql query compile \
4949
--check-only \
50-
--ram 52000 \
50+
--ram 50000 \
5151
--additional-packs "${{ github.workspace }}" \
5252
--threads=0 \
5353
--compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" \
@@ -58,7 +58,7 @@ jobs:
5858
run: |
5959
codeql test run \
6060
--threads=0 \
61-
--ram 52000 \
61+
--ram 50000 \
6262
--additional-packs "${{ github.workspace }}" \
6363
--compilation-cache "${{ steps.query-cache.outputs.cache-dir }}" \
6464
-- \

‎.github/workflows/ruby-qltest.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,6 @@ jobs:
6262
key: ruby-qltest
6363
- name: Run QL tests
6464
run: |
65-
codeql test run --threads=0 --ram 52000 --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
65+
codeql test run --threads=0 --ram 50000 --search-path "${{ github.workspace }}/ruby/extractor-pack" --check-databases --check-undefined-labels --check-unused-labels --check-repeated-labels --check-redefined-labels --check-use-before-definition --consistency-queries ql/consistency-queries ql/test --compilation-cache "${{ steps.query-cache.outputs.cache-dir }}"
6666
env:
6767
GITHUB_TOKEN: ${{ github.token }}

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -520,7 +520,8 @@ module Private {
520520
predicate summaryParameterNodeRange(SummarizedCallable c, ParameterPosition pos) {
521521
parameterReadState(c, _, pos)
522522
or
523-
isParameterPostUpdate(_, c, pos)
523+
// Same as `isParameterPostUpdate(_, c, pos)`, but can be used in a negative context
524+
any(SummaryNodeState state).isOutputState(c, SummaryComponentStack::argument(pos))
524525
}
525526

526527
private predicate callbackOutput(

‎go.work

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎go/ql/lib/semmle/go/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -520,7 +520,8 @@ module Private {
520520
predicate summaryParameterNodeRange(SummarizedCallable c, ParameterPosition pos) {
521521
parameterReadState(c, _, pos)
522522
or
523-
isParameterPostUpdate(_, c, pos)
523+
// Same as `isParameterPostUpdate(_, c, pos)`, but can be used in a negative context
524+
any(SummaryNodeState state).isOutputState(c, SummaryComponentStack::argument(pos))
524525
}
525526

526527
private predicate callbackOutput(

‎java/ql/lib/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -520,7 +520,8 @@ module Private {
520520
predicate summaryParameterNodeRange(SummarizedCallable c, ParameterPosition pos) {
521521
parameterReadState(c, _, pos)
522522
or
523-
isParameterPostUpdate(_, c, pos)
523+
// Same as `isParameterPostUpdate(_, c, pos)`, but can be used in a negative context
524+
any(SummaryNodeState state).isOutputState(c, SummaryComponentStack::argument(pos))
524525
}
525526

526527
private predicate callbackOutput(

‎javascript/ql/lib/semmle/javascript/ApiGraphs.qll

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -561,6 +561,9 @@ module API {
561561
/** Gets a node whose type has the given qualified name, not including types from models. */
562562
Node getANodeOfTypeRaw(string moduleName, string exportedName) {
563563
result = Impl::MkTypeUse(moduleName, exportedName).(Node).getInstance()
564+
or
565+
exportedName = "" and
566+
result = getAModuleImportRaw(moduleName)
564567
}
565568
}
566569

‎javascript/ql/lib/semmle/javascript/frameworks/NoSQL.qll

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ private module MongoDB {
2424
override predicate row(string row) {
2525
// In Mongo version 2.x, a client and a database handle were the same concept, but in 3.x
2626
// they were separated. To handle everything with a single model, we treat them as the same here.
27-
row = "mongodb;Db;mongodb;MongoClient;"
27+
row = "mongodb.Db;mongodb.MongoClient;"
2828
}
2929
}
3030

@@ -42,11 +42,11 @@ private module MongoDB {
4242
/** A call to a MongoDB query method. */
4343
private class QueryCall extends DatabaseAccess, API::CallNode {
4444
QueryCall() {
45-
this = ModelOutput::getATypeNode("mongodb", "Collection").getAMember().getACall() and
45+
this = ModelOutput::getATypeNode("mongodb.Collection").getAMember().getACall() and
4646
not this.getCalleeName() = ["toString", "valueOf", "getLogger"]
4747
or
4848
this =
49-
ModelOutput::getATypeNode("mongodb", ["Db", "MongoClient"])
49+
ModelOutput::getATypeNode(["mongodb.Db", "mongodb.MongoClient"])
5050
.getMember(["watch", "aggregate"])
5151
.getACall()
5252
}
@@ -63,7 +63,7 @@ private module MongoDB {
6363

6464
private class Insertion extends DatabaseAccess, API::CallNode {
6565
Insertion() {
66-
this = ModelOutput::getATypeNode("mongodb", "Collection").getAMember().getACall() and
66+
this = ModelOutput::getATypeNode("mongodb.Collection").getAMember().getACall() and
6767
this.getCalleeName().matches("insert%")
6868
}
6969

@@ -105,9 +105,7 @@ private module Mongoose {
105105
private class QueryCall extends DatabaseAccess, API::CallNode {
106106
QueryCall() {
107107
this =
108-
ModelOutput::getATypeNode("mongoose", "Query")
109-
.getMember(["exec", "then", "catch"])
110-
.getACall()
108+
ModelOutput::getATypeNode("mongoose.Query").getMember(["exec", "then", "catch"]).getACall()
111109
}
112110

113111
override DataFlow::Node getAQueryArgument() { result = this.getReceiver() }
@@ -132,10 +130,10 @@ private module Mongoose {
132130
private class QueryWithCallback extends DatabaseAccess, API::CallNode {
133131
QueryWithCallback() {
134132
this =
135-
ModelOutput::getATypeNode("mongoose", ["Document", "Model", "Query"])
133+
ModelOutput::getATypeNode(["mongoose.Document", "mongoose.Model", "mongoose.Query"])
136134
.getAMember()
137135
.getACall() and
138-
this.getReturn() = ModelOutput::getATypeNode("mongoose", "Query") and
136+
this.getReturn() = ModelOutput::getATypeNode("mongoose.Query") and
139137
exists(this.getLastArgument().getABoundFunctionValue(_))
140138
}
141139

@@ -152,7 +150,7 @@ private module Mongoose {
152150

153151
QueryAwait() {
154152
astNode.getOperand().flow() =
155-
ModelOutput::getATypeNode("mongoose", "Query").getAValueReachableFromSource()
153+
ModelOutput::getATypeNode("mongoose.Query").getAValueReachableFromSource()
156154
}
157155

158156
override DataFlow::Node getAQueryArgument() { result = astNode.getOperand().flow() }
@@ -162,7 +160,7 @@ private module Mongoose {
162160

163161
class Insertion extends DatabaseAccess, API::CallNode {
164162
Insertion() {
165-
this = ModelOutput::getATypeNode("mongoose", "Model").getAMember().getACall() and
163+
this = ModelOutput::getATypeNode("mongoose.Model").getAMember().getACall() and
166164
this.getCalleeName().matches("insert%")
167165
}
168166

@@ -180,9 +178,9 @@ private module MarsDB {
180178
override predicate row(string row) {
181179
row =
182180
[
183-
"mongoose;Query;marsdb;;Member[Collection].Instance",
184-
"mongoose;Model;marsdb;;Member[Collection].Instance",
185-
"mongoose;Query;mongoose;Query;Member[sortFunc].ReturnValue",
181+
"mongoose.Query;marsdb;Member[Collection].Instance",
182+
"mongoose.Model;marsdb;Member[Collection].Instance",
183+
"mongoose.Query;mongoose.Query;Member[sortFunc].ReturnValue",
186184
]
187185
}
188186
}

‎javascript/ql/lib/semmle/javascript/frameworks/SQL.qll

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -357,21 +357,21 @@ private module Sequelize {
357357
// Note: the sinks are specified directly in the MaD model
358358
class SequelizeSource extends ModelInput::SourceModelCsv {
359359
override predicate row(string row) {
360-
row = "sequelize;Sequelize;Member[query].ReturnValue.Awaited;database-access-result"
360+
row = "sequelize.Sequelize;Member[query].ReturnValue.Awaited;database-access-result"
361361
}
362362
}
363363
}
364364

365365
private module SpannerCsv {
366366
class SpannerSinks extends ModelInput::SinkModelCsv {
367367
override predicate row(string row) {
368-
// package; type; path; kind
368+
// type; path; kind
369369
row =
370370
[
371-
"@google-cloud/spanner;~SqlExecutorDirect;Argument[0];sql-injection",
372-
"@google-cloud/spanner;~SqlExecutorDirect;Argument[0].Member[sql];sql-injection",
373-
"@google-cloud/spanner;Transaction;Member[batchUpdate].Argument[0];sql-injection",
374-
"@google-cloud/spanner;Transaction;Member[batchUpdate].Argument[0].ArrayElement.Member[sql];sql-injection",
371+
"@google-cloud/spanner.~SqlExecutorDirect;Argument[0];sql-injection",
372+
"@google-cloud/spanner.~SqlExecutorDirect;Argument[0].Member[sql];sql-injection",
373+
"@google-cloud/spanner.Transaction;Member[batchUpdate].Argument[0];sql-injection",
374+
"@google-cloud/spanner.Transaction;Member[batchUpdate].Argument[0].ArrayElement.Member[sql];sql-injection",
375375
]
376376
}
377377
}
@@ -380,10 +380,10 @@ private module SpannerCsv {
380380
override predicate row(string row) {
381381
row =
382382
[
383-
"@google-cloud/spanner;~SpannerObject;Member[executeSql].Argument[0..].Parameter[1];database-access-result",
384-
"@google-cloud/spanner;~SpannerObject;Member[executeSql].ReturnValue.Awaited.Member[0];database-access-result",
385-
"@google-cloud/spanner;~SpannerObject;Member[run].ReturnValue.Awaited;database-access-result",
386-
"@google-cloud/spanner;~SpannerObject;Member[run].Argument[0..].Parameter[1];database-access-result",
383+
"@google-cloud/spanner.~SpannerObject;Member[executeSql].Argument[0..].Parameter[1];database-access-result",
384+
"@google-cloud/spanner.~SpannerObject;Member[executeSql].ReturnValue.Awaited.Member[0];database-access-result",
385+
"@google-cloud/spanner.~SpannerObject;Member[run].ReturnValue.Awaited;database-access-result",
386+
"@google-cloud/spanner.~SpannerObject;Member[run].Argument[0..].Parameter[1];database-access-result",
387387
]
388388
}
389389
}

0 commit comments

Comments
 (0)