Skip to content

Commit 0f34693

Browse files
geoffw0geoffw0
committed
Merge branch 'main' into ctor
2 parents a6f20a6 + 5f41b6d commit 0f34693

File tree

175 files changed

+8681
-1616
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

175 files changed

+8681
-1616
lines changed

‎.vscode/tasks.json

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,93 @@
3838
"command": "${config:python.pythonPath}",
3939
},
4040
"problemMatcher": []
41+
},
42+
{
43+
"label": "Create query change note",
44+
"type": "process",
45+
"command": "python3",
46+
"args": [
47+
"misc/scripts/create-change-note.py",
48+
"${input:language}",
49+
"src",
50+
"${input:name}",
51+
"${input:categoryQuery}"
52+
],
53+
"presentation": {
54+
"reveal": "never",
55+
"close": true
56+
},
57+
"problemMatcher": []
58+
},
59+
{
60+
"label": "Create library change note",
61+
"type": "process",
62+
"command": "python3",
63+
"args": [
64+
"misc/scripts/create-change-note.py",
65+
"${input:language}",
66+
"lib",
67+
"${input:name}",
68+
"${input:categoryLibrary}"
69+
],
70+
"presentation": {
71+
"reveal": "never",
72+
"close": true
73+
},
74+
"problemMatcher": []
75+
}
76+
],
77+
"inputs": [
78+
{
79+
"type": "pickString",
80+
"id": "language",
81+
"description": "Language",
82+
"options":
83+
[
84+
"go",
85+
"java",
86+
"javascript",
87+
"cpp",
88+
"csharp",
89+
"python",
90+
"ruby",
91+
"rust",
92+
"swift",
93+
]
94+
},
95+
{
96+
"type": "promptString",
97+
"id": "name",
98+
"description": "Short name (kebab-case)"
99+
},
100+
{
101+
"type": "pickString",
102+
"id": "categoryQuery",
103+
"description": "Category (query change)",
104+
"options":
105+
[
106+
"breaking",
107+
"deprecated",
108+
"newQuery",
109+
"queryMetadata",
110+
"majorAnalysis",
111+
"minorAnalysis",
112+
"fix",
113+
]
114+
},
115+
{
116+
"type": "pickString",
117+
"id": "categoryLibrary",
118+
"description": "Category (library change)",
119+
"options":
120+
[
121+
"breaking",
122+
"deprecated",
123+
"feature",
124+
"majorAnalysis",
125+
"minorAnalysis",
126+
"fix",
127+
]
41128
}
42129
]
43130
}

‎2024-11-25-ts57.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: majorAnalysis
3+
---
4+
* Added support for TypeScript 5.7.

‎cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -793,28 +793,27 @@ private Element interpretElement0(
793793
) {
794794
(
795795
// Non-member functions
796-
elementSpec(namespace, type, subtypes, name, signature, _) and
796+
funcHasQualifiedName(result, namespace, name) and
797797
subtypes = false and
798798
type = "" and
799799
(
800800
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
801801
or
802802
signature = "" and
803-
elementSpec(namespace, type, subtypes, name, "", _) and
804-
funcHasQualifiedName(result, namespace, name)
803+
elementSpec(namespace, type, subtypes, name, signature, _)
805804
)
806805
or
807806
// Member functions
808807
exists(Class namedClass, Class classWithMethod |
808+
hasClassAndName(classWithMethod, result, name) and
809+
classHasQualifiedName(namedClass, namespace, type)
810+
|
809811
(
810-
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature) and
811-
hasClassAndName(classWithMethod, result, name)
812+
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
812813
or
813814
signature = "" and
814-
elementSpec(namespace, type, subtypes, name, "", _) and
815-
hasClassAndName(classWithMethod, result, name)
815+
elementSpec(namespace, type, subtypes, name, "", _)
816816
) and
817-
classHasQualifiedName(namedClass, namespace, type) and
818817
(
819818
// member declared in the named type or a subtype of it
820819
subtypes = true and

‎cpp/ql/lib/semmle/code/cpp/models/Models.qll

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,3 +49,4 @@ private import implementations.PostgreSql
4949
private import implementations.System
5050
private import implementations.StructuredExceptionHandling
5151
private import implementations.ZMQ
52+
private import implementations.Win32CommandExecution

‎cpp/ql/lib/semmle/code/cpp/models/implementations/Win32CommandExecution.qll

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
private import semmle.code.cpp.models.interfaces.CommandExecution
2+
3+
/** The `ShellExecute` family of functions from Win32. */
4+
class ShellExecute extends Function {
5+
ShellExecute() { this.hasGlobalName("ShellExecute" + ["", "A", "W"]) }
6+
}
7+
8+
private class ShellExecuteModel extends ShellExecute, CommandExecutionFunction {
9+
override predicate hasCommandArgument(FunctionInput input) { input.isParameterDeref(2) }
10+
}
11+
12+
/** The `WinExec` function from Win32. */
13+
class WinExec extends Function {
14+
WinExec() { this.hasGlobalName("WinExec") }
15+
}
16+
17+
private class WinExecModel extends WinExec, CommandExecutionFunction {
18+
override predicate hasCommandArgument(FunctionInput input) { input.isParameterDeref(0) }
19+
}
20+
21+
/** The `CreateProcess` family of functions from Win32. */
22+
class CreateProcess extends Function {
23+
CreateProcess() { this.hasGlobalName("CreateProcess" + ["", "A", "W"]) }
24+
}
25+
26+
private class CreateProcessModel extends CreateProcess, CommandExecutionFunction {
27+
override predicate hasCommandArgument(FunctionInput input) { input.isParameterDeref(0) }
28+
}
29+
30+
/** The `CreateProcessAsUser` family of functions from Win32. */
31+
class CreateProcessAsUser extends Function {
32+
CreateProcessAsUser() { this.hasGlobalName("CreateProcessAsUser" + ["", "A", "W"]) }
33+
}
34+
35+
private class CreateProcessAsUserModel extends CreateProcessAsUser, CommandExecutionFunction {
36+
override predicate hasCommandArgument(FunctionInput input) { input.isParameterDeref(1) }
37+
}
38+
39+
/** The `CreateProcessWithLogonW` function from Win32. */
40+
class CreateProcessWithLogonW extends Function {
41+
CreateProcessWithLogonW() { this.hasGlobalName("CreateProcessWithLogonW") }
42+
}
43+
44+
private class CreateProcessWithLogonModel extends CreateProcessWithLogonW, CommandExecutionFunction {
45+
override predicate hasCommandArgument(FunctionInput input) { input.isParameterDeref(4) }
46+
}
47+
48+
/** The `CreateProcessWithTokenW` function from Win32. */
49+
class CreateProcessWithTokenW extends Function {
50+
CreateProcessWithTokenW() { this.hasGlobalName("CreateProcessWithTokenW") }
51+
}
52+
53+
private class CreateProcessWithTokenWModel extends CreateProcessWithTokenW, CommandExecutionFunction
54+
{
55+
override predicate hasCommandArgument(FunctionInput input) { input.isParameterDeref(2) }
56+
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,4 +164,10 @@ void test_format() {
164164

165165
auto s2 = std::format(string::source());
166166
sink(s2); // $ ir MISSING: ast
167+
}
168+
169+
void test(std::format_string s) {
170+
int x = source();
171+
int y = std::same_signature_as_format_but_different_name(s, x);
172+
sink(y); // clean
167173
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,9 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
451451
| format.cpp:162:24:162:27 | {} | format.cpp:162:24:162:27 | call to basic_format_string | TAINT |
452452
| format.cpp:165:13:165:23 | call to format | format.cpp:166:8:166:9 | s2 | |
453453
| format.cpp:165:25:165:38 | call to source | format.cpp:165:25:165:40 | call to basic_format_string | TAINT |
454+
| format.cpp:169:30:169:30 | s | format.cpp:171:60:171:60 | s | |
455+
| format.cpp:170:11:170:16 | call to source | format.cpp:171:63:171:63 | x | |
456+
| format.cpp:171:11:171:58 | call to same_signature_as_format_but_different_name | format.cpp:172:8:172:8 | y | |
454457
| map.cpp:21:28:21:28 | call to pair | map.cpp:23:2:23:2 | a | |
455458
| map.cpp:21:28:21:28 | call to pair | map.cpp:24:7:24:7 | a | |
456459
| map.cpp:21:28:21:28 | call to pair | map.cpp:25:7:25:7 | a | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -676,4 +676,9 @@ namespace std {
676676
using format_string = basic_format_string<char>; // simplified from `char, std::type_identity_t<Args>...`
677677

678678
template<class... Args> string format( format_string fmt, Args&&... args );
679+
680+
// This function has the same signature as `format`, but a different name. It should NOT be able to use
681+
// the model for `format`.
682+
template <typename... Args>
683+
int same_signature_as_format_but_different_name(format_string, Args &&...args);
679684
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,8 @@ signatureMatches
265265
| stl.h:678:33:678:38 | format | (format_string,Args &&) | | format<Args> | 0 |
266266
| stl.h:678:33:678:38 | format | (format_string,Args &&) | | format<Args> | 1 |
267267
| stl.h:678:33:678:38 | format | (format_string,Args &&) | | format<Args> | 1 |
268+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | (format_string,Args &&) | | format<Args> | 0 |
269+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | (format_string,Args &&) | | format<Args> | 1 |
268270
getSignatureParameterName
269271
| (InputIt,InputIt) | deque | assign<InputIt> | 0 | func:0 |
270272
| (InputIt,InputIt) | deque | assign<InputIt> | 1 | func:0 |
@@ -729,6 +731,8 @@ getParameterTypeName
729731
| stl.h:678:33:678:38 | format | 0 | format_string |
730732
| stl.h:678:33:678:38 | format | 1 | func:0 && |
731733
| stl.h:678:33:678:38 | format | 1 | func:0 && |
734+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | 0 | format_string |
735+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | 1 | func:0 && |
732736
| stringstream.cpp:18:6:18:9 | sink | 0 | const basic_ostream> & |
733737
| stringstream.cpp:21:6:21:9 | sink | 0 | const basic_istream> & |
734738
| stringstream.cpp:24:6:24:9 | sink | 0 | const basic_iostream> & |

‎csharp/ql/lib/change-notes/2024-11-26-model-microsoft.jsinterop.ijsruntime.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added `js-interop` sinks for the `InvokeAsync` and `InvokeVoidAsync` methods of `Microsoft.JSInterop.IJSRuntime`, which can run arbitrary JavaScript.
5+

0 commit comments

Comments
 (0)