Skip to content

Commit a818859

Browse files
author
Paolo Tranquilli
committed
Merge branch 'main' into redsun82/rust-canonical-enum
2 parents c3b4447 + d86fea5 commit a818859

File tree

103 files changed

+3379
-667
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

103 files changed

+3379
-667
lines changed

‎.vscode/tasks.json

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,93 @@
3838
"command": "${config:python.pythonPath}",
3939
},
4040
"problemMatcher": []
41+
},
42+
{
43+
"label": "Create query change note",
44+
"type": "process",
45+
"command": "python3",
46+
"args": [
47+
"misc/scripts/create-change-note.py",
48+
"${input:language}",
49+
"src",
50+
"${input:name}",
51+
"${input:categoryQuery}"
52+
],
53+
"presentation": {
54+
"reveal": "never",
55+
"close": true
56+
},
57+
"problemMatcher": []
58+
},
59+
{
60+
"label": "Create library change note",
61+
"type": "process",
62+
"command": "python3",
63+
"args": [
64+
"misc/scripts/create-change-note.py",
65+
"${input:language}",
66+
"lib",
67+
"${input:name}",
68+
"${input:categoryLibrary}"
69+
],
70+
"presentation": {
71+
"reveal": "never",
72+
"close": true
73+
},
74+
"problemMatcher": []
75+
}
76+
],
77+
"inputs": [
78+
{
79+
"type": "pickString",
80+
"id": "language",
81+
"description": "Language",
82+
"options":
83+
[
84+
"go",
85+
"java",
86+
"javascript",
87+
"cpp",
88+
"csharp",
89+
"python",
90+
"ruby",
91+
"rust",
92+
"swift",
93+
]
94+
},
95+
{
96+
"type": "promptString",
97+
"id": "name",
98+
"description": "Short name (kebab-case)"
99+
},
100+
{
101+
"type": "pickString",
102+
"id": "categoryQuery",
103+
"description": "Category (query change)",
104+
"options":
105+
[
106+
"breaking",
107+
"deprecated",
108+
"newQuery",
109+
"queryMetadata",
110+
"majorAnalysis",
111+
"minorAnalysis",
112+
"fix",
113+
]
114+
},
115+
{
116+
"type": "pickString",
117+
"id": "categoryLibrary",
118+
"description": "Category (library change)",
119+
"options":
120+
[
121+
"breaking",
122+
"deprecated",
123+
"feature",
124+
"majorAnalysis",
125+
"minorAnalysis",
126+
"fix",
127+
]
41128
}
42129
]
43130
}

‎cpp/ql/lib/semmle/code/cpp/dataflow/ExternalFlow.qll

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -793,28 +793,27 @@ private Element interpretElement0(
793793
) {
794794
(
795795
// Non-member functions
796-
elementSpec(namespace, type, subtypes, name, signature, _) and
796+
funcHasQualifiedName(result, namespace, name) and
797797
subtypes = false and
798798
type = "" and
799799
(
800800
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
801801
or
802802
signature = "" and
803-
elementSpec(namespace, type, subtypes, name, "", _) and
804-
funcHasQualifiedName(result, namespace, name)
803+
elementSpec(namespace, type, subtypes, name, signature, _)
805804
)
806805
or
807806
// Member functions
808807
exists(Class namedClass, Class classWithMethod |
808+
hasClassAndName(classWithMethod, result, name) and
809+
classHasQualifiedName(namedClass, namespace, type)
810+
|
809811
(
810-
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature) and
811-
hasClassAndName(classWithMethod, result, name)
812+
elementSpecMatchesSignature(result, namespace, type, subtypes, name, signature)
812813
or
813814
signature = "" and
814-
elementSpec(namespace, type, subtypes, name, "", _) and
815-
hasClassAndName(classWithMethod, result, name)
815+
elementSpec(namespace, type, subtypes, name, "", _)
816816
) and
817-
classHasQualifiedName(namedClass, namespace, type) and
818817
(
819818
// member declared in the named type or a subtype of it
820819
subtypes = true and

‎cpp/ql/test/library-tests/dataflow/taint-tests/format.cpp

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,4 +164,10 @@ void test_format() {
164164

165165
auto s2 = std::format(string::source());
166166
sink(s2); // $ ir MISSING: ast
167+
}
168+
169+
void test(std::format_string s) {
170+
int x = source();
171+
int y = std::same_signature_as_format_but_different_name(s, x);
172+
sink(y); // clean
167173
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/localTaint.expected

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,6 +451,9 @@ WARNING: module 'TaintTracking' has been deprecated and may be removed in future
451451
| format.cpp:162:24:162:27 | {} | format.cpp:162:24:162:27 | call to basic_format_string | TAINT |
452452
| format.cpp:165:13:165:23 | call to format | format.cpp:166:8:166:9 | s2 | |
453453
| format.cpp:165:25:165:38 | call to source | format.cpp:165:25:165:40 | call to basic_format_string | TAINT |
454+
| format.cpp:169:30:169:30 | s | format.cpp:171:60:171:60 | s | |
455+
| format.cpp:170:11:170:16 | call to source | format.cpp:171:63:171:63 | x | |
456+
| format.cpp:171:11:171:58 | call to same_signature_as_format_but_different_name | format.cpp:172:8:172:8 | y | |
454457
| map.cpp:21:28:21:28 | call to pair | map.cpp:23:2:23:2 | a | |
455458
| map.cpp:21:28:21:28 | call to pair | map.cpp:24:7:24:7 | a | |
456459
| map.cpp:21:28:21:28 | call to pair | map.cpp:25:7:25:7 | a | |

‎cpp/ql/test/library-tests/dataflow/taint-tests/stl.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -676,4 +676,9 @@ namespace std {
676676
using format_string = basic_format_string<char>; // simplified from `char, std::type_identity_t<Args>...`
677677

678678
template<class... Args> string format( format_string fmt, Args&&... args );
679+
680+
// This function has the same signature as `format`, but a different name. It should NOT be able to use
681+
// the model for `format`.
682+
template <typename... Args>
683+
int same_signature_as_format_but_different_name(format_string, Args &&...args);
679684
}

‎cpp/ql/test/library-tests/dataflow/taint-tests/test_mad-signatures.expected

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,8 @@ signatureMatches
265265
| stl.h:678:33:678:38 | format | (format_string,Args &&) | | format<Args> | 0 |
266266
| stl.h:678:33:678:38 | format | (format_string,Args &&) | | format<Args> | 1 |
267267
| stl.h:678:33:678:38 | format | (format_string,Args &&) | | format<Args> | 1 |
268+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | (format_string,Args &&) | | format<Args> | 0 |
269+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | (format_string,Args &&) | | format<Args> | 1 |
268270
getSignatureParameterName
269271
| (InputIt,InputIt) | deque | assign<InputIt> | 0 | func:0 |
270272
| (InputIt,InputIt) | deque | assign<InputIt> | 1 | func:0 |
@@ -729,6 +731,8 @@ getParameterTypeName
729731
| stl.h:678:33:678:38 | format | 0 | format_string |
730732
| stl.h:678:33:678:38 | format | 1 | func:0 && |
731733
| stl.h:678:33:678:38 | format | 1 | func:0 && |
734+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | 0 | format_string |
735+
| stl.h:683:6:683:48 | same_signature_as_format_but_different_name | 1 | func:0 && |
732736
| stringstream.cpp:18:6:18:9 | sink | 0 | const basic_ostream> & |
733737
| stringstream.cpp:21:6:21:9 | sink | 0 | const basic_istream> & |
734738
| stringstream.cpp:24:6:24:9 | sink | 0 | const basic_iostream> & |

‎go/documentation/library-coverage/coverage.csv

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,7 @@ os,29,11,6,3,,,,,26,,,,,,,,,,,7,3,,1,6,
130130
path,,,18,,,,,,,,,,,,,,,,,,,,,18,
131131
reflect,,,37,,,,,,,,,,,,,,,,,,,,,37,
132132
regexp,10,,20,,,,,,,3,3,4,,,,,,,,,,,,20,
133+
slices,,,17,,,,,,,,,,,,,,,,,,,,,,17
133134
sort,,,1,,,,,,,,,,,,,,,,,,,,,1,
134135
strconv,,,9,,,,,,,,,,,,,,,,,,,,,9,
135136
strings,,,34,,,,,,,,,,,,,,,,,,,,,34,

‎go/documentation/library-coverage/coverage.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Go framework & library support
2626
`Macaron <https://gopkg.in/macaron.v1>`_,``gopkg.in/macaron*``,12,1,1
2727
`Revel <http://revel.github.io/>`_,"``github.com/revel/revel*``, ``github.com/robfig/revel*``",46,20,4
2828
`SendGrid <https://github.com/sendgrid/sendgrid-go>`_,``github.com/sendgrid/sendgrid-go*``,,1,
29-
`Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",33,587,104
29+
`Standard library <https://pkg.go.dev/std>`_,"````, ``archive/*``, ``bufio``, ``bytes``, ``cmp``, ``compress/*``, ``container/*``, ``context``, ``crypto``, ``crypto/*``, ``database/*``, ``debug/*``, ``embed``, ``encoding``, ``encoding/*``, ``errors``, ``expvar``, ``flag``, ``fmt``, ``go/*``, ``hash``, ``hash/*``, ``html``, ``html/*``, ``image``, ``image/*``, ``index/*``, ``io``, ``io/*``, ``log``, ``log/*``, ``maps``, ``math``, ``math/*``, ``mime``, ``mime/*``, ``net``, ``net/*``, ``os``, ``os/*``, ``path``, ``path/*``, ``plugin``, ``reflect``, ``reflect/*``, ``regexp``, ``regexp/*``, ``slices``, ``sort``, ``strconv``, ``strings``, ``sync``, ``sync/*``, ``syscall``, ``syscall/*``, ``testing``, ``testing/*``, ``text/*``, ``time``, ``time/*``, ``unicode``, ``unicode/*``, ``unsafe``",33,604,104
3030
`XPath <https://github.com/antchfx/xpath>`_,``github.com/antchfx/xpath*``,,,4
3131
`appleboy/gin-jwt <https://github.com/appleboy/gin-jwt>`_,``github.com/appleboy/gin-jwt*``,,,1
3232
`beego <https://beego.me/>`_,"``github.com/astaxie/beego*``, ``github.com/beego/beego*``",63,63,213
@@ -61,5 +61,5 @@ Go framework & library support
6161
`yaml <https://gopkg.in/yaml.v3>`_,``gopkg.in/yaml*``,,9,
6262
`zap <https://go.uber.org/zap>`_,``go.uber.org/zap*``,,11,33
6363
Others,"``github.com/Masterminds/squirrel``, ``github.com/caarlos0/env``, ``github.com/go-gorm/gorm``, ``github.com/go-xorm/xorm``, ``github.com/gobuffalo/envy``, ``github.com/gogf/gf/database/gdb``, ``github.com/hashicorp/go-envparse``, ``github.com/jinzhu/gorm``, ``github.com/jmoiron/sqlx``, ``github.com/joho/godotenv``, ``github.com/kelseyhightower/envconfig``, ``github.com/lann/squirrel``, ``github.com/raindog308/gorqlite``, ``github.com/rqlite/gorqlite``, ``github.com/uptrace/bun``, ``go.mongodb.org/mongo-driver/mongo``, ``gopkg.in/Masterminds/squirrel``, ``gorm.io/gorm``, ``xorm.io/xorm``",23,2,391
64-
Totals,,307,911,1532
64+
Totals,,307,928,1532
6565

‎go/ql/lib/ext/slices.model.yml

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/go-all
4+
extensible: summaryModel
5+
data:
6+
# All should be modeled when we have a way to model iterators
7+
# AppendSec should be modeled when we have a way to model iterators
8+
# Backward should be modeled when we have a way to model iterators
9+
# Chunk should be modeled when we have a way to model iterators
10+
- ["slices", "", False, "Clip", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
11+
- ["slices", "", False, "Clone", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
12+
# Collect should be modeled when we have a way to model iterators
13+
- ["slices", "", False, "Compact", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
14+
- ["slices", "", False, "CompactFunc", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
15+
- ["slices", "", False, "Concat", "", "", "Argument[0].ArrayElement.ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
16+
- ["slices", "", False, "Delete", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
17+
- ["slices", "", False, "DeleteFunc", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
18+
- ["slices", "", False, "Grow", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
19+
- ["slices", "", False, "Insert", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
20+
- ["slices", "", False, "Insert", "", "", "Argument[2].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
21+
- ["slices", "", False, "Max", "", "", "Argument[0].ArrayElement", "ReturnValue", "value", "manual"]
22+
- ["slices", "", False, "MaxFunc", "", "", "Argument[0].ArrayElement", "ReturnValue", "value", "manual"]
23+
- ["slices", "", False, "Min", "", "", "Argument[0].ArrayElement", "ReturnValue", "value", "manual"]
24+
- ["slices", "", False, "MinFunc", "", "", "Argument[0].ArrayElement", "ReturnValue", "value", "manual"]
25+
- ["slices", "", False, "Repeat", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
26+
- ["slices", "", False, "Replace", "", "", "Argument[0].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
27+
- ["slices", "", False, "Replace", "", "", "Argument[3].ArrayElement", "ReturnValue.ArrayElement", "value", "manual"]
28+
# Sorted should be modeled when we have a way to model iterators
29+
# SortedFunc should be modeled when we have a way to model iterators
30+
# SortedStableFunc should be modeled when we have a way to model iterators
31+
# Values should be modeled when we have a way to model iterators

‎go/ql/src/change-notes/2024-11-26-model-slices-package.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added value flow models for functions in the `slices` package which do not involve the `iter` package.

0 commit comments

Comments
 (0)