Skip to content

Commit cf7091a

Browse files
atorralbaatorralba
authored
Merge branch 'main' into atorralba/java/open-redirect-sanitizer
2 parents 34f7486 + 5f729d5 commit cf7091a

File tree

454 files changed

+20773
-21177
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

454 files changed

+20773
-21177
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -709,7 +709,7 @@ class FinalGlobalValue extends Node, TFinalGlobalValue {
709709
override DataFlowType getType() {
710710
exists(int indirectionIndex |
711711
indirectionIndex = globalUse.getIndirectionIndex() and
712-
result = getTypeImpl(globalUse.getUnspecifiedType(), indirectionIndex - 1)
712+
result = getTypeImpl(globalUse.getUnderlyingType(), indirectionIndex - 1)
713713
)
714714
}
715715

@@ -740,7 +740,7 @@ class InitialGlobalValue extends Node, TInitialGlobalValue {
740740

741741
override DataFlowType getType() {
742742
exists(DataFlowType type |
743-
type = globalDef.getUnspecifiedType() and
743+
type = globalDef.getUnderlyingType() and
744744
if this.isGLValue()
745745
then result = type
746746
else result = getTypeImpl(type, globalDef.getIndirectionIndex() - 1)
@@ -943,10 +943,13 @@ private Type getTypeImpl0(Type t, int indirectionIndex) {
943943
indirectionIndex > 0 and
944944
exists(Type stripped |
945945
stripped = stripPointer(t.stripTopLevelSpecifiers()) and
946-
// We need to avoid the case where `stripPointer(t) = t` (which can happen on
947-
// iterators that specify a `value_type` that is the iterator itself). Such a type
948-
// would create an infinite loop otherwise. For these cases we simply don't produce
949-
// a result for `getTypeImpl`.
946+
// We need to avoid the case where `stripPointer(t) = t` (which can happen
947+
// on iterators that specify a `value_type` that is the iterator itself).
948+
// Such a type would create an infinite loop otherwise. For these cases we
949+
// simply don't produce a result for `getTypeImpl`.
950+
// To be on the safe side, we check whether the _unspecified_ type has
951+
// changed since this also prevents an infinite loop when `stripped` and
952+
// `t` only differ by const'ness or volatile'ness.
950953
stripped.getUnspecifiedType() != t.getUnspecifiedType() and
951954
result = getTypeImpl0(stripped, indirectionIndex - 1)
952955
)
@@ -996,12 +999,14 @@ private module RawIndirectNodes {
996999

9971000
override Declaration getEnclosingCallable() { result = this.getFunction() }
9981001

1002+
override predicate isGLValue() { this.getOperand().isGLValue() }
1003+
9991004
override DataFlowType getType() {
10001005
exists(int sub, DataFlowType type, boolean isGLValue |
10011006
type = getOperandType(this.getOperand(), isGLValue) and
10021007
if isGLValue = true then sub = 1 else sub = 0
10031008
|
1004-
result = getTypeImpl(type.getUnspecifiedType(), indirectionIndex - sub)
1009+
result = getTypeImpl(type.getUnderlyingType(), indirectionIndex - sub)
10051010
)
10061011
}
10071012

@@ -1038,12 +1043,14 @@ private module RawIndirectNodes {
10381043

10391044
override Declaration getEnclosingCallable() { result = this.getFunction() }
10401045

1046+
override predicate isGLValue() { this.getInstruction().isGLValue() }
1047+
10411048
override DataFlowType getType() {
10421049
exists(int sub, DataFlowType type, boolean isGLValue |
10431050
type = getInstructionType(this.getInstruction(), isGLValue) and
10441051
if isGLValue = true then sub = 1 else sub = 0
10451052
|
1046-
result = getTypeImpl(type.getUnspecifiedType(), indirectionIndex - sub)
1053+
result = getTypeImpl(type.getUnderlyingType(), indirectionIndex - sub)
10471054
)
10481055
}
10491056

@@ -1136,7 +1143,7 @@ class FinalParameterNode extends Node, TFinalParameterNode {
11361143

11371144
override Declaration getEnclosingCallable() { result = this.getFunction() }
11381145

1139-
override DataFlowType getType() { result = getTypeImpl(p.getUnspecifiedType(), indirectionIndex) }
1146+
override DataFlowType getType() { result = getTypeImpl(p.getUnderlyingType(), indirectionIndex) }
11401147

11411148
final override Location getLocationImpl() {
11421149
// Parameters can have multiple locations. When there's a unique location we use
@@ -1789,7 +1796,7 @@ class VariableNode extends Node, TVariableNode {
17891796
}
17901797

17911798
override DataFlowType getType() {
1792-
result = getTypeImpl(v.getUnspecifiedType(), indirectionIndex - 1)
1799+
result = getTypeImpl(v.getUnderlyingType(), indirectionIndex - 1)
17931800
}
17941801

17951802
final override Location getLocationImpl() {

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/ProductFlow.qll

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -507,13 +507,13 @@ module ProductFlow {
507507
private predicate pathSuccPlus(TNodePair n1, TNodePair n2) = fastTC(pathSucc/2)(n1, n2)
508508

509509
private predicate localPathStep1(Flow1::PathNode pred, Flow1::PathNode succ) {
510-
Flow1::PathGraph::edges(pred, succ) and
510+
Flow1::PathGraph::edges(pred, succ, _, _) and
511511
pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
512512
pragma[only_bind_out](succ.getNode().getEnclosingCallable())
513513
}
514514

515515
private predicate localPathStep2(Flow2::PathNode pred, Flow2::PathNode succ) {
516-
Flow2::PathGraph::edges(pred, succ) and
516+
Flow2::PathGraph::edges(pred, succ, _, _) and
517517
pragma[only_bind_out](pred.getNode().getEnclosingCallable()) =
518518
pragma[only_bind_out](succ.getNode().getEnclosingCallable())
519519
}
@@ -530,7 +530,7 @@ module ProductFlow {
530530
TJump()
531531

532532
private predicate intoImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
533-
Flow1::PathGraph::edges(pred1, succ1) and
533+
Flow1::PathGraph::edges(pred1, succ1, _, _) and
534534
pred1.getNode().(ArgumentNode).getCall() = call and
535535
succ1.getNode() instanceof ParameterNode
536536
}
@@ -543,7 +543,7 @@ module ProductFlow {
543543
}
544544

545545
private predicate outImpl1(Flow1::PathNode pred1, Flow1::PathNode succ1, DataFlowCall call) {
546-
Flow1::PathGraph::edges(pred1, succ1) and
546+
Flow1::PathGraph::edges(pred1, succ1, _, _) and
547547
exists(ReturnKindExt returnKind |
548548
succ1.getNode() = returnKind.getAnOutNode(call) and
549549
pred1.getNode().(ReturnNodeExt).getKind() = returnKind
@@ -558,7 +558,7 @@ module ProductFlow {
558558
}
559559

560560
private predicate intoImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
561-
Flow2::PathGraph::edges(pred2, succ2) and
561+
Flow2::PathGraph::edges(pred2, succ2, _, _) and
562562
pred2.getNode().(ArgumentNode).getCall() = call and
563563
succ2.getNode() instanceof ParameterNode
564564
}
@@ -571,7 +571,7 @@ module ProductFlow {
571571
}
572572

573573
private predicate outImpl2(Flow2::PathNode pred2, Flow2::PathNode succ2, DataFlowCall call) {
574-
Flow2::PathGraph::edges(pred2, succ2) and
574+
Flow2::PathGraph::edges(pred2, succ2, _, _) and
575575
exists(ReturnKindExt returnKind |
576576
succ2.getNode() = returnKind.getAnOutNode(call) and
577577
pred2.getNode().(ReturnNodeExt).getKind() = returnKind
@@ -590,7 +590,7 @@ module ProductFlow {
590590
Declaration predDecl, Declaration succDecl, Flow1::PathNode pred1, Flow1::PathNode succ1,
591591
TKind kind
592592
) {
593-
Flow1::PathGraph::edges(pred1, succ1) and
593+
Flow1::PathGraph::edges(pred1, succ1, _, _) and
594594
predDecl != succDecl and
595595
pred1.getNode().getEnclosingCallable() = predDecl and
596596
succ1.getNode().getEnclosingCallable() = succDecl and
@@ -610,7 +610,7 @@ module ProductFlow {
610610
Declaration predDecl, Declaration succDecl, Flow2::PathNode pred2, Flow2::PathNode succ2,
611611
TKind kind
612612
) {
613-
Flow2::PathGraph::edges(pred2, succ2) and
613+
Flow2::PathGraph::edges(pred2, succ2, _, _) and
614614
predDecl != succDecl and
615615
pred2.getNode().getEnclosingCallable() = predDecl and
616616
succ2.getNode().getEnclosingCallable() = succDecl and

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/SsaInternals.qll

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -548,6 +548,11 @@ class GlobalUse extends UseImpl, TGlobalUse {
548548
*/
549549
Type getUnspecifiedType() { result = global.getUnspecifiedType() }
550550

551+
/**
552+
* Gets the type of this use, after typedefs have been resolved.
553+
*/
554+
Type getUnderlyingType() { result = global.getUnderlyingType() }
555+
551556
override predicate isCertain() { any() }
552557

553558
override BaseSourceVariableInstruction getBase() { none() }
@@ -591,11 +596,16 @@ class GlobalDefImpl extends DefOrUseImpl, TGlobalDefImpl {
591596
int getIndirection() { result = indirectionIndex }
592597

593598
/**
594-
* Gets the type of this use after specifiers have been deeply stripped
595-
* and typedefs have been resolved.
599+
* Gets the type of this definition after specifiers have been deeply
600+
* stripped and typedefs have been resolved.
596601
*/
597602
Type getUnspecifiedType() { result = global.getUnspecifiedType() }
598603

604+
/**
605+
* Gets the type of this definition, after typedefs have been resolved.
606+
*/
607+
Type getUnderlyingType() { result = global.getUnderlyingType() }
608+
599609
override string toString() { result = "Def of " + this.getSourceVariable() }
600610

601611
override Location getLocation() { result = f.getLocation() }
@@ -1115,6 +1125,11 @@ class GlobalDef extends TGlobalDef, SsaDefOrUse {
11151125
*/
11161126
DataFlowType getUnspecifiedType() { result = global.getUnspecifiedType() }
11171127

1128+
/**
1129+
* Gets the type of this definition, after typedefs have been resolved.
1130+
*/
1131+
DataFlowType getUnderlyingType() { result = global.getUnderlyingType() }
1132+
11181133
/** Gets the `IRFunction` whose body is evaluated after this definition. */
11191134
IRFunction getIRFunction() { result = global.getIRFunction() }
11201135

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.expected

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
edges
2-
| test.cpp:22:27:22:30 | **argv | test.cpp:29:13:29:20 | *filePath |
2+
| test.cpp:22:27:22:30 | **argv | test.cpp:29:13:29:20 | *filePath | provenance | |
33
nodes
44
| test.cpp:22:27:22:30 | **argv | semmle.label | **argv |
55
| test.cpp:29:13:29:20 | *filePath | semmle.label | *filePath |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.expected

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
edges
2-
| test.cpp:22:17:22:21 | ... * ... | test.cpp:23:33:23:37 | size1 |
3-
| test.cpp:37:24:37:27 | size | test.cpp:37:46:37:49 | size |
4-
| test.cpp:45:36:45:40 | ... * ... | test.cpp:37:24:37:27 | size |
2+
| test.cpp:22:17:22:21 | ... * ... | test.cpp:23:33:23:37 | size1 | provenance | |
3+
| test.cpp:37:24:37:27 | size | test.cpp:37:46:37:49 | size | provenance | |
4+
| test.cpp:45:36:45:40 | ... * ... | test.cpp:37:24:37:27 | size | provenance | |
55
nodes
66
| test.cpp:13:33:13:37 | ... * ... | semmle.label | ... * ... |
77
| test.cpp:15:31:15:35 | ... * ... | semmle.label | ... * ... |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected

Lines changed: 39 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,43 @@
11
edges
2-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:6:9:6:11 | arr |
3-
| test.cpp:4:17:4:22 | call to malloc | test.cpp:10:9:10:11 | arr |
4-
| test.cpp:19:9:19:16 | *mk_array [p] | test.cpp:28:19:28:26 | call to mk_array [p] |
5-
| test.cpp:19:9:19:16 | *mk_array [p] | test.cpp:50:18:50:25 | call to mk_array [p] |
6-
| test.cpp:21:5:21:7 | *arr [post update] [p] | test.cpp:22:5:22:7 | *arr [p] |
7-
| test.cpp:21:5:21:24 | ... = ... | test.cpp:21:5:21:7 | *arr [post update] [p] |
8-
| test.cpp:21:13:21:18 | call to malloc | test.cpp:21:5:21:24 | ... = ... |
9-
| test.cpp:22:5:22:7 | *arr [p] | test.cpp:19:9:19:16 | *mk_array [p] |
10-
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:31:9:31:11 | *arr [p] |
11-
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:35:9:35:11 | *arr [p] |
12-
| test.cpp:31:9:31:11 | *arr [p] | test.cpp:31:13:31:13 | p |
13-
| test.cpp:35:9:35:11 | *arr [p] | test.cpp:35:13:35:13 | p |
14-
| test.cpp:39:27:39:29 | arr [p] | test.cpp:41:9:41:11 | *arr [p] |
15-
| test.cpp:39:27:39:29 | arr [p] | test.cpp:45:9:45:11 | *arr [p] |
16-
| test.cpp:41:9:41:11 | *arr [p] | test.cpp:41:13:41:13 | p |
17-
| test.cpp:45:9:45:11 | *arr [p] | test.cpp:45:13:45:13 | p |
18-
| test.cpp:50:18:50:25 | call to mk_array [p] | test.cpp:39:27:39:29 | arr [p] |
19-
| test.cpp:55:5:55:7 | *arr [post update] [p] | test.cpp:56:5:56:7 | *arr [p] |
20-
| test.cpp:55:5:55:24 | ... = ... | test.cpp:55:5:55:7 | *arr [post update] [p] |
21-
| test.cpp:55:13:55:18 | call to malloc | test.cpp:55:5:55:24 | ... = ... |
22-
| test.cpp:56:5:56:7 | *arr [p] | test.cpp:59:9:59:11 | *arr [p] |
23-
| test.cpp:56:5:56:7 | *arr [p] | test.cpp:63:9:63:11 | *arr [p] |
24-
| test.cpp:59:9:59:11 | *arr [p] | test.cpp:59:13:59:13 | p |
25-
| test.cpp:63:9:63:11 | *arr [p] | test.cpp:63:13:63:13 | p |
26-
| test.cpp:67:10:67:19 | **mk_array_p [p] | test.cpp:76:20:76:29 | *call to mk_array_p [p] |
27-
| test.cpp:67:10:67:19 | **mk_array_p [p] | test.cpp:98:18:98:27 | *call to mk_array_p [p] |
28-
| test.cpp:69:5:69:7 | *arr [post update] [p] | test.cpp:70:5:70:7 | *arr [p] |
29-
| test.cpp:69:5:69:25 | ... = ... | test.cpp:69:5:69:7 | *arr [post update] [p] |
30-
| test.cpp:69:14:69:19 | call to malloc | test.cpp:69:5:69:25 | ... = ... |
31-
| test.cpp:70:5:70:7 | *arr [p] | test.cpp:67:10:67:19 | **mk_array_p [p] |
32-
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:79:9:79:11 | *arr [p] |
33-
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:83:9:83:11 | *arr [p] |
34-
| test.cpp:79:9:79:11 | *arr [p] | test.cpp:79:14:79:14 | p |
35-
| test.cpp:83:9:83:11 | *arr [p] | test.cpp:83:14:83:14 | p |
36-
| test.cpp:87:28:87:30 | *arr [p] | test.cpp:89:9:89:11 | *arr [p] |
37-
| test.cpp:87:28:87:30 | *arr [p] | test.cpp:93:9:93:11 | *arr [p] |
38-
| test.cpp:89:9:89:11 | *arr [p] | test.cpp:89:14:89:14 | p |
39-
| test.cpp:93:9:93:11 | *arr [p] | test.cpp:93:14:93:14 | p |
40-
| test.cpp:98:18:98:27 | *call to mk_array_p [p] | test.cpp:87:28:87:30 | *arr [p] |
2+
| test.cpp:4:17:4:22 | call to malloc | test.cpp:6:9:6:11 | arr | provenance | |
3+
| test.cpp:4:17:4:22 | call to malloc | test.cpp:10:9:10:11 | arr | provenance | |
4+
| test.cpp:19:9:19:16 | *mk_array [p] | test.cpp:28:19:28:26 | call to mk_array [p] | provenance | |
5+
| test.cpp:19:9:19:16 | *mk_array [p] | test.cpp:50:18:50:25 | call to mk_array [p] | provenance | |
6+
| test.cpp:21:5:21:7 | *arr [post update] [p] | test.cpp:22:5:22:7 | *arr [p] | provenance | |
7+
| test.cpp:21:5:21:24 | ... = ... | test.cpp:21:5:21:7 | *arr [post update] [p] | provenance | |
8+
| test.cpp:21:13:21:18 | call to malloc | test.cpp:21:5:21:24 | ... = ... | provenance | |
9+
| test.cpp:22:5:22:7 | *arr [p] | test.cpp:19:9:19:16 | *mk_array [p] | provenance | |
10+
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:31:9:31:11 | *arr [p] | provenance | |
11+
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:35:9:35:11 | *arr [p] | provenance | |
12+
| test.cpp:31:9:31:11 | *arr [p] | test.cpp:31:13:31:13 | p | provenance | |
13+
| test.cpp:35:9:35:11 | *arr [p] | test.cpp:35:13:35:13 | p | provenance | |
14+
| test.cpp:39:27:39:29 | arr [p] | test.cpp:41:9:41:11 | *arr [p] | provenance | |
15+
| test.cpp:39:27:39:29 | arr [p] | test.cpp:45:9:45:11 | *arr [p] | provenance | |
16+
| test.cpp:41:9:41:11 | *arr [p] | test.cpp:41:13:41:13 | p | provenance | |
17+
| test.cpp:45:9:45:11 | *arr [p] | test.cpp:45:13:45:13 | p | provenance | |
18+
| test.cpp:50:18:50:25 | call to mk_array [p] | test.cpp:39:27:39:29 | arr [p] | provenance | |
19+
| test.cpp:55:5:55:7 | *arr [post update] [p] | test.cpp:56:5:56:7 | *arr [p] | provenance | |
20+
| test.cpp:55:5:55:24 | ... = ... | test.cpp:55:5:55:7 | *arr [post update] [p] | provenance | |
21+
| test.cpp:55:13:55:18 | call to malloc | test.cpp:55:5:55:24 | ... = ... | provenance | |
22+
| test.cpp:56:5:56:7 | *arr [p] | test.cpp:59:9:59:11 | *arr [p] | provenance | |
23+
| test.cpp:56:5:56:7 | *arr [p] | test.cpp:63:9:63:11 | *arr [p] | provenance | |
24+
| test.cpp:59:9:59:11 | *arr [p] | test.cpp:59:13:59:13 | p | provenance | |
25+
| test.cpp:63:9:63:11 | *arr [p] | test.cpp:63:13:63:13 | p | provenance | |
26+
| test.cpp:67:10:67:19 | **mk_array_p [p] | test.cpp:76:20:76:29 | *call to mk_array_p [p] | provenance | |
27+
| test.cpp:67:10:67:19 | **mk_array_p [p] | test.cpp:98:18:98:27 | *call to mk_array_p [p] | provenance | |
28+
| test.cpp:69:5:69:7 | *arr [post update] [p] | test.cpp:70:5:70:7 | *arr [p] | provenance | |
29+
| test.cpp:69:5:69:25 | ... = ... | test.cpp:69:5:69:7 | *arr [post update] [p] | provenance | |
30+
| test.cpp:69:14:69:19 | call to malloc | test.cpp:69:5:69:25 | ... = ... | provenance | |
31+
| test.cpp:70:5:70:7 | *arr [p] | test.cpp:67:10:67:19 | **mk_array_p [p] | provenance | |
32+
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:79:9:79:11 | *arr [p] | provenance | |
33+
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:83:9:83:11 | *arr [p] | provenance | |
34+
| test.cpp:79:9:79:11 | *arr [p] | test.cpp:79:14:79:14 | p | provenance | |
35+
| test.cpp:83:9:83:11 | *arr [p] | test.cpp:83:14:83:14 | p | provenance | |
36+
| test.cpp:87:28:87:30 | *arr [p] | test.cpp:89:9:89:11 | *arr [p] | provenance | |
37+
| test.cpp:87:28:87:30 | *arr [p] | test.cpp:93:9:93:11 | *arr [p] | provenance | |
38+
| test.cpp:89:9:89:11 | *arr [p] | test.cpp:89:14:89:14 | p | provenance | |
39+
| test.cpp:93:9:93:11 | *arr [p] | test.cpp:93:14:93:14 | p | provenance | |
40+
| test.cpp:98:18:98:27 | *call to mk_array_p [p] | test.cpp:87:28:87:30 | *arr [p] | provenance | |
4141
nodes
4242
| test.cpp:4:17:4:22 | call to malloc | semmle.label | call to malloc |
4343
| test.cpp:6:9:6:11 | arr | semmle.label | arr |

0 commit comments

Comments
 (0)