Skip to content

Commit 2d57abd

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into mathiasvp/read-step-without-memory-operands
2 parents ad602b8 + d60b7c7 commit 2d57abd

65 files changed

Lines changed: 1952 additions & 489 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/query-list.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Build code scanning query list
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- 'rc/**'
8+
pull_request:
9+
paths:
10+
- '.github/workflows/query-list.yml'
11+
- 'misc/scripts/generate-code-scanning-query-list.py'
12+
13+
jobs:
14+
build:
15+
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Clone self (github/codeql)
20+
uses: actions/checkout@v2
21+
with:
22+
path: codeql
23+
- name: Clone github/codeql-go
24+
uses: actions/checkout@v2
25+
with:
26+
repository: 'github/codeql-go'
27+
path: codeql-go
28+
- name: Set up Python 3.8
29+
uses: actions/setup-python@v2
30+
with:
31+
python-version: 3.8
32+
- name: Download CodeQL CLI
33+
uses: dsaltares/fetch-gh-release-asset@aa37ae5c44d3c9820bc12fe675e8670ecd93bd1c
34+
with:
35+
repo: "github/codeql-cli-binaries"
36+
version: "latest"
37+
file: "codeql-linux64.zip"
38+
token: ${{ secrets.GITHUB_TOKEN }}
39+
- name: Unzip CodeQL CLI
40+
run: unzip -d codeql-cli codeql-linux64.zip
41+
- name: Build code scanning query list
42+
run: |
43+
PATH="$PATH:codeql-cli/codeql" python codeql/misc/scripts/generate-code-scanning-query-list.py > code-scanning-query-list.csv
44+
- name: Upload code scanning query list
45+
uses: actions/upload-artifact@v2
46+
with:
47+
name: code-scanning-query-list
48+
path: code-scanning-query-list.csv
49+

‎change-notes/1.26/analysis-cpp.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,5 +24,6 @@ The following changes in version 1.26 affect C/C++ analysis in all applications.
2424
* The models library now models many taint flows through `std::array`, `std::vector`, `std::deque`, `std::list` and `std::forward_list`.
2525
* The models library now models many more taint flows through `std::string`.
2626
* The models library now models some taint flows through `std::ostream`.
27+
* The models library now models some taint flows through `std::shared_ptr`, `std::unique_ptr`, `std::make_shared` and `std::make_unique`.
2728
* The `SimpleRangeAnalysis` library now supports multiplications of the form
2829
`e1 * e2` and `x *= e2` when `e1` and `e2` are unsigned or constant.

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,10 @@ predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
3333
}
3434

3535
/**
36-
* Holds if `node` should be a barrier in all global taint flow configurations
36+
* Holds if `node` should be a sanitizer in all global taint flow configurations
3737
* but not in local taint.
3838
*/
39-
predicate defaultTaintBarrier(DataFlow::Node node) { none() }
39+
predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
4040

4141
/**
4242
* Holds if taint can flow in one local step from `nodeFrom` to `nodeTo` excluding

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking1/TaintTrackingImpl.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,20 @@ abstract class Configuration extends DataFlow::Configuration {
7676

7777
final override predicate isBarrier(DataFlow::Node node) {
7878
isSanitizer(node) or
79-
defaultTaintBarrier(node)
79+
defaultTaintSanitizer(node)
8080
}
8181

82-
/** Holds if data flow into `node` is prohibited. */
82+
/** Holds if taint propagation into `node` is prohibited. */
8383
predicate isSanitizerIn(DataFlow::Node node) { none() }
8484

8585
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
8686

87-
/** Holds if data flow out of `node` is prohibited. */
87+
/** Holds if taint propagation out of `node` is prohibited. */
8888
predicate isSanitizerOut(DataFlow::Node node) { none() }
8989

9090
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
9191

92-
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
92+
/** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
9393
predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
9494

9595
final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }

‎cpp/ql/src/semmle/code/cpp/dataflow/internal/tainttracking2/TaintTrackingImpl.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,20 @@ abstract class Configuration extends DataFlow::Configuration {
7676

7777
final override predicate isBarrier(DataFlow::Node node) {
7878
isSanitizer(node) or
79-
defaultTaintBarrier(node)
79+
defaultTaintSanitizer(node)
8080
}
8181

82-
/** Holds if data flow into `node` is prohibited. */
82+
/** Holds if taint propagation into `node` is prohibited. */
8383
predicate isSanitizerIn(DataFlow::Node node) { none() }
8484

8585
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
8686

87-
/** Holds if data flow out of `node` is prohibited. */
87+
/** Holds if taint propagation out of `node` is prohibited. */
8888
predicate isSanitizerOut(DataFlow::Node node) { none() }
8989

9090
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
9191

92-
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
92+
/** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
9393
predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
9494

9595
final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }

‎cpp/ql/src/semmle/code/cpp/exprs/Expr.qll‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -402,7 +402,7 @@ class Expr extends StmtParent, @expr {
402402
*/
403403
predicate hasImplicitConversion() {
404404
exists(Expr e |
405-
exprconv(underlyingElement(this), unresolveElement(e)) and e.(Cast).isImplicit()
405+
exprconv(underlyingElement(this), unresolveElement(e)) and e.(Conversion).isImplicit()
406406
)
407407
}
408408

@@ -414,7 +414,7 @@ class Expr extends StmtParent, @expr {
414414
*/
415415
predicate hasExplicitConversion() {
416416
exists(Expr e |
417-
exprconv(underlyingElement(this), unresolveElement(e)) and not e.(Cast).isImplicit()
417+
exprconv(underlyingElement(this), unresolveElement(e)) and not e.(Conversion).isImplicit()
418418
)
419419
}
420420

@@ -453,12 +453,14 @@ class Expr extends StmtParent, @expr {
453453
* cast from B to C. Only (1) and (2) would be included.
454454
*/
455455
Expr getExplicitlyConverted() {
456-
// result is this or one of its conversions
457-
result = this.getConversion*() and
458-
// result is not an implicit conversion - it's either the expr or an explicit cast
459-
(result = this or not result.(Cast).isImplicit()) and
460-
// there is no further explicit conversion after result
461-
not exists(Cast other | other = result.getConversion+() and not other.isImplicit())
456+
// For performance, we avoid a full transitive closure over `getConversion`.
457+
// Since there can be several implicit conversions before and after an
458+
// explicit conversion, use `getImplicitlyConverted` to step over them
459+
// cheaply. Then, if there is an explicit conversion following the implict
460+
// conversion sequence, recurse to handle multiple explicit conversions.
461+
if this.getImplicitlyConverted().hasExplicitConversion()
462+
then result = this.getImplicitlyConverted().getConversion().getExplicitlyConverted()
463+
else result = this
462464
}
463465

464466
/**

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/TaintTrackingUtil.qll‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,10 +100,10 @@ predicate defaultAdditionalTaintStep(DataFlow::Node src, DataFlow::Node sink) {
100100
}
101101

102102
/**
103-
* Holds if `node` should be a barrier in all global taint flow configurations
103+
* Holds if `node` should be a sanitizer in all global taint flow configurations
104104
* but not in local taint.
105105
*/
106-
predicate defaultTaintBarrier(DataFlow::Node node) { none() }
106+
predicate defaultTaintSanitizer(DataFlow::Node node) { none() }
107107

108108
/**
109109
* Holds if taint can flow from `instrIn` to `instrOut` through a call to a

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking1/TaintTrackingImpl.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,20 @@ abstract class Configuration extends DataFlow::Configuration {
7676

7777
final override predicate isBarrier(DataFlow::Node node) {
7878
isSanitizer(node) or
79-
defaultTaintBarrier(node)
79+
defaultTaintSanitizer(node)
8080
}
8181

82-
/** Holds if data flow into `node` is prohibited. */
82+
/** Holds if taint propagation into `node` is prohibited. */
8383
predicate isSanitizerIn(DataFlow::Node node) { none() }
8484

8585
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
8686

87-
/** Holds if data flow out of `node` is prohibited. */
87+
/** Holds if taint propagation out of `node` is prohibited. */
8888
predicate isSanitizerOut(DataFlow::Node node) { none() }
8989

9090
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
9191

92-
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
92+
/** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
9393
predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
9494

9595
final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }

‎cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/tainttracking2/TaintTrackingImpl.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,20 @@ abstract class Configuration extends DataFlow::Configuration {
7676

7777
final override predicate isBarrier(DataFlow::Node node) {
7878
isSanitizer(node) or
79-
defaultTaintBarrier(node)
79+
defaultTaintSanitizer(node)
8080
}
8181

82-
/** Holds if data flow into `node` is prohibited. */
82+
/** Holds if taint propagation into `node` is prohibited. */
8383
predicate isSanitizerIn(DataFlow::Node node) { none() }
8484

8585
final override predicate isBarrierIn(DataFlow::Node node) { isSanitizerIn(node) }
8686

87-
/** Holds if data flow out of `node` is prohibited. */
87+
/** Holds if taint propagation out of `node` is prohibited. */
8888
predicate isSanitizerOut(DataFlow::Node node) { none() }
8989

9090
final override predicate isBarrierOut(DataFlow::Node node) { isSanitizerOut(node) }
9191

92-
/** Holds if data flow through nodes guarded by `guard` is prohibited. */
92+
/** Holds if taint propagation through nodes guarded by `guard` is prohibited. */
9393
predicate isSanitizerGuard(DataFlow::BarrierGuard guard) { none() }
9494

9595
final override predicate isBarrierGuard(DataFlow::BarrierGuard guard) { isSanitizerGuard(guard) }

‎cpp/ql/src/semmle/code/cpp/models/Models.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,4 @@ private import implementations.StdContainer
1818
private import implementations.StdString
1919
private import implementations.Swap
2020
private import implementations.GetDelim
21+
private import implementations.SmartPointer

0 commit comments

Comments
 (0)