Skip to content

Commit 0d6bd6f

Browse files
committed
Merge branch 'main' into map
2 parents 4b0e9a4 + fce76e2 commit 0d6bd6f

File tree

339 files changed

+10484
-1864
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

339 files changed

+10484
-1864
lines changed

change-notes/1.25/analysis-java.md

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,26 @@ The following changes in version 1.25 affect Java analysis in all applications.
44

55
## General improvements
66

7-
## New queries
8-
9-
| **Query** | **Tags** | **Purpose** |
10-
|-----------------------------|-----------|--------------------------------------------------------------------|
11-
7+
The Java autobuilder has been improved to detect more Gradle Java versions.
128

139
## Changes to existing queries
1410

1511
| **Query** | **Expected impact** | **Change** |
1612
|------------------------------|------------------------|-----------------------------------|
17-
13+
| Hard-coded credential in API call (`java/hardcoded-credential-api-call`) | More results | The query now recognizes the `BasicAWSCredentials` class of the Amazon client SDK library with hardcoded access key/secret key. |
14+
| Deserialization of user-controlled data (`java/unsafe-deserialization`) | Fewer false positive results | The query no longer reports results using `org.apache.commons.io.serialization.ValidatingObjectInputStream`. |
15+
| Use of a broken or risky cryptographic algorithm (`java/weak-cryptographic-algorithm`) | More results | The query now recognizes the `MessageDigest.getInstance` method. |
16+
| Use of a potentially broken or risky cryptographic algorithm (`java/potentially-weak-cryptographic-algorithm`) | More results | The query now recognizes the `MessageDigest.getInstance` method. |
17+
| Reading from a world writable file (`java/world-writable-file-read`) | More results | The query now recognizes more JDK file operations. |
1818

1919
## Changes to libraries
2020

21+
* The data-flow library has been improved with more taint flow modeling for the
22+
Collections framework and other classes of the JDK. This affects all security
23+
queries using data flow and can yield additional results.
24+
* The data-flow library has been improved with more taint flow modeling for the
25+
Spring framework. This affects all security queries using data flow and can
26+
yield additional results on project that rely on the Spring framework.
2127
* The data-flow library has been improved, which affects most security queries by potentially
2228
adding more results. Flow through methods now takes nested field reads/writes into account.
2329
For example, the library is able to track flow from `"taint"` to `sink()` via the method
@@ -39,3 +45,5 @@ The following changes in version 1.25 affect Java analysis in all applications.
3945
}
4046
}
4147
```
48+
* The library has been extended with more support for Java 14 features
49+
(`switch` expressions and pattern-matching for `instanceof`).
Lines changed: 6 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,9 @@
11
# Improvements to Python analysis
22

3-
The following changes in version 1.25 affect Python analysis in all applications.
4-
5-
## General improvements
6-
7-
8-
## New queries
9-
10-
| **Query** | **Tags** | **Purpose** |
11-
|-----------------------------|-----------|--------------------------------------------------------------------|
12-
13-
14-
## Changes to existing queries
15-
16-
| **Query** | **Expected impact** | **Change** |
17-
|----------------------------|------------------------|------------------------------------------------------------------|
18-
19-
20-
## Changes to libraries
21-
223
* Importing `semmle.python.web.HttpRequest` will no longer import `UntrustedStringKind` transitively. `UntrustedStringKind` is the most commonly used non-abstract subclass of `ExternalStringKind`. If not imported (by one mean or another), taint-tracking queries that concern `ExternalStringKind` will not produce any results. Please ensure such queries contain an explicit import (`import semmle.python.security.strings.Untrusted`).
4+
* Added model of taint sources for HTTP servers using `http.server`.
5+
* Added taint modeling of routed parameters in Flask.
6+
* Improved modeling of built-in methods on strings for taint tracking.
7+
* Improved classification of test files.
8+
* New class `BoundMethodValue` represents a bound method during runtime.
9+
* The query `py/command-line-injection` now recognizes command execution with the `fabric` and `invoke` Python libraries.

change-notes/1.26/analysis-csharp.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ The following changes in version 1.26 affect C# analysis in all applications.
1212

1313
| **Query** | **Expected impact** | **Change** |
1414
|------------------------------|------------------------|-----------------------------------|
15-
15+
| Weak encryption: Insufficient key size (`cs/insufficient-key-size`) | More results | The required key size has been increased from 1024 to 2048. |
1616

1717
## Removal of old queries
1818

change-notes/1.26/analysis-javascript.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,14 @@
1414
- [json-stringify-safe](https://www.npmjs.com/package/json-stringify-safe)
1515
- [json3](https://www.npmjs.com/package/json3)
1616
- [lodash](https://www.npmjs.com/package/lodash)
17+
- [needle](https://www.npmjs.com/package/needle)
1718
- [object-inspect](https://www.npmjs.com/package/object-inspect)
1819
- [pretty-format](https://www.npmjs.com/package/pretty-format)
1920
- [stringify-object](https://www.npmjs.com/package/stringify-object)
2021
- [underscore](https://www.npmjs.com/package/underscore)
2122

2223
* Analyzing files with the ".cjs" extension is now supported.
24+
* ES2021 features are now supported.
2325

2426
## New queries
2527

@@ -38,6 +40,7 @@
3840
| Unsafe shell command constructed from library input (`js/shell-command-constructed-from-input`) | More results | This query now recognizes more commands where colon, dash, and underscore are used. |
3941
| Unsafe jQuery plugin (`js/unsafe-jquery-plugin`) | More results | This query now detects more unsafe uses of nested option properties. |
4042
| Client-side URL redirect (`js/client-side-unvalidated-url-redirection`) | More results | This query now recognizes some unsafe uses of `importScripts()` inside WebWorkers. |
43+
| Missing CSRF middleware (`js/missing-token-validation`) | More results | This query now recognizes writes to cookie and session variables as potentially vulnerable to CSRF attacks. |
4144

4245

4346
## Changes to libraries

config/identical-files.json

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,18 @@
5050
"csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
5151
"python/ql/src/experimental/dataflow/internal/DataFlowImplConsistency.qll"
5252
],
53+
"SsaReadPosition Java/C#": [
54+
"java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
55+
"csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
56+
],
57+
"Sign Java/C#": [
58+
"java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/Sign.qll",
59+
"csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/Sign.qll"
60+
],
61+
"SignAnalysis Java/C#": [
62+
"java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll",
63+
"csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SignAnalysisCommon.qll"
64+
],
5365
"C++ SubBasicBlocks": [
5466
"cpp/ql/src/semmle/code/cpp/controlflow/SubBasicBlocks.qll",
5567
"cpp/ql/src/semmle/code/cpp/dataflow/internal/SubBasicBlocks.qll"
@@ -87,7 +99,7 @@
8799
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/Operand.qll",
88100
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/Operand.qll",
89101
"csharp/ql/src/experimental/ir/implementation/raw/Operand.qll",
90-
"csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll"
102+
"csharp/ql/src/experimental/ir/implementation/unaliased_ssa/Operand.qll"
91103
],
92104
"IR IRType": [
93105
"cpp/ql/src/semmle/code/cpp/ir/implementation/IRType.qll",
@@ -109,11 +121,11 @@
109121
"cpp/ql/src/semmle/code/cpp/ir/implementation/internal/OperandTag.qll",
110122
"csharp/ql/src/experimental/ir/implementation/internal/OperandTag.qll"
111123
],
112-
"IR TInstruction":[
124+
"IR TInstruction": [
113125
"cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TInstruction.qll",
114126
"csharp/ql/src/experimental/ir/implementation/internal/TInstruction.qll"
115127
],
116-
"IR TIRVariable":[
128+
"IR TIRVariable": [
117129
"cpp/ql/src/semmle/code/cpp/ir/implementation/internal/TIRVariable.qll",
118130
"csharp/ql/src/experimental/ir/implementation/internal/TIRVariable.qll"
119131
],
@@ -381,4 +393,4 @@
381393
"javascript/ql/src/Comments/CommentedOutCodeReferences.qhelp",
382394
"python/ql/src/Lexical/CommentedOutCodeReferences.qhelp"
383395
]
384-
}
396+
}

cpp/ql/src/Security/CWE/CWE-022/TaintedPath.qhelp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ access all the system's passwords.</p>
3939

4040
<li>
4141
OWASP:
42-
<a href="https://www.owasp.org/index.php/Path_traversal">Path Traversal</a>.
42+
<a href="https://owasp.org/www-community/attacks/Path_Traversal">Path Traversal</a>.
4343
</li>
4444

4545
</references>
Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/**
2+
* EXPERIMENTAL: The API of this module may change without notice.
3+
*
4+
* Provides a class for modeling `RangeSsaDefinition`s with a restricted range.
5+
*/
6+
7+
import cpp
8+
import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
9+
10+
/**
11+
* EXPERIMENTAL: The API of this class may change without notice.
12+
*
13+
* An SSA definition for which a range can be deduced. As with
14+
* `RangeSsaDefinition` and `SsaDefinition`, instances of this class
15+
* correspond to points in the program where one or more variables are defined
16+
* or have their value constrained in some way.
17+
*
18+
* Extend this class to add functionality to the range analysis library.
19+
*/
20+
abstract class SimpleRangeAnalysisDefinition extends RangeSsaDefinition {
21+
/**
22+
* Holds if this `SimpleRangeAnalysisDefinition` adds range information for
23+
* `v`. Because a `SimpleRangeAnalysisDefinition` is just a point in the
24+
* program, it's possible that more than one variable might be defined at
25+
* this point. This predicate clarifies which variable(s) should get range
26+
* information from `this`.
27+
*
28+
* This predicate **must be overridden** to hold for any `v` that can show
29+
* up in the other members of `SimpleRangeAnalysisDefinition`. Conversely,
30+
* the other members **must be accurate** for any `v` in this predicate.
31+
*/
32+
abstract predicate hasRangeInformationFor(StackVariable v);
33+
34+
/**
35+
* Holds if `(this, v)` depends on the range of the unconverted expression
36+
* `e`. This information is used to inform the range analysis about cyclic
37+
* dependencies. Without this information, range analysis might work for
38+
* simple cases but will go into infinite loops on complex code.
39+
*
40+
* For example, when modelling the definition by reference in a call to an
41+
* overloaded `operator=`, written as `v = e`, the definition of `(this, v)`
42+
* depends on `e`.
43+
*/
44+
abstract predicate dependsOnExpr(StackVariable v, Expr e);
45+
46+
/**
47+
* Gets the lower bound of the variable `v` defined by this definition.
48+
*
49+
* Implementations of this predicate should use
50+
* `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
51+
* recursive calls to get the bounds of their dependencies.
52+
*/
53+
abstract float getLowerBounds(StackVariable v);
54+
55+
/**
56+
* Gets the upper bound of the variable `v` defined by this definition.
57+
*
58+
* Implementations of this predicate should use
59+
* `getFullyConvertedLowerBounds` and `getFullyConvertedUpperBounds` for
60+
* recursive calls to get the bounds of their dependencies.
61+
*/
62+
abstract float getUpperBounds(StackVariable v);
63+
}
64+
65+
import SimpleRangeAnalysisInternal
Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import semmle.code.cpp.rangeanalysis.SimpleRangeAnalysis
2+
//
3+
// Import each extension we want to enable
4+
import extensions.SubtractSelf
Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
import experimental.semmle.code.cpp.models.interfaces.SimpleRangeAnalysisExpr
2+
3+
private class SelfSub extends SimpleRangeAnalysisExpr, SubExpr {
4+
SelfSub() {
5+
// Match `x - x` but not `myInt - (unsigned char)myInt`.
6+
getLeftOperand().getExplicitlyConverted().(VariableAccess).getTarget() =
7+
getRightOperand().getExplicitlyConverted().(VariableAccess).getTarget()
8+
}
9+
10+
override float getLowerBounds() { result = 0 }
11+
12+
override float getUpperBounds() { result = 0 }
13+
14+
override predicate dependsOnChild(Expr child) { none() }
15+
}

cpp/ql/src/semmle/code/cpp/Variable.qll

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,11 @@ class Variable extends Declaration, @variable {
144144
*/
145145
predicate isConstexpr() { this.hasSpecifier("is_constexpr") }
146146

147+
/**
148+
* Holds if this variable is declared `constinit`.
149+
*/
150+
predicate isConstinit() { this.hasSpecifier("declared_constinit") }
151+
147152
/**
148153
* Holds if this variable is `thread_local`.
149154
*/

0 commit comments

Comments
 (0)