Skip to content

Commit 1c43cea

Browse files
jonjanegojonjanego
authored
Merge branch 'main' into codeql-spark-run-21760759512
2 parents 5bf2d94 + 48db24d commit 1c43cea

File tree

183 files changed

+60273
-48485
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

183 files changed

+60273
-48485
lines changed

‎actions/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-all
2-
version: 0.4.27
2+
version: 0.4.28-dev
33
library: true
44
warnOnImplicitThis: true
55
dependencies:

‎actions/ql/src/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/actions-queries
2-
version: 0.6.19
2+
version: 0.6.20-dev
33
library: false
44
warnOnImplicitThis: true
55
groups: [actions, queries]

‎cpp/ql/lib/change-notes/2026-02-03-windows-remote-flow-sources.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added remote flow source models for the `winhttp.h` windows header and the Azure SDK core library for C/C++.

‎cpp/ql/lib/ext/Windows.model.yml‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,13 @@ extensions:
2424
- ["", "", False, "MapViewOfFileNuma2", "", "", "ReturnValue[*]", "local", "manual"]
2525
# ntifs.h
2626
- ["", "", False, "NtReadFile", "", "", "Argument[*5]", "local", "manual"]
27+
# winhttp.h
28+
- ["", "", False, "WinHttpReadData", "", "", "Argument[*1]", "remote", "manual"]
29+
- ["", "", False, "WinHttpReadDataEx", "", "", "Argument[*1]", "remote", "manual"]
30+
- ["", "", False, "WinHttpQueryHeaders", "", "", "Argument[*3]", "remote", "manual"]
31+
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[*5]", "remote", "manual"]
32+
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[*6]", "remote", "manual"]
33+
- ["", "", False, "WinHttpQueryHeadersEx", "", "", "Argument[**8]", "remote", "manual"]
2734
- addsTo:
2835
pack: codeql/cpp-all
2936
extensible: summaryModel
@@ -46,4 +53,6 @@ extensions:
4653
- ["", "", False, "RtlMoveMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
4754
- ["", "", False, "RtlMoveVolatileMemory", "", "", "Argument[*@1]", "Argument[*@0]", "value", "manual"]
4855
# winternl.h
49-
- ["", "", False, "RtlInitUnicodeString", "", "", "Argument[*1]", "Argument[*0].Field[*Buffer]", "value", "manual"]
56+
- ["", "", False, "RtlInitUnicodeString", "", "", "Argument[*1]", "Argument[*0].Field[*Buffer]", "value", "manual"]
57+
# winhttp.h
58+
- ["", "", False, "WinHttpCrackUrl", "", "", "Argument[*0]", "Argument[*3]", "taint", "manual"]

‎cpp/ql/lib/ext/azure.core.model.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
extensions:
2+
- addsTo:
3+
pack: codeql/cpp-all
4+
extensible: sourceModel
5+
data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
6+
- ["Azure::Core::Http", "RawResponse", True, "GetHeaders", "", "", "ReturnValue[*]", "remote", "manual"]
7+
- ["Azure::Core::Http", "RawResponse", True, "GetBody", "", "", "ReturnValue[*]", "remote", "manual"]
8+
- ["Azure::Core::Http", "RawResponse", True, "ExtractBodyStream", "", "", "ReturnValue[*]", "remote", "manual"]
9+
- ["Azure::Core::Http", "Request", True, "GetHeaders", "", "", "ReturnValue", "remote", "manual"]
10+
- ["Azure::Core::Http", "Request", True, "GetHeader", "", "", "ReturnValue", "remote", "manual"]
11+
- ["Azure::Core::Http", "Request", True, "GetBodyStream", "", "", "ReturnValue[*]", "remote", "manual"]
12+
13+
- addsTo:
14+
pack: codeql/cpp-all
15+
extensible: summaryModel
16+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
17+
- ["Azure::Core", "Url", True, "Url", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
18+
- ["Azure::Core", "Url", True, "SetScheme", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
19+
- ["Azure::Core", "Url", True, "SetHost", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
20+
- ["Azure::Core", "Url", True, "SetPort", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
21+
- ["Azure::Core", "Url", True, "SetPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
22+
- ["Azure::Core", "Url", True, "SetQueryParameters", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
23+
- ["Azure::Core", "Url", True, "AppendPath", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
24+
- ["Azure::Core", "Url", True, "AppendQueryParameter", "", "", "Argument[*1]", "Argument[-1]", "taint", "manual"]
25+
- ["Azure::Core", "Url", True, "GetHost", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
26+
- ["Azure::Core", "Url", True, "GetPath", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
27+
- ["Azure::Core", "Url", True, "GetPort", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
28+
- ["Azure::Core", "Url", True, "GetQueryParameters", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
29+
- ["Azure::Core", "Url", True, "GetScheme", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
30+
- ["Azure::Core", "Url", True, "GetRelativeUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
31+
- ["Azure::Core", "Url", True, "GetAbsoluteUrl", "", "", "Argument[-1]", "ReturnValue", "taint", "manual"]
32+
- ["Azure::Core", "Url", True, "Decode", "", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
33+
- ["Azure::Core", "Url", True, "Encode", "", "", "Argument[*0]", "ReturnValue", "taint", "manual"]
34+
- ["Azure::Core::IO", "BodyStream", True, "Read", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
35+
- ["Azure::Core::IO", "BodyStream", True, "ReadToCount", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
36+
- ["Azure::Core::IO", "BodyStream", True, "ReadToEnd", "", "", "Argument[-1]", "ReturnValue.Element", "taint", "manual"]
37+
- ["Azure", "Nullable", True, "Nullable", "", "", "Argument[0]", "Argument[-1]", "taint", "manual"]
38+
- ["Azure", "Nullable", True, "operator=", "", "", "Argument[*0]", "Argument[-1]", "value", "manual"]
39+
- ["Azure", "Nullable", True, "Value", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
40+
- ["Azure", "Nullable", True, "operator->", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
41+
- ["Azure", "Nullable", True, "operator*", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]

‎cpp/ql/lib/qlpack.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cpp-all
2-
version: 7.1.0
2+
version: 7.1.1-dev
33
groups: cpp
44
dbscheme: semmlecode.cpp.dbscheme
55
extractor: cpp

‎cpp/ql/lib/semmle/code/cpp/internal/Overlay.qll‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,17 +64,27 @@ private string getMultiLocationFilePath(@element e) {
6464
overlay[local]
6565
private predicate isBase() { not isOverlay() }
6666

67+
/**
68+
* Holds if `path` was extracted in the overlay database.
69+
*/
70+
overlay[local]
71+
private predicate overlayHasFile(string path) {
72+
isOverlay() and
73+
files(_, path) and
74+
path != ""
75+
}
76+
6777
/**
6878
* Discards an element from the base variant if:
69-
* - It has a single location in a changed file, or
70-
* - All of its locations are in changed files.
79+
* - It has a single location in a file extracted in the overlay, or
80+
* - All of its locations are in files extracted in the overlay.
7181
*/
7282
overlay[discard_entity]
7383
private predicate discardElement(@element e) {
7484
isBase() and
7585
(
76-
overlayChangedFiles(getSingleLocationFilePath(e))
86+
overlayHasFile(getSingleLocationFilePath(e))
7787
or
78-
forex(string path | path = getMultiLocationFilePath(e) | overlayChangedFiles(path))
88+
forex(string path | path = getMultiLocationFilePath(e) | overlayHasFile(path))
7989
)
8090
}

‎cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedStmt.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -390,7 +390,7 @@ class TranslatedDeclStmt extends TranslatedStmt {
390390

391391
override TranslatedElement getLastChild() { result = this.getChild(this.getChildCount() - 1) }
392392

393-
private int getChildCount() { result = count(this.getDeclarationEntry(_)) }
393+
private int getChildCount() { result = count(int i | exists(this.getDeclarationEntry(i))) }
394394

395395
IRDeclarationEntry getIRDeclarationEntry(int index) {
396396
result.hasIndex(index) and

‎cpp/ql/lib/semmle/code/cpp/models/Models.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,3 +57,4 @@ private import implementations.CAtlFile
5757
private import implementations.CAtlFileMapping
5858
private import implementations.CAtlTemporaryFile
5959
private import implementations.CRegKey
60+
private import implementations.WinHttp

‎cpp/ql/lib/semmle/code/cpp/models/implementations/WinHttp.qll‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
private import cpp
2+
private import semmle.code.cpp.ir.dataflow.FlowSteps
3+
private import semmle.code.cpp.dataflow.new.DataFlow
4+
5+
/** The `WINHTTP_HEADER_NAME` class from `winhttp.h`. */
6+
class WinHttpHeaderName extends Class {
7+
WinHttpHeaderName() { this.hasGlobalName("_WINHTTP_HEADER_NAME") }
8+
}
9+
10+
/** The `WINHTTP_EXTENDED_HEADER` class from `winhttp.h`. */
11+
class WinHttpExtendedHeader extends Class {
12+
WinHttpExtendedHeader() { this.hasGlobalName("_WINHTTP_EXTENDED_HEADER") }
13+
}
14+
15+
private class WinHttpHeaderNameInheritingContent extends TaintInheritingContent,
16+
DataFlow::FieldContent
17+
{
18+
WinHttpHeaderNameInheritingContent() {
19+
this.getIndirectionIndex() = 2 and
20+
(
21+
this.getAField().getDeclaringType() instanceof WinHttpHeaderName
22+
or
23+
// The extended header looks like:
24+
// struct WINHTTP_EXTENDED_HEADER {
25+
// union { [...] };
26+
// union { [...] };
27+
// };
28+
// So the first declaring type is the anonymous unions, and the declaring
29+
// type of those anonymous unions is the `WINHTTP_EXTENDED_HEADER` struct.
30+
this.getAField().getDeclaringType().getDeclaringType() instanceof WinHttpExtendedHeader
31+
)
32+
}
33+
}
34+
35+
/** The `URL_COMPONENTS` class from `winhttp.h`. */
36+
class WinHttpUrlComponents extends Class {
37+
WinHttpUrlComponents() { this.hasGlobalName("_WINHTTP_URL_COMPONENTS") }
38+
}
39+
40+
private class WinHttpUrlComponentsInheritingContent extends TaintInheritingContent,
41+
DataFlow::FieldContent
42+
{
43+
WinHttpUrlComponentsInheritingContent() {
44+
exists(Field f | f = this.getField() and f.getDeclaringType() instanceof WinHttpUrlComponents |
45+
if f.getType().getUnspecifiedType() instanceof PointerType
46+
then this.getIndirectionIndex() = 2
47+
else this.getIndirectionIndex() = 1
48+
)
49+
}
50+
}

0 commit comments

Comments
 (0)