Skip to content

Commit 54493eb

Browse files
raulgarciamsftraulgarciamsft
authored
Merge branch 'master' into master
2 parents d6d27df + 8f19efe commit 54493eb

File tree

328 files changed

+8737
-7968
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

328 files changed

+8737
-7968
lines changed

‎.editorconfig‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
[*.{ql,qll,qlref,dbscheme,qhelp,html,js,mjs,ts,json,yml}]
2-
end_of_line = lf
1+
[*]
2+
end_of_line = lf

‎.gitattributes‎

Lines changed: 44 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,48 @@
1-
# The following file types will be normalized to LF line endings in the Git
2-
# database, and will keep those LF line endings in the working tree even on
3-
# Windows. Any other files will have whatever line endings they had when they
4-
# were committed. If you add new entries below, you should renormalize the
5-
# affected files by running the following from the root of this repo (requires
6-
# Git 2.16 or greater):
1+
# Text files will be normalized to LF line endings in the Git database, and will keep those LF line
2+
# endings in the working tree even on Windows. If you make changes below, you should renormalize the
3+
# affected files by running the following from the root of this repo (requires Git 2.16 or greater):
74
#
85
# git add --renormalize .
96
# git status [just to show what files were renormalized]
107
# git commit -m "Normalize line endings"
11-
#
12-
# Also, please update .editorconfig to handle any new entries as well.
13-
*.ql eol=lf
14-
*.qll eol=lf
15-
*.qlref eol=lf
16-
*.dbscheme eol=lf
17-
*.qhelp eol=lf
18-
*.html eol=lf
19-
*.js eol=lf
20-
*.mjs eol=lf
21-
*.ts eol=lf
22-
*.json eol=lf
23-
*.yml eol=lf
8+
9+
# Anything Git auto-detects as text gets normalized and checked out as LF
10+
* text=auto eol=lf
11+
12+
# Explicitly set a bunch of known extensions to text, in case auto detection gets confused.
13+
*.ql text
14+
*.qll text
15+
*.qlref text
16+
*.dbscheme text
17+
*.qhelp text
18+
*.html text
19+
*.htm text
20+
*.xhtml text
21+
*.xhtm text
22+
*.js text
23+
*.mjs text
24+
*.ts text
25+
*.json text
26+
*.yml text
27+
*.yaml text
28+
*.c text
29+
*.cpp text
30+
*.h text
31+
*.hpp text
32+
*.md text
33+
*.stats text
34+
*.xml text
35+
*.sh text
36+
*.pl text
37+
*.java text
38+
*.cs text
39+
*.py text
40+
*.lua text
41+
*.expected text
42+
43+
# Explicitly set a bunch of known extensions to binary, because Git < 2.10 will treat
44+
# `* text=auto eol=lf` as `* text eol=lf`
45+
*.png -text
46+
*.jpg -text
47+
*.jpeg -text
48+
*.gif -text

‎.gitignore‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,4 @@
1212
/.vs/ql/v15/Browse.VC.opendb
1313
/.vs/ql/v15/Browse.VC.db
1414
/.vs/ProjectSettings.json
15-
/.vs/ql5/v15/Browse.VC.opendb
16-
/.vs/ql5/v15/Browse.VC.db
17-
/.vs/ql5/v15/.suo
15+

‎change-notes/1.19/analysis-cpp.md‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
1-
# Improvements to C/C++ analysis
2-
3-
## General improvements
4-
5-
## New queries
6-
7-
| **Query** | **Tags** | **Purpose** |
8-
|-----------------------------|-----------|--------------------------------------------------------------------|
9-
| *@name of query (Query ID)* | *Tags* |*Aim of the new query and whether it is enabled by default or not* |
10-
11-
## Changes to existing queries
12-
13-
| **Query** | **Expected impact** | **Change** |
14-
|----------------------------|------------------------|------------------------------------------------------------------|
15-
| *@name of query (Query ID)*| *Impact on results* | *How/why the query has changed* |
16-
17-
18-
## Changes to QL libraries
19-
20-
* Added a hash consing library for structural comparison of expressions.
1+
# Improvements to C/C++ analysis
2+
3+
## General improvements
4+
5+
## New queries
6+
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
| *@name of query (Query ID)* | *Tags* |*Aim of the new query and whether it is enabled by default or not* |
10+
11+
## Changes to existing queries
12+
13+
| **Query** | **Expected impact** | **Change** |
14+
|----------------------------|------------------------|------------------------------------------------------------------|
15+
| Resource not released in destructor | Fewer false positive results | Placement new is now excluded from the query. |
16+
17+
18+
## Changes to QL libraries
19+
20+
* Added a hash consing library for structural comparison of expressions.

‎change-notes/1.19/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,6 @@
2222
| Regular expression injection | Fewer false-positive results | This rule now identifies calls to `String.prototype.search` with more precision. |
2323
| Unbound event handler receiver | Fewer false-positive results | This rule now recognizes additional ways class methods can be bound. |
2424
| Remote property injection | Fewer results | The precision of this rule has been revised to "medium". Results are no longer shown on LGTM by default. |
25+
| Missing CSRF middleware | Fewer false-positive results | This rule now recognizes additional CSRF protection middlewares. |
2526

2627
## Changes to QL libraries

‎cpp/config/suites/security/cwe-120‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
# CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
2-
+ semmlecode-cpp-queries/Security/CWE/CWE-120/UnboundedWrite.ql: /CWE/CWE-120
3-
@name Unbounded write (CWE-120)
4-
+ semmlecode-cpp-queries/Security/CWE/CWE-120/BadlyBoundedWrite.ql: /CWE/CWE-120
5-
@name Badly bounded write (CWE-120)
6-
+ semmlecode-cpp-queries/Security/CWE/CWE-120/OverrunWrite.ql: /CWE/CWE-120
7-
@name Potentially overrunning write (CWE-120)
8-
+ semmlecode-cpp-queries/Security/CWE/CWE-120/OverrunWriteFloat.ql: /CWE/CWE-120
9-
@name Potentially overrunning write with float to string conversion (CWE-120)
10-
+ semmlecode-cpp-queries/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql: /CWE/CWE-120
11-
@name Array offset used before range check (CWE-120)
12-
+ semmlecode-cpp-queries/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql: /CWE/CWE-120
13-
@name Potentially unsafe use of strcat (CWE-120)
1+
# CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
2+
+ semmlecode-cpp-queries/Security/CWE/CWE-120/UnboundedWrite.ql: /CWE/CWE-120
3+
@name Unbounded write (CWE-120)
4+
+ semmlecode-cpp-queries/Security/CWE/CWE-120/BadlyBoundedWrite.ql: /CWE/CWE-120
5+
@name Badly bounded write (CWE-120)
6+
+ semmlecode-cpp-queries/Security/CWE/CWE-120/OverrunWrite.ql: /CWE/CWE-120
7+
@name Potentially overrunning write (CWE-120)
8+
+ semmlecode-cpp-queries/Security/CWE/CWE-120/OverrunWriteFloat.ql: /CWE/CWE-120
9+
@name Potentially overrunning write with float to string conversion (CWE-120)
10+
+ semmlecode-cpp-queries/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql: /CWE/CWE-120
11+
@name Array offset used before range check (CWE-120)
12+
+ semmlecode-cpp-queries/Likely Bugs/Memory Management/UnsafeUseOfStrcat.ql: /CWE/CWE-120
13+
@name Potentially unsafe use of strcat (CWE-120)

‎cpp/config/suites/security/cwe-121‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
1-
# CWE-121: Stack-based Buffer Overflow
2-
+ semmlecode-cpp-queries/Security/CWE/CWE-121/UnterminatedVarargsCall.ql: /CWE/CWE-121
3-
@name Unterminated variadic call (CWE-121)
1+
# CWE-121: Stack-based Buffer Overflow
2+
+ semmlecode-cpp-queries/Security/CWE/CWE-121/UnterminatedVarargsCall.ql: /CWE/CWE-121
3+
@name Unterminated variadic call (CWE-121)

‎cpp/config/suites/security/cwe-131‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
# CWE-131: Incorrect Calculation of Buffer Size
2-
+ semmlecode-cpp-queries/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql: /CWE/CWE-131
3-
@name No space for zero terminator (CWE-131)
4-
+ semmlecode-cpp-queries/Critical/SizeCheck.ql: /CWE/CWE-131
5-
@name Not enough memory allocated for pointer type (CWE-131)
6-
+ semmlecode-cpp-queries/Critical/SizeCheck2.ql: /CWE/CWE-131
7-
@name Not enough memory allocated for array of pointer type (CWE-131)
1+
# CWE-131: Incorrect Calculation of Buffer Size
2+
+ semmlecode-cpp-queries/Security/CWE/CWE-131/NoSpaceForZeroTerminator.ql: /CWE/CWE-131
3+
@name No space for zero terminator (CWE-131)
4+
+ semmlecode-cpp-queries/Critical/SizeCheck.ql: /CWE/CWE-131
5+
@name Not enough memory allocated for pointer type (CWE-131)
6+
+ semmlecode-cpp-queries/Critical/SizeCheck2.ql: /CWE/CWE-131
7+
@name Not enough memory allocated for array of pointer type (CWE-131)

‎cpp/config/suites/security/cwe-134‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
# CWE-134: Uncontrolled Format String
2-
+ semmlecode-cpp-queries/Likely Bugs/Format/NonConstantFormat.ql: /CWE/CWE-134
3-
@name Non-constant format string (CWE-134)
4-
# This one runs out of memory. See ODASA-608.
5-
#+ semmlecode-cpp-queries/PointsTo/TaintedFormatStrings.ql: /CWE/CWE-134
6-
+ semmlecode-cpp-queries/Likely Bugs/Format/WrongNumberOfFormatArguments.ql: /CWE/CWE-134
7-
@name Wrong number of arguments to formatting function (CWE-134)
8-
+ semmlecode-cpp-queries/Likely Bugs/Format/WrongTypeFormatArguments.ql: /CWE/CWE-134
9-
@name Wrong type of arguments to formatting function (CWE-134)
10-
+ semmlecode-cpp-queries/Security/CWE/CWE-134/UncontrolledFormatString.ql: /CWE/CWE-134
11-
@name Uncontrolled format string (CWE-134)
12-
+ semmlecode-cpp-queries/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql: /CWE/CWE-134
13-
@name Uncontrolled format string (through global variable) (CWE-134)
1+
# CWE-134: Uncontrolled Format String
2+
+ semmlecode-cpp-queries/Likely Bugs/Format/NonConstantFormat.ql: /CWE/CWE-134
3+
@name Non-constant format string (CWE-134)
4+
# This one runs out of memory. See ODASA-608.
5+
#+ semmlecode-cpp-queries/PointsTo/TaintedFormatStrings.ql: /CWE/CWE-134
6+
+ semmlecode-cpp-queries/Likely Bugs/Format/WrongNumberOfFormatArguments.ql: /CWE/CWE-134
7+
@name Wrong number of arguments to formatting function (CWE-134)
8+
+ semmlecode-cpp-queries/Likely Bugs/Format/WrongTypeFormatArguments.ql: /CWE/CWE-134
9+
@name Wrong type of arguments to formatting function (CWE-134)
10+
+ semmlecode-cpp-queries/Security/CWE/CWE-134/UncontrolledFormatString.ql: /CWE/CWE-134
11+
@name Uncontrolled format string (CWE-134)
12+
+ semmlecode-cpp-queries/Security/CWE/CWE-134/UncontrolledFormatStringThroughGlobalVar.ql: /CWE/CWE-134
13+
@name Uncontrolled format string (through global variable) (CWE-134)

‎cpp/ql/src/Architecture/Refactoring Opportunities/ClassesWithManyDependencies.cpp‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
1-
// an include declaration just adds one source dependency, it does not automatically
2-
// add a dependency from this file to all the declarations in stdio.h
3-
#include <stdio.h>
4-
#include <myfile.h> // contains non-static global myfile_err
5-
6-
extern int myfile_err; // this external declaration adds a dependency on myfile.h
7-
8-
class C {
9-
public:
10-
C() {
11-
// one dependency for printf:
12-
printf("Hello world!");
13-
// one dependency for FILE type, and one for NULL macro:
14-
FILE fp = NULL;
15-
}
16-
};
17-
1+
// an include declaration just adds one source dependency, it does not automatically
2+
// add a dependency from this file to all the declarations in stdio.h
3+
#include <stdio.h>
4+
#include <myfile.h> // contains non-static global myfile_err
5+
6+
extern int myfile_err; // this external declaration adds a dependency on myfile.h
7+
8+
class C {
9+
public:
10+
C() {
11+
// one dependency for printf:
12+
printf("Hello world!");
13+
// one dependency for FILE type, and one for NULL macro:
14+
FILE fp = NULL;
15+
}
16+
};
17+

0 commit comments

Comments
 (0)