Skip to content

Commit 5ccc1a3

Browse files
raulgarciamsftraulgarciamsft
authored
Merge branch 'master' into master
2 parents 48c99fb + 69962bd commit 5ccc1a3

File tree

85 files changed

+4546
-164
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

85 files changed

+4546
-164
lines changed

‎.editorconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
1-
[*.{ql,qll,qlref,dbscheme,qhelp}]
1+
[*.{ql,qll,qlref,dbscheme,qhelp,html,js,mjs,ts,json,yml}]
22
end_of_line = lf

‎.gitattributes‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,9 @@
1515
*.qlref eol=lf
1616
*.dbscheme eol=lf
1717
*.qhelp eol=lf
18+
*.html eol=lf
19+
*.js eol=lf
20+
*.mjs eol=lf
21+
*.ts eol=lf
22+
*.json eol=lf
23+
*.yml eol=lf

‎.gitignore‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@
99
*/ql/test/**/*.testproj
1010
*/ql/test/**/*.actual
1111
/.vs/slnx.sqlite
12-
/.vs/ql3/v15/Browse.VC.opendb
13-
/.vs/ql3/v15/Browse.VC.db
12+
/.vs/ql/v15/Browse.VC.opendb
13+
/.vs/ql/v15/Browse.VC.db
1414
/.vs/ProjectSettings.json

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
/csharp/ @Semmle/cs
2+
/java/ @Semmle/java
23
/javascript/ @Semmle/js

‎change-notes/1.19/analysis-cpp.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Improvements to C/C++ analysis
2+
3+
## General improvements
4+
5+
## New queries
6+
7+
| **Query** | **Tags** | **Purpose** |
8+
|-----------------------------|-----------|--------------------------------------------------------------------|
9+
| *@name of query (Query ID)* | *Tags* |*Aim of the new query and whether it is enabled by default or not* |
10+
11+
## Changes to existing queries
12+
13+
| **Query** | **Expected impact** | **Change** |
14+
|----------------------------|------------------------|------------------------------------------------------------------|
15+
| *@name of query (Query ID)*| *Impact on results* | *How/why the query has changed* |
16+
17+
18+
## Changes to QL libraries
19+
20+
* Added a hash consing library for structural comparison of expressions.

‎change-notes/1.19/analysis-javascript.md‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,25 @@
22

33
## General improvements
44

5+
* Modelling of taint flow through array operations has been improved. This may give additional results for the security queries.
6+
7+
* Support for popular libraries has been improved. Consequently, queries may produce more results on code bases that use the following features:
8+
- file system access, for example through [fs-extra](https://github.com/jprichardson/node-fs-extra) or [globby](https://www.npmjs.com/package/globby)
9+
10+
511
## New queries
612

7-
| **Query** | **Tags** | **Purpose** |
8-
|-----------------------------|-----------|--------------------------------------------------------------------|
9-
| *@name of query (Query ID)* | *Tags* |*Aim of the new query and whether it is enabled by default or not* |
13+
| **Query** | **Tags** | **Purpose** |
14+
|-----------------------------------------------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
15+
| Enabling Node.js integration for Electron web content renderers (`js/enabling-electron-renderer-node-integration`) | security, frameworks/electron, external/cwe/cwe-094 | Highlights Electron web content renderer preferences with Node.js integration enabled, indicating a violation of [CWE-94](https://cwe.mitre.org/data/definitions/94.html). Results are not shown on LGTM by default. |
16+
| Stored cross-site scripting (`js/stored-xss`) | security, external/cwe/cwe-079, external/cwe/cwe-116 | Highlights uncontrolled stored values flowing into HTML content, indicating a violation of [CWE-079](https://cwe.mitre.org/data/definitions/79.html). Results shown on LGTM by default. |
1017

1118
## Changes to existing queries
1219

1320
| **Query** | **Expected impact** | **Change** |
1421
|--------------------------------|----------------------------|----------------------------------------------|
1522
| Regular expression injection | Fewer false-positive results | This rule now identifies calls to `String.prototype.search` with more precision. |
16-
23+
| Unbound event handler receiver | Fewer false-positive results | This rule now recognizes additional ways class methods can be bound. |
24+
| Remote property injection | Fewer results | The precision of this rule has been revised to "medium". Results are no longer shown on LGTM by default. |
1725

1826
## Changes to QL libraries

‎config/identical-files.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,5 +54,10 @@
5454
"C++ SSA SSAConstruction": [
5555
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/SSAConstruction.qll",
5656
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/SSAConstruction.qll"
57+
],
58+
"C++ IR ValueNumber": [
59+
"cpp/ql/src/semmle/code/cpp/ir/implementation/raw/gvn/ValueNumbering.qll",
60+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/gvn/ValueNumbering.qll",
61+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/gvn/ValueNumbering.qll"
5762
]
5863
}

‎cpp/ql/src/Security/CWE/CWE-119/OverflowBuffer.ql‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ from BufferAccess ba, string bufferDesc, int accessSize, int accessType,
2929
where accessSize = ba.getSize()
3030
and bufferSize = getBufferSize(ba.getBuffer(bufferDesc, accessType),
3131
bufferAlloc)
32-
and accessSize > bufferSize
32+
and (accessSize > bufferSize or (accessSize <= 0 and accessType = 3))
3333
and if accessType = 1 then (
3434
message = "This '" + ba.getName() + "' operation accesses "
3535
+ plural(accessSize, " byte", " bytes")
@@ -41,8 +41,13 @@ where accessSize = ba.getSize()
4141
+ " but the $@ is only "
4242
+ plural(bufferSize, " byte", " bytes") + "."
4343
) else (
44-
message = "This array indexing operation accesses byte offset "
45-
+ (accessSize - 1) + " but the $@ is only "
46-
+ plural(bufferSize, " byte", " bytes") + "."
44+
if accessSize > 0 then (
45+
message = "This array indexing operation accesses byte offset "
46+
+ (accessSize - 1) + " but the $@ is only "
47+
+ plural(bufferSize, " byte", " bytes") + "."
48+
) else (
49+
message = "This array indexing operation accesses a negative index "
50+
+ ((accessSize/ba.getActualType().getSize()) - 1) + " on the $@."
51+
)
4752
)
4853
select ba, message, bufferAlloc, bufferDesc

‎cpp/ql/src/filters/ImportAdditionalLibraries.ql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import semmle.code.cpp.dataflow.DataFlow2
1414
import semmle.code.cpp.dataflow.DataFlow3
1515
import semmle.code.cpp.dataflow.DataFlow4
1616
import semmle.code.cpp.dataflow.TaintTracking
17+
import semmle.code.cpp.valuenumbering.HashCons
1718

1819
from File f, string tag
1920
where none()

‎cpp/ql/src/semmle/code/cpp/ir/PrintIR.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
import implementation.aliased_ssa.PrintIR

0 commit comments

Comments
 (0)