Merge branch 'master' into python-cwe-312

Author: markshannon

change-notes/1.23/analysis-csharp.md

@@ -0,0 +1,21 @@
+# Improvements to C# analysis
+
+The following changes in version 1.23 affect C# analysis in all applications.
+
+## Changes to existing queries
+
+| **Query**                    | **Expected impact**    | **Change**                        |
+|------------------------------|------------------------|-----------------------------------|
+
+## Removal of old queries
+
+## Changes to code extraction
+
+* `nameof` expressions are now extracted correctly when the name is a namespace.
+
+## Changes to QL libraries
+
+* The new class `NamespaceAccess` models accesses to namespaces, for example in `nameof` expressions.
+
+## Changes to autobuilder
+

cpp/ql/src/Likely Bugs/Leap Year/Adding365DaysPerYear.ql

@@ -1,6 +1,8 @@
 /**
- * @name Year field changed using an arithmetic operation is used on an unchecked time conversion function
- * @description A year field changed using an arithmetic operation is used on a time conversion function, but the return value of the function is not checked for success or failure.
+ * @name Arithmetic operation assumes 365 days per year
+ * @description When an arithmetic operation modifies a date by a constant
+ *              value of 365, it may be a sign that leap years are not taken
+ *              into account.
  * @kind problem
  * @problem.severity warning
  * @id cpp/leap-year/adding-365-days-per-year

cpp/ql/src/Likely Bugs/Leap Year/UncheckedReturnValueForTimeFunctions.ql

@@ -1,6 +1,8 @@
 /**
- * @name Year field changed using an arithmetic operation is used on an unchecked time conversion function
- * @description A year field changed using an arithmetic operation is used on a time conversion function, but the return value of the function is not checked for success or failure
+ * @name Unchecked return value for time conversion function
+ * @description When the return value of a fallible time conversion function is
+ *              not checked for failure, its output parameters may contain
+ *              invalid dates.
  * @kind problem
  * @problem.severity warning
  * @id cpp/leap-year/unchecked-return-value-for-time-conversion-function

cpp/ql/src/semmle/code/cpp/Enum.qll

@@ -2,11 +2,16 @@ import semmle.code.cpp.Type
 private import semmle.code.cpp.internal.ResolveClass
 
 /**
- * A C/C++ enum [N4140 7.2]. For example, the type `MyEnum` in:
+ * A C/C++ enum [N4140 7.2]. For example, the types `MyEnum` and
+ * `MyScopedEnum` in:
  * ```
  * enum MyEnum {
  *   MyEnumConstant
  * };
+ *
+ * enum class MyScopedEnum {
+ *   MyScopedEnumConstant
+ * };
  * ```
  * This includes C++ scoped enums, see the `ScopedEnum` QL class.
  */

cpp/ql/src/semmle/code/cpp/NameQualifiers.qll

@@ -1,7 +1,18 @@
 import cpp
 
 /**
- * A C++ name qualifier, for example `N::`.
+ * A C++ name qualifier, for example `N::` in the following code:
+ * ```
+ * namespace N {
+ *   int f() {
+ *     ...
+ *   }
+ * }
+ *
+ * int g() {
+ *   return N::f();
+ * }
+ * ```
  */
 class NameQualifier extends NameQualifiableElement, @namequalifier {
   /**
@@ -61,10 +72,21 @@ class NameQualifier extends NameQualifiableElement, @namequalifier {
 
 /**
  * A C++ element that can be qualified with a name. This is in practice
- * either an expression or a name qualifier. For instance, in
- * `N1::N2::f()`, there are two name-qualifiable elements: the expression
- * `f()` and the name qualifier `N2::`. The former is qualified by `N2` and
- * the latter is qualified by `N1`.
+ * either an expression or a name qualifier. For example, there are two
+ * name-qualifiable elements in the following code, the expression `f()`
+ * (which is qualified by `N::`), and the qualifier `N::` (which is not
+ * itself qualified in this example):
+ * ```
+ * namespace N {
+ *   int f() {
+ *     ...
+ *   }
+ * }
+ *
+ * int g() {
+ *   return N::f();
+ * }
+ * ```
  */
 class NameQualifiableElement extends Element, @namequalifiableelement {
   /**
@@ -99,8 +121,19 @@ class NameQualifiableElement extends Element, @namequalifiableelement {
 }
 
 /**
- * A C++ element that can qualify a name. For example, `N` in `N::f()`.  A
- * name-qualifying element is either a namespace or a user-defined type.
+ * A C++ element that can qualify a name. For example, the namespaces `A` and
+ * `A::B` and the class `A::C` in the following code:
+ * ```
+ * namespace A {
+ *   namespace B {
+ *     ...
+ *   }
+ * 
+ *   class C {
+ *     ...
+ *   };
+ * }
+ * ```
  */
 class NameQualifyingElement extends Element, @namequalifyingelement {
   /**

cpp/ql/src/semmle/code/cpp/exprs/Expr.qll

@@ -85,10 +85,32 @@ class Expr extends StmtParent, @expr {
   override string toString() { none() }
 
   /** Gets the value of this expression, if it is a constant. */
-  string getValue() { exists(@value v | values(v,result,_) and valuebind(v,underlyingElement(this))) }
+  string getValue() { exists(@value v | values(v,result) and valuebind(v,underlyingElement(this))) }
+
+  /** Gets the value text of this expression that's in the database. */
+  private string getDbValueText() {
+    exists(@value v | valuebind(v,underlyingElement(this)) and valuetext(v, result))
+  }
+
+  /**
+   * Gets the value text of `this`. If it doesn't have one, then instead
+   * gets the value text is `this`'s nearest compatible conversion, if any.
+   */
+  private string getValueTextFollowingConversions() {
+    if exists(this.getDbValueText())
+    then result = this.getDbValueText()
+    else exists(Expr e |
+                e = this.getConversion() and
+                e.getValue() = this.getValue() and
+                result = e.getValueTextFollowingConversions())
+  }
 
   /** Gets the source text for the value of this expression, if it is a constant. */
-  string getValueText() { exists(@value v | values(v,_,result) and valuebind(v,underlyingElement(this))) }
+  string getValueText() {
+    if exists(this.getValueTextFollowingConversions())
+    then result = this.getValueTextFollowingConversions()
+    else result = this.getValue()
+  }
 
   /** Holds if this expression has a value that can be determined at compile time. */
   cached

cpp/ql/src/semmlecode.cpp.dbscheme

@@ -1237,11 +1237,15 @@ expr_cond_false(
     int false: @expr ref
 );
 
-// the second field is a string representation of the value
-// the third field is the actual text in the source or the same as the second field
+/** A string representation of the value. */
 values(
     unique int id: @value,
-    string str: string ref,
+    string str: string ref
+);
+
+/** The actual text in the source code for the value, if any. */
+valuetext(
+    unique int id: @value ref,
     string text: string ref
 );