Skip to content

Commit 9b17493

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into not-all-functions-throw
2 parents c734646 + 7ca0144 commit 9b17493

File tree

162 files changed

+4599
-712
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

162 files changed

+4599
-712
lines changed

‎config/identical-files.json‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -525,7 +525,8 @@
525525
"csharp/ql/lib/semmle/code/csharp/dataflow/internal/AccessPathSyntax.qll",
526526
"java/ql/lib/semmle/code/java/dataflow/internal/AccessPathSyntax.qll",
527527
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/AccessPathSyntax.qll",
528-
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll"
528+
"ruby/ql/lib/codeql/ruby/dataflow/internal/AccessPathSyntax.qll",
529+
"python/ql/lib/semmle/python/frameworks/data/internal/AccessPathSyntax.qll"
529530
],
530531
"IncompleteUrlSubstringSanitization": [
531532
"javascript/ql/src/Security/CWE-020/IncompleteUrlSubstringSanitization.qll",
@@ -543,7 +544,8 @@
543544
],
544545
"ApiGraphModels": [
545546
"javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModels.qll",
546-
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll"
547+
"ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll",
548+
"python/ql/lib/semmle/python/frameworks/data/internal/ApiGraphModels.qll"
547549
],
548550
"TaintedFormatStringQuery Ruby/JS": [
549551
"javascript/ql/lib/semmle/javascript/security/dataflow/TaintedFormatStringQuery.qll",

‎csharp/documentation/library-coverage/coverage.csv‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,27 @@
11
package,sink,source,summary,sink:code,sink:html,sink:remote,sink:sql,sink:xss,source:local,summary:taint,summary:value
22
Dapper,55,,,,,,55,,,,
3+
JsonToItemsTaskFactory,,,7,,,,,,,7,
34
Microsoft.ApplicationBlocks.Data,28,,,,,,28,,,,
5+
Microsoft.CSharp,,,24,,,,,,,24,
46
Microsoft.EntityFrameworkCore,6,,,,,,6,,,,
5-
Microsoft.Extensions.Primitives,,,54,,,,,,,54,
6-
Microsoft.VisualBasic,,,4,,,,,,,,4
7+
Microsoft.Extensions.Caching.Distributed,,,15,,,,,,,15,
8+
Microsoft.Extensions.Caching.Memory,,,46,,,,,,,45,1
9+
Microsoft.Extensions.Configuration,,,83,,,,,,,80,3
10+
Microsoft.Extensions.DependencyInjection,,,62,,,,,,,62,
11+
Microsoft.Extensions.DependencyModel,,,12,,,,,,,12,
12+
Microsoft.Extensions.FileProviders,,,15,,,,,,,15,
13+
Microsoft.Extensions.FileSystemGlobbing,,,15,,,,,,,13,2
14+
Microsoft.Extensions.Hosting,,,17,,,,,,,16,1
15+
Microsoft.Extensions.Http,,,10,,,,,,,10,
16+
Microsoft.Extensions.Logging,,,37,,,,,,,37,
17+
Microsoft.Extensions.Options,,,8,,,,,,,8,
18+
Microsoft.Extensions.Primitives,,,63,,,,,,,63,
19+
Microsoft.Interop,,,27,,,,,,,27,
20+
Microsoft.NET.Build.Tasks,,,1,,,,,,,1,
21+
Microsoft.NETCore.Platforms.BuildTasks,,,4,,,,,,,4,
22+
Microsoft.VisualBasic,,,9,,,,,,,5,4
23+
Microsoft.Win32,,,8,,,,,,,8,
724
MySql.Data.MySqlClient,48,,,,,,48,,,,
825
Newtonsoft.Json,,,91,,,,,,,73,18
926
ServiceStack,194,,7,27,,75,92,,,7,
10-
System,28,3,2336,,4,,23,1,3,611,1725
27+
System,28,3,12038,,4,,23,1,3,10096,1942

‎csharp/documentation/library-coverage/coverage.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ C# framework & library support
88

99
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
1010
`ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
11-
System,"``System.*``, ``System``",3,2336,28,5
12-
Others,"``Dapper``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Primitives``, ``Microsoft.VisualBasic``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``",,149,137,
13-
Totals,,3,2492,359,5
11+
System,"``System.*``, ``System``",3,12038,28,5
12+
Others,"``Dapper``, ``JsonToItemsTaskFactory``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.CSharp``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NETCore.Platforms.BuildTasks``, ``Microsoft.VisualBasic``, ``Microsoft.Win32``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``",,554,137,
13+
Totals,,3,12599,359,5
1414

‎docs/codeql/support/reusables/versions-compilers.rst‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,10 @@
2020
Java,"Java 7 to 18 [4]_","javac (OpenJDK and Oracle JDK),
2121

2222
Eclipse compiler for Java (ECJ) [5]_",``.java``
23-
JavaScript,ECMAScript 2021 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [6]_"
23+
JavaScript,ECMAScript 2022 or lower,Not applicable,"``.js``, ``.jsx``, ``.mjs``, ``.es``, ``.es6``, ``.htm``, ``.html``, ``.xhtm``, ``.xhtml``, ``.vue``, ``.hbs``, ``.ejs``, ``.njk``, ``.json``, ``.yaml``, ``.yml``, ``.raml``, ``.xml`` [6]_"
2424
Python,"2.7, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10",Not applicable,``.py``
2525
Ruby [7]_,"up to 3.0.2",Not applicable,"``.rb``, ``.erb``, ``.gemspec``, ``Gemfile``"
26-
TypeScript [8]_,"2.6-4.6",Standard TypeScript compiler,"``.ts``, ``.tsx``"
26+
TypeScript [8]_,"2.6-4.7",Standard TypeScript compiler,"``.ts``, ``.tsx``, ``.mts``, ``.cts``"
2727

2828
.. container:: footnote-group
2929

‎java/kotlin-extractor/src/main/kotlin/KotlinFileExtractor.kt‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ open class KotlinFileExtractor(
135135
Unit
136136
}
137137
is IrField -> {
138-
val parentId = useDeclarationParent(declaration.parent, false)?.cast<DbReftype>()
138+
val parentId = useDeclarationParent(getFieldParent(declaration), false)?.cast<DbReftype>()
139139
if (parentId != null) {
140140
extractField(declaration, parentId)
141141
}
@@ -759,7 +759,8 @@ open class KotlinFileExtractor(
759759
with("field", f) {
760760
DeclarationStackAdjuster(f).use {
761761
declarationStack.push(f)
762-
return extractField(useField(f), f.name.asString(), f.type, parentId, tw.getLocation(f), f.visibility, f, isExternalDeclaration(f), f.isFinal)
762+
val fNameSuffix = getExtensionReceiverType(f)?.let { it.classFqName?.asString()?.replace(".", "$$") } ?: ""
763+
return extractField(useField(f), "${f.name.asString()}$fNameSuffix", f.type, parentId, tw.getLocation(f), f.visibility, f, isExternalDeclaration(f), f.isFinal)
763764
}
764765
}
765766
}
@@ -829,10 +830,13 @@ open class KotlinFileExtractor(
829830
}
830831

831832
if (bf != null && extractBackingField) {
832-
val fieldId = extractField(bf, parentId)
833-
tw.writeKtPropertyBackingFields(id, fieldId)
834-
if (p.isDelegated) {
835-
tw.writeKtPropertyDelegates(id, fieldId)
833+
val fieldParentId = useDeclarationParent(getFieldParent(bf), false)
834+
if (fieldParentId != null) {
835+
val fieldId = extractField(bf, fieldParentId.cast())
836+
tw.writeKtPropertyBackingFields(id, fieldId)
837+
if (p.isDelegated) {
838+
tw.writeKtPropertyDelegates(id, fieldId)
839+
}
836840
}
837841
}
838842

‎java/kotlin-extractor/src/main/kotlin/KotlinUsesExtractor.kt‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import com.semmle.extractor.java.OdasaOutput
66
import org.jetbrains.kotlin.backend.common.extensions.IrPluginContext
77
import org.jetbrains.kotlin.backend.common.ir.allOverridden
88
import org.jetbrains.kotlin.backend.common.lower.parentsWithSelf
9+
import org.jetbrains.kotlin.backend.jvm.ir.getJvmNameFromAnnotation
910
import org.jetbrains.kotlin.backend.jvm.ir.propertyIfAccessor
1011
import org.jetbrains.kotlin.builtins.StandardNames
1112
import org.jetbrains.kotlin.descriptors.*
@@ -1269,9 +1270,34 @@ open class KotlinUsesExtractor(
12691270
fun useValueParameter(vp: IrValueParameter, parent: Label<out DbCallable>?): Label<out DbParam> =
12701271
tw.getLabelFor(getValueParameterLabel(vp, parent))
12711272

1273+
fun isDirectlyExposedCompanionObjectField(f: IrField) =
1274+
f.hasAnnotation(FqName("kotlin.jvm.JvmField")) ||
1275+
f.correspondingPropertySymbol?.owner?.let {
1276+
it.isConst || it.isLateinit
1277+
} ?: false
1278+
1279+
fun getFieldParent(f: IrField) =
1280+
f.parentClassOrNull?.let {
1281+
if (it.isCompanion && isDirectlyExposedCompanionObjectField(f))
1282+
it.parent
1283+
else
1284+
null
1285+
} ?: f.parent
1286+
1287+
// Gets a field's corresponding property's extension receiver type, if any
1288+
fun getExtensionReceiverType(f: IrField) =
1289+
f.correspondingPropertySymbol?.owner?.let {
1290+
(it.getter ?: it.setter)?.extensionReceiverParameter?.type
1291+
}
1292+
12721293
fun getFieldLabel(f: IrField): String {
1273-
val parentId = useDeclarationParent(f.parent, false)
1274-
return "@\"field;{$parentId};${f.name.asString()}\""
1294+
val parentId = useDeclarationParent(getFieldParent(f), false)
1295+
// Distinguish backing fields of properties based on their extension receiver type;
1296+
// otherwise two extension properties declared in the same enclosing context will get
1297+
// clashing trap labels. These are always private, so we can just make up a label without
1298+
// worrying about their names as seen from Java.
1299+
val extensionPropertyDiscriminator = getExtensionReceiverType(f)?.let { "extension;${useType(it)}" } ?: ""
1300+
return "@\"field;{$parentId};${extensionPropertyDiscriminator}${f.name.asString()}\""
12751301
}
12761302

12771303
fun useField(f: IrField): Label<out DbField> =

‎java/ql/src/utils/model-generator/CaptureSinkModels.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Capture sink models.
33
* @description Finds public methods that act as sinks as they flow into a a known sink.
4+
* @kind diagnostic
45
* @id java/utils/model-generator/sink-models
6+
* @tags model-generator
57
*/
68

79
private import internal.CaptureModels

‎java/ql/src/utils/model-generator/CaptureSourceModels.ql‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Capture source models.
33
* @description Finds APIs that act as sources as they expose already known sources.
4-
* @id java/utils/model-generator/sink-models
4+
* @kind diagnostic
5+
* @id java/utils/model-generator/source-models
6+
* @tags model-generator
57
*/
68

79
private import internal.CaptureModels

‎java/ql/src/utils/model-generator/CaptureSummaryModels.ql‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
/**
22
* @name Capture summary models.
33
* @description Finds applicable summary models to be used by other queries.
4+
* @kind diagnostic
45
* @id java/utils/model-generator/summary-models
6+
* @tags model-generator
57
*/
68

79
private import internal.CaptureModels

‎java/ql/test/kotlin/library-tests/clashing-extension-fields/test.expected‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
| |
2+
| <clinit> |
3+
| A |
4+
| B |
5+
| get |
6+
| getX |
7+
| invoke |
8+
| x$delegatepackagename$$subpackagename$$A |
9+
| x$delegatepackagename$$subpackagename$$B |

0 commit comments

Comments
 (0)