Skip to content

Commit d51e521

Browse files
jbjjbj
committed
Merge remote-tracking branch 'upstream/master' into dataflow-TTwo
Conflicts: cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl4.qll cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImplLocal.qll cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl.qll cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl2.qll cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl3.qll cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowImpl4.qll cpp/ql/test/library-tests/dataflow/fields/flow.expected csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl.qll csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl2.qll csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl3.qll csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl4.qll csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImpl5.qll java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl.qll java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl2.qll java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll
2 parents 9c9b7ac + 9eebe00 commit d51e521

File tree

428 files changed

+8095
-2364
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

428 files changed

+8095
-2364
lines changed

‎change-notes/1.23/analysis-cpp.md‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,16 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
88

99
| **Query** | **Tags** | **Purpose** |
1010
|-----------------------------|-----------|--------------------------------------------------------------------|
11-
| Query name (`query id`) | tags | Message. |
11+
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | reliability, japanese-era | This query is a combination of two old queries that were identical in purpose but separate as an implementation detail. This new query replaces Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) and Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`). |
1212

1313
## Changes to existing queries
1414

1515
| **Query** | **Expected impact** | **Change** |
1616
|----------------------------|------------------------|------------------------------------------------------------------|
1717
| Query name (`query id`) | Expected impact | Message. |
18+
| Hard-coded Japanese era start date in call (`cpp/japanese-era/constructor-or-method-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
19+
| Hard-coded Japanese era start date in struct (`cpp/japanese-era/struct-with-exact-era-date`) | Deprecated | This query has been deprecated. Use the new combined query Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) instead. |
20+
| Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`) | More correct results | This query now checks for the beginning date of the Reiwa era (1st May 2019). |
1821

1922
## Changes to QL libraries
2023

@@ -25,3 +28,10 @@ The following changes in version 1.23 affect C/C++ analysis in all applications.
2528
picture of the partial flow paths from a given source. The feature is
2629
disabled by default and can be enabled for individual configurations by
2730
overriding `int explorationLimit()`.
31+
* The `DataFlow::DefinitionByReferenceNode` class now considers `f(x)` to be a
32+
definition of `x` when `x` is a variable of pointer type. It no longer
33+
considers deep paths such as `f(&x.myField)` to be definitions of `x`. These
34+
changes are in line with the user expectations we've observed.
35+
* There is now a `DataFlow::localExprFlow` predicate and a
36+
`TaintTracking::localExprTaint` predicate to make it easy to use the most
37+
common case of local data flow and taint: from one `Expr` to another.

‎change-notes/1.23/analysis-javascript.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
| **Query** | **Expected impact** | **Change** |
1919
|--------------------------------|------------------------------|---------------------------------------------------------------------------|
2020
| Client-side cross-site scripting (`js/xss`) | More results | More potential vulnerabilities involving functions that manipulate DOM attributes are now recognized. |
21+
| Prototype pollution (`js/prototype-pollution`) | More results | The query now highlights vulnerable uses of jQuery and Angular, and the results are shown on LGTM by default. |
2122

2223
## Changes to QL libraries
2324

‎change-notes/1.23/extractor-javascript.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
[[ condition: enterprise-only ]]
2+
3+
# Improvements to JavaScript analysis
4+
5+
## Changes to code extraction
6+
7+
* Asynchronous generator methods are now parsed correctly and no longer cause a spurious syntax error.

‎cpp/ql/src/Best Practices/Magic Constants/JapaneseEraDate.qhelp‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
<overview>
6+
<p>
7+
When eras change, date and time conversions that rely on a hard-coded era start date need to be reviewed. Conversions relying on Japanese dates in the current era can produce an ambiguous date.
8+
The values for the current Japanese era dates should be read from a source that will be updated, such as the Windows registry.
9+
</p>
10+
</overview>
11+
12+
<references>
13+
<li>
14+
<a href="https://blogs.msdn.microsoft.com/shawnste/2018/04/12/the-japanese-calendars-y2k-moment/">The Japanese Calendar's Y2K Moment</a>.
15+
</li>
16+
</references>
17+
</qhelp>

‎cpp/ql/src/Best Practices/Magic Constants/JapaneseEraDate.ql‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/**
2+
* @name Hard-coded Japanese era start date
3+
* @description Japanese era changes can lead to code behaving differently. Avoid hard-coding Japanese era start dates.
4+
* @kind problem
5+
* @problem.severity warning
6+
* @id cpp/japanese-era/exact-era-date
7+
* @precision medium
8+
* @tags reliability
9+
* japanese-era
10+
*/
11+
12+
import cpp
13+
import semmle.code.cpp.commons.DateTime
14+
15+
predicate assignedYear(Struct s, YearFieldAccess year, int value) {
16+
exists(Operation yearAssignment |
17+
s.getAField().getAnAccess() = year and
18+
yearAssignment.getAnOperand() = year and
19+
yearAssignment.getAnOperand().getValue().toInt() = value
20+
)
21+
}
22+
23+
predicate assignedMonth(Struct s, MonthFieldAccess month, int value) {
24+
exists(Operation monthAssignment |
25+
s.getAField().getAnAccess() = month and
26+
monthAssignment.getAnOperand() = month and
27+
monthAssignment.getAnOperand().getValue().toInt() = value
28+
)
29+
}
30+
31+
predicate assignedDay(Struct s, DayFieldAccess day, int value) {
32+
exists(Operation dayAssignment |
33+
s.getAField().getAnAccess() = day and
34+
dayAssignment.getAnOperand() = day and
35+
dayAssignment.getAnOperand().getValue().toInt() = value
36+
)
37+
}
38+
39+
predicate eraDate(int year, int month, int day) {
40+
year = 1989 and month = 1 and day = 8
41+
or
42+
year = 2019 and month = 5 and day = 1
43+
}
44+
45+
46+
predicate badStructInitialization(Element target, string message) {
47+
exists(
48+
StructLikeClass s, YearFieldAccess year, MonthFieldAccess month, DayFieldAccess day,
49+
int yearValue, int monthValue, int dayValue
50+
|
51+
eraDate(yearValue, monthValue, dayValue) and
52+
assignedYear(s, year, yearValue) and
53+
assignedMonth(s, month, monthValue) and
54+
assignedDay(s, day, dayValue) and
55+
target = year and
56+
message = "A time struct that is initialized with exact Japanese calendar era start date."
57+
)
58+
}
59+
60+
predicate badCall(Element target, string message) {
61+
exists(Call cc, int i |
62+
eraDate(cc.getArgument(i).getValue().toInt(), cc.getArgument(i + 1).getValue().toInt(),
63+
cc.getArgument(i + 2).getValue().toInt()) and
64+
target = cc and
65+
message = "Call that appears to have hard-coded Japanese era start date as parameter."
66+
)
67+
}
68+
69+
from Element target, string message
70+
where
71+
badStructInitialization(target, message) or
72+
badCall(target, message)
73+
select target, message

‎cpp/ql/src/Critical/NewDelete.qll‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ predicate allocExprOrIndirect(Expr alloc, string kind) {
4747
or
4848
exists(Expr e |
4949
allocExprOrIndirect(e, kind) and
50-
DataFlow::localFlow(DataFlow::exprNode(e), DataFlow::exprNode(rtn.getExpr()))
50+
DataFlow::localExprFlow(e, rtn.getExpr())
5151
)
5252
)
5353
)

‎cpp/ql/src/Critical/OverflowStatic.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ class CallWithBufferSize extends FunctionCall {
9595

9696
int statedSizeValue() {
9797
exists(Expr statedSizeSrc |
98-
DataFlow::localFlow(DataFlow::exprNode(statedSizeSrc), DataFlow::exprNode(statedSizeExpr())) and
98+
DataFlow::localExprFlow(statedSizeSrc, statedSizeExpr()) and
9999
result = statedSizeSrc.getValue().toInt()
100100
)
101101
}

‎cpp/ql/src/Likely Bugs/Conversion/LossyFunctionResultCast.ql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ predicate whiteListWrapped(FunctionCall fc) {
5555
whitelistPow(fc) or
5656
exists(Expr e, ReturnStmt rs |
5757
whiteListWrapped(e) and
58-
DataFlow::localFlow(DataFlow::exprNode(e), DataFlow::exprNode(rs.getExpr())) and
58+
DataFlow::localExprFlow(e, rs.getExpr()) and
5959
fc.getTarget() = rs.getEnclosingFunction()
6060
)
6161
}

‎cpp/ql/src/Likely Bugs/JapaneseEra/ConstructorOrMethodWithExactEraDate.ql‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
/**
2-
* @name Hard-coded Japanese era start date
2+
* @name Hard-coded Japanese era start date in call
33
* @description Japanese era changes can lead to code behaving differently. Avoid hard-coding Japanese era start dates.
44
* @kind problem
55
* @problem.severity warning
66
* @id cpp/japanese-era/constructor-or-method-with-exact-era-date
77
* @precision medium
88
* @tags reliability
99
* japanese-era
10+
* @deprecated This query is deprecated, use
11+
* Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`)
12+
* instead.
1013
*/
1114

1215
import cpp

‎cpp/ql/src/Likely Bugs/JapaneseEra/StructWithExactEraDate.ql‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
/**
2-
* @name Hard-coded Japanese era start date
2+
* @name Hard-coded Japanese era start date in struct
33
* @description Japanese era changes can lead to code behaving differently. Avoid hard-coding Japanese era start dates.
44
* @kind problem
55
* @problem.severity warning
66
* @id cpp/japanese-era/struct-with-exact-era-date
77
* @precision medium
88
* @tags reliability
99
* japanese-era
10+
* @deprecated This query is deprecated, use
11+
* Hard-coded Japanese era start date (`cpp/japanese-era/exact-era-date`)
12+
* instead.
1013
*/
1114

1215
import cpp

0 commit comments

Comments
 (0)