Skip to content

Commit ef7984d

Browse files
author
Felicity Chapman
authored
Merge pull request #1842 from jf205/add-java-slides/sd-3762
docs: add rst versions of java training slides
2 parents cdcc716 + 64c4548 commit ef7984d

32 files changed

+1440
-421
lines changed

‎docs/language/ql-training-rst/_static-training/java-data-flow-code-example.svg‎

Lines changed: 1 addition & 0 deletions
Loading

‎docs/language/ql-training-rst/_static-training/java-expression-ast.svg‎

Lines changed: 1 addition & 0 deletions
Loading

‎docs/language/ql-training-rst/_static-training/mismatched-calls-and-returns.svg‎

Lines changed: 1 addition & 0 deletions
Loading

‎docs/language/ql-training-rst/_static-training/slides-semmle-2/layout.html‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@
134134
{% endblock %}
135135
</head>
136136
<body style="opacity: 0">
137-
<div class="wrapper" id="wrapper">
137+
138138
<slides class="layout-widescreen" id="slides">
139139

140140
<!-- {% include "title_slide.html" %} -->
@@ -146,7 +146,7 @@
146146
<slide class="backdrop"></slide>
147147

148148
</slides>
149-
</div>
149+
150150

151151

152152
<!--[if IE]>

‎docs/language/ql-training-rst/_static-training/slides-semmle-2/static/theme/css/default.css‎

Lines changed: 51 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -285,7 +285,8 @@ slides > slide.current .gdbar {
285285
}
286286
/* line 112, ../scss/default.scss */
287287
slides > slide.next {
288-
display: block;
288+
/*display: block;*/
289+
display: none;
289290
opacity: 0;
290291
pointer-events: none;
291292
}
@@ -407,7 +408,7 @@ slides.layout-faux-widescreen > slide.current {
407408
/* line 238, ../scss/default.scss */
408409
slides.layout-widescreen > slide.next,
409410
slides.layout-faux-widescreen > slide.next {
410-
display: block;
411+
/*display: block;*/
411412
opacity: 0;
412413
pointer-events: none;
413414
}
@@ -744,11 +745,7 @@ table tr:nth-child(odd) {
744745
table th {
745746
color: white;
746747
font-size: 1em;
747-
background: url('data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4gPHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJncmFkIiBncmFkaWVudFVuaXRzPSJvYmplY3RCb3VuZGluZ0JveCIgeDE9IjAuNSIgeTE9IjAuMCIgeDI9IjAuNSIgeTI9IjEuMCI+PHN0b3Agb2Zmc2V0PSI0MCUiIHN0b3AtY29sb3I9IiM0Mzg3ZmQiLz48c3RvcCBvZmZzZXQ9IjgwJSIgc3RvcC1jb2xvcj0iIzJhN2NkZiIvPjwvbGluZWFyR3JhZGllbnQ+PC9kZWZzPjxyZWN0IHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAlIiBoZWlnaHQ9IjEwMCUiIGZpbGw9InVybCgjZ3JhZCkiIC8+PC9zdmc+IA==') no-repeat;
748-
background: -webkit-gradient(linear, 50% 0%, 50% 100%, color-stop(40%, #4387fd), color-stop(80%, #2a7cdf)) no-repeat;
749-
background: -moz-linear-gradient(top, #4387fd 40%, #2a7cdf 80%) no-repeat;
750-
background: -webkit-linear-gradient(top, #4387fd 40%, #2a7cdf 80%) no-repeat;
751-
background: linear-gradient(to bottom, #4387fd 40%, #2a7cdf 80%) no-repeat;
748+
background: grey;
752749
}
753750
/* line 494, ../scss/default.scss */
754751
table td, table th {
@@ -758,17 +755,16 @@ table td, table th {
758755
/* line 499, ../scss/default.scss */
759756
table td.highlight {
760757
color: #515151;
761-
background: url('data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4gPHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PGRlZnM+PGxpbmVhckdyYWRpZW50IGlkPSJncmFkIiBncmFkaWVudFVuaXRzPSJvYmplY3RCb3VuZGluZ0JveCIgeDE9IjAuNSIgeTE9IjAuMCIgeDI9IjAuNSIgeTI9IjEuMCI+PHN0b3Agb2Zmc2V0PSI0MCUiIHN0b3AtY29sb3I9IiNmZmQxNGQiLz48c3RvcCBvZmZzZXQ9IjgwJSIgc3RvcC1jb2xvcj0iI2Y2YzAwMCIvPjwvbGluZWFyR3JhZGllbnQ+PC9kZWZzPjxyZWN0IHg9IjAiIHk9IjAiIHdpZHRoPSIxMDAlIiBoZWlnaHQ9IjEwMCUiIGZpbGw9InVybCgjZ3JhZCkiIC8+PC9zdmc+IA==') no-repeat;
762-
background: -webkit-gradient(linear, 50% 0%, 50% 100%, color-stop(40%, #ffd14d), color-stop(80%, #f6c000)) no-repeat;
763-
background: -moz-linear-gradient(top, #ffd14d 40%, #f6c000 80%) no-repeat;
764-
background: -webkit-linear-gradient(top, #ffd14d 40%, #f6c000 80%) no-repeat;
765-
background: linear-gradient(to bottom, #ffd14d 40%, #f6c000 80%) no-repeat;
758+
background: grey;
766759
}
767760
/* line 504, ../scss/default.scss */
768761
table.rows {
769762
border-bottom: none;
770763
border-right: 1px solid #797979;
771764
}
765+
table td {
766+
background: white;
767+
}
772768

773769
/* line 510, ../scss/default.scss */
774770
q {
@@ -1013,18 +1009,24 @@ article.smaller q:before, article.smaller q:after {
10131009
background-image: -webkit-radial-gradient(50% 50%, #b1dfff 0%, #4387fd 600px);
10141010
background-image: radial-gradient(50% 50%, #b1dfff 0%, #4387fd 600px);
10151011
}
1012+
1013+
/* the popup class is used to display the speaker notes when 'presenter' view
1014+
is enabled. This view is not currently optimal, so certain selectors have been commented-out,
1015+
with a view to improving the styles at a later date */
1016+
1017+
10161018
/* line 684, ../scss/default.scss */
1017-
.with-notes.popup slide.next {
1019+
/*.with-notes.popup slide.next {
10181020
-moz-transform: translate3d(570px, 80px, 0) scale(0.35);
10191021
-ms-transform: translate3d(570px, 80px, 0) scale(0.35);
10201022
-webkit-transform: translate3d(570px, 80px, 0) scale(0.35);
10211023
transform: translate3d(570px, 80px, 0) scale(0.35);
10221024
opacity: 1 !important;
1023-
}
1025+
}*/
10241026
/* line 688, ../scss/default.scss */
1025-
.with-notes.popup slide.next .note {
1027+
/*.with-notes.popup slide.next .note {
10261028
display: none !important;
1027-
}
1029+
}*/
10281030
/* line 694, ../scss/default.scss */
10291031
.with-notes.popup .note {
10301032
width: 109%;
@@ -1168,7 +1170,7 @@ article.smaller q:before, article.smaller q:after {
11681170

11691171
/* Clickable/tappable areas */
11701172
/* line 773, ../scss/default.scss */
1171-
.slide-area {
1173+
/*.slide-area {
11721174
z-index: 1000;
11731175
position: absolute;
11741176
left: 0;
@@ -1179,7 +1181,7 @@ article.smaller q:before, article.smaller q:after {
11791181
top: 50%;
11801182
cursor: pointer;
11811183
margin-top: -350px;
1182-
}
1184+
}*/
11831185

11841186
/* line 790, ../scss/default.scss */
11851187
#prev-slide-area {
@@ -1469,6 +1471,15 @@ hgroup .pre {
14691471
color: white;
14701472
}
14711473

1474+
.subheading {
1475+
position: absolute;
1476+
top: 62.5%;
1477+
}
1478+
1479+
.subheading p {
1480+
position: relative;
1481+
}
1482+
14721483
/* purple background slides (new section)*/
14731484

14741485
.background2 {
@@ -1593,7 +1604,7 @@ p.first.admonition-title {
15931604
width: inherit;
15941605
}
15951606

1596-
/* images */
1607+
/********* images ************/
15971608
/* general styles to scale and centre images*/
15981609

15991610
.image-box {
@@ -1606,7 +1617,7 @@ img {
16061617
margin: auto;
16071618
}
16081619

1609-
/* deck-specific styles for individual images*/
1620+
/********* deck-specific styles for individual images *********/
16101621
/* intro to ql */
16111622
img.analysis {
16121623
width: 90%;
@@ -1619,6 +1630,26 @@ img.analysis {
16191630
right: -10%;
16201631
}
16211632

1633+
.java-expression-ast {
1634+
background-image: url("../../java-expression-ast.svg");
1635+
background-size: cover;
1636+
}
1637+
1638+
/* java data flow code example */
1639+
1640+
.java-data-flow-code-example {
1641+
background-image: url("../../java-data-flow-code-example.svg");
1642+
background-size: cover;
1643+
}
1644+
1645+
/* extra global data flow slies*/
1646+
1647+
.mismatched-calls-and-returns {
1648+
background-image: url("../../mismatched-calls-and-returns.svg");
1649+
background-size: cover;
1650+
}
1651+
1652+
/******* Other custom styles *******/
16221653
/* custom styles for lists*/
16231654

16241655
ol {

‎docs/language/ql-training-rst/cpp/bad-overflow-guard.rst‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,11 @@ For this example you should download:
2424

2525
You can query the project in `the query console <https://lgtm.com/query/project:2034240708/lang:cpp/>`__ on LGTM.com.
2626

27-
Note that results generated in the query console are likely to differ to those generated in the QL plugin as LGTM.com analyzes the most recent revisions of each project that has been added–the snapshot available to download above is based on an historical version of the code base.
27+
.. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
28+
29+
.. include:: ../slide-snippets/snapshot-note.rst
30+
31+
.. resume slides
2832
2933
Checking for overflow in C
3034
==========================

‎docs/language/ql-training-rst/cpp/control-flow-cpp.rst‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,11 @@ For this example you should download:
2626

2727
You can query the project in `the query console <https://lgtm.com/query/project:2034240708/lang:cpp/>`__ on LGTM.com.
2828

29-
Note that results generated in the query console are likely to differ to those generated in the QL plugin as LGTM.com analyzes the most recent revisions of each project that has been added–the snapshot available to download above is based on an historical version of the code base.
29+
.. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
30+
31+
.. include:: ../slide-snippets/snapshot-note.rst
32+
33+
.. resume slides
3034
3135
3236
.. rst-class:: agenda

‎docs/language/ql-training-rst/cpp/data-flow-cpp.rst‎

Lines changed: 9 additions & 156 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,11 @@ For this example you should download:
2424

2525
You can query the project in `the query console <https://lgtm.com/query/projects:1505958977333/lang:cpp/>`__ on LGTM.com.
2626

27-
Note that results generated in the query console are likely to differ to those generated in the QL plugin as LGTM.com analyzes the most recent revisions of each project that has been added–the snapshot available to download above is based on an historical version of the code base.
27+
.. insert snapshot-note.rst to explain differences between snapshot available to download and the version available in the query console.
28+
29+
.. include:: ../slide-snippets/snapshot-note.rst
30+
31+
.. resume slides
2832
2933
.. rst-class:: agenda
3034

@@ -114,162 +118,11 @@ We need something better.
114118

115119
What we need is a way to determine whether the format argument is ever set to something that is not constant.
116120

117-
Data flow analysis
118-
==================
119-
120-
- Models flow of data through the program.
121-
- Implemented in the module ``semmle.code.cpp.dataflow.DataFlow``.
122-
- Class ``DataFlow::Node`` represents program elements that have a value, such as expressions and function parameters.
123-
124-
- Nodes of the data flow graph.
125-
126-
- Various predicated represent flow between these nodes.
127-
128-
- Edges of the data flow graph.
129-
130-
.. note::
131-
132-
The solution here is to use *data flow*. Data flow is, as the name suggests, about tracking the flow of data through the program. It helps answers questions like: *does this expression ever hold a value that originates from a particular other place in the program*?
133-
134-
We can visualize the data flow problem as one of finding paths through a directed graph, where the nodes of the graph are elements in the program, and the edges represent the flow of data between those elements. If a path exists, then the data flows between those two edges.
135-
136-
Data flow graphs
137-
================
138-
139-
.. container:: column-left
140-
141-
Example:
142-
143-
.. code-block:: cpp
144-
145-
int func(int, tainted) {
146-
int x = tainted;
147-
if (someCondition) {
148-
int y = x;
149-
callFoo(y);
150-
} else {
151-
return x;
152-
}
153-
return -1;
154-
}
155-
156-
.. container:: column-right
157-
158-
Data flow graph:
159-
160-
.. graphviz::
161-
162-
digraph {
163-
graph [ dpi = 1000 ]
164-
node [shape=polygon,sides=4,color=blue4,style="filled,rounded", fontname=consolas,fontcolor=white]
165-
a [label=<tainted<BR /><FONT POINT-SIZE="10">ParameterNode</FONT>>]
166-
b [label=<tainted<BR /><FONT POINT-SIZE="10">ExprNode</FONT>>]
167-
c [label=<x<BR /><FONT POINT-SIZE="10">ExprNode</FONT>>]
168-
d [label=<x<BR /><FONT POINT-SIZE="10">ExprNode</FONT>>]
169-
e [label=<y<BR /><FONT POINT-SIZE="10">ExprNode</FONT>>]
170-
171-
a -> b
172-
b -> {c, d}
173-
c -> e
174-
175-
}
176-
177-
Local vs global data flow
178-
=========================
179-
180-
- Local (“intra-procedural”) data flow models flow within one function; feasible to compute for all functions in a snapshot
181-
- Global (“inter-procedural”) data flow models flow across function calls; not feasible to compute for all functions in a snapshot
182-
- Different APIs, so discussed separately
183-
- This slide deck focuses on the former.
184-
185-
.. note::
186-
187-
For further information, see:
188-
189-
- `Introduction to data flow analysis in QL <https://help.semmle.com/QL/learn-ql/ql/intro-to-data-flow.html>`__
190-
- `Analyzing data flow in C/C++ <https://help.semmle.com/QL/learn-ql/ql/cpp/dataflow.html>`__
191-
192-
.. rst-class:: background2
193-
194-
Local data flow
195-
===============
196-
197-
Importing data flow
198-
===================
199-
200-
To use the data flow library, add the following import:
201-
202-
.. code-block:: ql
203-
204-
import semmle.code.cpp.dataflow.DataFlow
205-
206-
**Note**: this library contains an explicit “module” declaration:
207-
208-
.. code-block:: ql
209-
210-
module DataFlow {
211-
class Node extends ... { ... }
212-
predicate localFlow(Node source, Node sink) {
213-
localFlowStep*(source, sink)
214-
}
215-
...
216-
}
217-
218-
So all references will need to be qualified (that is, ``DataFlow::Node``)
219-
220-
.. note::
221-
222-
A **query library** is file with the extension ``.qll``. Query libraries do not contain a query clause, but may contain modules, classes, and predicates. For example, the `C/C++ data flow library <https://help.semmle.com/qldoc/cpp/semmle/code/cpp/dataflow/DataFlow.qll/module.DataFlow.html>`__ is contained in the ``semmle/code/cpp/dataflow/DataFlow.qll`` QLL file, and can be imported as shown above.
223-
224-
A **module** is a way of organizing QL code by grouping together related predicates, classes, and (sub-)modules. They can be either explicitly declared or implicit. A query library implicitly declares a module with the same name as the QLL file.
225-
226-
For further information on libraries and modules in QL, see the chapter on `Modules <https://help.semmle.com/QL/ql-handbook/modules.html>`__ in the QL language handbook.
227-
228-
For further information on importing QL libraries and modules, see the chapter on `Name resolution <https://help.semmle.com/QL/ql-handbook/name-resolution.html>`__ in the QL language handbook.
229-
230-
Data flow graph
231-
===============
232-
233-
- Class ``DataFlow::Node`` represents data flow graph nodes
234-
- Predicate ``DataFlow::localFlowStep`` represents local data flow graph edges, ``DataFlow::localFlow`` is its transitive closure
235-
- Data flow graph nodes are *not* AST nodes, but they correspond to AST nodes, and there are predicates for mapping between them:
236-
237-
- ``Expr Node.asExpr()``
238-
- ``Parameter Node.asParameter()``
239-
- ``DataFlow::Node DataFlow::exprNode(Expr e)``
240-
- ``DataFlow::Node DataFlow::parameterNode(Parameter p)``
241-
- ``etc.``
242-
243-
.. note::
244-
245-
The ``DataFlow::Node`` class is shared between both the local and global data flow graphs–the primary difference is the edges, which in the “global” case can link different functions.
246-
247-
``localFlowStep`` is the “single step” flow relation–that is, it describes single edges in the local data flow graph. ``localFlow`` represents the `transitive <https://help.semmle.com/QL/ql-handbook/recursion.html#transitive-closures>`__ closure of this relation–in other words, it contains every pair of nodes where the second node is reachable from the first in the data flow graph.
248-
249-
The data flow graph is separate from the `AST <https://en.wikipedia.org/wiki/Abstract_syntax_tree>`__, to allow for flexibility in how data flow is modeled. There are a small number of data flow node types–expression nodes, parameter nodes, uninitialized variable nodes, and definition by reference nodes. Each node provides mapping functions to and from the relevant AST (for example ``Expr``, ``Parameter`` etc.) or symbol table (for example ``Variable``) classes.
250-
251-
Taint tracking
252-
==============
253-
254-
- Usually, we want to generalise slightly by not only considering plain data flow, but also “taint” propagation, that is, whether a value is influenced by or derived from another.
255-
256-
- Examples:
257-
258-
.. code-block:: cpp
259-
260-
sink = source; // source -> sink: data and taint
261-
strcat(sink, source); // source -> sink: taint, not data
262-
263-
- Library ``semmle.code.cpp.dataflow.TaintTracking`` provides predicates for tracking taint:
264-
265-
- ``TaintTracking::localTaintStep`` represents one (local) taint step
266-
- ``TaintTracking::localTaint`` is its transitive closure.
267-
268-
.. note::
121+
.. include general data flow slides
269122
270-
Taint tracking can be thought of as another type of data flow graph. It usually extends the standard data flow graph for a problem by adding edges between nodes where one one node influences or *taints* another.
123+
.. include:: ../slide-snippets/local-data-flow.rst
271124

272-
The `API <https://help.semmle.com/qldoc/cpp/semmle/code/cpp/dataflow/TaintTracking.qll/module.TaintTracking.html>`__ is almost identical to that of the local data flow. All we need to do to switch to taint tracking is ``import semmle.code.cpp.dataflow.TaintTracking`` instead of ``semmle.code.cpp.dataflow.DataFlow``, and instead of using ``localFlow``, we use ``localTaint``.
125+
.. resume language-specific slides
273126
274127
Exercise: source nodes
275128
======================
@@ -343,4 +196,4 @@ Beyond local data flow
343196
- Results are still underwhelming.
344197
- Dealing with parameter passing becomes cumbersome.
345198
- Instead, let’s turn the problem around and find user-controlled data that flows into a ``printf`` format argument, potentially through calls.
346-
- This needs :doc:`global data flow <global-data-flow-cpp>`.
199+
- This needs :doc:`global data flow <global-data-flow-cpp>`.

0 commit comments

Comments
 (0)