Граф коммитов

10679 Коммитов

Автор SHA1 Сообщение Дата
Pavel Avgustinov 4e3616eaf1
Merge pull request #97 from shati-semmle/ql-style-guide
QL style guide: Small fixes
2018-08-29 16:18:15 +01:00
semmle-qlci d22a65a66b
Merge pull request #108 from esben-semmle/js/classify-generated-data-files
Approved by xiemaisi
2018-08-29 14:15:55 +01:00
Jonas Jensen 4cc27459ca C++: Remove redundant charpred on Element 2018-08-29 14:09:04 +02:00
Jonas Jensen 8b9e4e347c C++: Introduce ElementBase class
By extending this class, a class can define its own `getLocation`
predicate without participating in the dispatch hierarchy of
`getLocation` as defined on `Element`. Classes wanting to override their
location previously had to define `getURL` or `hasLocationInfo` instead
and rely on these predicates not being defined on future versions of
`Element`.
2018-08-29 13:21:10 +02:00
shati-semmle be254ef39a Update analysis-csharp.md 2018-08-29 11:06:27 +01:00
Jonas Jensen 418a16772b
Merge pull request #105 from geoffw0/samate-crement
CPP: Support crement operations in CWE-190
2018-08-29 09:03:29 +02:00
Ole Herman Schumacher Elgesem 00c552fe2f
Fixed error in gmtime example
gmtime and gmtime_r take a time_t pointer, so have to store the value
of time(NULL) on the stack.

Signed-off-by: Ole Herman Schumacher Elgesem <oleherman93@gmail.com>
2018-08-28 11:10:11 -07:00
Geoffrey White 0d6373924c CPP: De-conflate cause and effect strings. 2018-08-28 16:39:10 +01:00
Geoffrey White c82ab3866f CPP: Extend change note. 2018-08-28 16:39:10 +01:00
Geoffrey White 229d0406bb CPP: Add support for += and -=. 2018-08-28 16:39:10 +01:00
Geoffrey White 0bd8d9a113 CPP: Spell out increment / decrement in change note. 2018-08-28 16:39:10 +01:00
Geoffrey White eaf4c6e319 CPP: Change notes. 2018-08-28 16:39:10 +01:00
Geoffrey White 87fb447c4b CPP: Improve the logic in ArithmeticWithExtremeValues.ql. 2018-08-28 16:39:10 +01:00
Geoffrey White a125e3ed86 CPP: Fix crement operations on pointers. 2018-08-28 16:39:09 +01:00
Geoffrey White d2fd986f40 CPP: Support crement operations in CWE-190. 2018-08-28 16:39:09 +01:00
ian-semmle 1d202dd7cd
Merge pull request #24 from nickrolfe/declspec_guard
C++: test for __declspec(guard(...))
2018-08-28 16:15:08 +01:00
Jonas Jensen 24567c57db
Merge pull request #109 from dave-bartolomeo/dave/Call
C++: `Invoke` -> `Call`
2018-08-28 15:28:22 +02:00
Jonas Jensen f88dc37218
Merge pull request #99 from aschackmull/java/fieldflow-perf
Java/C: Improve performance when multiple configs use field flow.
2018-08-28 15:27:29 +02:00
Jonas Jensen 4536d75b2f
Merge pull request #93 from ian-semmle/underlyingElement
C++: Add a missing underlyingElement call
2018-08-28 15:24:16 +02:00
Jonas Jensen ea26ac8c22 C++: Remove unneeded CPython toString overrides
These were made redundant when a1e44041e changed their parent class to
extend `Element`.
2018-08-28 14:58:39 +02:00
Jonas Jensen 38fe45ef32 C++: Don't use dbtypes in Declaration.qll 2018-08-28 14:58:39 +02:00
Jonas Jensen 01dc4385cd C++: Don't use dbtypes in TaintTracking.qll 2018-08-28 14:58:39 +02:00
Jonas Jensen 854d0db552 C++: Don't use dbtypes in ClassesWithManyFields.ql
This changes the test output because `VariableDeclarationGroup.toString`
changes to be the one inherited from VariableDeclarationEntry. This
should not affect the output as shown by any front end because
the string to be displayed to the user for a `$@` interpolation comes
from the following column instead.
2018-08-28 14:58:39 +02:00
Jonas Jensen 1d11a13230 C++: Don't use dbtypes in SuppressionScope
This avoids using a raw db type.

It is possible for `SuppressionComment` and `SuppressionScope` to have
different locations because `SuppressionScope` defines `hasLocationInfo`
as a new rootdef whereas `SuppressionComment` only responds to
`getLocation` that it inherited. In interpretation of query results, a
`hasLocationInfo` predicate is preferred over `getLocation` if it
exists.
2018-08-28 14:58:39 +02:00
Jonas Jensen f005d45c63 C++: Change `SuppressionScope.toString`
This should have no effect in itself but changes the test output to
correspond with the change coming next.
2018-08-28 14:58:39 +02:00
Jonas Jensen 367776511f C++: Don't use dbtypes in ControlFlowNode etc.
Many classes have been declared with `extends @cfgnode` because they
should be implemented internally as a control-flow node but should not
expose the member predicates of `ControlFlowNode` to their users. After
the transition in a1e44041e it became mandatory to convert explicitly
between the `Element`-derived `ControlFlowNode` and the raw dbtype
`@cfgnode`, and that commit inserted numerous such conversions as a
result of having all those classes that did not derive from `Element` in
the standard library.

It was also confusing and error-prone that the libraries implementing
`ControlFlowNode` referred to `ControlFlowNode`. This seemingly cyclic
reference worked out because the libraries did not call the predicates
on `ControlFlowNode` whose implementation they were part of.

Both these problems are now solved by adding a new class
`ControlFlowNodeBase extends Element` that should be used in preference
to `@cfgnode` everywhere. This class is for exactly those use cases
where `@cfgnode` should be seen as an `Element` without having too many
member predicates on it.

The classes that move from extending `@cfgnode` to extending
`ControlFlowNodeBase` are: `BasicBlock`, `AdditionalControlFlowEdge`,
`DefOrUse`, `SsaDefinition`, `SubBasicBlock` and `RangeSsaDefinition`.
These previously had to define their own `toString` rootdef, which
typically had some dummy string as result (like `"BasicBlock"`), but now
their `toString` is part of the `Element` rootdef and should not be
overridden otherwise `Element.toString` will sometimes have multiple
results. Removing these dummy `toString` predicates had some effects on
the tests that are included in this commit.

The `getLocation` family of predicates is affected like `toString`, but
the situation is slightly different. Some of these classes had genuinely
useful alternative definitions of locations. Fortunately, they all used
`hasLocationInfo`, which is preferred over `getLocation` by the QL
engine. Because `Element` does not define `getLocationInfo`, each class
can create its own rootdef of this predicate like before.
2018-08-28 14:27:32 +02:00
Nick Rolfe f44f8d576d C++: test that __declspec(guard(...)) doesn't cause extractor errors 2018-08-28 10:24:53 +01:00
Dave Bartolomeo 6e0fe92434 C++: Fix comments to reference `Call` instead of `Invoke` 2018-08-27 11:02:07 -07:00
Dave Bartolomeo b44c2c72a6 C++: `Invoke` -> `Call`
Now that opcodes are in their own module that isn't imported into the global namespace, `Opcode::Call` no longer conflicts with `Call` from the ASTs. I've renamed `Opcode::Invoke` to `Opcode::Call`.
2018-08-27 09:22:01 -07:00
Esben Sparre Andreasen 02d56306c9 JS: classify generated data files 2018-08-27 15:06:00 +02:00
Pavel Avgustinov d0497a5cff
Merge pull request #106 from dave-bartolomeo/dave/LF
Force LF line endings for .ql, .qll, .qlref, and .dbscheme
2018-08-27 10:04:53 +01:00
Jonas Jensen dc0f3be753
Merge pull request #102 from ian-semmle/type_variants
C++: Tweak type_variants test
2018-08-27 10:34:45 +02:00
Anders Schack-Mulligen f2760f2547 Java/C: Improve performance when multiple configs use field flow. 2018-08-27 10:00:58 +02:00
Dave Bartolomeo 2af82d9485 LF for .qhelp files too 2018-08-26 21:12:51 -07:00
ian-semmle bafa3d79fe
Merge pull request #101 from nickrolfe/edg5
C++: test fixes for extractor frontend upgrade
2018-08-26 19:33:01 +01:00
Dave Bartolomeo dfb082e34f Add .editorconfig to use LF in .ql/.qlref/.qll/.dbscheme files 2018-08-24 13:20:40 -07:00
Jonas Jensen 1ed4a489ec C++: Make ControlFlowNode's predicates concrete
The presence of abstract predicates on this class made it hard to
specialize it, and this is one of the reasons why the raw db-type
`@cfgnode` is often used in preference to `ControlFlowNode`.
2018-08-24 22:03:59 +02:00
Dave Bartolomeo 12631e3fb1 Force LF line endings for .dbscheme files 2018-08-24 12:05:35 -07:00
Dave Bartolomeo d920fc7d94 Force LF line endings for .ql, .qll, and .qlref files 2018-08-24 11:58:58 -07:00
Nick Rolfe 7cf550a70f C++: regression test for extractor bug with enum in template class 2018-08-24 18:41:37 +01:00
Nick Rolfe 193e013196 C++: accept more extraction of functions in local classes/lambdas 2018-08-24 18:41:37 +01:00
Nick Rolfe da7d70662b C++: accept more test changes following extractor frontend upgrade 2018-08-24 18:41:37 +01:00
Nick Rolfe 04385a83ba C++: fix tests: frontend no longer optimises dynamic_cast to base type 2018-08-24 18:41:37 +01:00
Nick Rolfe dd169d1b21 C++: fix test to enable C++11 support in frontend 2018-08-24 18:41:37 +01:00
Nick Rolfe 59ddda881e
Merge pull request #104 from dave-bartolomeo/dave/ASTWobble
C++: Fix wobble in PrintAST test
2018-08-24 18:40:51 +01:00
Dave Bartolomeo 65ed9afdfb C++: Update test expectations for other PrintAST test 2018-08-24 08:50:35 -07:00
Dave Bartolomeo c4d6e1b01c C++: Fix wobble in PrintAST test
PrintAST.ql orders the functions by location, then in lexicographical order of the function signature. This is supposed to ensure a stable ordering, but functions without a location were not getting assigned an order at all.
2018-08-24 08:36:30 -07:00
Dave Bartolomeo 7cae9be4bf
Merge pull request #100 from jbj/sync-identical-files-ql
C++: Move the identical-files.json spec to ql repo
2018-08-24 07:31:48 -07:00
Ian Lynagh 01c7fc1c8b C++: Tweak type_variants test
It's now easier to see what's happening in cases where 2 functions have
the same name, or a function has 2 locations.
2018-08-24 14:46:02 +01:00
Luke Cartey f9227eeee5 C#: ZipSlip - Module documentation improvements. 2018-08-24 14:34:20 +01:00