Skip to content

Commit 7554517

Browse files
lcarteylcartey
committed
Merge commit 'cb9a05fb4a02424cb4da3a9de3ae818b2e3eb2b4' into lcartey/update-to-2.11
2 parents 23e25b9 + cb9a05f commit 7554517

File tree

49 files changed

+214
-120
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+214
-120
lines changed

‎.codeqlmanifest.json

+9-1
Original file line numberDiff line numberDiff line change
@@ -1 +1,9 @@
1-
{ "provide": [ "cpp/*/src/qlpack.yml", "cpp/*/test/qlpack.yml", "c/*/src/qlpack.yml", "c/*/test/qlpack.yml", "scripts/generate_modules/queries/qlpack.yml" ] }
1+
{
2+
"provide": [
3+
"cpp/*/src/qlpack.yml",
4+
"cpp/*/test/qlpack.yml",
5+
"c/*/src/qlpack.yml",
6+
"c/*/test/qlpack.yml",
7+
"scripts/generate_modules/queries/qlpack.yml"
8+
]
9+
}

‎c/cert/src/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎c/cert/src/codeql-suites/cert-default.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@
66
- path-problem
77
- exclude:
88
tags contain:
9-
- external/cert/default-disabled
9+
- external/cert/default-disabled

‎c/cert/src/qlpack.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
name: codeql/cert-c-coding-standards
1+
name: codeql/codeql/cert-c-coding-standards
22
version: 2.19.0-dev
33
description: CERT C 2016
44
suites: codeql-suites
55
license: MIT
66
dependencies:
77
codeql/common-c-coding-standards: '*'
8-
codeql/cpp-all: 0.3.5
8+
codeql/cpp-all: 0.4.0

‎c/cert/src/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.ql

+83-9
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,9 @@ import cpp
1515
import codingstandards.c.cert
1616
import semmle.code.cpp.security.FunctionWithWrappers
1717
import semmle.code.cpp.security.Security
18-
import semmle.code.cpp.security.TaintTracking
19-
import TaintedWithPath
18+
import semmle.code.cpp.ir.IR
19+
import semmle.code.cpp.ir.dataflow.TaintTracking
20+
import DataFlow::PathGraph
2021

2122
// Query TaintedPath.ql from the CodeQL standard library
2223
/**
@@ -45,20 +46,93 @@ class FileFunction extends FunctionWithWrappers {
4546
override predicate interestingArg(int arg) { arg = 0 }
4647
}
4748

48-
class TaintedPathConfiguration extends TaintTrackingConfiguration {
49-
override predicate isSink(Element tainted) {
50-
exists(FileFunction fileFunction | fileFunction.outermostWrapperFunctionCall(tainted, _))
49+
Expr asSourceExpr(DataFlow::Node node) {
50+
result = node.asConvertedExpr()
51+
or
52+
result = node.asDefiningArgument()
53+
}
54+
55+
Expr asSinkExpr(DataFlow::Node node) {
56+
result =
57+
node.asOperand()
58+
.(SideEffectOperand)
59+
.getUse()
60+
.(ReadSideEffectInstruction)
61+
.getArgumentDef()
62+
.getUnconvertedResultExpression()
63+
}
64+
65+
/**
66+
* Holds for a variable that has any kind of upper-bound check anywhere in the program.
67+
* This is biased towards being inclusive and being a coarse overapproximation because
68+
* there are a lot of valid ways of doing an upper bounds checks if we don't consider
69+
* where it occurs, for example:
70+
* ```cpp
71+
* if (x < 10) { sink(x); }
72+
*
73+
* if (10 > y) { sink(y); }
74+
*
75+
* if (z > 10) { z = 10; }
76+
* sink(z);
77+
* ```
78+
*/
79+
predicate hasUpperBoundsCheck(Variable var) {
80+
exists(RelationalOperation oper, VariableAccess access |
81+
oper.getAnOperand() = access and
82+
access.getTarget() = var and
83+
// Comparing to 0 is not an upper bound check
84+
not oper.getAnOperand().getValue() = "0"
85+
)
86+
}
87+
88+
class TaintedPathConfiguration extends TaintTracking::Configuration {
89+
TaintedPathConfiguration() { this = "TaintedPathConfiguration" }
90+
91+
override predicate isSource(DataFlow::Node node) { isUserInput(asSourceExpr(node), _) }
92+
93+
override predicate isSink(DataFlow::Node node) {
94+
exists(FileFunction fileFunction |
95+
fileFunction.outermostWrapperFunctionCall(asSinkExpr(node), _)
96+
)
97+
}
98+
99+
override predicate isSanitizerIn(DataFlow::Node node) { this.isSource(node) }
100+
101+
override predicate isSanitizer(DataFlow::Node node) {
102+
node.asExpr().(Call).getTarget().getUnspecifiedType() instanceof ArithmeticType
103+
or
104+
exists(LoadInstruction load, Variable checkedVar |
105+
load = node.asInstruction() and
106+
checkedVar = load.getSourceAddress().(VariableAddressInstruction).getAstVariable() and
107+
hasUpperBoundsCheck(checkedVar)
108+
)
109+
}
110+
111+
predicate hasFilteredFlowPath(DataFlow::PathNode source, DataFlow::PathNode sink) {
112+
this.hasFlowPath(source, sink) and
113+
// The use of `isUserInput` in `isSink` in combination with `asSourceExpr` causes
114+
// duplicate results. Filter these duplicates. The proper solution is to switch to
115+
// using `LocalFlowSource` and `RemoteFlowSource`, but this currently only supports
116+
// a subset of the cases supported by `isUserInput`.
117+
not exists(DataFlow::PathNode source2 |
118+
this.hasFlowPath(source2, sink) and
119+
asSourceExpr(source.getNode()) = asSourceExpr(source2.getNode())
120+
|
121+
not exists(source.getNode().asConvertedExpr()) and exists(source2.getNode().asConvertedExpr())
122+
)
51123
}
52124
}
53125

54126
from
55-
FileFunction fileFunction, Expr taintedArg, Expr taintSource, PathNode sourceNode,
56-
PathNode sinkNode, string taintCause, string callChain
127+
FileFunction fileFunction, Expr taintedArg, Expr taintSource, TaintedPathConfiguration cfg,
128+
DataFlow::PathNode sourceNode, DataFlow::PathNode sinkNode, string taintCause, string callChain
57129
where
58130
not isExcluded(taintedArg, IO3Package::doNotPerformFileOperationsOnDevicesQuery()) and
131+
taintedArg = asSinkExpr(sinkNode.getNode()) and
59132
fileFunction.outermostWrapperFunctionCall(taintedArg, callChain) and
60-
taintedWithPath(taintSource, taintedArg, sourceNode, sinkNode) and
133+
cfg.hasFilteredFlowPath(sourceNode, sinkNode) and
134+
taintSource = asSourceExpr(sourceNode.getNode()) and
61135
isUserInput(taintSource, taintCause)
62136
select taintedArg, sourceNode, sinkNode,
63-
"This argument to a file access function is derived from $@ and then passed to " + callChain,
137+
"This argument to a file access function is derived from $@ and then passed to " + callChain + ".",
64138
taintSource, "user input (" + taintCause + ")"

‎c/cert/test/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎c/cert/test/rules/FIO32-C/DoNotPerformFileOperationsOnDevices.expected

+3-31
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,12 @@
11
edges
2-
| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | (const char *)... |
3-
| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name |
4-
| test.c:20:15:20:23 | array to pointer conversion | test.c:21:8:21:16 | file_name indirection |
5-
| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | (const char *)... |
6-
| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name |
7-
| test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name indirection |
8-
| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | (const char *)... |
9-
| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name |
102
| test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection |
11-
| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | (LPCTSTR)... |
12-
| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name |
13-
| test.c:45:15:45:23 | array to pointer conversion | test.c:46:29:46:37 | file_name indirection |
14-
| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | (LPCTSTR)... |
15-
| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name |
16-
| test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name indirection |
17-
| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | (LPCTSTR)... |
18-
| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name |
193
| test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection |
20-
subpaths
214
nodes
22-
| test.c:20:15:20:23 | array to pointer conversion | semmle.label | array to pointer conversion |
23-
| test.c:20:15:20:23 | file_name | semmle.label | file_name |
245
| test.c:20:15:20:23 | scanf output argument | semmle.label | scanf output argument |
25-
| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... |
26-
| test.c:21:8:21:16 | (const char *)... | semmle.label | (const char *)... |
27-
| test.c:21:8:21:16 | file_name | semmle.label | file_name |
28-
| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection |
296
| test.c:21:8:21:16 | file_name indirection | semmle.label | file_name indirection |
30-
| test.c:45:15:45:23 | array to pointer conversion | semmle.label | array to pointer conversion |
31-
| test.c:45:15:45:23 | file_name | semmle.label | file_name |
327
| test.c:45:15:45:23 | scanf output argument | semmle.label | scanf output argument |
33-
| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... |
34-
| test.c:46:29:46:37 | (LPCTSTR)... | semmle.label | (LPCTSTR)... |
35-
| test.c:46:29:46:37 | file_name | semmle.label | file_name |
36-
| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection |
378
| test.c:46:29:46:37 | file_name indirection | semmle.label | file_name indirection |
9+
subpaths
3810
#select
39-
| test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | file_name | test.c:21:8:21:16 | file_name | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen((unnamed parameter 0)) | test.c:20:15:20:23 | file_name | user input (scanf) |
40-
| test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | file_name | test.c:46:29:46:37 | file_name | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName) | test.c:45:15:45:23 | file_name | user input (scanf) |
11+
| test.c:21:8:21:16 | file_name | test.c:20:15:20:23 | scanf output argument | test.c:21:8:21:16 | file_name indirection | This argument to a file access function is derived from $@ and then passed to func(file_name), which calls fopen((unnamed parameter 0)). | test.c:20:15:20:23 | file_name | user input (scanf) |
12+
| test.c:46:29:46:37 | file_name | test.c:45:15:45:23 | scanf output argument | test.c:46:29:46:37 | file_name indirection | This argument to a file access function is derived from $@ and then passed to CreateFile(lpFileName). | test.c:45:15:45:23 | file_name | user input (scanf) |

‎c/common/src/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎c/common/src/codingstandards/c/Pointers.qll

+1-1
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ class ArrayPointerArithmeticExpr extends PointerArithmeticExpr, ArrayExpr {
6060
* A null pointer constant, which is either in the form `NULL` or `(void *)0`.
6161
*/
6262
predicate isNullPointerConstant(Expr e) {
63-
e.findRootCause() instanceof NULLMacro
63+
e.findRootCause() instanceof NullMacro
6464
or
6565
exists(CStyleCast c |
6666
not c.isImplicit() and

‎c/common/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@ version: 2.19.0-dev
33
license: MIT
44
dependencies:
55
codeql/common-cpp-coding-standards: '*'
6-
codeql/cpp-all: 0.3.5
6+
codeql/cpp-all: 0.4.0

‎c/common/test/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎c/misra/src/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎c/misra/src/codeql-suites/misra-default.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@
77
- exclude:
88
tags contain:
99
- external/misra/audit
10-
- external/misra/default-disabled
10+
- external/misra/default-disabled

‎c/misra/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ suites: codeql-suites
55
license: MIT
66
dependencies:
77
codeql/common-c-coding-standards: '*'
8-
codeql/cpp-all: 0.3.5
8+
codeql/cpp-all: 0.4.0

‎c/misra/test/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎change_notes/2022-05-04-compiler-generated-fp-M0-1-4.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
- `M0-1-4` - `SingleUsePODVariable.ql`
2+
- This rule no longer considers compiler-generated access to a variable when determining if the
3+
variable has a single use.

‎change_notes/2022-06-01-fix-A8-5-3-braced-initialization-detection.md

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
- `A8-5-3` - `AvoidAutoWithBracedInitialization.ql`:
2+
- Fix regression where `auto x{0}` was no longer detected as a braced initialization with type `auto` with the latest CodeQL versions.
3+
- No longer falsely detect cases where braced initialization was not used, but where the inferred type would be `std::initializer_list`.

‎change_notes/2022-07-15-fix-A7-3-1-location-reporting.md

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- `A7-3-1` - `DefinitionNotConsideredForUnqualifiedLookup.ql`
2+
- The locations reported for names occurring in using-declarations has improved in the latest CodeQL versions.

‎change_notes/2022-12-06-remove-use-of-default-taint-tracking.md

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- `FIO32-C` - `DoNotPerformFileOperationsOnDevices.ql`:
2+
- The query was rewritten to no longer depend of the `DefaultTaintTracking` library, which will be deprecated.

‎cpp/autosar/src/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

‎cpp/autosar/src/codeql-suites/autosar-advisory.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@
88
- external/autosar/obligation/advisory
99
- exclude:
1010
tags contain:
11-
- external/autosar/audit
11+
- external/autosar/audit

‎cpp/autosar/src/codeql-suites/autosar-audit.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@
55
- problem
66
- path-problem
77
tags contain:
8-
- external/autosar/audit
8+
- external/autosar/audit

‎cpp/autosar/src/codeql-suites/autosar-default.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@
77
- exclude:
88
tags contain:
99
- external/autosar/audit
10-
- external/autosar/default-disabled
10+
- external/autosar/default-disabled

‎cpp/autosar/src/codeql-suites/autosar-required.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -8,4 +8,4 @@
88
- external/autosar/obligation/required
99
- exclude:
1010
tags contain:
11-
- external/autosar/audit
11+
- external/autosar/audit

‎cpp/autosar/src/codeql-suites/autosar-single-translation-unit.qls

+1-1
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,4 @@
99
- exclude:
1010
tags contain:
1111
- external/autosar/audit
12-
- external/autosar/default-disabled
12+
- external/autosar/default-disabled

‎cpp/autosar/src/codingstandards/cpp/HardwareOrProtocolInterface.qll

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ class DefinedSizeType extends Type {
3939

4040
class DefinedSizeClass extends Class {
4141
DefinedSizeClass() {
42-
this.isPOD() and
42+
this.isPod() and
4343
forall(Field f | f = this.getAField() | f.getType() instanceof DefinedSizeType)
4444
}
4545
}

‎cpp/autosar/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ suites: codeql-suites
55
license: MIT
66
dependencies:
77
codeql/common-cpp-coding-standards: '*'
8-
codeql/cpp-all: 0.3.5
8+
codeql/cpp-all: 0.4.0

‎cpp/autosar/src/rules/A11-0-1/NonPodTypeShouldBeDefinedAsClass.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,5 +22,5 @@ import codingstandards.cpp.Typehelpers
2222
from Struct s
2323
where
2424
not isExcluded(s, ClassesPackage::nonPodTypeShouldBeDefinedAsClassQuery()) and
25-
not s.isPOD()
25+
not s.isPod()
2626
select s, "Non-POD type defined as struct instead of class."

‎cpp/autosar/src/rules/A12-0-2/OperationsAssumingMemoryLayoutPerformedOnObjects.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ import cpp
1919
import codingstandards.cpp.autosar
2020

2121
class Object extends Class {
22-
Object() { not this.(Struct).isPOD() }
22+
Object() { not this.(Struct).isPod() }
2323
}
2424

2525
predicate isPointerToObject(Expr e) {

‎cpp/autosar/src/rules/A9-6-1/DataTypesUsedForInterfacingWithHardwareOrProtocolsMustBeTrivialAndStandardLayout.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,6 @@ from HardwareOrProtocolInterfaceClass c
2323
where
2424
not isExcluded(c,
2525
ClassesPackage::dataTypesUsedForInterfacingWithHardwareOrProtocolsMustBeTrivialAndStandardLayoutQuery()) and
26-
not c.isPOD()
26+
not c.isPod()
2727
select c,
2828
"Data type used for hardware interface or communication protocol is not standard layout and trivial."

‎cpp/autosar/src/rules/M11-0-1/MemberDataInNonPodClassTypesNotPrivate.ql

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ import cpp
1717
import codingstandards.cpp.autosar
1818

1919
class NonPODType extends Class {
20-
NonPODType() { not this.isPOD() }
20+
NonPODType() { not this.isPod() }
2121
}
2222

2323
from NonPODType p, Field f

‎cpp/autosar/test/codeql-pack.lock.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
---
22
dependencies:
33
codeql/cpp-all:
4-
version: 0.3.5
4+
version: 0.4.0
5+
codeql/ssa:
6+
version: 0.0.1
57
compiled: false
68
lockVersion: 1.0.0

0 commit comments

Comments
 (0)