Skip to content

Commit 46d330c

Browse files
felickzfelickz
committed
Merge branch 'ruby-framework-grape' of github.com:felickz/codeql into ruby-framework-grape
2 parents 37e0c30 + 7a9a259 commit 46d330c

File tree

64 files changed

+7045
-2130
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+7045
-2130
lines changed

‎docs/codeql/ql-language-reference/annotations.rst‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ For example, to declare a module ``M`` as private, you could use:
1616
}
1717
1818
Note that some annotations act on an entity itself, whilst others act on a particular *name* for the entity:
19-
- Act on an **entity**: ``abstract``, ``cached``, ``external``, ``transient``, ``override``, ``pragma``, ``language``,
20-
and ``bindingset``
21-
- Act on a **name**: ``deprecated``, ``library``, ``private``, ``final``, and ``query``
19+
- Act on an **entity**: ``abstract``, ``bindingset``, ``cached``, ``extensible``, ``external``, ``language``,
20+
``override``, ``pragma``, and ``transient``
21+
- Act on a **name**: ``additional``, ``deprecated``, ``final``, ``library``, ``private``, and ``query``
2222

2323
For example, if you annotate an entity with ``private``, then only that particular name is
2424
private. You could still access that entity under a different name (using an :ref:`alias <aliases>`).

‎docs/codeql/ql-language-reference/ql-language-specification.rst‎

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -761,17 +761,17 @@ Various kinds of syntax can have *annotations* applied to them. Annotations are
761761
annotation ::= simpleAnnotation | argsAnnotation
762762

763763
simpleAnnotation ::= "abstract"
764+
| "additional"
764765
| "cached"
765-
| "external"
766+
| "deprecated"
766767
| "extensible"
768+
| "external"
767769
| "final"
768-
| "transient"
769770
| "library"
770-
| "private"
771-
| "deprecated"
772771
| "override"
773-
| "additional"
772+
| "private"
774773
| "query"
774+
| "transient"
775775

776776
argsAnnotation ::= "pragma" "[" ("inline" | "inline_late" | "noinline" | "nomagic" | "noopt" | "assume_small_delta") "]"
777777
| "language" "[" "monotonicAggregates" "]"
@@ -791,28 +791,28 @@ The following table summarizes the syntactic constructs which can be marked with
791791
+================+=========+============+===================+=======================+=========+========+=========+=========+============+
792792
| ``abstract`` | yes | | yes | | | | | | |
793793
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
794+
| ``additional`` | yes | | | yes | | | yes | yes | yes |
795+
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
794796
| ``cached`` | yes | yes | yes | yes | | | yes | | |
795797
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
796-
| ``external`` | | | | yes | | | | | |
798+
| ``deprecated`` | yes | | yes | yes | yes | yes | yes | yes | yes |
797799
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
798800
| ``extensible`` | | | | yes | | | | | |
799801
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
800-
| ``final`` | yes | | yes | | | yes | | (yes) | |
802+
| ``external`` | | | | yes | | | | | |
801803
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
802-
| ``transient`` | | | | yes | | | | | |
804+
| ``final`` | yes | | yes | | | yes | | (yes) | |
803805
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
804806
| ``library`` | (yes) | | | | | | | | |
805807
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
806-
| ``private`` | yes | | yes | yes | yes | yes | yes | yes | yes |
807-
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
808-
| ``deprecated`` | yes | | yes | yes | yes | yes | yes | yes | yes |
809-
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
810808
| ``override`` | | | yes | | | yes | | | |
811809
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
812-
| ``additional`` | yes | | | yes | | | yes | yes | yes |
810+
| ``private`` | yes | | yes | yes | yes | yes | yes | yes | yes |
813811
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
814812
| ``query`` | | | | yes | | | | yes | |
815813
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
814+
| ``transient`` | | | | yes | | | | | |
815+
+----------------+---------+------------+-------------------+-----------------------+---------+--------+---------+---------+------------+
816816

817817
The ``library`` annotation is only usable within a QLL file, not a QL file.
818818
The ``final`` annotation is usable on type aliases, but not on module aliases and predicate aliases.
@@ -933,7 +933,8 @@ A predicate definition adds a mapping from the predicate name and arity to the p
933933

934934
When a predicate is a top-level clause in a module, it is called a non-member predicate. See below for "`Member predicates <#member-predicates>`__."
935935

936-
A valid non-member predicate can be annotated with ``cached``, ``deprecated``, ``external``, ``transient``, ``private``, and ``query``. Note, the ``transient`` annotation can only be applied if the non-member predicate is also annotated with ``external``.
936+
A valid non-member predicate can be annotated with ``additional``, ``cached``, ``deprecated``, ``extensible``, ``external``, ``transient``, ``private``, and ``query``.
937+
Note, the ``transient`` annotation can only be applied if the non-member predicate is also annotated with ``external``.
937938

938939
The head of the predicate gives a name, an optional *result type*, and a sequence of variables declarations that are *arguments*:
939940

@@ -979,7 +980,7 @@ A class type is said to *final inherit* from base types that are final or refere
979980

980981
A class adds a mapping from the class name to the class declaration to the current module's declared type environment.
981982

982-
A valid class can be annotated with ``abstract``, ``final``, ``library``, and ``private``. Any other annotation renders the class invalid.
983+
A valid class can be annotated with ``abstract``, ``additional``, ``final``, ``library``, and ``private``. Any other annotation renders the class invalid.
983984

984985
A valid class may not inherit from itself, or from more than one primitive type. The set of types that a valid class inherits from must be disjoint from the set of types that it final inherits from.
985986

@@ -2292,17 +2293,17 @@ The complete grammar for QL is as follows:
22922293
annotation ::= simpleAnnotation | argsAnnotation
22932294

22942295
simpleAnnotation ::= "abstract"
2296+
| "additional"
22952297
| "cached"
2296-
| "external"
2298+
| "deprecated"
22972299
| "extensible"
2300+
| "external"
22982301
| "final"
2299-
| "transient"
23002302
| "library"
2301-
| "private"
2302-
| "deprecated"
23032303
| "override"
2304-
| "additional"
2304+
| "private"
23052305
| "query"
2306+
| "transient"
23062307

23072308
argsAnnotation ::= "pragma" "[" ("inline" | "inline_late" | "noinline" | "nomagic" | "noopt" | "assume_small_delta") "]"
23082309
| "language" "[" "monotonicAggregates" "]"

‎java/ql/lib/semmle/code/java/Overlay.qll‎

Lines changed: 12 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ predicate isOverlay() { databaseMetadata("isOverlay", "true") }
1818
overlay[local]
1919
string getRawFile(@locatable el) {
2020
exists(@location loc, @file file |
21-
hasLocation(el, loc) and
21+
(hasLocation(el, loc) or xmllocations(el, loc)) and
2222
locations_default(loc, file, _, _, _, _) and
2323
files(file, result)
2424
)
@@ -73,40 +73,22 @@ private predicate discardReferableLocatable(@locatable el) {
7373
)
7474
}
7575

76+
/** Gets the raw file for a configLocatable. */
7677
overlay[local]
77-
private predicate baseConfigLocatable(@configLocatable l) { not isOverlay() and exists(l) }
78-
79-
overlay[local]
80-
private predicate overlayHasConfigLocatables() {
81-
isOverlay() and
82-
exists(@configLocatable el)
83-
}
84-
85-
overlay[discard_entity]
86-
private predicate discardBaseConfigLocatable(@configLocatable el) {
87-
// The properties extractor is currently not incremental, so if
88-
// the overlay contains any config locatables, the overlay should
89-
// contain a full extraction and all config locatables from base
90-
// should be discarded.
91-
baseConfigLocatable(el) and overlayHasConfigLocatables()
92-
}
93-
94-
overlay[local]
95-
private predicate baseXmlLocatable(@xmllocatable l) {
96-
not isOverlay() and not files(l, _) and not xmlNs(l, _, _, _)
78+
private string getRawFileForConfig(@configLocatable el) {
79+
exists(@location loc, @file file |
80+
configLocations(el, loc) and
81+
locations_default(loc, file, _, _, _, _) and
82+
files(file, result)
83+
)
9784
}
9885

9986
overlay[local]
100-
private predicate overlayHasXmlLocatable() {
101-
isOverlay() and
102-
exists(@xmllocatable l | not files(l, _) and not xmlNs(l, _, _, _))
87+
private string baseConfigLocatable(@configLocatable el) {
88+
not isOverlay() and result = getRawFileForConfig(el)
10389
}
10490

10591
overlay[discard_entity]
106-
private predicate discardBaseXmlLocatable(@xmllocatable el) {
107-
// The XML extractor is currently not incremental, so if
108-
// the overlay contains any XML locatables, the overlay should
109-
// contain a full extraction and all XML locatables from base
110-
// should be discarded.
111-
baseXmlLocatable(el) and overlayHasXmlLocatable()
92+
private predicate discardBaseConfigLocatable(@configLocatable el) {
93+
overlayChangedFiles(baseConfigLocatable(el))
11294
}

‎java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ overlay[caller?]
8383
pragma[inline]
8484
predicate localFlow(Node node1, Node node2) { node1 = node2 or localFlowStepPlus(node1, node2) }
8585

86+
overlay[caller?]
8687
private predicate localFlowStepPlus(Node node1, Node node2) = fastTC(localFlowStep/2)(node1, node2)
8788

8889
/**

‎java/ql/lib/semmle/code/java/regex/RegexFlowConfigs.qll‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -163,18 +163,22 @@ private module RegexFlowConfig implements DataFlow::ConfigSig {
163163

164164
private module RegexFlow = DataFlow::Global<RegexFlowConfig>;
165165

166+
private predicate usedAsRegexImpl(StringLiteral regex, string mode, boolean match_full_string) {
167+
RegexFlow::flow(DataFlow::exprNode(regex), _) and
168+
mode = "None" and // TODO: proper mode detection
169+
(if matchesFullString(regex) then match_full_string = true else match_full_string = false)
170+
}
171+
166172
/**
167173
* Holds if `regex` is used as a regex, with the mode `mode` (if known).
168174
* If regex mode is not known, `mode` will be `"None"`.
169175
*
170176
* As an optimisation, only regexes containing an infinite repitition quatifier (`+`, `*`, or `{x,}`)
171177
* and therefore may be relevant for ReDoS queries are considered.
172178
*/
173-
predicate usedAsRegex(StringLiteral regex, string mode, boolean match_full_string) {
174-
RegexFlow::flow(DataFlow::exprNode(regex), _) and
175-
mode = "None" and // TODO: proper mode detection
176-
(if matchesFullString(regex) then match_full_string = true else match_full_string = false)
177-
}
179+
overlay[local]
180+
predicate usedAsRegex(StringLiteral regex, string mode, boolean match_full_string) =
181+
forceLocal(usedAsRegexImpl/3)(regex, mode, match_full_string)
178182

179183
/**
180184
* Holds if `regex` is used as a regular expression that is matched against a full string,

‎java/ql/lib/semmle/code/xml/XML.qll‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ module;
66

77
import semmle.files.FileSystem
88
private import codeql.xml.Xml
9+
private import semmle.code.java.Overlay
910

1011
private module Input implements InputSig<File, Location> {
1112
class XmlLocatableBase = @xmllocatable or @xmlnamespaceable;
@@ -69,3 +70,13 @@ private module Input implements InputSig<File, Location> {
6970
}
7071

7172
import Make<File, Location, Input>
73+
74+
private class DiscardableXmlAttribute extends DiscardableLocatable, @xmlattribute { }
75+
76+
private class DiscardableXmlElement extends DiscardableLocatable, @xmlelement { }
77+
78+
private class DiscardableXmlComment extends DiscardableLocatable, @xmlcomment { }
79+
80+
private class DiscardableXmlCharacters extends DiscardableLocatable, @xmlcharacters { }
81+
82+
private class DiscardableXmlDtd extends DiscardableLocatable, @xmldtd { }

‎javascript/ql/lib/change-notes/2025-09-19-graphql-type-object.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added modeling of `GraphQLObjectType` resolver function parameters as remote sources.

‎javascript/ql/lib/ext/graph-ql.model.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,3 +4,8 @@ extensions:
44
extensible: summaryModel
55
data:
66
- ["graphql", "Member[graphql]", "Argument[0].Member[source,variableValues]", "Argument[0].Member[rootValue].AnyMember.Parameter[0]", "taint"]
7+
- addsTo:
8+
pack: codeql/javascript-all
9+
extensible: sourceModel
10+
data:
11+
- ["graphql", "Member[GraphQLObjectType].Argument[0].Member[fields].AnyMember.Member[resolve].Parameter[1]", "remote"]

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@
6363
| fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:51 | request ... plyCode | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:51 | request ... plyCode | user-provided value |
6464
| graph-ql.js:20:19:20:22 | expr | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:20:19:20:22 | expr | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
6565
| graph-ql.js:39:19:39:30 | name + title | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:39:19:39:30 | name + title | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
66+
| graph-ql.js:66:23:66:27 | value | graph-ql.js:65:22:65:30 | { value } | graph-ql.js:66:23:66:27 | value | This code execution depends on a $@. | graph-ql.js:65:22:65:30 | { value } | user-provided value |
6667
| module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
6768
| module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
6869
| react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -173,6 +174,8 @@ edges
173174
| graph-ql.js:39:19:39:22 | name | graph-ql.js:39:19:39:30 | name + title | provenance | |
174175
| graph-ql.js:39:26:39:30 | title | graph-ql.js:39:19:39:30 | name + title | provenance | |
175176
| graph-ql.js:54:21:54:29 | variables | graph-ql.js:38:13:38:27 | { name, title } | provenance | |
177+
| graph-ql.js:65:22:65:30 | { value } | graph-ql.js:65:24:65:28 | value | provenance | |
178+
| graph-ql.js:65:24:65:28 | value | graph-ql.js:66:23:66:27 | value | provenance | |
176179
| react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
177180
| react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
178181
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | |
@@ -323,6 +326,9 @@ nodes
323326
| graph-ql.js:39:19:39:30 | name + title | semmle.label | name + title |
324327
| graph-ql.js:39:26:39:30 | title | semmle.label | title |
325328
| graph-ql.js:54:21:54:29 | variables | semmle.label | variables |
329+
| graph-ql.js:65:22:65:30 | { value } | semmle.label | { value } |
330+
| graph-ql.js:65:24:65:28 | value | semmle.label | value |
331+
| graph-ql.js:66:23:66:27 | value | semmle.label | value |
326332
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
327333
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
328334
| react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

‎javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,8 @@ edges
7272
| graph-ql.js:39:19:39:22 | name | graph-ql.js:39:19:39:30 | name + title | provenance | |
7373
| graph-ql.js:39:26:39:30 | title | graph-ql.js:39:19:39:30 | name + title | provenance | |
7474
| graph-ql.js:54:21:54:29 | variables | graph-ql.js:38:13:38:27 | { name, title } | provenance | |
75+
| graph-ql.js:65:22:65:30 | { value } | graph-ql.js:65:24:65:28 | value | provenance | |
76+
| graph-ql.js:65:24:65:28 | value | graph-ql.js:66:23:66:27 | value | provenance | |
7577
| react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance | |
7678
| react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance | |
7779
| react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance | |
@@ -224,6 +226,9 @@ nodes
224226
| graph-ql.js:39:19:39:30 | name + title | semmle.label | name + title |
225227
| graph-ql.js:39:26:39:30 | title | semmle.label | title |
226228
| graph-ql.js:54:21:54:29 | variables | semmle.label | variables |
229+
| graph-ql.js:65:22:65:30 | { value } | semmle.label | { value } |
230+
| graph-ql.js:65:24:65:28 | value | semmle.label | value |
231+
| graph-ql.js:66:23:66:27 | value | semmle.label | value |
227232
| module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
228233
| module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
229234
| react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

0 commit comments

Comments
 (0)