Skip to content

Commit 93a9c62

Browse files
asgerfasgerf
authored
Merge branch 'main' into js/graph-export
2 parents 3335d48 + 7434a58 commit 93a9c62

File tree

45 files changed

+940
-313
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+940
-313
lines changed

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowImplSpecific.qll‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,6 @@ module CppDataFlow implements InputSig<Location> {
2727
predicate mayBenefitFromCallContext = Private::mayBenefitFromCallContext/1;
2828

2929
predicate viableImplInCallContext = Private::viableImplInCallContext/2;
30+
31+
predicate neverSkipInPathGraph = Private::neverSkipInPathGraph/1;
3032
}

‎cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1306,6 +1306,13 @@ predicate nodeIsHidden(Node n) {
13061306
n instanceof InitialGlobalValue
13071307
}
13081308

1309+
predicate neverSkipInPathGraph(Node n) {
1310+
// Always show the right-hand side of assignments in the path graph
1311+
exists(n.asDefinition())
1312+
or
1313+
exists(n.asIndirectDefinition())
1314+
}
1315+
13091316
class LambdaCallKind = Unit;
13101317

13111318
/** Holds if `creation` is an expression that creates a lambda of kind `kind` for `c`. */

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-078/WordexpTainted.expected‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
edges
2-
| test.cpp:22:27:22:30 | **argv | test.cpp:29:13:29:20 | *filePath | provenance | |
2+
| test.cpp:22:27:22:30 | **argv | test.cpp:23:20:23:26 | *access to array | provenance | |
3+
| test.cpp:23:20:23:26 | *access to array | test.cpp:29:13:29:20 | *filePath | provenance | |
34
nodes
45
| test.cpp:22:27:22:30 | **argv | semmle.label | **argv |
6+
| test.cpp:23:20:23:26 | *access to array | semmle.label | *access to array |
57
| test.cpp:29:13:29:20 | *filePath | semmle.label | *filePath |
68
subpaths
79
#select

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-190/AllocMultiplicationOverflow/AllocMultiplicationOverflow.expected‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
edges
2-
| test.cpp:22:17:22:21 | ... * ... | test.cpp:23:33:23:37 | size1 | provenance | |
2+
| test.cpp:22:17:22:21 | (size_t)... | test.cpp:23:33:23:37 | size1 | provenance | |
3+
| test.cpp:22:17:22:21 | ... * ... | test.cpp:22:17:22:21 | (size_t)... | provenance | |
34
| test.cpp:37:24:37:27 | size | test.cpp:37:46:37:49 | size | provenance | |
45
| test.cpp:45:36:45:40 | ... * ... | test.cpp:37:24:37:27 | size | provenance | |
56
nodes
67
| test.cpp:13:33:13:37 | ... * ... | semmle.label | ... * ... |
78
| test.cpp:15:31:15:35 | ... * ... | semmle.label | ... * ... |
89
| test.cpp:19:34:19:38 | ... * ... | semmle.label | ... * ... |
10+
| test.cpp:22:17:22:21 | (size_t)... | semmle.label | (size_t)... |
911
| test.cpp:22:17:22:21 | ... * ... | semmle.label | ... * ... |
1012
| test.cpp:23:33:23:37 | size1 | semmle.label | size1 |
1113
| test.cpp:30:18:30:32 | ... * ... | semmle.label | ... * ... |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/array-access/ArrayAccessProductFlow.expected‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
edges
2+
| test.cpp:4:17:4:22 | call to malloc | test.cpp:4:17:4:22 | call to malloc | provenance | |
23
| test.cpp:4:17:4:22 | call to malloc | test.cpp:6:9:6:11 | arr | provenance | |
34
| test.cpp:4:17:4:22 | call to malloc | test.cpp:10:9:10:11 | arr | provenance | |
45
| test.cpp:19:9:19:16 | *mk_array [p] | test.cpp:28:19:28:26 | call to mk_array [p] | provenance | |
56
| test.cpp:19:9:19:16 | *mk_array [p] | test.cpp:50:18:50:25 | call to mk_array [p] | provenance | |
67
| test.cpp:21:5:21:7 | *arr [post update] [p] | test.cpp:22:5:22:7 | *arr [p] | provenance | |
78
| test.cpp:21:5:21:24 | ... = ... | test.cpp:21:5:21:7 | *arr [post update] [p] | provenance | |
89
| test.cpp:21:13:21:18 | call to malloc | test.cpp:21:5:21:24 | ... = ... | provenance | |
9-
| test.cpp:22:5:22:7 | *arr [p] | test.cpp:19:9:19:16 | *mk_array [p] | provenance | |
10+
| test.cpp:22:5:22:7 | *arr [p] | test.cpp:24:12:24:14 | arr [p] | provenance | |
11+
| test.cpp:24:12:24:14 | arr [p] | test.cpp:19:9:19:16 | *mk_array [p] | provenance | |
12+
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:28:19:28:26 | call to mk_array [p] | provenance | |
1013
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:31:9:31:11 | *arr [p] | provenance | |
1114
| test.cpp:28:19:28:26 | call to mk_array [p] | test.cpp:35:9:35:11 | *arr [p] | provenance | |
1215
| test.cpp:31:9:31:11 | *arr [p] | test.cpp:31:13:31:13 | p | provenance | |
@@ -28,7 +31,9 @@ edges
2831
| test.cpp:69:5:69:7 | *arr [post update] [p] | test.cpp:70:5:70:7 | *arr [p] | provenance | |
2932
| test.cpp:69:5:69:25 | ... = ... | test.cpp:69:5:69:7 | *arr [post update] [p] | provenance | |
3033
| test.cpp:69:14:69:19 | call to malloc | test.cpp:69:5:69:25 | ... = ... | provenance | |
31-
| test.cpp:70:5:70:7 | *arr [p] | test.cpp:67:10:67:19 | **mk_array_p [p] | provenance | |
34+
| test.cpp:70:5:70:7 | *arr [p] | test.cpp:72:12:72:14 | *arr [p] | provenance | |
35+
| test.cpp:72:12:72:14 | *arr [p] | test.cpp:67:10:67:19 | **mk_array_p [p] | provenance | |
36+
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:76:20:76:29 | *call to mk_array_p [p] | provenance | |
3237
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:79:9:79:11 | *arr [p] | provenance | |
3338
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | test.cpp:83:9:83:11 | *arr [p] | provenance | |
3439
| test.cpp:79:9:79:11 | *arr [p] | test.cpp:79:14:79:14 | p | provenance | |
@@ -43,13 +48,16 @@ edges
4348
| test.cpp:98:18:98:27 | test6_callee output argument [p] | test.cpp:98:18:98:27 | *call to mk_array_p [p] | provenance | |
4449
nodes
4550
| test.cpp:4:17:4:22 | call to malloc | semmle.label | call to malloc |
51+
| test.cpp:4:17:4:22 | call to malloc | semmle.label | call to malloc |
4652
| test.cpp:6:9:6:11 | arr | semmle.label | arr |
4753
| test.cpp:10:9:10:11 | arr | semmle.label | arr |
4854
| test.cpp:19:9:19:16 | *mk_array [p] | semmle.label | *mk_array [p] |
4955
| test.cpp:21:5:21:7 | *arr [post update] [p] | semmle.label | *arr [post update] [p] |
5056
| test.cpp:21:5:21:24 | ... = ... | semmle.label | ... = ... |
5157
| test.cpp:21:13:21:18 | call to malloc | semmle.label | call to malloc |
5258
| test.cpp:22:5:22:7 | *arr [p] | semmle.label | *arr [p] |
59+
| test.cpp:24:12:24:14 | arr [p] | semmle.label | arr [p] |
60+
| test.cpp:28:19:28:26 | call to mk_array [p] | semmle.label | call to mk_array [p] |
5361
| test.cpp:28:19:28:26 | call to mk_array [p] | semmle.label | call to mk_array [p] |
5462
| test.cpp:31:9:31:11 | *arr [p] | semmle.label | *arr [p] |
5563
| test.cpp:31:13:31:13 | p | semmle.label | p |
@@ -74,6 +82,8 @@ nodes
7482
| test.cpp:69:5:69:25 | ... = ... | semmle.label | ... = ... |
7583
| test.cpp:69:14:69:19 | call to malloc | semmle.label | call to malloc |
7684
| test.cpp:70:5:70:7 | *arr [p] | semmle.label | *arr [p] |
85+
| test.cpp:72:12:72:14 | *arr [p] | semmle.label | *arr [p] |
86+
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | semmle.label | *call to mk_array_p [p] |
7787
| test.cpp:76:20:76:29 | *call to mk_array_p [p] | semmle.label | *call to mk_array_p [p] |
7888
| test.cpp:79:9:79:11 | *arr [p] | semmle.label | *arr [p] |
7989
| test.cpp:79:14:79:14 | p | semmle.label | p |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-193/constant-size/ConstantSizeArrayOffByOne.expected‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,9 @@ edges
1818
| test.cpp:77:32:77:34 | buf | test.cpp:77:26:77:44 | & ... | provenance | |
1919
| test.cpp:79:27:79:34 | buf | test.cpp:70:33:70:33 | p | provenance | |
2020
| test.cpp:79:32:79:34 | buf | test.cpp:79:27:79:34 | buf | provenance | |
21-
| test.cpp:85:34:85:36 | buf | test.cpp:87:5:87:31 | access to array | provenance | |
22-
| test.cpp:85:34:85:36 | buf | test.cpp:88:5:88:27 | access to array | provenance | |
21+
| test.cpp:85:21:85:36 | (char *)... | test.cpp:87:5:87:31 | access to array | provenance | |
22+
| test.cpp:85:21:85:36 | (char *)... | test.cpp:88:5:88:27 | access to array | provenance | |
23+
| test.cpp:85:34:85:36 | buf | test.cpp:85:21:85:36 | (char *)... | provenance | |
2324
| test.cpp:96:13:96:15 | arr | test.cpp:96:13:96:18 | access to array | provenance | |
2425
| test.cpp:111:17:111:19 | arr | test.cpp:111:17:111:22 | access to array | provenance | |
2526
| test.cpp:111:17:111:19 | arr | test.cpp:115:35:115:40 | access to array | provenance | |
@@ -32,17 +33,21 @@ edges
3233
| test.cpp:119:17:119:19 | arr | test.cpp:119:17:119:22 | access to array | provenance | |
3334
| test.cpp:128:9:128:11 | arr | test.cpp:128:9:128:14 | access to array | provenance | |
3435
| test.cpp:134:25:134:27 | arr | test.cpp:136:9:136:16 | ... += ... | provenance | |
36+
| test.cpp:136:9:136:16 | ... += ... | test.cpp:136:9:136:16 | ... += ... | provenance | |
3537
| test.cpp:136:9:136:16 | ... += ... | test.cpp:138:13:138:15 | arr | provenance | |
3638
| test.cpp:143:18:143:21 | asdf | test.cpp:134:25:134:27 | arr | provenance | |
3739
| test.cpp:143:18:143:21 | asdf | test.cpp:143:18:143:21 | asdf | provenance | |
3840
| test.cpp:146:26:146:26 | *p | test.cpp:147:4:147:9 | -- ... | provenance | |
3941
| test.cpp:156:12:156:14 | buf | test.cpp:156:12:156:18 | ... + ... | provenance | |
42+
| test.cpp:156:12:156:18 | ... + ... | test.cpp:156:12:156:18 | ... + ... | provenance | |
4043
| test.cpp:156:12:156:18 | ... + ... | test.cpp:158:17:158:18 | *& ... | provenance | |
4144
| test.cpp:158:17:158:18 | *& ... | test.cpp:146:26:146:26 | *p | provenance | |
42-
| test.cpp:218:23:218:28 | buffer | test.cpp:220:5:220:11 | access to array | provenance | |
43-
| test.cpp:218:23:218:28 | buffer | test.cpp:221:5:221:11 | access to array | provenance | |
44-
| test.cpp:229:25:229:29 | array | test.cpp:231:5:231:10 | access to array | provenance | |
45-
| test.cpp:229:25:229:29 | array | test.cpp:232:5:232:10 | access to array | provenance | |
45+
| test.cpp:218:16:218:28 | (int *)... | test.cpp:220:5:220:11 | access to array | provenance | |
46+
| test.cpp:218:16:218:28 | (int *)... | test.cpp:221:5:221:11 | access to array | provenance | |
47+
| test.cpp:218:23:218:28 | buffer | test.cpp:218:16:218:28 | (int *)... | provenance | |
48+
| test.cpp:229:17:229:29 | (vec2 *)... | test.cpp:231:5:231:10 | access to array | provenance | |
49+
| test.cpp:229:17:229:29 | (vec2 *)... | test.cpp:232:5:232:10 | access to array | provenance | |
50+
| test.cpp:229:25:229:29 | array | test.cpp:229:17:229:29 | (vec2 *)... | provenance | |
4651
| test.cpp:245:30:245:30 | p | test.cpp:261:27:261:30 | access to array | provenance | |
4752
| test.cpp:245:30:245:30 | p | test.cpp:261:27:261:30 | access to array | provenance | |
4853
| test.cpp:274:14:274:20 | buffer3 | test.cpp:245:30:245:30 | p | provenance | |
@@ -61,13 +66,16 @@ edges
6166
| test.cpp:306:20:306:23 | arr1 | test.cpp:306:20:306:23 | arr1 | provenance | |
6267
| test.cpp:309:20:309:23 | arr2 | test.cpp:292:25:292:27 | arr | provenance | |
6368
| test.cpp:309:20:309:23 | arr2 | test.cpp:309:20:309:23 | arr2 | provenance | |
69+
| test.cpp:319:13:319:27 | ... = ... | test.cpp:325:24:325:26 | end | provenance | |
6470
| test.cpp:319:19:319:22 | temp | test.cpp:319:19:319:27 | ... + ... | provenance | |
6571
| test.cpp:319:19:319:22 | temp | test.cpp:324:23:324:32 | ... + ... | provenance | |
66-
| test.cpp:319:19:319:27 | ... + ... | test.cpp:325:24:325:26 | end | provenance | |
72+
| test.cpp:319:19:319:27 | ... + ... | test.cpp:319:13:319:27 | ... = ... | provenance | |
73+
| test.cpp:322:13:322:27 | ... = ... | test.cpp:325:24:325:26 | end | provenance | |
6774
| test.cpp:322:19:322:22 | temp | test.cpp:322:19:322:27 | ... + ... | provenance | |
6875
| test.cpp:322:19:322:22 | temp | test.cpp:324:23:324:32 | ... + ... | provenance | |
69-
| test.cpp:322:19:322:27 | ... + ... | test.cpp:325:24:325:26 | end | provenance | |
76+
| test.cpp:322:19:322:27 | ... + ... | test.cpp:322:13:322:27 | ... = ... | provenance | |
7077
| test.cpp:324:23:324:26 | temp | test.cpp:324:23:324:32 | ... + ... | provenance | |
78+
| test.cpp:324:23:324:32 | ... + ... | test.cpp:324:23:324:32 | ... + ... | provenance | |
7179
| test.cpp:324:23:324:32 | ... + ... | test.cpp:325:15:325:19 | temp2 | provenance | |
7280
nodes
7381
| test.cpp:34:5:34:24 | access to array | semmle.label | access to array |
@@ -103,6 +111,7 @@ nodes
103111
| test.cpp:77:32:77:34 | buf | semmle.label | buf |
104112
| test.cpp:79:27:79:34 | buf | semmle.label | buf |
105113
| test.cpp:79:32:79:34 | buf | semmle.label | buf |
114+
| test.cpp:85:21:85:36 | (char *)... | semmle.label | (char *)... |
106115
| test.cpp:85:34:85:36 | buf | semmle.label | buf |
107116
| test.cpp:87:5:87:31 | access to array | semmle.label | access to array |
108117
| test.cpp:88:5:88:27 | access to array | semmle.label | access to array |
@@ -118,17 +127,21 @@ nodes
118127
| test.cpp:128:9:128:14 | access to array | semmle.label | access to array |
119128
| test.cpp:134:25:134:27 | arr | semmle.label | arr |
120129
| test.cpp:136:9:136:16 | ... += ... | semmle.label | ... += ... |
130+
| test.cpp:136:9:136:16 | ... += ... | semmle.label | ... += ... |
121131
| test.cpp:138:13:138:15 | arr | semmle.label | arr |
122132
| test.cpp:143:18:143:21 | asdf | semmle.label | asdf |
123133
| test.cpp:143:18:143:21 | asdf | semmle.label | asdf |
124134
| test.cpp:146:26:146:26 | *p | semmle.label | *p |
125135
| test.cpp:147:4:147:9 | -- ... | semmle.label | -- ... |
126136
| test.cpp:156:12:156:14 | buf | semmle.label | buf |
127137
| test.cpp:156:12:156:18 | ... + ... | semmle.label | ... + ... |
138+
| test.cpp:156:12:156:18 | ... + ... | semmle.label | ... + ... |
128139
| test.cpp:158:17:158:18 | *& ... | semmle.label | *& ... |
140+
| test.cpp:218:16:218:28 | (int *)... | semmle.label | (int *)... |
129141
| test.cpp:218:23:218:28 | buffer | semmle.label | buffer |
130142
| test.cpp:220:5:220:11 | access to array | semmle.label | access to array |
131143
| test.cpp:221:5:221:11 | access to array | semmle.label | access to array |
144+
| test.cpp:229:17:229:29 | (vec2 *)... | semmle.label | (vec2 *)... |
132145
| test.cpp:229:25:229:29 | array | semmle.label | array |
133146
| test.cpp:231:5:231:10 | access to array | semmle.label | access to array |
134147
| test.cpp:232:5:232:10 | access to array | semmle.label | access to array |
@@ -152,12 +165,15 @@ nodes
152165
| test.cpp:306:20:306:23 | arr1 | semmle.label | arr1 |
153166
| test.cpp:309:20:309:23 | arr2 | semmle.label | arr2 |
154167
| test.cpp:309:20:309:23 | arr2 | semmle.label | arr2 |
168+
| test.cpp:319:13:319:27 | ... = ... | semmle.label | ... = ... |
155169
| test.cpp:319:19:319:22 | temp | semmle.label | temp |
156170
| test.cpp:319:19:319:27 | ... + ... | semmle.label | ... + ... |
171+
| test.cpp:322:13:322:27 | ... = ... | semmle.label | ... = ... |
157172
| test.cpp:322:19:322:22 | temp | semmle.label | temp |
158173
| test.cpp:322:19:322:27 | ... + ... | semmle.label | ... + ... |
159174
| test.cpp:324:23:324:26 | temp | semmle.label | temp |
160175
| test.cpp:324:23:324:32 | ... + ... | semmle.label | ... + ... |
176+
| test.cpp:324:23:324:32 | ... + ... | semmle.label | ... + ... |
161177
| test.cpp:325:15:325:19 | temp2 | semmle.label | temp2 |
162178
| test.cpp:325:24:325:26 | end | semmle.label | end |
163179
| test.cpp:325:24:325:26 | end | semmle.label | end |

‎cpp/ql/test/experimental/query-tests/Security/CWE/CWE-359/semmle/tests/PrivateCleartextWrite.expected‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
edges
2-
| test.cpp:45:18:45:23 | buffer | test.cpp:45:7:45:10 | *func | provenance | |
3-
| test.cpp:74:24:74:30 | medical | test.cpp:78:24:78:27 | temp | provenance | |
2+
| test.cpp:45:18:45:23 | buffer | test.cpp:47:10:47:15 | buffer | provenance | |
3+
| test.cpp:47:10:47:15 | buffer | test.cpp:45:7:45:10 | *func | provenance | |
4+
| test.cpp:74:24:74:30 | medical | test.cpp:77:16:77:22 | medical | provenance | |
45
| test.cpp:74:24:74:30 | medical | test.cpp:81:22:81:28 | medical | provenance | |
6+
| test.cpp:77:16:77:22 | medical | test.cpp:77:16:77:22 | medical | provenance | |
57
| test.cpp:77:16:77:22 | medical | test.cpp:78:24:78:27 | temp | provenance | |
68
| test.cpp:77:16:77:22 | medical | test.cpp:81:22:81:28 | medical | provenance | |
9+
| test.cpp:81:17:81:20 | call to func | test.cpp:81:17:81:20 | call to func | provenance | |
710
| test.cpp:81:17:81:20 | call to func | test.cpp:82:24:82:28 | buff5 | provenance | |
811
| test.cpp:81:22:81:28 | medical | test.cpp:45:18:45:23 | buffer | provenance | |
912
| test.cpp:81:22:81:28 | medical | test.cpp:81:17:81:20 | call to func | provenance | |
@@ -12,12 +15,15 @@ edges
1215
nodes
1316
| test.cpp:45:7:45:10 | *func | semmle.label | *func |
1417
| test.cpp:45:18:45:23 | buffer | semmle.label | buffer |
18+
| test.cpp:47:10:47:15 | buffer | semmle.label | buffer |
1519
| test.cpp:57:9:57:18 | theZipcode | semmle.label | theZipcode |
1620
| test.cpp:74:24:74:30 | medical | semmle.label | medical |
1721
| test.cpp:74:24:74:30 | medical | semmle.label | medical |
1822
| test.cpp:77:16:77:22 | medical | semmle.label | medical |
23+
| test.cpp:77:16:77:22 | medical | semmle.label | medical |
1924
| test.cpp:78:24:78:27 | temp | semmle.label | temp |
2025
| test.cpp:81:17:81:20 | call to func | semmle.label | call to func |
26+
| test.cpp:81:17:81:20 | call to func | semmle.label | call to func |
2127
| test.cpp:81:22:81:28 | medical | semmle.label | medical |
2228
| test.cpp:82:24:82:28 | buff5 | semmle.label | buff5 |
2329
| test.cpp:96:37:96:46 | theZipcode | semmle.label | theZipcode |

0 commit comments

Comments
 (0)