Skip to content

Commit e0013ee

Browse files
henrymercerhenrymercer
authored
Merge pull request #17294 from github/codeql-cli-2.18.3
Merge `codeql-cli-2.18.3` back into `rc/3.15`
2 parents 55d3251 + 92910f9 commit e0013ee

File tree

72 files changed

+846
-1557
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+846
-1557
lines changed

‎csharp/ql/lib/semmle/code/csharp/dataflow/internal/DataFlowPrivate.qll‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2170,11 +2170,9 @@ predicate jumpStep(Node pred, Node succ) {
21702170
f.getAnAssignedValue() = pred.asExpr() and
21712171
succ = TFlowInsensitiveFieldNode(f)
21722172
or
2173-
exists(FieldOrPropertyRead fr | f.getAnAccess() = fr |
2174-
fr = pred.(PostUpdateNode).getPreUpdateNode().asExpr() and
2175-
succ = TFlowInsensitiveFieldNode(f)
2176-
or
2173+
exists(FieldOrPropertyRead fr |
21772174
pred = TFlowInsensitiveFieldNode(f) and
2175+
f.getAnAccess() = fr and
21782176
fr = succ.asExpr() and
21792177
fr.hasNonlocalValue()
21802178
)

‎csharp/ql/test/library-tests/dataflow/fields/FieldFlow.expected‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1152,16 +1152,6 @@ edges
11521152
| J.cs:125:14:125:14 | access to local variable a : Int32[] [element] : Int32 | J.cs:125:14:125:17 | access to array element : Int32 | provenance | |
11531153
| J.cs:125:14:125:17 | access to array element : Int32 | J.cs:125:14:125:17 | (...) ... | provenance | |
11541154
| J.cs:125:14:125:17 | access to array element : Int32 | J.cs:125:14:125:17 | (...) ... | provenance | |
1155-
| K.cs:7:13:7:13 | access to local variable o : String | K.cs:8:22:8:22 | access to local variable o : String | provenance | |
1156-
| K.cs:7:13:7:13 | access to local variable o : String | K.cs:8:22:8:22 | access to local variable o : String | provenance | |
1157-
| K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:7:13:7:13 | access to local variable o : String | provenance | |
1158-
| K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:7:13:7:13 | access to local variable o : String | provenance | |
1159-
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | provenance | |
1160-
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | provenance | |
1161-
| K.cs:8:22:8:22 | access to local variable o : String | K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | provenance | |
1162-
| K.cs:8:22:8:22 | access to local variable o : String | K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | provenance | |
1163-
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | K.cs:13:14:13:23 | access to array element | provenance | |
1164-
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | K.cs:13:14:13:23 | access to array element | provenance | |
11651155
nodes
11661156
| A.cs:5:13:5:13 | access to local variable c : C | semmle.label | access to local variable c : C |
11671157
| A.cs:5:13:5:13 | access to local variable c : C | semmle.label | access to local variable c : C |
@@ -2403,18 +2393,6 @@ nodes
24032393
| J.cs:125:14:125:17 | (...) ... | semmle.label | (...) ... |
24042394
| J.cs:125:14:125:17 | access to array element : Int32 | semmle.label | access to array element : Int32 |
24052395
| J.cs:125:14:125:17 | access to array element : Int32 | semmle.label | access to array element : Int32 |
2406-
| K.cs:7:13:7:13 | access to local variable o : String | semmle.label | access to local variable o : String |
2407-
| K.cs:7:13:7:13 | access to local variable o : String | semmle.label | access to local variable o : String |
2408-
| K.cs:7:17:7:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
2409-
| K.cs:7:17:7:33 | call to method Source<String> : String | semmle.label | call to method Source<String> : String |
2410-
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | semmle.label | [post] access to field Strings : String[] [element] : String |
2411-
| K.cs:8:9:8:15 | [post] access to field Strings : String[] [element] : String | semmle.label | [post] access to field Strings : String[] [element] : String |
2412-
| K.cs:8:22:8:22 | access to local variable o : String | semmle.label | access to local variable o : String |
2413-
| K.cs:8:22:8:22 | access to local variable o : String | semmle.label | access to local variable o : String |
2414-
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | semmle.label | access to field Strings : String[] [element] : String |
2415-
| K.cs:13:14:13:20 | access to field Strings : String[] [element] : String | semmle.label | access to field Strings : String[] [element] : String |
2416-
| K.cs:13:14:13:23 | access to array element | semmle.label | access to array element |
2417-
| K.cs:13:14:13:23 | access to array element | semmle.label | access to array element |
24182396
subpaths
24192397
| A.cs:6:24:6:24 | access to local variable c : C | A.cs:147:32:147:32 | c : C | A.cs:149:20:149:27 | object creation of type B : B [field c] : C | A.cs:6:17:6:25 | call to method Make : B [field c] : C |
24202398
| A.cs:6:24:6:24 | access to local variable c : C | A.cs:147:32:147:32 | c : C | A.cs:149:20:149:27 | object creation of type B : B [field c] : C | A.cs:6:17:6:25 | call to method Make : B [field c] : C |
@@ -2670,5 +2648,3 @@ testFailures
26702648
| J.cs:107:14:107:17 | access to property Y | J.cs:105:32:105:48 | call to method Source<Object> : Object | J.cs:107:14:107:17 | access to property Y | $@ | J.cs:105:32:105:48 | call to method Source<Object> : Object | call to method Source<Object> : Object |
26712649
| J.cs:125:14:125:17 | (...) ... | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | J.cs:125:14:125:17 | (...) ... | $@ | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | call to method Source<Int32> : Int32 |
26722650
| J.cs:125:14:125:17 | (...) ... | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | J.cs:125:14:125:17 | (...) ... | $@ | J.cs:119:20:119:34 | call to method Source<Int32> : Int32 | call to method Source<Int32> : Int32 |
2673-
| K.cs:13:14:13:23 | access to array element | K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:13:14:13:23 | access to array element | $@ | K.cs:7:17:7:33 | call to method Source<String> : String | call to method Source<String> : String |
2674-
| K.cs:13:14:13:23 | access to array element | K.cs:7:17:7:33 | call to method Source<String> : String | K.cs:13:14:13:23 | access to array element | $@ | K.cs:7:17:7:33 | call to method Source<String> : String | call to method Source<String> : String |

‎csharp/ql/test/library-tests/dataflow/fields/K.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ private void M1()
1010

1111
private void M2()
1212
{
13-
Sink(Strings[0]); // $ hasValueFlow=1
13+
Sink(Strings[0]); // $ MISSING: hasValueFlow=1
1414
}
1515

1616
public static void Sink(object o) { }

‎docs/codeql/codeql-language-guides/analyzing-data-flow-in-cpp-new.rst‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.. _analyzing-data-flow-in-cpp-new:
2+
3+
:orphan:
4+
:nosearch:
5+
6+
Analyzing data flow in C and C++
7+
================================
8+
9+
This article has moved to a new location: https://codeql.github.com/docs/codeql-language-guides/analyzing-data-flow-in-cpp/.

‎docs/codeql/conf.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ def setup(sphinx):
6767

6868
# The language for content autogenerated by Sphinx. Refer to documentation
6969
# for a list of supported languages.
70-
language = None
70+
language = 'en'
7171

7272
# If true, `todo` and `todoList` produce output, else they produce nothing.
7373
todo_include_todos = False

‎go/ql/lib/change-notes/2024-08-24-ioutil-fix.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
category: fix
3+
---
4+
* Fixed an issue where `io/ioutil.WriteFile`'s non-path arguments incorrectly generated `go/path-injection` alerts when untrusted data was written to a file, or controlled the file's mode.
5+

‎go/ql/lib/ext/database.sql.driver.model.yml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,4 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/go-all
4-
extensible: sinkModel
5-
data:
6-
- ["database/sql/driver", "Execer", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
7-
- ["database/sql/driver", "ExecerContext", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
8-
- ["database/sql/driver", "Conn", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
9-
- ["database/sql/driver", "ConnPrepareContext", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
10-
- ["database/sql/driver", "Queryer", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
11-
- ["database/sql/driver", "QueryerContext", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
122
- addsTo:
133
pack: codeql/go-all
144
extensible: summaryModel

‎go/ql/lib/ext/database.sql.model.yml‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,4 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/go-all
4-
extensible: sinkModel
5-
data:
6-
- ["database/sql", "Conn", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
7-
- ["database/sql", "Conn", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
8-
- ["database/sql", "Conn", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
9-
- ["database/sql", "Conn", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
10-
- ["database/sql", "Conn", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
11-
- ["database/sql", "Conn", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
12-
- ["database/sql", "Conn", False, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
13-
- ["database/sql", "Conn", False, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
14-
- ["database/sql", "DB", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
15-
- ["database/sql", "DB", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
16-
- ["database/sql", "DB", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
17-
- ["database/sql", "DB", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
18-
- ["database/sql", "DB", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
19-
- ["database/sql", "DB", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
20-
- ["database/sql", "DB", False, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
21-
- ["database/sql", "DB", False, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
22-
- ["database/sql", "Tx", False, "Exec", "", "", "Argument[0]", "sql-injection", "manual"]
23-
- ["database/sql", "Tx", False, "ExecContext", "", "", "Argument[1]", "sql-injection", "manual"]
24-
- ["database/sql", "Tx", False, "Prepare", "", "", "Argument[0]", "sql-injection", "manual"]
25-
- ["database/sql", "Tx", False, "PrepareContext", "", "", "Argument[1]", "sql-injection", "manual"]
26-
- ["database/sql", "Tx", False, "Query", "", "", "Argument[0]", "sql-injection", "manual"]
27-
- ["database/sql", "Tx", False, "QueryContext", "", "", "Argument[1]", "sql-injection", "manual"]
28-
- ["database/sql", "Tx", False, "QueryRow", "", "", "Argument[0]", "sql-injection", "manual"]
29-
- ["database/sql", "Tx", False, "QueryRowContext", "", "", "Argument[1]", "sql-injection", "manual"]
302
- addsTo:
313
pack: codeql/go-all
324
extensible: summaryModel

‎go/ql/lib/ext/fmt.model.yml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,4 @@
11
extensions:
2-
- addsTo:
3-
pack: codeql/go-all
4-
extensible: sinkModel
5-
data:
6-
- ["fmt", "", False, "Print", "", "", "Argument[0]", "log-injection", "manual"]
7-
- ["fmt", "", False, "Printf", "", "", "Argument[0..1]", "log-injection", "manual"]
8-
- ["fmt", "", False, "Println", "", "", "Argument[0]", "log-injection", "manual"]
92
- addsTo:
103
pack: codeql/go-all
114
extensible: summaryModel

‎go/ql/lib/ext/github.com.beego.beego.client.orm.model.yml‎

Lines changed: 0 additions & 42 deletions
This file was deleted.

0 commit comments

Comments
 (0)