Skip to content

Commit af073b7

Browse files
fabienpefabienpe
authored
Merge branch 'main' into main
2 parents 9a37682 + 3d3f07a commit af073b7

File tree

444 files changed

+10097
-3542
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

444 files changed

+10097
-3542
lines changed

‎cpp/ql/lib/semmle/code/cpp/commons/Buffer.qll

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,11 @@ private Class getRootType(FieldAccess fa) {
4949
exists(VariableAccess root |
5050
root = fa.getQualifier+() and
5151
not exists(root.getQualifier()) and
52-
result = root.getUnspecifiedType()
52+
// We strip the type because the root may be a pointer. For example `p` in:
53+
// struct S { char buffer[10]; };
54+
// S* p = ...;
55+
// strcpy(p->buffer, "abc");
56+
result = root.getUnspecifiedType().stripType()
5357
)
5458
}
5559

‎cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,9 @@ where
171171
not arg.isAffectedByMacro() and
172172
not arg.isFromUninstantiatedTemplate(_) and
173173
not actual.stripType() instanceof ErroneousType and
174-
not arg.(Call).mayBeFromImplicitlyDeclaredFunction()
174+
not arg.(Call).mayBeFromImplicitlyDeclaredFunction() and
175+
// Make sure that the format function definition is consistent
176+
count(ffc.getTarget().getFormatParameterIndex()) = 1
175177
select arg,
176178
"This format specifier for type '" + expected.getName() + "' does not match the argument type '" +
177179
actual.getUnspecifiedType().getName() + "'."

‎cpp/ql/src/change-notes/2025-01-31-format-args.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* The "Wrong type of arguments to formatting function" query (`cpp/wrong-type-format-argument`) now produces fewer FPs if the formatting function has multiple definitions.

‎cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests.c

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,21 @@ void f(UNKNOWN_CHAR * str) {
1010
fprintf(0, "%s", ""); // GOOD
1111
printf("%s", str); // GOOD - erroneous type is ignored
1212
}
13+
14+
#define va_list void*
15+
#define va_start(x, y) x = 0;
16+
#define va_arg(x, y) ((y)x)
17+
#define va_end(x)
18+
int vprintf(const char * format, va_list args);
19+
20+
int my_printf(const char * format, ...) {
21+
va_list args;
22+
va_start(args, format);
23+
int result = vprintf(format, args);
24+
va_end(args);
25+
return result;
26+
}
27+
28+
void linker_awareness_test() {
29+
my_printf("%s%d", "", 1); // GOOD
30+
}

‎cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests2.c

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#define va_list void*
2+
#define va_start(x, y) x = 0;
3+
#define va_arg(x, y) ((y)x)
4+
#define va_end(x)
5+
6+
int vprintf(const char * format, va_list args);
7+
8+
int my_printf(void * p,const char * format, ...) {
9+
va_list args;
10+
va_start(args, format);
11+
int result = vprintf(format, args);
12+
va_end(args);
13+
return result;
14+
}

‎csharp/documentation/library-coverage/coverage.csv

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,5 +48,5 @@ MySql.Data.MySqlClient,48,,,,,,,,,,,,48,,,,,,,,,,
4848
Newtonsoft.Json,,,91,,,,,,,,,,,,,,,,,,,73,18
4949
ServiceStack,194,,7,27,,,,,75,,,,92,,,,,,,,,7,
5050
SourceGenerators,,,5,,,,,,,,,,,,,,,,,,,,5
51-
System,54,47,10819,,6,5,5,,,4,1,,33,2,,6,15,17,4,3,,5512,5307
51+
System,54,47,10864,,6,5,5,,,4,1,,33,2,,6,15,17,4,3,,5547,5317
5252
Windows.Security.Cryptography.Core,1,,,,,,,1,,,,,,,,,,,,,,,

‎csharp/documentation/library-coverage/coverage.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ C# framework & library support
88

99
Framework / library,Package,Flow sources,Taint & value steps,Sinks (total),`CWE-079` :sub:`Cross-site scripting`
1010
`ServiceStack <https://servicestack.net/>`_,"``ServiceStack.*``, ``ServiceStack``",,7,194,
11-
System,"``System.*``, ``System``",47,10819,54,5
11+
System,"``System.*``, ``System``",47,10864,54,5
1212
Others,"``Amazon.Lambda.APIGatewayEvents``, ``Amazon.Lambda.Core``, ``Dapper``, ``ILCompiler``, ``ILLink.RoslynAnalyzer``, ``ILLink.Shared``, ``ILLink.Tasks``, ``Internal.IL``, ``Internal.Pgo``, ``Internal.TypeSystem``, ``JsonToItemsTaskFactory``, ``Microsoft.Android.Build``, ``Microsoft.Apple.Build``, ``Microsoft.ApplicationBlocks.Data``, ``Microsoft.AspNetCore.Components``, ``Microsoft.AspNetCore.Http``, ``Microsoft.AspNetCore.Mvc``, ``Microsoft.AspNetCore.WebUtilities``, ``Microsoft.CSharp``, ``Microsoft.Diagnostics.Tools.Pgo``, ``Microsoft.DotNet.Build.Tasks``, ``Microsoft.DotNet.PlatformAbstractions``, ``Microsoft.EntityFrameworkCore``, ``Microsoft.Extensions.Caching.Distributed``, ``Microsoft.Extensions.Caching.Memory``, ``Microsoft.Extensions.Configuration``, ``Microsoft.Extensions.DependencyInjection``, ``Microsoft.Extensions.DependencyModel``, ``Microsoft.Extensions.Diagnostics.Metrics``, ``Microsoft.Extensions.FileProviders``, ``Microsoft.Extensions.FileSystemGlobbing``, ``Microsoft.Extensions.Hosting``, ``Microsoft.Extensions.Http``, ``Microsoft.Extensions.Logging``, ``Microsoft.Extensions.Options``, ``Microsoft.Extensions.Primitives``, ``Microsoft.Interop``, ``Microsoft.JSInterop``, ``Microsoft.NET.Build.Tasks``, ``Microsoft.NET.Sdk.WebAssembly``, ``Microsoft.NET.WebAssembly.Webcil``, ``Microsoft.VisualBasic``, ``Microsoft.WebAssembly.Build.Tasks``, ``Microsoft.Win32``, ``Mono.Linker``, ``MySql.Data.MySqlClient``, ``Newtonsoft.Json``, ``SourceGenerators``, ``Windows.Security.Cryptography.Core``",61,2075,152,4
13-
Totals,,108,12901,400,9
13+
Totals,,108,12946,400,9
1414

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Accessor.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,10 @@ protected Accessor(Context cx, IMethodSymbol init, IPropertySymbol property)
3030
return props.SingleOrDefault();
3131
}
3232

33+
public override bool NeedsPopulation =>
34+
base.NeedsPopulation &&
35+
!Symbol.IsPartialDefinition; // Accessors always have an implementing declaration as well.
36+
3337
public override void Populate(TextWriter trapFile)
3438
{
3539
PopulateMethod(trapFile);

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Indexer.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,16 @@ public override void Populate(TextWriter trapFile)
2222
foreach (var l in Locations)
2323
trapFile.indexer_location(this, l);
2424

25-
var getter = Symbol.GetMethod;
26-
var setter = Symbol.SetMethod;
25+
var getter = BodyDeclaringSymbol.GetMethod;
26+
var setter = BodyDeclaringSymbol.SetMethod;
2727

2828
if (getter is null && setter is null)
2929
Context.ModelError(Symbol, "No indexer accessor defined");
3030

31-
if (!(getter is null))
31+
if (getter is not null)
3232
Method.Create(Context, getter);
3333

34-
if (!(setter is null))
34+
if (setter is not null)
3535
Method.Create(Context, setter);
3636

3737
for (var i = 0; i < Symbol.Parameters.Length; ++i)

‎csharp/extractor/Semmle.Extraction.CSharp/Entities/Property.cs

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,10 @@ protected Property(Context cx, IPropertySymbol init)
2121

2222
private Type Type => type.Value;
2323

24+
protected override IPropertySymbol BodyDeclaringSymbol => Symbol.PartialImplementationPart ?? Symbol;
25+
26+
public override Microsoft.CodeAnalysis.Location? ReportingLocation => BodyDeclaringSymbol.Locations.BestOrDefault();
27+
2428
public override void WriteId(EscapingTextWriter trapFile)
2529
{
2630
trapFile.WriteSubId(Type);
@@ -43,13 +47,13 @@ public override void Populate(TextWriter trapFile)
4347
var type = Type;
4448
trapFile.properties(this, Symbol.GetName(), ContainingType!, type.TypeRef, Create(Context, Symbol.OriginalDefinition));
4549

46-
var getter = Symbol.GetMethod;
47-
var setter = Symbol.SetMethod;
50+
var getter = BodyDeclaringSymbol.GetMethod;
51+
var setter = BodyDeclaringSymbol.SetMethod;
4852

49-
if (!(getter is null))
53+
if (getter is not null)
5054
Method.Create(Context, getter);
5155

52-
if (!(setter is null))
56+
if (setter is not null)
5357
Method.Create(Context, setter);
5458

5559
var declSyntaxReferences = IsSourceDeclaration ?

‎csharp/ql/lib/change-notes/2025-01-22-partial-members.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* C# 13: Added support for partial properties and indexers.

‎csharp/ql/lib/change-notes/2025-01-29-params-models.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
C# 13: Added MaD models for some overload implementations using `ReadOnlySpan` parameters (like `String.Format(System.String, System.ReadOnlySpan<System.Object>))`).

‎csharp/ql/lib/ext/System.IO.model.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ extensions:
6363
- ["System.IO", "Path", False, "Combine", "(System.String,System.String,System.String,System.String)", "", "Argument[2]", "ReturnValue", "taint", "manual"]
6464
- ["System.IO", "Path", False, "Combine", "(System.String,System.String,System.String,System.String)", "", "Argument[3]", "ReturnValue", "taint", "manual"]
6565
- ["System.IO", "Path", False, "Combine", "(System.String[])", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
66+
- ["System.IO", "Path", False, "Combine", "(System.ReadOnlySpan<System.String>)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
6667
- ["System.IO", "Path", False, "GetDirectoryName", "(System.ReadOnlySpan<System.Char>)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
6768
- ["System.IO", "Path", False, "GetDirectoryName", "(System.String)", "", "Argument[0]", "ReturnValue", "taint", "manual"]
6869
- ["System.IO", "Path", False, "GetExtension", "(System.ReadOnlySpan<System.Char>)", "", "Argument[0].Element", "ReturnValue", "taint", "manual"]
@@ -96,6 +97,7 @@ extensions:
9697
- ["System.IO", "Stream", True, "ReadExactly", "(System.Span<System.Byte>)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
9798
- ["System.IO", "Stream", True, "ReadExactly", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[this]", "Argument[0].Element", "taint", "manual"]
9899
- ["System.IO", "Stream", True, "Write", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
100+
- ["System.IO", "Stream", True, "Write", "(System.ReadOnlySpan<System.Byte>)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
99101
- ["System.IO", "Stream", False, "WriteAsync", "(System.Byte[],System.Int32,System.Int32)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
100102
- ["System.IO", "Stream", True, "WriteAsync", "(System.Byte[],System.Int32,System.Int32,System.Threading.CancellationToken)", "", "Argument[0].Element", "Argument[this]", "taint", "manual"]
101103
- ["System.IO", "StreamReader", False, "StreamReader", "(System.IO.Stream)", "", "Argument[0]", "Argument[this]", "taint", "manual"]

‎csharp/ql/lib/ext/System.Text.model.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,15 @@ extensions:
7070
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.String,System.Object[])", "", "Argument[1]", "Argument[this]", "taint", "manual"]
7171
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.String,System.Object[])", "", "Argument[2].Element", "Argument[this]", "taint", "manual"]
7272
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.String,System.Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
73+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[1]", "Argument[this]", "taint", "manual"]
74+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[2].Element", "Argument[this]", "taint", "manual"]
75+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
76+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.Text.CompositeFormat,System.Object[])", "", "Argument[1]", "Argument[this]", "taint", "manual"]
77+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.Text.CompositeFormat,System.Object[])", "", "Argument[2].Element", "Argument[this]", "taint", "manual"]
78+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.Text.CompositeFormat,System.Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
79+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.Text.CompositeFormat,System.ReadOnlySpan<System.Object>)", "", "Argument[1]", "Argument[this]", "taint", "manual"]
80+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.Text.CompositeFormat,System.ReadOnlySpan<System.Object>)", "", "Argument[2].Element", "Argument[this]", "taint", "manual"]
81+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.IFormatProvider,System.Text.CompositeFormat,System.ReadOnlySpan<System.Object>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
7382
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.Object)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
7483
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.Object)", "", "Argument[1]", "Argument[this]", "taint", "manual"]
7584
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.Object)", "", "Argument[this]", "ReturnValue", "value", "manual"]
@@ -85,16 +94,29 @@ extensions:
8594
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.Object[])", "", "Argument[0]", "Argument[this]", "taint", "manual"]
8695
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.Object[])", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
8796
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
97+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
98+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
99+
- ["System.Text", "StringBuilder", False, "AppendFormat", "(System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
88100
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.Object[])", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
89101
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
102+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.ReadOnlySpan<System.Object>)", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
103+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.ReadOnlySpan<System.Object>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
90104
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.String[])", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
91105
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.String[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
106+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.ReadOnlySpan<System.String>)", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
107+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.Char,System.ReadOnlySpan<System.String>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
92108
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.Object[])", "", "Argument[0]", "Argument[this]", "taint", "manual"]
93109
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.Object[])", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
94110
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
111+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
112+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
113+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.ReadOnlySpan<System.Object>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
95114
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.String[])", "", "Argument[0]", "Argument[this]", "taint", "manual"]
96115
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.String[])", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
97116
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.String[])", "", "Argument[this]", "ReturnValue", "value", "manual"]
117+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.ReadOnlySpan<System.String>)", "", "Argument[0]", "Argument[this]", "taint", "manual"]
118+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.ReadOnlySpan<System.String>)", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
119+
- ["System.Text", "StringBuilder", False, "AppendJoin", "(System.String,System.ReadOnlySpan<System.String>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
98120
- ["System.Text", "StringBuilder", False, "AppendJoin<T>", "(System.Char,System.Collections.Generic.IEnumerable<T>)", "", "Argument[1].Element", "Argument[this]", "taint", "manual"]
99121
- ["System.Text", "StringBuilder", False, "AppendJoin<T>", "(System.Char,System.Collections.Generic.IEnumerable<T>)", "", "Argument[this]", "ReturnValue", "value", "manual"]
100122
- ["System.Text", "StringBuilder", False, "AppendJoin<T>", "(System.String,System.Collections.Generic.IEnumerable<T>)", "", "Argument[0]", "Argument[this]", "taint", "manual"]

0 commit comments

Comments
 (0)