Skip to content

Commit 989e004

Browse files
jketemajketema
committed
Merge branch 'main' into next
2 parents 0f4fa00 + fc282a6 commit 989e004

File tree

78 files changed

+1087
-364
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

78 files changed

+1087
-364
lines changed

‎.github/workflows/bump-version.yml

-33
This file was deleted.

‎.github/workflows/code-scanning-pack-gen.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -99,8 +99,8 @@ jobs:
9999
run: |
100100
PATH=$PATH:$CODEQL_HOME/codeql
101101
102-
codeql query compile --threads 0 cpp
103-
codeql query compile --threads 0 c
102+
codeql query compile --precompile --threads 0 cpp
103+
codeql query compile --precompile --threads 0 c
104104
105105
cd ..
106106
zip -r codeql-coding-standards/code-scanning-cpp-query-pack.zip codeql-coding-standards/c/ codeql-coding-standards/cpp/ codeql-coding-standards/.codeqlmanifest.json codeql-coding-standards/supported_codeql_configs.json codeql-coding-standards/scripts/configuration codeql-coding-standards/scripts/reports codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/guideline_recategorization codeql-coding-standards/scripts/shared codeql-coding-standards/scripts/schemas

‎.github/workflows/finalize-release.yml

+60-13
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,12 @@ on:
99
inputs:
1010
ref:
1111
description: |
12-
The release branch to finalize.
12+
The ref of release to finalize (e.g., 'rc/MAJOR.MINOR.PATCH').
1313
required: true
14+
tool-ref:
15+
description: |
16+
The ref to the tooling to use for the finalize (e.g., 'rc/MAJOR.MINOR.PATCH').
17+
required: false
1418

1519
jobs:
1620
finalize-release:
@@ -20,34 +24,56 @@ jobs:
2024
- name: Determine ref
2125
env:
2226
REF_FROM_INPUT: ${{ inputs.ref }}
27+
TOOL_REF_FROM_INPUT: ${{ inputs.tool-ref }}
2328
REF_FROM_PR: ${{ github.event.pull_request.merge_commit_sha }}
2429
BASE_REF_FROM_PR: ${{ github.event.pull_request.base.ref }}
2530
run: |
2631
if [[ $GITHUB_EVENT_NAME == "workflow_dispatch" ]]; then
2732
echo "REF=$REF_FROM_INPUT" >> "$GITHUB_ENV"
33+
echo "TOOL_REF=$TOOL_REF_FROM_INPUT" >> "$GITHUB_ENV"
2834
echo "BASE_REF=$REF_FROM_INPUT" >> "$GITHUB_ENV"
2935
else
3036
echo "REF=$REF_FROM_PR" >> "$GITHUB_ENV"
37+
echo "TOOL_REF=$REF_FROM_PR" >> "$GITHUB_ENV"
3138
echo "BASE_REF=$BASE_REF_FROM_PR" >> "$GITHUB_ENV"
3239
fi
3340
3441
- name: Checkout
3542
uses: actions/checkout@v4
3643
with:
3744
ref: ${{ env.REF }}
45+
fetch-depth: 0
46+
path: release
47+
48+
- name: Checkout
49+
uses: actions/checkout@v4
50+
with:
51+
ref: ${{ env.TOOL_REF }}
52+
path: tooling
53+
54+
- name: Install Python
55+
uses: actions/setup-python@v4
56+
with:
57+
python-version: "3.9"
58+
59+
- name: Install dependencies
60+
run: pip install -r scripts/release/requirements.txt
61+
working-directory: tooling
3862

3963
- name: Configure git
4064
run: |
4165
git config user.name "$GITHUB_ACTOR"
4266
git config user.email "[email protected]"
67+
working-directory: release
4368

4469
- name: Update release tag
4570
run: |
4671
version=${BASE_REF#rc/}
4772
echo "Creating release tag v$version"
4873
49-
git tag -a v$version -m "Release v$version"
50-
git push -f origin v$version
74+
git tag -f -a v$version -m "Release v$version"
75+
git push --force origin v$version
76+
working-directory: release
5177

5278
- name: Finalize release
5379
env:
@@ -57,30 +83,51 @@ jobs:
5783
echo "Finalizing release v$version"
5884
5985
gh release edit "v$version" --draft=false --tag=v$version
86+
working-directory: release
6087

6188
- name: Determine if release was a hotfix release
6289
run: |
6390
version=${BASE_REF#rc/}
64-
echo "HOTFIX_RELEASE=$(python scripts/release/is-hotfix.py $version)" >> "$GITHUB_ENV"
91+
# We are running the script in the tooling directory with the release directory as the working directory
92+
echo "HOTFIX_RELEASE=$(python ../tooling/scripts/release/is-hotfix-release.py $version)" >> "$GITHUB_ENV"
93+
working-directory: release
94+
95+
- name: Determine next release version
96+
if: env.HOTFIX_RELEASE == 'false'
97+
run: |
98+
version=${BASE_REF#rc/}
99+
next_version=$(python scripts/release/next-version.py --component minor --pre-release dev -- $version)
100+
echo "NEXT_VERSION=$next_version" >> "$GITHUB_ENV"
101+
working-directory: tooling
102+
103+
- name: Generate token
104+
if: env.HOTFIX_RELEASE == 'false'
105+
id: generate-token
106+
uses: actions/create-github-app-token@eaddb9eb7e4226c68cf4b39f167c83e5bd132b3e
107+
with:
108+
app-id: ${{ vars.AUTOMATION_APP_ID }}
109+
private-key: ${{ secrets.AUTOMATION_PRIVATE_KEY }}
110+
owner: ${{ github.repository_owner }}
111+
repositories: "codeql-coding-standards"
65112

66113
- name: Bump main version
67114
if: env.HOTFIX_RELEASE == 'false'
68115
env:
69-
GH_TOKEN: ${{ github.token }}
116+
GH_TOKEN: ${{ steps.generate-token.outputs.token }}
70117
run: |
71-
version=${BASE_REF#rc/}
72-
next_version="$version-dev"
73-
echo "Bumping main version to $next_version"
118+
echo "Bumping main version to $NEXT_VERSION"
74119
75120
git switch main
76121
git pull --ff-only origin main
77122
78-
git switch -c release-automation/bump-version
123+
git switch -c "release-automation/bump-version-to-$NEXT_VERSION"
79124
80-
./scripts/release/bump-version.sh "$next_version"
125+
# We are running the script in the tooling directory with the release directory as the working directory
126+
../tooling/scripts/release/bump-version.sh "$NEXT_VERSION"
81127
82128
git add -u .
83-
git commit -m "Bump version to $next_version"
84-
git push --set-upstream origin release-automation/bump-version
129+
git commit -m "Bump version to $NEXT_VERSION"
130+
git push --set-upstream origin "release-automation/bump-version-to-$NEXT_VERSION"
85131
86-
gh pr create --repo $GITHUB_REPOSITORY --base main --head release-automation/bump-version --body "Bump the version of main to the dev label of the just released version $next_version" --title "Bump version to $next_version"
132+
gh pr create --repo $GITHUB_REPOSITORY --base main --head "release-automation/bump-version-to-$NEXT_VERSION" --body "Bump the version of main to $NEXT_VERSION" --title "Bump version to $NEXT_VERSION"
133+
working-directory: release

‎.github/workflows/update-release.yml

+2-1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ jobs:
3131
uses: actions/checkout@v4
3232
with:
3333
fetch-depth: 0 # We need the full history to compute the changelog
34+
ref: ${{ inputs.head-sha }}
3435

3536
- name: Install Python
3637
uses: actions/setup-python@v4
@@ -59,7 +60,7 @@ jobs:
5960
--layout scripts/release/release-layout.yml \
6061
--repo "$GITHUB_REPOSITORY" \
6162
--github-token "$GITHUB_REPOSITORY:$GITHUB_TOKEN" "github/codeql-coding-standards-release-engineering:$RELEASE_ENGINEERING_TOKEN" \
62-
--skip-checkrun "release-status"
63+
--skip-checkrun "release-status" "Update Release"
6364
6465
- name: Update release notes
6566
env:

‎c/cert/src/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cert-c-coding-standards
2-
version: 2.22.0-dev
2+
version: 2.29.0-dev
33
description: CERT C 2016
44
suites: codeql-suites
55
license: MIT

‎c/cert/src/rules/STR32-C/NonNullTerminatedToFunctionThatExpectsAString.ql

+81-22
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import codingstandards.c.cert
1717
import codingstandards.cpp.Naming
1818
import semmle.code.cpp.dataflow.TaintTracking
1919
import codingstandards.cpp.PossiblyUnsafeStringOperation
20+
import semmle.code.cpp.valuenumbering.GlobalValueNumbering
2021

2122
/**
2223
* Models a function that is part of the standard library that expects a
@@ -43,32 +44,90 @@ class ExpectsNullTerminatedStringAsArgumentFunctionCall extends FunctionCall {
4344
Expr getAnExpectingExpr() { result = e }
4445
}
4546

46-
from ExpectsNullTerminatedStringAsArgumentFunctionCall fc, Expr e, Expr target
47-
where
48-
target = fc.getAnExpectingExpr() and
49-
not isExcluded(fc, Strings1Package::nonNullTerminatedToFunctionThatExpectsAStringQuery()) and
50-
(
51-
exists(PossiblyUnsafeStringOperation op |
52-
// don't report violations of the same function call.
53-
not op = fc and
54-
e = op and
55-
TaintTracking::localTaint(DataFlow::exprNode(op.getAnArgument()), DataFlow::exprNode(target))
47+
class PossiblyUnsafeStringOperationSource extends Source {
48+
PossiblyUnsafeStringOperation op;
49+
50+
PossiblyUnsafeStringOperationSource() { this.asExpr() = op.getAnArgument() }
51+
52+
PossiblyUnsafeStringOperation getOp() { result = op }
53+
}
54+
55+
class CharArraySource extends Source {
56+
CharArrayInitializedWithStringLiteral op;
57+
58+
CharArraySource() {
59+
op.getContainerLength() <= op.getStringLiteralLength() and
60+
this.asExpr() = op
61+
}
62+
}
63+
64+
abstract class Source extends DataFlow::Node { }
65+
66+
class Sink extends DataFlow::Node {
67+
Sink() {
68+
exists(ExpectsNullTerminatedStringAsArgumentFunctionCall fc |
69+
fc.getAnExpectingExpr() = this.asExpr()
5670
)
57-
or
58-
exists(CharArrayInitializedWithStringLiteral op |
59-
e = op and
60-
op.getContainerLength() <= op.getStringLiteralLength() and
61-
TaintTracking::localTaint(DataFlow::exprNode(op), DataFlow::exprNode(target))
71+
}
72+
}
73+
74+
module MyFlowConfiguration implements DataFlow::ConfigSig {
75+
predicate isSink(DataFlow::Node sink) {
76+
sink instanceof Sink and
77+
//don't report violations of the same function call
78+
not sink instanceof Source
79+
}
80+
81+
predicate isSource(DataFlow::Node source) { source instanceof Source }
82+
83+
predicate isAdditionalFlowStep(DataFlow::Node innode, DataFlow::Node outnode) {
84+
exists(FunctionCall realloc, ReallocFunction fn |
85+
fn.getACallToThisFunction() = realloc and
86+
realloc.getArgument(0) = innode.asExpr() and
87+
realloc = outnode.asExpr()
6288
)
63-
) and
64-
// don't report cases flowing to this node where there is a flow from a
65-
// literal assignment of a null terminator
66-
not exists(AssignExpr aexp |
89+
}
90+
}
91+
92+
class ReallocFunction extends AllocationFunction {
93+
ReallocFunction() { exists(this.getReallocPtrArg()) }
94+
}
95+
96+
/**
97+
* Determines if the string is acceptably null terminated
98+
* The only condition we accept as a guarantee to null terminate is:
99+
* `str[size_expr] = '\0';`
100+
* where we do not check the value of the `size_expr` used
101+
*/
102+
predicate isGuarded(Expr guarded, Expr source) {
103+
exists(AssignExpr aexp |
67104
aexp.getLValue() instanceof ArrayExpr and
68105
aexp.getRValue() instanceof Zero and
69-
TaintTracking::localTaint(DataFlow::exprNode(aexp.getRValue()), DataFlow::exprNode(target)) and
70-
// this must be AFTER the operation causing the non-null termination to be valid.
71-
aexp.getAPredecessor*() = e
106+
// this must be AFTER the operation causing the non-null termination
107+
aexp.getAPredecessor+() = source and
108+
//this guards anything after it
109+
aexp.getASuccessor+() = guarded and
110+
// no reallocs exist after this because they will be conservatively assumed to make the buffer smaller and remove the likliehood of this properly terminating
111+
not exists(ReallocFunction realloc, FunctionCall fn |
112+
fn = realloc.getACallToThisFunction() and
113+
globalValueNumber(aexp.getLValue().(ArrayExpr).getArrayBase()) =
114+
globalValueNumber(fn.getArgument(0)) and
115+
aexp.getASuccessor+() = fn
116+
)
72117
)
118+
}
119+
120+
module MyFlow = TaintTracking::Global<MyFlowConfiguration>;
121+
122+
from
123+
DataFlow::Node source, DataFlow::Node sink, ExpectsNullTerminatedStringAsArgumentFunctionCall fc,
124+
Expr e
125+
where
126+
MyFlow::flow(source, sink) and
127+
sink.asExpr() = fc.getAnExpectingExpr() and
128+
not isGuarded(sink.asExpr(), source.asExpr()) and
129+
if source instanceof PossiblyUnsafeStringOperationSource
130+
then e = source.(PossiblyUnsafeStringOperationSource).getOp()
131+
else e = source.asExpr()
73132
select fc, "String modified by $@ is passed to function expecting a null-terminated string.", e,
74133
"this expression"

‎c/cert/test/qlpack.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: codeql/cert-c-coding-standards-tests
2-
version: 2.22.0-dev
2+
version: 2.29.0-dev
33
extractor: cpp
44
license: MIT
55
dependencies:

0 commit comments

Comments
 (0)