Skip to content

Commit 21c2c97

Browse files
authored
Merge branch 'main' into post-release-prep/codeql-cli-2.26.2
2 parents e38a44b + 478878c commit 21c2c97

210 files changed

Lines changed: 11900 additions & 4105 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

MODULE.bazel

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ bazel_dep(name = "rules_cc", version = "0.2.17")
1919
bazel_dep(name = "rules_go", version = "0.60.0")
2020
bazel_dep(name = "rules_java", version = "9.6.1")
2121
bazel_dep(name = "rules_pkg", version = "1.2.0")
22-
bazel_dep(name = "rules_nodejs", version = "6.7.3")
22+
bazel_dep(name = "rules_nodejs", version = "6.7.5")
2323
bazel_dep(name = "rules_python", version = "1.9.0")
2424
bazel_dep(name = "rules_shell", version = "0.7.1")
2525
bazel_dep(name = "bazel_skylib", version = "1.9.0")
@@ -322,7 +322,7 @@ go_sdk.download(version = "1.26.5")
322322

323323
go_deps = use_extension("@gazelle//:extensions.bzl", "go_deps")
324324
go_deps.from_file(go_mod = "//go/extractor:go.mod")
325-
use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_tools")
325+
use_repo(go_deps, "com_github_stretchr_testify", "org_golang_x_mod", "org_golang_x_sys", "org_golang_x_tools")
326326

327327
ripunzip_archive = use_repo_rule("//misc/ripunzip:ripunzip.bzl", "ripunzip_archive")
328328

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added flow source models for `RegQueryValue` and related functions from the `winreg.h` Windows header.

cpp/ql/lib/ext/Windows.model.yml

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,17 @@ extensions:
3434
- ["", "", False, "HttpReceiveHttpRequest", "", "", "Argument[*3]", "remote", "manual"]
3535
- ["", "", False, "HttpReceiveRequestEntityBody", "", "", "Argument[*3]", "remote", "manual"]
3636
- ["", "", False, "HttpReceiveClientCertificate", "", "", "Argument[*3]", "remote", "manual"]
37+
# winreg.h
38+
- ["", "", False, "RegQueryValueA", "", "", "Argument[*2]", "local", "manual"]
39+
- ["", "", False, "RegQueryValueExA", "", "", "Argument[*4]", "local", "manual"]
40+
- ["", "", False, "RegQueryValueW", "", "", "Argument[*2]", "local", "manual"]
41+
- ["", "", False, "RegQueryValueExW", "", "", "Argument[*4]", "local", "manual"]
42+
- ["", "", False, "RegGetValueA", "", "", "Argument[*5]", "local", "manual"]
43+
- ["", "", False, "RegGetValueW", "", "", "Argument[*5]", "local", "manual"]
44+
# TODO: Once we support access paths at sources we should also mark Argument[*1].Field[*ve_valueptr]
45+
- ["", "", False, "RegQueryMultipleValuesA", "", "", "Argument[*3]", "local", "manual"]
46+
# TODO: Once we support access paths at sources we should also mark Argument[*1].Field[*ve_valueptr]
47+
- ["", "", False, "RegQueryMultipleValuesW", "", "", "Argument[*3]", "local", "manual"]
3748
- addsTo:
3849
pack: codeql/cpp-all
3950
extensible: summaryModel

cpp/ql/test/library-tests/dataflow/external-models/flow.expected

Lines changed: 141 additions & 113 deletions
Large diffs are not rendered by default.

cpp/ql/test/library-tests/dataflow/external-models/sources.expected

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,3 +43,10 @@
4343
| windows.cpp:900:64:900:77 | HttpReceiveHttpRequest output argument | remote |
4444
| windows.cpp:929:70:929:75 | HttpReceiveRequestEntityBody output argument | remote |
4545
| windows.cpp:936:70:936:78 | HttpReceiveClientCertificate output argument | remote |
46+
| windows.cpp:994:35:994:38 | RegQueryValueA output argument | local |
47+
| windows.cpp:1001:36:1001:39 | RegQueryValueW output argument | local |
48+
| windows.cpp:1009:53:1009:56 | RegQueryValueExA output argument | local |
49+
| windows.cpp:1017:54:1017:57 | RegQueryValueExW output argument | local |
50+
| windows.cpp:1025:46:1025:49 | RegQueryMultipleValuesA output argument | local |
51+
| windows.cpp:1033:46:1033:49 | RegQueryMultipleValuesW output argument | local |
52+
| windows.cpp:1041:53:1041:56 | RegGetValueA output argument | local |

cpp/ql/test/library-tests/dataflow/external-models/windows.cpp

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -940,4 +940,106 @@ void test_http_server_api(HANDLE hRequestQueue) {
940940
sink(certInfo.pCertEncoded);
941941
sink(*certInfo.pCertEncoded); // $ ir
942942
}
943+
}
944+
945+
using HKEY = void*;
946+
using BYTE = unsigned char;
947+
using LPBYTE = BYTE*;
948+
using PLONG = LONG*;
949+
950+
typedef struct value_entA {
951+
LPSTR ve_valuename;
952+
DWORD ve_valuelen;
953+
DWORD_PTR ve_valueptr;
954+
DWORD ve_type;
955+
} VALENTA, *PVALENTA;
956+
957+
typedef struct value_entW {
958+
LPWSTR ve_valuename;
959+
DWORD ve_valuelen;
960+
DWORD_PTR ve_valueptr;
961+
DWORD ve_type;
962+
} VALENTW, *PVALENTW;
963+
964+
LONG RegQueryValueA(HKEY hKey, LPCSTR lpSubKey, LPSTR lpData, PLONG lpcbData);
965+
LONG RegQueryValueW(HKEY hKey, LPCWSTR lpSubKey, LPWSTR lpData, PLONG lpcbData);
966+
967+
LONG RegQueryValueExA(
968+
HKEY hKey, LPCSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData,
969+
LPDWORD lpcbData
970+
);
971+
972+
LONG RegQueryValueExW(
973+
HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData,
974+
LPDWORD lpcbData
975+
);
976+
977+
LONG RegGetValueA(
978+
HKEY hKey, LPCSTR lpSubKey, LPCSTR lpValue, DWORD flags, LPDWORD lpType, PVOID lpData,
979+
LPDWORD lpcbData
980+
);
981+
982+
LONG RegQueryMultipleValuesA(
983+
HKEY hKey, PVALENTA valList, DWORD numVals, LPSTR valueBuffer, LPDWORD totalSize
984+
);
985+
986+
LONG RegQueryMultipleValuesW(
987+
HKEY hKey, PVALENTW valList, DWORD numVals, LPWSTR valueBuffer, LPDWORD totalSize
988+
);
989+
990+
void test_registry_queries(HKEY hKey) {
991+
{
992+
char data[256];
993+
LONG dataSize = sizeof(data);
994+
RegQueryValueA(hKey, "value", data, &dataSize);
995+
sink(data); // clean
996+
sink(*data); // $ ir
997+
}
998+
{
999+
wchar_t data[256];
1000+
LONG dataSize = sizeof(data);
1001+
RegQueryValueW(hKey, L"value", data, &dataSize);
1002+
sink(data); // clean
1003+
sink(*data); // $ ir
1004+
}
1005+
{
1006+
BYTE data[256];
1007+
DWORD dataSize = sizeof(data);
1008+
DWORD type;
1009+
RegQueryValueExA(hKey, "value", nullptr, &type, data, &dataSize);
1010+
sink(data); // clean
1011+
sink(*data); // $ ir
1012+
}
1013+
{
1014+
BYTE data[256];
1015+
DWORD dataSize = sizeof(data);
1016+
DWORD type;
1017+
RegQueryValueExW(hKey, L"value", nullptr, &type, data, &dataSize);
1018+
sink(data); // clean
1019+
sink(*data); // $ ir
1020+
}
1021+
{
1022+
VALENTA values[1];
1023+
char data[256];
1024+
DWORD dataSize = sizeof(data);
1025+
RegQueryMultipleValuesA(hKey, values, 1, data, &dataSize);
1026+
sink(data); // clean
1027+
sink(*data); // $ ir
1028+
}
1029+
{
1030+
VALENTW values[1];
1031+
wchar_t data[256];
1032+
DWORD dataSize = sizeof(data);
1033+
RegQueryMultipleValuesW(hKey, values, 1, data, &dataSize);
1034+
sink(data); // clean
1035+
sink(*data); // $ ir
1036+
}
1037+
{
1038+
BYTE data[256];
1039+
DWORD dataSize = sizeof(data);
1040+
DWORD type;
1041+
RegGetValueA(hKey, "subkey", "value", 0, &type, data, &dataSize);
1042+
sink(data); // clean
1043+
sink(*data); // $ ir
1044+
}
9431045
}
Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
| code/Program.cs:0:0:0:0 | code/Program.cs | |
2-
| code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs:0:0:0:0 | code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs | |
3-
| code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs | |
4-
| code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs | |
5-
| code/obj/Debug/net9.0/dotnet_build.dll:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.dll | |
1+
| code/Program.cs:0:0:0:0 | code/Program.cs | relative |
2+
| code/dotnet_build.csproj:0:0:0:0 | code/dotnet_build.csproj | relative |
3+
| code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs:0:0:0:0 | code/obj/Debug/net9.0/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs | relative |
4+
| code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.AssemblyInfo.cs | relative |
5+
| code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.GlobalUsings.g.cs | relative |
6+
| code/obj/Debug/net9.0/dotnet_build.dll:0:0:0:0 | code/obj/Debug/net9.0/dotnet_build.dll | relative |
7+
| code/obj/dotnet_build.csproj.nuget.g.props:0:0:0:0 | code/obj/dotnet_build.csproj.nuget.g.props | relative |
68
| file://:0:0:0:0 | | |
7-
| file://Z:/dotnet_build.csproj:0:0:0:0 | Z:/dotnet_build.csproj | relative |
8-
| file://Z:/obj/dotnet_build.csproj.nuget.g.props:0:0:0:0 | Z:/obj/dotnet_build.csproj.nuget.g.props | relative |

go/extractor/extractor.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -770,7 +770,7 @@ func normalizedPath(ast *ast.File, fset *token.FileSet) string {
770770
if err != nil {
771771
return file
772772
}
773-
return path
773+
return util.ResolvePath(path)
774774
}
775775

776776
// extractFile extracts AST information for the given file

go/extractor/go.mod

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@ require (
1313
golang.org/x/tools v0.48.0
1414
)
1515

16-
require github.com/stretchr/testify v1.11.1
16+
require (
17+
github.com/stretchr/testify v1.11.1
18+
golang.org/x/sys v0.47.0
19+
)
1720

1821
require (
1922
github.com/davecgh/go-spew v1.1.1 // indirect

go/extractor/go.sum

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
1010
golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
1111
golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
1212
golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
13+
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
14+
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
1315
golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
1416
golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
1517
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

0 commit comments

Comments
 (0)