Skip to content

Commit 49d014c

Browse files
MarkLee131MarkLee131
authored
Merge branch 'main' into fix/trust-boundary-regexp-barrier
2 parents d27ee86 + 0192ffa commit 49d014c

686 files changed

Lines changed: 50055 additions & 33960 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎cpp/ql/lib/change-notes/2026-03-28-switch-stmt.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: feature
3+
---
4+
* A new predicate `getSwitchCase` was added to the `SwitchStmt` class, which yields the `n`th `case` statement from a `switch` statement.

‎cpp/ql/lib/change-notes/2026-04-28-strsafe.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
category: minorAnalysis
3+
---
4+
* Added taint flow models for the `Strsafe.h` header from the Windows SDK.

‎cpp/ql/lib/ext/Strsafe.model.yml‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Models for strsafe.h safe string functions
2+
extensions:
3+
- addsTo:
4+
pack: codeql/cpp-all
5+
extensible: sourceModel
6+
data: # namespace, type, subtypes, name, signature, ext, output, kind, provenance
7+
# StringCchGets: (pszDest, cchDest)
8+
- ["", "", False, "StringCchGetsA", "", "", "Argument[*0]", "local", "manual"]
9+
- ["", "", False, "StringCchGetsW", "", "", "Argument[*0]", "local", "manual"]
10+
# StringCbGets: (pszDest, cbDest)
11+
- ["", "", False, "StringCbGetsA", "", "", "Argument[*0]", "local", "manual"]
12+
- ["", "", False, "StringCbGetsW", "", "", "Argument[*0]", "local", "manual"]
13+
# StringCchGetsEx: (pszDest, cchDest, ppszDestEnd, pcchRemaining, dwFlags)
14+
- ["", "", False, "StringCchGetsExA", "", "", "Argument[*0]", "local", "manual"]
15+
- ["", "", False, "StringCchGetsExW", "", "", "Argument[*0]", "local", "manual"]
16+
# StringCbGetsEx: (pszDest, cbDest, ppszDestEnd, pcbRemaining, dwFlags)
17+
- ["", "", False, "StringCbGetsExA", "", "", "Argument[*0]", "local", "manual"]
18+
- ["", "", False, "StringCbGetsExW", "", "", "Argument[*0]", "local", "manual"]
19+
- addsTo:
20+
pack: codeql/cpp-all
21+
extensible: summaryModel
22+
data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
23+
# StringCchCopy: (pszDest, cchDest, pszSrc)
24+
- ["", "", False, "StringCchCopyA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
25+
- ["", "", False, "StringCchCopyW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
26+
# StringCbCopy: (pszDest, cbDest, pszSrc)
27+
- ["", "", False, "StringCbCopyA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
28+
- ["", "", False, "StringCbCopyW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
29+
# StringCchCopyEx: (pszDest, cchDest, pszSrc, ppszDestEnd, pcchRemaining, dwFlags)
30+
- ["", "", False, "StringCchCopyExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
31+
- ["", "", False, "StringCchCopyExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
32+
# StringCbCopyEx: (pszDest, cbDest, pszSrc, ppszDestEnd, pcbRemaining, dwFlags)
33+
- ["", "", False, "StringCbCopyExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
34+
- ["", "", False, "StringCbCopyExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
35+
# StringCchCopyN: (pszDest, cchDest, pszSrc, cchToCopy)
36+
- ["", "", False, "StringCchCopyNA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
37+
- ["", "", False, "StringCchCopyNW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
38+
# StringCbCopyN: (pszDest, cbDest, pszSrc, cbToCopy)
39+
- ["", "", False, "StringCbCopyNA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
40+
- ["", "", False, "StringCbCopyNW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
41+
# StringCchCopyNEx: (pszDest, cchDest, pszSrc, cchToCopy, ppszDestEnd, pcchRemaining, dwFlags)
42+
- ["", "", False, "StringCchCopyNExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
43+
- ["", "", False, "StringCchCopyNExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
44+
# StringCbCopyNEx: (pszDest, cbDest, pszSrc, cbToCopy, ppszDestEnd, pcbRemaining, dwFlags)
45+
- ["", "", False, "StringCbCopyNExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
46+
- ["", "", False, "StringCbCopyNExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
47+
# StringCchCat: (pszDest, cchDest, pszSrc)
48+
- ["", "", False, "StringCchCatA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
49+
- ["", "", False, "StringCchCatW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
50+
# StringCbCat: (pszDest, cbDest, pszSrc)
51+
- ["", "", False, "StringCbCatA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
52+
- ["", "", False, "StringCbCatW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
53+
# StringCchCatEx: (pszDest, cchDest, pszSrc, ppszDestEnd, pcchRemaining, dwFlags)
54+
- ["", "", False, "StringCchCatExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
55+
- ["", "", False, "StringCchCatExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
56+
# StringCbCatEx: (pszDest, cbDest, pszSrc, ppszDestEnd, pcbRemaining, dwFlags)
57+
- ["", "", False, "StringCbCatExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
58+
- ["", "", False, "StringCbCatExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
59+
# StringCchCatN: (pszDest, cchDest, pszSrc, cchToAppend)
60+
- ["", "", False, "StringCchCatNA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
61+
- ["", "", False, "StringCchCatNW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
62+
# StringCbCatN: (pszDest, cbDest, pszSrc, cbToAppend)
63+
- ["", "", False, "StringCbCatNA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
64+
- ["", "", False, "StringCbCatNW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
65+
# StringCchCatNEx: (pszDest, cchDest, pszSrc, cchToAppend, ppszDestEnd, pcchRemaining, dwFlags)
66+
- ["", "", False, "StringCchCatNExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
67+
- ["", "", False, "StringCchCatNExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
68+
# StringCbCatNEx: (pszDest, cbDest, pszSrc, cbToAppend, ppszDestEnd, pcbRemaining, dwFlags)
69+
- ["", "", False, "StringCbCatNExA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
70+
- ["", "", False, "StringCbCatNExW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
71+
# StringCchPrintf: (pszDest, cchDest, pszFormat, ...)
72+
- ["", "", False, "StringCchPrintfA", "", "", "Argument[*2..8]", "Argument[*0]", "taint", "manual"]
73+
- ["", "", False, "StringCchPrintfW", "", "", "Argument[*2..8]", "Argument[*0]", "taint", "manual"]
74+
# StringCbPrintf: (pszDest, cbDest, pszFormat, ...)
75+
- ["", "", False, "StringCbPrintfA", "", "", "Argument[*2..8]", "Argument[*0]", "taint", "manual"]
76+
- ["", "", False, "StringCbPrintfW", "", "", "Argument[*2..8]", "Argument[*0]", "taint", "manual"]
77+
# StringCchPrintfEx: (pszDest, cchDest, ppszDestEnd, pcchRemaining, dwFlags, pszFormat, ...)
78+
- ["", "", False, "StringCchPrintfExA", "", "", "Argument[*5..11]", "Argument[*0]", "taint", "manual"]
79+
- ["", "", False, "StringCchPrintfExW", "", "", "Argument[*5..11]", "Argument[*0]", "taint", "manual"]
80+
# StringCbPrintfEx: (pszDest, cbDest, ppszDestEnd, pcbRemaining, dwFlags, pszFormat, ...)
81+
- ["", "", False, "StringCbPrintfExA", "", "", "Argument[*5..11]", "Argument[*0]", "taint", "manual"]
82+
- ["", "", False, "StringCbPrintfExW", "", "", "Argument[*5..11]", "Argument[*0]", "taint", "manual"]
83+
# StringCchVPrintf: (pszDest, cchDest, pszFormat, argList)
84+
- ["", "", False, "StringCchVPrintfA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
85+
- ["", "", False, "StringCchVPrintfW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
86+
# StringCbVPrintf: (pszDest, cbDest, pszFormat, argList)
87+
- ["", "", False, "StringCbVPrintfA", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
88+
- ["", "", False, "StringCbVPrintfW", "", "", "Argument[*2]", "Argument[*0]", "taint", "manual"]
89+
# StringCchVPrintfEx: (pszDest, cchDest, ppszDestEnd, pcchRemaining, dwFlags, pszFormat, argList)
90+
- ["", "", False, "StringCchVPrintfExA", "", "", "Argument[*5]", "Argument[*0]", "taint", "manual"]
91+
- ["", "", False, "StringCchVPrintfExW", "", "", "Argument[*5]", "Argument[*0]", "taint", "manual"]
92+
# StringCbVPrintfEx: (pszDest, cbDest, ppszDestEnd, pcbRemaining, dwFlags, pszFormat, argList)
93+
- ["", "", False, "StringCbVPrintfExA", "", "", "Argument[*5]", "Argument[*0]", "taint", "manual"]
94+
- ["", "", False, "StringCbVPrintfExW", "", "", "Argument[*5]", "Argument[*0]", "taint", "manual"]

cpp/ql/lib/ext/generated/brotli/brotli.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/brotli/brotli.model.yml

File renamed without changes.

cpp/ql/lib/ext/generated/curl/curl.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/curl/curl.model.yml

File renamed without changes.

cpp/ql/lib/ext/generated/glibc/glibc.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/glibc/glibc.model.yml

File renamed without changes.

cpp/ql/lib/ext/generated/libidn2/libidn2.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/libidn2/libidn2.model.yml

File renamed without changes.

cpp/ql/lib/ext/generated/libssh2/libssh2.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/libssh2/libssh2.model.yml

File renamed without changes.

cpp/ql/lib/ext/generated/libuv/libuv.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/libuv/libuv.model.yml

File renamed without changes.

cpp/ql/lib/ext/generated/nghttp2/nghttp2.model.yml renamed to cpp/ql/lib/ext/generated/modelgenerator/nghttp2/nghttp2.model.yml

File renamed without changes.

0 commit comments

Comments
 (0)