Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

C++: Reduce duplication from cpp/path-injection #16328

Merged
merged 3 commits into from Apr 30, 2024
Merged

C++: Reduce duplication from cpp/path-injection #16328

merged 3 commits into from Apr 30, 2024

Conversation

geoffw0
Copy link
Contributor

@geoffw0 geoffw0 commented Apr 25, 2024

Reduce duplication from the cpp/path-injection query, by making sources and sinks barriers.

@geoffw0 geoffw0 added the C++ label Apr 25, 2024
@geoffw0 geoffw0 requested a review from a team as a code owner April 25, 2024 16:07
MathiasVP
MathiasVP approved these changes Apr 25, 2024
View reviewed changes
Copy link
Contributor

@MathiasVP MathiasVP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM once we have a happy DCA run (as happy as DCA can currently be)

cpp/ql/src/Security/CWE/CWE-022/TaintedPath.ql Show resolved Hide resolved
@geoffw0
Copy link
Contributor Author

geoffw0 commented Apr 29, 2024

DCA shows 61 lost results for cpp/path-injection, which is expected, and a very small sample (3) of those results LGTM. There are a whole lot of failures though, so I'm going to re-run it.

@MathiasVP
Copy link
Contributor

There are a whole lot of failures though, so I'm going to re-run it.

Yeah, there was a DCA issue last week caused by some analysis changes. That should be fixed now. I expect that you'll get many more removed results on this run when vim successfully completes since vim is known to have a lot of results on this query.

@geoffw0
Copy link
Contributor Author

geoffw0 commented Apr 30, 2024

Yep, we're now up to 80 lost results, and again a very small sample LGTM. There are still some failures, but fewer, and nothing else looks amiss. Merging.

@geoffw0 geoffw0 merged commit 7d9f78b into github:main Apr 30, 2024
16 checks passed
@MathiasVP
Copy link
Contributor

Yep, we're now up to 80 lost results, and again a very small sample LGTM. There are still some failures, but fewer, and nothing else looks amiss. Merging.

Indeed. These are known Windows tracer issues that Dave is currently looking into

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@MathiasVP MathiasVP MathiasVP approved these changes

Assignees
No one assigned
Labels
C++ documentation
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@geoffw0 @MathiasVP