From de05aee483c204aa6da50fe6213c44c229748348 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Mon, 18 Nov 2024 11:11:25 -0500 Subject: [PATCH 01/16] Adding model transition to using Throwing.qll. --- .../raw/internal/TranslatedCall.qll | 4 +- .../cpp/models/implementations/Memcpy.qll | 4 +- .../cpp/models/implementations/Memset.qll | 4 +- .../implementations/NoexceptFunction.qll | 4 +- .../cpp/models/implementations/Printf.qll | 12 +++- .../cpp/models/implementations/Strcat.qll | 4 +- .../cpp/models/implementations/Strcpy.qll | 4 +- .../StructuredExceptionHandling.qll | 23 ++++++- .../cpp/models/interfaces/NonThrowing.qll | 11 --- .../code/cpp/models/interfaces/Throwing.qll | 69 +++++++++++++++++-- 10 files changed, 112 insertions(+), 27 deletions(-) delete mode 100644 cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll index daa6bdaafcf6..a4c678869590 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll @@ -363,11 +363,11 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall { } final override predicate mayThrowException() { - expr.getTarget().(ThrowingFunction).mayThrowException(_) + expr.getTarget().(ThrowingFunction).mayRaiseException() } final override predicate mustThrowException() { - expr.getTarget().(ThrowingFunction).mayThrowException(true) + expr.getTarget().(ThrowingFunction).alwaysRaisesException() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll index 0bf2dd31fe40..8c3ae368da9d 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll @@ -9,7 +9,7 @@ import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.SideEffect import semmle.code.cpp.models.interfaces.Taint -import semmle.code.cpp.models.interfaces.NonThrowing +import semmle.code.cpp.models.interfaces.Throwing /** * The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant @@ -106,6 +106,8 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect not this.hasGlobalName(["bcopy", mempcpy(), "memccpy"]) and index = this.getParamDest() } + + override TCxxException getExceptionType() { any() } } private string mempcpy() { result = ["mempcpy", "wmempcpy"] } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll index ab2e0af99f38..6a4ab8a133f2 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll @@ -8,7 +8,7 @@ import semmle.code.cpp.models.interfaces.ArrayFunction import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.NonThrowing +import semmle.code.cpp.models.interfaces.Throwing private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, AliasFunction, SideEffectFunction, NonThrowingFunction @@ -74,6 +74,8 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias i = 0 and if this.hasGlobalName(bzero()) then result = 1 else result = 2 } + + override TCxxException getExceptionType() { any() } } private string bzero() { result = ["bzero", "explicit_bzero"] } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll index b0f76ee6538a..ee05b2a68a0b 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll @@ -1,4 +1,4 @@ -import semmle.code.cpp.models.interfaces.NonThrowing +import semmle.code.cpp.models.interfaces.Throwing /** * A function that is annotated with a `noexcept` specifier (or the equivalent @@ -8,4 +8,6 @@ import semmle.code.cpp.models.interfaces.NonThrowing */ class NoexceptFunction extends NonThrowingFunction { NoexceptFunction() { this.isNoExcept() or this.isNoThrow() } + + override TCxxException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll index 9c3bfb4f35ec..7dbd38126bf6 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll @@ -8,7 +8,7 @@ import semmle.code.cpp.models.interfaces.FormattingFunction import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.NonThrowing +import semmle.code.cpp.models.interfaces.Throwing /** * The standard functions `printf`, `wprintf` and their glib variants. @@ -32,6 +32,8 @@ private class Printf extends FormattingFunction, AliasFunction, NonThrowingFunct override predicate parameterEscapesOnlyViaReturn(int n) { none() } override predicate parameterIsAlwaysReturned(int n) { none() } + + override TCxxException getExceptionType() { any() } } /** @@ -50,6 +52,8 @@ private class Fprintf extends FormattingFunction, NonThrowingFunction { override int getFormatParameterIndex() { result = 1 } override int getOutputParameterIndex(boolean isStream) { result = 0 and isStream = true } + + override TCxxException getExceptionType() { any() } } /** @@ -93,6 +97,8 @@ private class Sprintf extends FormattingFunction, NonThrowingFunction { then result = 4 else result = super.getFirstFormatArgumentIndex() } + + override TCxxException getExceptionType() { any() } } /** @@ -165,6 +171,8 @@ private class SnprintfImpl extends Snprintf, AliasFunction, SideEffectFunction, // We don't know how many parameters are passed to the function since it's varargs, but they also have read side effects. i = this.getFormatParameterIndex() and buffer = true } + + override TCxxException getExceptionType() { any() } } /** @@ -215,4 +223,6 @@ private class Syslog extends FormattingFunction, NonThrowingFunction { override int getFormatParameterIndex() { result = 1 } override predicate isOutputGlobal() { any() } + + override TCxxException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll index 9b11ed0af153..df85c56148a8 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll @@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.ArrayFunction import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Taint import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.NonThrowing +import semmle.code.cpp.models.interfaces.Throwing /** * The standard function `strcat` and its wide, sized, and Microsoft variants. @@ -94,6 +94,8 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid (i = 0 or i = 1) and buffer = true } + + override TCxxException getExceptionType() { any() } } /** diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll index b7f06f0cebf4..b09cbeb8dc60 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll @@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.ArrayFunction import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Taint import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.NonThrowing +import semmle.code.cpp.models.interfaces.Throwing /** * The standard function `strcpy` and its wide, sized, and Microsoft variants. @@ -145,4 +145,6 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid i = this.getParamDest() and result = this.getParamSize() } + + override TCxxException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll index af8f3088f255..d5941488d0d7 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll @@ -1,9 +1,26 @@ import semmle.code.cpp.models.interfaces.Throwing -class WindowsDriverFunction extends ThrowingFunction { - WindowsDriverFunction() { +/** + * The default behavior for Structured Exception Handling (SEH) is + * any function may (conditionally) raise an exception. + * NOTE: this can be overridden by for any specific function to make in + * unconditional or non-throwing. IR generation will enforce + * the most strict interpretation. + */ +class DefaultSehExceptionBehavior extends ThrowingFunction { + DefaultSehExceptionBehavior() { any() } + + override predicate raisesException(boolean unconditional) { unconditional = false } + + override TSehException getExceptionType() { any() } +} + +class WindowsDriverExceptionAnnotation extends ThrowingFunction { + WindowsDriverExceptionAnnotation() { this.hasGlobalName(["RaiseException", "ExRaiseAccessViolation", "ExRaiseDatatypeMisalignment"]) } - final override predicate mayThrowException(boolean unconditional) { unconditional = true } + override predicate raisesException(boolean unconditional) { unconditional = true } + + override TSehException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll deleted file mode 100644 index 64901d39ad30..000000000000 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll +++ /dev/null @@ -1,11 +0,0 @@ -/** - * Provides an abstract class for modeling functions that never throw. - */ - -import semmle.code.cpp.Function -import semmle.code.cpp.models.Models - -/** - * A function that is guaranteed to never throw. - */ -abstract class NonThrowingFunction extends Function { } diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll index 79b7523f1d9f..72db8c9e96c7 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll @@ -11,12 +11,71 @@ import semmle.code.cpp.models.Models import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs /** - * A class that models the exceptional behavior of a function. + * Represents a type of exception, + * either Structured Exception Handling (SEH) or C++ exceptions. */ -abstract class ThrowingFunction extends Function { +newtype TException = + /** Structured Exception Handling (SEH) exception */ + TSehException() or + /** C++ exception */ + TCxxException() + +/** + * Functions with information about how an exception is thrown or if one is thrown at all. + * If throwing details conflict for the same function, IR is assumed + * to use the most restricted interpretation, meaning taking options + * that stipulate no exception is raised, before the exception is always raised, + * before conditional exceptions. + * + * Annotations must specify if the exception is from SEH (structured exception handling) + * or ordinary c++ exceptions. + */ +abstract private class ExceptionAnnotation extends Function { + /** + * Returns the type of exception this annotation is for, + * either a CPP exception or a STructured Exception Handling (SEH) exception. + */ + abstract TException getExceptionType(); + + /** + * Holds if the exception type of this annotation is for a Structured Exception Handling (SEH) exception. + */ + final predicate isSeh() { this.getExceptionType() = TSehException() } + + /** + * Holds if the exception type of this annotation is for a CPP exception. + */ + final predicate isCxx() { this.getExceptionType() = TCxxException() } +} + +/** + * A Function that is known to not throw an exception. + */ +abstract class NonThrowingFunction extends ExceptionAnnotation { } + +/** + * A function this is known to raise an exception. + */ +abstract class ThrowingFunction extends ExceptionAnnotation { + ThrowingFunction() { any() } + + /** + * Holds if this function may raise an exception during evaluation. + * If `unconditional` is `false` the function may raise, and if `true` the function + * will always raise an exception. + * Do not specify `none()` if no exception is raised, instead use the + * `NonThrowingFunction` class instead. + */ + abstract predicate raisesException(boolean unconditional); + + /** + * Holds if this function will always raise an exception if called + */ + final predicate alwaysRaisesException() { this.raisesException(true) } + /** - * Holds if this function may throw an exception during evaluation. - * If `unconditional` is `true` the function always throws an exception. + * Holds if this function may raise an exception if called but + * it is not guaranteed to do so. I.e., the function does not always raise an exception. */ - abstract predicate mayThrowException(boolean unconditional); + final predicate mayRaiseException() { this.raisesException(false) } } From 4b83a451bd0547bba0d6bd41750d4739fd7dd5e0 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Mon, 18 Nov 2024 11:14:46 -0500 Subject: [PATCH 02/16] Change log --- cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md diff --git a/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md b/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md new file mode 100644 index 000000000000..f3c33f40b517 --- /dev/null +++ b/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md @@ -0,0 +1,4 @@ +--- +category: minorAnalysis +--- +* Removed NonThrowing.qll. Throwing meta-data now part of Throwing.qll. Updated models and IR to use the new Throwing library and predicates. \ No newline at end of file From 792231c949154be6b003d86204df40478e23e600 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Mon, 18 Nov 2024 14:43:44 -0500 Subject: [PATCH 03/16] Removing SEH default case for function calls as the logic to handle SEH is not yet part of the IR generation to make this logic work. --- .../StructuredExceptionHandling.qll | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll index d5941488d0d7..485dc7137b81 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll @@ -1,20 +1,5 @@ import semmle.code.cpp.models.interfaces.Throwing -/** - * The default behavior for Structured Exception Handling (SEH) is - * any function may (conditionally) raise an exception. - * NOTE: this can be overridden by for any specific function to make in - * unconditional or non-throwing. IR generation will enforce - * the most strict interpretation. - */ -class DefaultSehExceptionBehavior extends ThrowingFunction { - DefaultSehExceptionBehavior() { any() } - - override predicate raisesException(boolean unconditional) { unconditional = false } - - override TSehException getExceptionType() { any() } -} - class WindowsDriverExceptionAnnotation extends ThrowingFunction { WindowsDriverExceptionAnnotation() { this.hasGlobalName(["RaiseException", "ExRaiseAccessViolation", "ExRaiseDatatypeMisalignment"]) From 1c874d32217994a6faae1d2a24d07d19a3a52af2 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Tue, 19 Nov 2024 10:04:11 -0500 Subject: [PATCH 04/16] Fixed usage raisesException --- .../cpp/ir/implementation/raw/internal/TranslatedCall.qll | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll index a4c678869590..5f1b2fbe3b45 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll @@ -363,11 +363,11 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall { } final override predicate mayThrowException() { - expr.getTarget().(ThrowingFunction).mayRaiseException() + expr.getTarget().(ThrowingFunction).raisesException(_) } final override predicate mustThrowException() { - expr.getTarget().(ThrowingFunction).alwaysRaisesException() + expr.getTarget().(ThrowingFunction).raisesException(true) } } From 26d590a616fba45b40fa3e5d47791b59c6d38d13 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Tue, 19 Nov 2024 12:57:50 -0500 Subject: [PATCH 05/16] Putting back deleted file, and deprecating instead. Deprecating mayThrowException as well. --- .../code/cpp/models/interfaces/NonThrowing.qll | 13 +++++++++++++ .../semmle/code/cpp/models/interfaces/Throwing.qll | 7 +++++++ 2 files changed, 20 insertions(+) create mode 100644 cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll new file mode 100644 index 000000000000..9f2c28979b44 --- /dev/null +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll @@ -0,0 +1,13 @@ +/** + * Provides an abstract class for modeling functions that never throw. + */ + +import semmle.code.cpp.Function +import semmle.code.cpp.models.Models + +/** + * A function that is guaranteed to never throw. + * + * DEPRECATED: use `NonThrowingFunction` in `semmle.code.cpp.models.Models.Interfaces.Throwing` instead. + */ +abstract deprecated class NonThrowingFunction extends Function { } diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll index 72db8c9e96c7..bd64051d1415 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll @@ -68,6 +68,13 @@ abstract class ThrowingFunction extends ExceptionAnnotation { */ abstract predicate raisesException(boolean unconditional); + /** + * DEPRECATES: use/extend `raisesException` instead. + */ + deprecated predicate mayThrowException(boolean unconditional){ + this.raisesException(unconditional) + } + /** * Holds if this function will always raise an exception if called */ From 07847762e1f7dc87408c0e74dba32edcd5d0be56 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Tue, 19 Nov 2024 13:17:10 -0500 Subject: [PATCH 06/16] bringing back mayThrowException to make it cleaner/easier for backwards compatibility. --- .../raw/internal/TranslatedCall.qll | 4 ++-- .../code/cpp/models/interfaces/Throwing.qll | 17 ++--------------- 2 files changed, 4 insertions(+), 17 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll index 5f1b2fbe3b45..daa6bdaafcf6 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll @@ -363,11 +363,11 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall { } final override predicate mayThrowException() { - expr.getTarget().(ThrowingFunction).raisesException(_) + expr.getTarget().(ThrowingFunction).mayThrowException(_) } final override predicate mustThrowException() { - expr.getTarget().(ThrowingFunction).raisesException(true) + expr.getTarget().(ThrowingFunction).mayThrowException(true) } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll index bd64051d1415..db6bd689b4f1 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll @@ -66,23 +66,10 @@ abstract class ThrowingFunction extends ExceptionAnnotation { * Do not specify `none()` if no exception is raised, instead use the * `NonThrowingFunction` class instead. */ - abstract predicate raisesException(boolean unconditional); - - /** - * DEPRECATES: use/extend `raisesException` instead. - */ - deprecated predicate mayThrowException(boolean unconditional){ - this.raisesException(unconditional) - } + abstract predicate mayThrowException(boolean unconditional); /** * Holds if this function will always raise an exception if called */ - final predicate alwaysRaisesException() { this.raisesException(true) } - - /** - * Holds if this function may raise an exception if called but - * it is not guaranteed to do so. I.e., the function does not always raise an exception. - */ - final predicate mayRaiseException() { this.raisesException(false) } + final predicate alwaysRaisesException() { this.mayThrowException(true) } } From a69daa0d2018844fae600a420e7417de4f8600b8 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Tue, 19 Nov 2024 13:35:45 -0500 Subject: [PATCH 07/16] Missing change to 'mayThrowException' in StructuredExceptionHandling.qll --- .../cpp/models/implementations/StructuredExceptionHandling.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll index 485dc7137b81..36a2f6cdbe40 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll @@ -5,7 +5,7 @@ class WindowsDriverExceptionAnnotation extends ThrowingFunction { this.hasGlobalName(["RaiseException", "ExRaiseAccessViolation", "ExRaiseDatatypeMisalignment"]) } - override predicate raisesException(boolean unconditional) { unconditional = true } + override predicate mayThrowException(boolean unconditional) { unconditional = true } override TSehException getExceptionType() { any() } } From 4e777561f06ad9f891de48ab648135ebc50cd361 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Tue, 19 Nov 2024 15:10:15 -0500 Subject: [PATCH 08/16] Changing terminology back to "throws" vs "rasis" for alwaysThrowsException to be consistent with other backward compatibility changes. --- cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll index db6bd689b4f1..d64ba61caa0f 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll @@ -71,5 +71,5 @@ abstract class ThrowingFunction extends ExceptionAnnotation { /** * Holds if this function will always raise an exception if called */ - final predicate alwaysRaisesException() { this.mayThrowException(true) } + final predicate alwaysThrowsException() { this.mayThrowException(true) } } From 69df07ed1208ca12a82e83c1c2da9f430dbd458a Mon Sep 17 00:00:00 2001 From: Ben Rodes Date: Wed, 20 Nov 2024 09:06:44 -0500 Subject: [PATCH 09/16] Update cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md Co-authored-by: Mathias Vorreiter Pedersen --- cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md b/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md index f3c33f40b517..114822e6c8f7 100644 --- a/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md +++ b/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md @@ -1,4 +1,4 @@ --- -category: minorAnalysis +category: deprecated --- -* Removed NonThrowing.qll. Throwing meta-data now part of Throwing.qll. Updated models and IR to use the new Throwing library and predicates. \ No newline at end of file +* The `NonThrowing` class (`semmle.code.cpp.models.interfaces.NonThrowing`) has been deprecated. Please use the `NonThrowing` class from `semmle.code.cpp.models.interfaces.Throwing` instead. \ No newline at end of file From 9b2590ec7a2c49771e12b45bdeec185c76767769 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 11:28:11 -0500 Subject: [PATCH 10/16] Updating PR per review comments. Moving more towards a simplified model. --- .../raw/internal/TranslatedCall.qll | 4 +- .../cpp/models/implementations/Memcpy.qll | 6 +- .../cpp/models/implementations/Memset.qll | 6 +- .../implementations/NoexceptFunction.qll | 6 +- .../cpp/models/implementations/Printf.qll | 14 +--- .../cpp/models/implementations/Strcat.qll | 6 +- .../cpp/models/implementations/Strcpy.qll | 6 +- .../StructuredExceptionHandling.qll | 6 +- .../cpp/models/interfaces/NonThrowing.qll | 10 ++- .../code/cpp/models/interfaces/Throwing.qll | 69 +++++-------------- 10 files changed, 39 insertions(+), 94 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll index daa6bdaafcf6..df92e73ed372 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll @@ -363,11 +363,11 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall { } final override predicate mayThrowException() { - expr.getTarget().(ThrowingFunction).mayThrowException(_) + expr.getTarget() instanceof AlwaysSehThrowingFunction } final override predicate mustThrowException() { - expr.getTarget().(ThrowingFunction).mayThrowException(true) + expr.getTarget() instanceof AlwaysSehThrowingFunction } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll index 8c3ae368da9d..311847e8aec0 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memcpy.qll @@ -9,14 +9,14 @@ import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.SideEffect import semmle.code.cpp.models.interfaces.Taint -import semmle.code.cpp.models.interfaces.Throwing +import semmle.code.cpp.models.interfaces.NonThrowing /** * The standard functions `memcpy`, `memmove` and `bcopy`; and the gcc variant * `__builtin___memcpy_chk`. */ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffectFunction, - AliasFunction, NonThrowingFunction + AliasFunction, NonCppThrowingFunction { MemcpyFunction() { // memcpy(dest, src, num) @@ -106,8 +106,6 @@ private class MemcpyFunction extends ArrayFunction, DataFlowFunction, SideEffect not this.hasGlobalName(["bcopy", mempcpy(), "memccpy"]) and index = this.getParamDest() } - - override TCxxException getExceptionType() { any() } } private string mempcpy() { result = ["mempcpy", "wmempcpy"] } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll index 6a4ab8a133f2..51234e50f94f 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Memset.qll @@ -8,10 +8,10 @@ import semmle.code.cpp.models.interfaces.ArrayFunction import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.Throwing +import semmle.code.cpp.models.interfaces.NonThrowing private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, AliasFunction, - SideEffectFunction, NonThrowingFunction + SideEffectFunction, NonCppThrowingFunction { MemsetFunctionModel() { this.hasGlobalOrStdOrBslName("memset") @@ -74,8 +74,6 @@ private class MemsetFunctionModel extends ArrayFunction, DataFlowFunction, Alias i = 0 and if this.hasGlobalName(bzero()) then result = 1 else result = 2 } - - override TCxxException getExceptionType() { any() } } private string bzero() { result = ["bzero", "explicit_bzero"] } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll index ee05b2a68a0b..22f860bc593f 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/NoexceptFunction.qll @@ -1,4 +1,4 @@ -import semmle.code.cpp.models.interfaces.Throwing +import semmle.code.cpp.models.interfaces.NonThrowing /** * A function that is annotated with a `noexcept` specifier (or the equivalent @@ -6,8 +6,6 @@ import semmle.code.cpp.models.interfaces.Throwing * * Note: The `throw` specifier was deprecated in C++11 and removed in C++17. */ -class NoexceptFunction extends NonThrowingFunction { +class NoexceptFunction extends NonCppThrowingFunction { NoexceptFunction() { this.isNoExcept() or this.isNoThrow() } - - override TCxxException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll index 7dbd38126bf6..f28359c7f642 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll @@ -8,12 +8,12 @@ import semmle.code.cpp.models.interfaces.FormattingFunction import semmle.code.cpp.models.interfaces.Alias import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.Throwing +import semmle.code.cpp.models.interfaces.NonThrowing /** * The standard functions `printf`, `wprintf` and their glib variants. */ -private class Printf extends FormattingFunction, AliasFunction, NonThrowingFunction { +private class Printf extends FormattingFunction, AliasFunction, NonCppThrowingFunction { Printf() { this instanceof TopLevelFunction and ( @@ -32,8 +32,6 @@ private class Printf extends FormattingFunction, AliasFunction, NonThrowingFunct override predicate parameterEscapesOnlyViaReturn(int n) { none() } override predicate parameterIsAlwaysReturned(int n) { none() } - - override TCxxException getExceptionType() { any() } } /** @@ -52,8 +50,6 @@ private class Fprintf extends FormattingFunction, NonThrowingFunction { override int getFormatParameterIndex() { result = 1 } override int getOutputParameterIndex(boolean isStream) { result = 0 and isStream = true } - - override TCxxException getExceptionType() { any() } } /** @@ -97,8 +93,6 @@ private class Sprintf extends FormattingFunction, NonThrowingFunction { then result = 4 else result = super.getFirstFormatArgumentIndex() } - - override TCxxException getExceptionType() { any() } } /** @@ -171,8 +165,6 @@ private class SnprintfImpl extends Snprintf, AliasFunction, SideEffectFunction, // We don't know how many parameters are passed to the function since it's varargs, but they also have read side effects. i = this.getFormatParameterIndex() and buffer = true } - - override TCxxException getExceptionType() { any() } } /** @@ -223,6 +215,4 @@ private class Syslog extends FormattingFunction, NonThrowingFunction { override int getFormatParameterIndex() { result = 1 } override predicate isOutputGlobal() { any() } - - override TCxxException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll index df85c56148a8..966c7425dc45 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll @@ -7,7 +7,7 @@ import semmle.code.cpp.models.interfaces.ArrayFunction import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Taint import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.Throwing +import semmle.code.cpp.models.interfaces.NonThrowing /** * The standard function `strcat` and its wide, sized, and Microsoft variants. @@ -15,7 +15,7 @@ import semmle.code.cpp.models.interfaces.Throwing * Does not include `strlcat`, which is covered by `StrlcatFunction` */ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, SideEffectFunction, - NonThrowingFunction + NonCppThrowingFunction { StrcatFunction() { this.hasGlobalOrStdOrBslName([ @@ -94,8 +94,6 @@ class StrcatFunction extends TaintFunction, DataFlowFunction, ArrayFunction, Sid (i = 0 or i = 1) and buffer = true } - - override TCxxException getExceptionType() { any() } } /** diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll index b09cbeb8dc60..b7ed20f1bab3 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Strcpy.qll @@ -7,13 +7,13 @@ import semmle.code.cpp.models.interfaces.ArrayFunction import semmle.code.cpp.models.interfaces.DataFlow import semmle.code.cpp.models.interfaces.Taint import semmle.code.cpp.models.interfaces.SideEffect -import semmle.code.cpp.models.interfaces.Throwing +import semmle.code.cpp.models.interfaces.NonThrowing /** * The standard function `strcpy` and its wide, sized, and Microsoft variants. */ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, SideEffectFunction, - NonThrowingFunction + NonCppThrowingFunction { StrcpyFunction() { this.hasGlobalOrStdOrBslName([ @@ -145,6 +145,4 @@ class StrcpyFunction extends ArrayFunction, DataFlowFunction, TaintFunction, Sid i = this.getParamDest() and result = this.getParamSize() } - - override TCxxException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll index 36a2f6cdbe40..e561bfadee6b 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/StructuredExceptionHandling.qll @@ -1,11 +1,7 @@ import semmle.code.cpp.models.interfaces.Throwing -class WindowsDriverExceptionAnnotation extends ThrowingFunction { +class WindowsDriverExceptionAnnotation extends AlwaysSehThrowingFunction { WindowsDriverExceptionAnnotation() { this.hasGlobalName(["RaiseException", "ExRaiseAccessViolation", "ExRaiseDatatypeMisalignment"]) } - - override predicate mayThrowException(boolean unconditional) { unconditional = true } - - override TSehException getExceptionType() { any() } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll index 9f2c28979b44..5ddf754f7456 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/NonThrowing.qll @@ -5,9 +5,15 @@ import semmle.code.cpp.Function import semmle.code.cpp.models.Models +/** + * A function that is guaranteed to never throw a C++ exception + * (distinct from a structured exception handling, SEH, exception). + */ +abstract class NonCppThrowingFunction extends Function { } + /** * A function that is guaranteed to never throw. * - * DEPRECATED: use `NonThrowingFunction` in `semmle.code.cpp.models.Models.Interfaces.Throwing` instead. + * DEPRECATED: use `NonCppThrowingFunction` instead. */ -abstract deprecated class NonThrowingFunction extends Function { } +deprecated class NonThrowingFunction = NonCppThrowingFunction; diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll index d64ba61caa0f..f75d0a78592a 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll @@ -11,65 +11,28 @@ import semmle.code.cpp.models.Models import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs /** - * Represents a type of exception, - * either Structured Exception Handling (SEH) or C++ exceptions. - */ -newtype TException = - /** Structured Exception Handling (SEH) exception */ - TSehException() or - /** C++ exception */ - TCxxException() - -/** - * Functions with information about how an exception is thrown or if one is thrown at all. - * If throwing details conflict for the same function, IR is assumed - * to use the most restricted interpretation, meaning taking options - * that stipulate no exception is raised, before the exception is always raised, - * before conditional exceptions. + * A function that is known to raise an exception. * - * Annotations must specify if the exception is from SEH (structured exception handling) - * or ordinary c++ exceptions. + * DEPRECATED: use `AlwaysSehThrowingFunction` instead if a function unconditionally throws. + * These are assumed the only case where functions throw/raise exceptions unconditionally. + * For functions that may throw, this will be the default behavior in the IR. */ -abstract private class ExceptionAnnotation extends Function { - /** - * Returns the type of exception this annotation is for, - * either a CPP exception or a STructured Exception Handling (SEH) exception. - */ - abstract TException getExceptionType(); - - /** - * Holds if the exception type of this annotation is for a Structured Exception Handling (SEH) exception. - */ - final predicate isSeh() { this.getExceptionType() = TSehException() } +abstract deprecated class ThrowingFunction extends Function { + ThrowingFunction() { any() } /** - * Holds if the exception type of this annotation is for a CPP exception. + * Holds if this function may throw an exception during evaluation. + * If `unconditional` is `true` the function always throws an exception. + * + * DPERECATED: for always throwing functions use `AlwaysSehThrowingFunction` instead. + * For functions that may throw, this will be the default behavior in the IR. */ - final predicate isCxx() { this.getExceptionType() = TCxxException() } + abstract deprecated predicate mayThrowException(boolean unconditional); } /** - * A Function that is known to not throw an exception. - */ -abstract class NonThrowingFunction extends ExceptionAnnotation { } - -/** - * A function this is known to raise an exception. + * A function that is known to raise an exception unconditionally. + * The only cases known where this happens is for SEH + * (structured exception handling) exceptions. */ -abstract class ThrowingFunction extends ExceptionAnnotation { - ThrowingFunction() { any() } - - /** - * Holds if this function may raise an exception during evaluation. - * If `unconditional` is `false` the function may raise, and if `true` the function - * will always raise an exception. - * Do not specify `none()` if no exception is raised, instead use the - * `NonThrowingFunction` class instead. - */ - abstract predicate mayThrowException(boolean unconditional); - - /** - * Holds if this function will always raise an exception if called - */ - final predicate alwaysThrowsException() { this.mayThrowException(true) } -} +abstract class AlwaysSehThrowingFunction extends Function { } From 44126913cd8af92e731247f3d534b388aa0d3179 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 12:08:04 -0500 Subject: [PATCH 11/16] Delaying deprecation of ThrowingFunction. --- .../ir/implementation/raw/internal/TranslatedCall.qll | 4 ++-- .../semmle/code/cpp/models/interfaces/Throwing.qll | 11 ++--------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll index df92e73ed372..daa6bdaafcf6 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll @@ -363,11 +363,11 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall { } final override predicate mayThrowException() { - expr.getTarget() instanceof AlwaysSehThrowingFunction + expr.getTarget().(ThrowingFunction).mayThrowException(_) } final override predicate mustThrowException() { - expr.getTarget() instanceof AlwaysSehThrowingFunction + expr.getTarget().(ThrowingFunction).mayThrowException(true) } } diff --git a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll index f75d0a78592a..044b30f7b702 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/interfaces/Throwing.qll @@ -12,22 +12,15 @@ import semmle.code.cpp.models.interfaces.FunctionInputsAndOutputs /** * A function that is known to raise an exception. - * - * DEPRECATED: use `AlwaysSehThrowingFunction` instead if a function unconditionally throws. - * These are assumed the only case where functions throw/raise exceptions unconditionally. - * For functions that may throw, this will be the default behavior in the IR. */ -abstract deprecated class ThrowingFunction extends Function { +abstract class ThrowingFunction extends Function { ThrowingFunction() { any() } /** * Holds if this function may throw an exception during evaluation. * If `unconditional` is `true` the function always throws an exception. - * - * DPERECATED: for always throwing functions use `AlwaysSehThrowingFunction` instead. - * For functions that may throw, this will be the default behavior in the IR. */ - abstract deprecated predicate mayThrowException(boolean unconditional); + abstract predicate mayThrowException(boolean unconditional); } /** From 7059fc3e31bc5b66b1ed971091960080ad422533 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 12:10:42 -0500 Subject: [PATCH 12/16] Adding intermediate solution towards deprecating ThrowingFunction --- .../cpp/ir/implementation/raw/internal/TranslatedCall.qll | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll index daa6bdaafcf6..2ddc55f91f5a 100644 --- a/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll +++ b/cpp/ql/lib/semmle/code/cpp/ir/implementation/raw/internal/TranslatedCall.qll @@ -364,10 +364,14 @@ class TranslatedFunctionCall extends TranslatedCallExpr, TranslatedDirectCall { final override predicate mayThrowException() { expr.getTarget().(ThrowingFunction).mayThrowException(_) + or + expr.getTarget() instanceof AlwaysSehThrowingFunction } final override predicate mustThrowException() { expr.getTarget().(ThrowingFunction).mayThrowException(true) + or + expr.getTarget() instanceof AlwaysSehThrowingFunction } } From 248f1c4ebea29dd967898b3077ac3dccea105919 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 12:15:14 -0500 Subject: [PATCH 13/16] Updating change log --- cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md b/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md index 114822e6c8f7..73b358a0e1fc 100644 --- a/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md +++ b/cpp/ql/lib/change-notes/2024-11-18-throwing-functions.md @@ -1,4 +1,4 @@ --- category: deprecated --- -* The `NonThrowing` class (`semmle.code.cpp.models.interfaces.NonThrowing`) has been deprecated. Please use the `NonThrowing` class from `semmle.code.cpp.models.interfaces.Throwing` instead. \ No newline at end of file +* The `NonThrowing` class (`semmle.code.cpp.models.interfaces.NonThrowing`) has been deprecated. Please use the `NonCppThrowingFunction` class instead. \ No newline at end of file From 583651ba40ff84c834905ded056fb65adfe7d835 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 12:41:26 -0500 Subject: [PATCH 14/16] Missing NonCppThrowingFunction changes in Printf.qll --- .../lib/semmle/code/cpp/models/implementations/Printf.qll | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll index f28359c7f642..585091eff705 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll @@ -37,7 +37,7 @@ private class Printf extends FormattingFunction, AliasFunction, NonCppThrowingFu /** * The standard functions `fprintf`, `fwprintf` and their glib variants. */ -private class Fprintf extends FormattingFunction, NonThrowingFunction { +private class Fprintf extends FormattingFunction, NonCppThrowingFunction { Fprintf() { this instanceof TopLevelFunction and ( @@ -55,7 +55,7 @@ private class Fprintf extends FormattingFunction, NonThrowingFunction { /** * The standard function `sprintf` and its Microsoft and glib variants. */ -private class Sprintf extends FormattingFunction, NonThrowingFunction { +private class Sprintf extends FormattingFunction, NonCppThrowingFunction { Sprintf() { this instanceof TopLevelFunction and ( @@ -98,7 +98,7 @@ private class Sprintf extends FormattingFunction, NonThrowingFunction { /** * Implements `Snprintf`. */ -private class SnprintfImpl extends Snprintf, AliasFunction, SideEffectFunction, NonThrowingFunction { +private class SnprintfImpl extends Snprintf, AliasFunction, SideEffectFunction, NonCppThrowingFunction { SnprintfImpl() { this instanceof TopLevelFunction and ( @@ -205,7 +205,7 @@ private class StringCchPrintf extends FormattingFunction { /** * The standard function `syslog`. */ -private class Syslog extends FormattingFunction, NonThrowingFunction { +private class Syslog extends FormattingFunction, NonCppThrowingFunction { Syslog() { this instanceof TopLevelFunction and this.hasGlobalName("syslog") and From 66cf736b4c8f56e2b5787a3906513fd5801c0a0d Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 12:44:28 -0500 Subject: [PATCH 15/16] printf formatting. --- cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll index 585091eff705..d4b054ea0b54 100644 --- a/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll +++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Printf.qll @@ -98,7 +98,9 @@ private class Sprintf extends FormattingFunction, NonCppThrowingFunction { /** * Implements `Snprintf`. */ -private class SnprintfImpl extends Snprintf, AliasFunction, SideEffectFunction, NonCppThrowingFunction { +private class SnprintfImpl extends Snprintf, AliasFunction, SideEffectFunction, + NonCppThrowingFunction +{ SnprintfImpl() { this instanceof TopLevelFunction and ( From 37365c746ccf15848cc9abc77f96678d11b01ec4 Mon Sep 17 00:00:00 2001 From: "REDMOND\\brodes" Date: Thu, 21 Nov 2024 12:59:56 -0500 Subject: [PATCH 16/16] Updating to NonCppThrowingFunction use in IncorrectALlocationErrorHandling.ql --- .../Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cpp/ql/src/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql b/cpp/ql/src/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql index 92daf31b0570..d4d908f8474b 100644 --- a/cpp/ql/src/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql +++ b/cpp/ql/src/Security/CWE/CWE-570/IncorrectAllocationErrorHandling.ql @@ -45,7 +45,7 @@ predicate deleteMayThrow(DeleteOrDeleteArrayExpr deleteExpr) { * like it might throw an exception, and the function does not have a `noexcept` or `throw()` specifier. */ predicate functionMayThrow(Function f) { - not f instanceof NonThrowingFunction and + not f instanceof NonCppThrowingFunction and (not exists(f.getBlock()) or stmtMayThrow(f.getBlock())) }