Introduce Length Type Keyword #876
Conversation
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #876 +/- ##
============================================
+ Coverage 77.20% 77.22% +0.01%
Complexity 250 250
============================================
Files 59 59
Lines 1882 1901 +19
Branches 265 273 +8
============================================
+ Hits 1453 1468 +15
- Misses 308 309 +1
- Partials 121 124 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
...pg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ImplementationDslTest.kt
Fixed
Show fixed
Hide fixed
...pg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ImplementationDslTest.kt
Fixed
Show fixed
Hide fixed
…f missing lazy evaluation
There was a problem hiding this comment.
detekt found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
...ds/cpg/src/main/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ImplementationDsl.kt
Fixed
Show fixed
Hide fixed
...pg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ImplementationDslTest.kt
Fixed
Show fixed
Hide fixed
...pg/src/test/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ImplementationDslTest.kt
Fixed
Show fixed
Hide fixed
...ds/cpg/src/main/kotlin/de/fraunhofer/aisec/codyze/backends/cpg/coko/dsl/ImplementationDsl.kt
Fixed
Show fixed
Hide fixed
|
This PR is waiting for an update to the SizeEvaluator in the CPG to cover more cases |
| } | ||
| } | ||
|
|
||
| val results = arrayOf(1, 0, 1, 2) |
Check warning
Code scanning / detekt
Using `Array<Primitive>` leads to implicit boxing and a performance hit. Warning test
| } | ||
| } | ||
|
|
||
| val results = arrayOf(1, 0, 1, 2) |
Check warning
Code scanning / detekt
Using `Array<Primitive>` leads to implicit boxing and a performance hit. Warning test
|
Moved everything regarding the new |
This adds the new
Length()Type to use in Coko queries.This enables rules to verify the length of an argument, e.g. how many bytes a salt parameter can assume.
One issue with the implementation if that when the length can not be determined (length == -1), false positives may be produced. The current evaluator structure makes it hard to propagate an
openresult from the length check to the Finding.(Refer to #886)
Additionally, this PR includes an optimization for Ranges given as arguments for Only and Never evaluators:
By only verifying that every possible value lies within the upper and lower bounds of the range we do not have to iterate over every value in the range. This is especially noticeable when specifying a huge range of allowed parameter values.
Tasks:
Lengthkeywordrestructure Evaluator to enable propagation of false positive knowledge