hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
28,569 Commits 1,671 Branches 157 Tags
aeisenberg/codeql-workspace
Commit Graph

53 Commits

Author SHA1 Message Date
Andrew Eisenberg
51fa7da55f Migrate to codeql-workspace.yml 
This file has the same structure and behaviour as .codeqlmanifest (only
in YAML!).

This new file has been supported since 2.6.3, but it has been unused.
 2021-10-29 13:21:01 -07:00
Nick Rolfe
f557df6c4e Revert "Ruby: update Cargo.lock" 
This reverts commit 0a89028663.
 2021-10-27 18:38:22 +01:00
Nick Rolfe
f1229ff071 Revert "Ruby: update Cargo.lock" 
This reverts commit 7a5e8f1756.
 2021-10-27 18:38:08 +01:00
Nick Rolfe
7a5e8f1756 Ruby: update Cargo.lock 2021-10-27 16:21:33 +01:00
Nick Rolfe
ff7826dd96 Revert "Update tracing-subscriber requirement from 0.2 to 0.3 in /ruby/generator" 
This reverts commit 4cedb43a54.
 2021-10-27 16:21:33 +01:00
Nick Rolfe
fc1f874f92 Revert "Update tracing-subscriber requirement from 0.2 to 0.3 in /ruby/extractor" 
This reverts commit e9da027539.
 2021-10-27 16:21:33 +01:00
Nick Rolfe
0a89028663 Ruby: update Cargo.lock 2021-10-27 11:43:09 +01:00
Mathias Vorreiter Pedersen
67fd38f328 C#/Ruby: Use a 'noinline' instead of a 'only_bind_into'. 2021-10-26 09:41:52 +01:00
Mathias Vorreiter Pedersen
4b137ede0e Ruby: Sync identical files. 2021-10-25 22:03:44 +01:00
Nick Rolfe
779e24eb73 Ruby: remove VS Code workspace 2021-10-25 13:12:31 +01:00
Nick Rolfe
fb79886fe7 Merge pull request #6944 from github/dependabot/cargo/ruby/extractor/tracing-subscriber-0.3 
Update tracing-subscriber requirement from 0.2 to 0.3 in /ruby/extractor
 2021-10-25 12:50:48 +01:00
dependabot[bot]
e9da027539 Update tracing-subscriber requirement from 0.2 to 0.3 in /ruby/extractor 
Updates the requirements on [tracing-subscriber](https://github.com/tokio-rs/tracing) to permit the latest version.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](https://github.com/tokio-rs/tracing/compare/tracing-subscriber-0.2.0...tracing-subscriber-0.3.0)

---
updated-dependencies:
- dependency-name: tracing-subscriber
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-10-25 10:40:34 +00:00
dependabot[bot]
4cedb43a54 Update tracing-subscriber requirement from 0.2 to 0.3 in /ruby/generator 
Updates the requirements on [tracing-subscriber](https://github.com/tokio-rs/tracing) to permit the latest version.
- [Release notes](https://github.com/tokio-rs/tracing/releases)
- [Commits](https://github.com/tokio-rs/tracing/compare/tracing-subscriber-0.2.0...tracing-subscriber-0.3.0)

---
updated-dependencies:
- dependency-name: tracing-subscriber
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-10-25 10:40:28 +00:00
Tom Hvitved
f020b2e437 Merge pull request #335 from github/hmac/self-flow 2021-10-22 19:14:20 +02:00
Nick Rolfe
3851a27fc1 Merge pull request #358 from github/external-control-file-path 
Add rb/path-injection query
 2021-10-22 15:38:39 +01:00
Tom Hvitved
61d7cdeec0 Data flow: Assign empty locations to summary nodes 2021-10-22 14:48:33 +02:00
Harry Maclean
87df3a0a99 Minor refactor 2021-10-22 11:44:38 +01:00
Nick Rolfe
d4cee73720 Add taint summaries for ActiveStorage::Filename 2021-10-22 11:15:42 +01:00
Harry Maclean
aa8607009b Update test fixtures 2021-10-22 10:56:34 +01:00
Harry Maclean
336bd15d2f Override isCapturedAccess for self variables 
Many `self` reads are synthesised from method calls with an implicit
`self` receiver. Synthesised nodes have no `toGenerated` result, which
the default definition of `isCapturedAccess` uses to determine if a
variable's scope matches the access's scope.

Hence we override the definition to properly identify accesses like the
call `puts` (below) as captured reads of a `self` variable defined in a
parent scope.

In other words, `puts x` is short for `self.puts x` and the `self`
refers to its value in the scope of the module `Foo`.

```ruby
module Foo
  MY_PROC = -> (x) { puts x }
end
```

We also have to update the SSA `SelfDefinition` to exclude captured
`self` variables.
 2021-10-22 10:56:34 +01:00
Harry Maclean
f1add388a0 Synthesise writes to self for classes/modules 
This requires changing the CFG trees for classes and modules from
post-order to pre-order so that we can place the writes at the root node
of the tree, to prevent them overlapping with reads in the body of the
class/module.

We need to do this because classes and modules don't define their own
basic block, but re-use the surrounding one. This problem doesn't occur
for `self` variables in methods because each method has its own basic
block and we can place the write on the entry node of the bock.
 2021-10-22 10:56:34 +01:00
Arthur Baars
4f72d0853a Merge pull request #375 from github/rc/3.3 
Merge rc/3.3 into main
 2021-10-21 18:16:57 +02:00
Nick Rolfe
5734f51792 Merge remote-tracking branch 'origin/main' into external-control-file-path 2021-10-21 10:58:38 +01:00
Arthur Baars
74ba532a8b Ruby: warn that Ruby is still in Beta 2021-10-20 15:59:26 +02:00
Arthur Baars
630ee17613 Ruby: sync-files and add allowParameterReturnInSelf() 2021-10-20 15:39:46 +02:00
Harry Maclean
356828cd51 Update stored XSS fixture 
The change to `self` modelling finds more true positives in this query.
 2021-10-20 13:30:51 +01:00
Nick Rolfe
16c62d22de Add change-note for rb/path-injection 2021-10-20 13:19:49 +01:00
Nick Rolfe
e367832637 Import Frameworks.qll in Summaries module 2021-10-20 13:11:50 +01:00
Nick Rolfe
86da3c2db3 Add rb/path-injection query 2021-10-20 12:31:16 +01:00
Tom Hvitved
f1f7930529 Make all self nodes LocalSourceNodes 2021-10-20 11:43:50 +02:00
Tom Hvitved
94f0f8daf2 Make SelfVariableAccess a sub type of LocalVariableAccess 2021-10-20 11:43:44 +02:00
Harry Maclean
e0b2d88377 Remove redundant import 2021-10-20 10:41:17 +01:00
Harry Maclean
c437fd50a4 Update test fixtures 
Some of these look a bit suspicious, so need to double check them before
merging.
 2021-10-20 10:39:36 +01:00
Harry Maclean
c71f538a5a Extend the scope of self variables 
`self` variables are scoped to methods, modules, classes and the
top-level of the program. Prior to this change, they were treated as
being scoped just to methods.

This change means we (once again) correctly synthesise `self` receivers
for method calls in class bodies, module bodies and at the top-level.
 2021-10-20 09:43:23 +01:00
Harry Maclean
647485acde Don't omit self from uninitialized writes 
We can safely create uninitialized writes for `self` variables, because
they appear at index -1 in the entry block of a method, and are
immediately overwritten by a write to `self` at index 0. As a result,
they are not live and will be pruned from the CFG.
 2021-10-20 09:43:22 +01:00
Tom Hvitved
446eb13471 Minor adjustments to SSA library for self variables 2021-10-20 09:43:21 +01:00
Harry Maclean
0d39a15786 Model implicit reads of self variables 
We already synthesise `self` nodes for method calls with no receiver.
This change creates read accesses for each of these synthesised nodes.
 2021-10-20 09:43:20 +01:00
Harry Maclean
e7a3050fb2 Improve the modelling of self variables. 
We model `self` variables by inserting a write at the start of every
method body. We then treat them as local variables that are alive for
the extent of the method body.
 2021-10-20 09:43:19 +01:00
Tom Hvitved
c57b7c5b2b Data flow: Restrict ExprReturnNode to nodes from the body of the callable 2021-10-18 17:01:30 +02:00
Tom Hvitved
397b8345e0 Data flow: Fix bug for sugared call arguments 2021-10-18 13:48:11 +02:00
Tom Hvitved
0de27bbc7e Data flow: Add ArgumentNode test 2021-10-18 13:47:50 +02:00
shati-patel
83a1260769 Move queries.xml to src 2021-10-18 11:18:00 +01:00
Arthur Baars
e26cf7c354 Merge pull request #369 from github/rc/3.3 
Merge 3.3 into main
 2021-10-15 23:04:12 +02:00
Arthur Baars
9b88bbdd04 Merge pull request #367 from github/shati-patel/queriesxml 
Add a queries.xml file (for CWE coverage docs)
 2021-10-15 20:50:21 +02:00
shati-patel
c37cf71766 Add a queries.xml file (for CWE coverage) docs 2021-10-15 20:33:16 +02:00
Arthur Baars
0e7b1f516c Merge remote-tracking branch 'origin/rc/3.3' into 'main' 2021-10-15 16:36:09 +02:00
Arthur Baars
5cd9b9cfc5 Remove github/codeql submodule 2021-10-15 15:38:16 +02:00
Arthur Baars
5a16f1e093 Merge identical-files.json 2021-10-15 15:38:16 +02:00
Arthur Baars
ceecb23118 Merge remote-tracking branch 'rc/3.3' into 'main' 2021-10-15 15:21:48 +02:00
Arthur Baars
a9ba13c557 Drop LICENSE and CODE_OF_CONDUCT.md 2021-10-15 14:20:07 +02:00