hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 02:44:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
75,255 Commits 1,672 Branches 157 Tags
codeql-cli-2.20.2
Commit Graph

6899 Commits

Author SHA1 Message Date
Geoffrey White
d2b18d952d C++: Add qhelp. 2021-11-09 18:41:56 +00:00
Geoffrey White
bd1e708c5d C++: First version of cpp/non-https-url. 2021-11-09 18:33:49 +00:00
ihsinme
55fe01018f Update InsecureTemporaryFile.ql 2021-11-09 09:33:33 +03:00
ihsinme
8ddfea1dee Update cpp/ql/src/experimental/Security/CWE/CWE-200/ExposureSensitiveInformationUnauthorizedActor.qhelp 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2021-11-09 09:20:39 +03:00
ihsinme
cedc5fd743 Update InsecureTemporaryFile.ql 2021-11-05 09:42:06 +03:00
Mathias Vorreiter Pedersen
e9b114630a Merge pull request #6948 from ihsinme/ihsinme-patch-076 
CPP: Add query for CWE-243 Creation of chroot Jail Without Changing Working Directory
 2021-11-03 18:50:13 +00:00
ihsinme
a9dd868348 Update IncorrectChangingWorkingDirectory.qhelp 2021-11-03 18:38:30 +03:00
ihsinme
c94b64cbca Update IncorrectChangingWorkingDirectory.qhelp 2021-11-03 18:28:57 +03:00
ihsinme
c175f0aa9d Update IncorrectChangingWorkingDirectory.ql 2021-11-03 12:25:30 +03:00
ihsinme
62b3c3c9a0 Update IncorrectChangingWorkingDirectory.ql 2021-11-02 16:16:17 +03:00
ihsinme
738354b8e7 Update cpp/ql/src/experimental/Security/CWE/CWE-243/IncorrectChangingWorkingDirectory.ql 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2021-11-02 16:13:34 +03:00
CodeQL CI
d5e2026a26 Merge pull request #6934 from erik-krogh/more-instanceof 
Approved by MathiasVP, esbena, yoff
 2021-11-02 03:46:23 -07:00
ihsinme
9b8b916199 Update IncorrectChangingWorkingDirectory.ql 2021-11-02 11:33:29 +03:00
ihsinme
3161d112d1 Update IncorrectChangingWorkingDirectory.ql 2021-10-30 13:47:22 +03:00
Erik Krogh Kristensen
d36c66cfca remove redundant inline casts in arguments where the type is inferred by the call target 2021-10-29 14:37:56 +02:00
ihsinme
635a668670 Update IncorrectChangingWorkingDirectory.ql 2021-10-29 10:08:41 +03:00
ihsinme
c8a4a8b965 Update InsecureTemporaryFile.ql 2021-10-29 09:44:43 +03:00
Erik Krogh Kristensen
15c90adec5 remove redundant cast where the type is enforced by an equality comparison 2021-10-28 18:08:20 +02:00
Erik Krogh Kristensen
e75448ebb0 remove redundant inline casts 2021-10-28 16:35:53 +02:00
ihsinme
432fc74455 Apply suggestions from code review 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2021-10-28 10:37:01 +03:00
ihsinme
235a3ec232 Update InsecureTemporaryFile.qhelp 2021-10-28 10:34:42 +03:00
ihsinme
0addb2d1ea Update IncorrectChangingWorkingDirectory.ql 2021-10-28 10:17:48 +03:00
ihsinme
c3b1d7e5c8 Apply suggestions from code review 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2021-10-28 10:17:13 +03:00
ihsinme
1c80f26178 Update ExposureSensitiveInformationUnauthorizedActor.ql 2021-10-28 09:50:41 +03:00
ihsinme
04ee78aecf Apply suggestions from code review 
thanks

Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2021-10-28 09:46:26 +03:00
Geoffrey White
2182bb5c91 C++: Remove unused qhelp files. 2021-10-27 15:47:01 +01:00
Geoffrey White
d990e790e7 C++: Remove unused index.qhelp files. 2021-10-27 15:40:34 +01:00
ihsinme
41e15cd497 Update IncorrectPrivilegeAssignment.cpp 2021-10-25 22:15:52 +03:00
Erik Krogh Kristensen
d2d6b2ca7c apply range pattern patch to cpp 2021-10-25 19:38:10 +02:00
ihsinme
1dacd2ea76 Add files via upload 2021-10-25 14:47:25 +03:00
ihsinme
6173b11274 Add files via upload 2021-10-25 14:39:43 +03:00
ihsinme
baec186359 Add files via upload 2021-10-25 14:33:01 +03:00
ihsinme
8e8a324fa6 Add files via upload 2021-10-25 14:23:19 +03:00
Geoffrey White
da412178ce C++: Use set literals (more). 2021-10-20 14:18:27 +01:00
Geoffrey White
3f3c79f48f Merge pull request #6884 from geoffw0/setliterals 
Replace or chains with set literals.
 2021-10-18 16:46:55 +01:00
Jonas Jensen
493a37ba5e Merge pull request #6903 from MathiasVP/remove-implicit-this-for-cpp 
C++: Remove uses of implicit `this`
 2021-10-18 13:41:30 +02:00
Geoffrey White
f38dade578 C++: Disable the two null termination queries enabled by 6794. 2021-10-15 17:39:12 +01:00
Erik Krogh Kristensen
fe891746bf C++: fix implicit this 2021-10-15 14:59:48 +01:00
Geoffrey White
f08d2ee759 Merge branch 'main' into setliterals 2021-10-14 14:39:39 +01:00
Mathias Vorreiter Pedersen
a2371370ff Merge pull request #6865 from MathiasVP/fix-if-none 
C++/C#/JS/Python: Replace 'if p() then q() else none()' with a conjunction
 2021-10-13 19:47:55 +01:00
Geoffrey White
2e61ae244a C++: Set literals. 2021-10-13 16:12:36 +01:00
Philip Ginsbach
a204b7f3e7 Merge pull request #6866 from github/ginsbach/MoreInstanceofExtensions 
more instanceof extensions
 2021-10-13 14:21:50 +01:00
Mathias Vorreiter Pedersen
6ece3c2b46 Merge pull request #6870 from jbj/cp-fixes 
C++: Fix potential Cartesian products
 2021-10-13 14:15:33 +01:00
Jonas Jensen
e80c1ad91f C++: Fix resource-not-released-in-destructor CP 
By moving a disjunct outside the scope of an `exists(Function f`
variable it doens't use, the code becomes clearer and can be optimized
better.

The CP in the QL code did not lead to a CP at evaluation time since the
optimizer was smart enough to compensate for it:

    376161  ~37597630%     {0} r1 = SCAN functions OUTPUT {}
    1       ~0%            {0} r2 = STREAM DEDUP r1

Before this change, the largest tuple count in `leakedInSameMethod` on
bitcoin/bitcoin was 2M. Now it's 400k.
 2021-10-13 14:24:26 +02:00
Jonas Jensen
955344e175 C++: Inline a predicate that contains CPs 
The `overflows` predicate had quite severe Cartesian products. We didn't
see them in practice because magic saved us, but we can't rely on magic
in the future, so it seems better to inline this predicate.

Tuple counts and speed look good both before and after.
 2021-10-13 14:11:47 +02:00
Mathias Vorreiter Pedersen
ba981c525b C++: Replace 'if p() then q() else none()' with a conjunction. 2021-10-13 12:11:42 +01:00
Philip Ginsbach
4a0aac8505 SuppressionScope non-extending subtype of SuppressionComment 2021-10-13 11:40:32 +01:00
Aditya Sharad
a517a05ca8 Merge pull request #6830 from github/henrymercer/report-extraction-errors-as-warnings 
C++: Improve SARIF severity level reporting of extractor diagnostics
 2021-10-12 09:59:27 -07:00
Mathias Vorreiter Pedersen
6853f491f4 Merge pull request #6794 from geoffw0/impropnullfp 
C++: Improvements to cpp/improper-null-termination
 2021-10-12 14:47:02 +01:00
Mathias Vorreiter Pedersen
df8c399efb Merge pull request #6710 from ihsinme/ihsinme-patch-70 
CPP: Add query for CWE-1041 Use of Redundant Code
 2021-10-11 17:17:01 +01:00