hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-18 09:43:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
79,688 Commits 1,672 Branches 157 Tags
codeql-cli-2.22.0
Commit Graph

3121 Commits

Author SHA1 Message Date
Owen Mansel-Chan
4b88279ccc Improve usage message formatting 2023-05-03 12:03:11 +01:00
Kasper Svendsen
e969018f99 Go: Make implicit this receivers explicit 2023-05-03 12:45:42 +02:00
Owen Mansel-Chan
27fb42db76 Env var for path to environment file 2023-05-03 11:11:09 +01:00
Owen Mansel-Chan
0c6efb8c84 Add telemetry-only diagnostics 2023-05-02 17:17:06 +01:00
Owen Mansel-Chan
3bfcbbf7af Add unit test 2023-05-02 17:17:05 +01:00
Owen Mansel-Chan
0710ed97db Refactor to be more easily testable 2023-05-02 17:17:05 +01:00
Owen Mansel-Chan
2db304edee Choose which version to install and write file 2023-05-02 17:17:04 +01:00
Owen Mansel-Chan
644d7f18c2 Factor out tryReadGoDirective() 2023-05-02 14:15:03 +01:00
Owen Mansel-Chan
5e87111a8b Stop using deprecate io/ioutil package 2023-05-02 14:15:02 +01:00
Owen Mansel-Chan
1e2bdd88b1 Add --identify-environment flag 2023-05-02 14:15:01 +01:00
github-actions[bot]
18d4af994d Post-release preparation for codeql-cli-2.13.1 2023-05-02 10:50:20 +00:00
Anders Schack-Mulligen
ca09649679 Dataflow: Forward hasLocationInfo. 2023-05-02 10:48:32 +02:00
Anders Schack-Mulligen
5927bb2030 Dataflow: Replace "extends Node" with "instanceof Node". 2023-05-02 09:48:34 +02:00
Anders Schack-Mulligen
6c8cb0dc5e Merge pull request #12930 from aschackmull/dataflow/split-typedcontent 
Dataflow: Refactor access paths to split TypedContent into an explicit pair
 2023-05-01 14:58:15 +02:00
github-actions[bot]
3bd29171fb Release preparation for version 2.13.1 2023-04-28 12:14:35 +00:00
Michael B. Gale
edfe2d7ab7 Merge pull request #12944 from github/mbg/go/html-template-sanitizers 
Go: Add `html/template` functions as sanitisers for XSS queries
 2023-04-28 12:15:57 +01:00
Michael B. Gale
5a44fae515 Go: add test for unrelated A->C data flow 2023-04-28 10:56:12 +01:00
Owen Mansel-Chan
8415c4a4eb Remove ArgumentNode assumption 2023-04-28 09:23:38 +01:00
Owen Mansel-Chan
c7c0a73b90 Accept review suggestions 2023-04-28 09:23:37 +01:00
Owen Mansel-Chan
52cc61198d Use CallExpr.hasImplicitArgs() 2023-04-28 09:23:37 +01:00
Owen Mansel-Chan
b928f13d94 Add CallExpr.hasImplicitArgs() 2023-04-28 09:23:36 +01:00
Owen Mansel-Chan
f3c1c53b54 Add CallExpr.getCalleeType() 
This avoids using `getTarget()`, so it works even when that doesn't
exist (for example when calling a variable with function type).
 2023-04-28 09:23:36 +01:00
Owen Mansel-Chan
3f095db853 Formatted parameters always a variadic parameter 2023-04-28 06:09:11 +01:00
Owen Mansel-Chan
f2368a9441 Do not use variadic sink fn in tests 2023-04-28 06:09:11 +01:00
Owen Mansel-Chan
bc0f9030e3 use CallNode.getSyntacticArgument 2023-04-28 06:09:10 +01:00
Owen Mansel-Chan
2d3fed9c07 Accept intended test result changes 2023-04-28 06:09:10 +01:00
Owen Mansel-Chan
17077f3ec5 Update OutParameter.getExitNode for implicit varargs slices 2023-04-28 06:09:10 +01:00
Michael B. Gale
72b082806b Go: Update html-template-escaping-passthrough 
Modify this query to apply sanitizers only in the data flow
between untrusted inputs and passthrough conversion types.
 2023-04-27 17:14:38 +01:00
Anders Schack-Mulligen
71ae0909d8 Dataflow: Enforce type pruning in all forward stages. 2023-04-27 14:55:26 +02:00
Anders Schack-Mulligen
9140cbefc0 Dataflow: Sync. 2023-04-27 14:55:23 +02:00
Michael B. Gale
1aa1153ed6 Go: Add html/template as XSS queries sanitizer 2023-04-26 21:21:52 +01:00
Owen Mansel-Chan
39da26e9b5 Update ParameterInput.getEntryNode for implicit varargs slices 2023-04-26 14:35:20 +01:00
Owen Mansel-Chan
1e3d81842e Update CallNode.getArgument for implicit varargs 
It now has one only result corresponding to a variadic parameter. If the
argument is followed by an ellipsis then it is just the argument itself.
Otherwise it is a ImplicitVarargsSlice node.
 2023-04-26 14:35:19 +01:00
Anders Schack-Mulligen
d681671356 Dataflow: Sync. 2023-04-26 14:45:07 +02:00
Owen Mansel-Chan
3e73e02175 Update PostUpdateNodes for implicit varargs slices 
We don't want a post update node for the implicit varargs slice, and we
do want one for each argument which is stored in the implicit varargs
slice.
 2023-04-25 07:33:35 +01:00
Owen Mansel-Chan
73b712a8c9 Allow data flow through varargs parameters 2023-04-25 07:33:34 +01:00
Owen Mansel-Chan
1afe845ed3 Add missing "v" to semver version string 
Because it was missing, that function always returned +1,
so we were doing the wrong thing when the Go version
installed was lower than 1.16.
 2023-04-24 14:31:46 +01:00
Michael Nebel
656d8d2451 Sync files. 2023-04-20 11:29:51 +02:00
Owen Mansel-Chan
3ca04338ca Use named initialization for struct 2023-04-19 13:06:51 +01:00
Owen Mansel-Chan
219c1686fd Wrap return values of moveToTemporaryGopath in a struct 2023-04-19 12:40:23 +01:00
Owen Mansel-Chan
1bb006f43e Move defer statements to the right place 
It turns out that extracting defer statements into a separate function
changes behaviour.
 2023-04-19 12:20:52 +01:00
Owen Mansel-Chan
641f16b0df Factor out extract() 2023-04-19 12:20:52 +01:00
Owen Mansel-Chan
a611769b43 Factor out installDependencies() 2023-04-19 12:20:51 +01:00
Owen Mansel-Chan
d61d595b21 Factor out function buildWithCustomCommands 2023-04-19 12:20:51 +01:00
Owen Mansel-Chan
b45c0ff848 Factor out buildWithoutCustomCommands 2023-04-19 12:20:51 +01:00
Owen Mansel-Chan
b76e655735 Factor out moving code to temp dir in gopath 2023-04-19 12:20:50 +01:00
Owen Mansel-Chan
ba48eaa8a6 Factor out calculation of source dir 2023-04-19 12:20:50 +01:00
Owen Mansel-Chan
702c22b630 Refactor calculation of inLGTM 2023-04-19 12:20:49 +01:00
Owen Mansel-Chan
f0186957ca Factor out tryUpdateGoModAndGoSum 2023-04-19 12:20:49 +01:00
Owen Mansel-Chan
0bfb242e63 Factor out logic for needGopath 2023-04-19 12:20:49 +01:00