hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
83,294 Commits 1,671 Branches 157 Tags
codeql-cli-2.23.3
Commit Graph

7095 Commits

Author SHA1 Message Date
github-actions[bot]
71ab804274 Release preparation for version 2.16.6 2024-03-25 16:58:08 +00:00
Jeroen Ketema
453cdfa513 C++: Add change note 2024-03-22 15:52:52 +01:00
Jeroen Ketema
adfb3c3d50 C++: Simplify cpp/boost/tls-settings-misconfiguration 2024-03-22 11:22:11 +01:00
Jeroen Ketema
a770bddff0 C++: Add precision to cpp/boost/tls-settings-misconfiguration and cpp/boost/use-of-deprecated-hardcoded-security-protocol 
Also clean up the names of the queries while here.
 2024-03-22 10:48:18 +01:00
Arthur Baars
c219b1a3c7 Merge pull request #16013 from github/rc/3.13 
Merge rc/3.13 into main
 2024-03-21 16:04:58 +01:00
Henry Mercer
4e3a6e2140 Merge pull request #15874 from github/henrymercer/mark-loc-as-telemetry 
Show lines of code data in debug mode only
 2024-03-21 12:20:09 +00:00
Mathias Vorreiter Pedersen
dc5ee7c8b4 Merge pull request #16007 from MathiasVP/fix-tls-settings-misconfiguration 
C++: Fix `cpp/boost/tls-settings-misconfiguration` FPs
 2024-03-21 10:16:37 +00:00
Mathias Vorreiter Pedersen
7fb64268bd Merge pull request #15997 from MathiasVP/simplify-guard-in-missing-check-scanf 
C++: Simplify use of guard conditions in `cpp/missing-check-scanf`
 2024-03-21 10:16:12 +00:00
Henry Mercer
a76832f4e0 Mark LOC queries as debug instead 2024-03-20 21:18:55 +00:00
Mathias Vorreiter Pedersen
1330c885c8 C++: Use 'asIndirectExpr' in the sink of 'ExistsAnyFlowConfig. 2024-03-20 18:04:59 +00:00
Mathias Vorreiter Pedersen
f31bb1391d C++: Simplify 'checkedForEof'. 2024-03-20 16:59:39 +00:00
Mathias Vorreiter Pedersen
5476f42d2c C++: Simplify use of 'GuardCondition's in 'cpp/missing-check-scanf'. 2024-03-20 16:44:43 +00:00
Mathias Vorreiter Pedersen
96cd259eda C++: Add change note. 2024-03-20 14:56:39 +00:00
Mathias Vorreiter Pedersen
14aff5c94c C++: Convert 'cpp/missing-check-scanf' to a path-problem query. 2024-03-20 14:54:53 +00:00
Mathias Vorreiter Pedersen
c9dbb7c5a9 C++: Rewrite 'cpp/missing-check-scanf' to use standard dataflow configurations. 2024-03-20 12:01:57 +00:00
Dave Bartolomeo
311ba8ea1b Merge from main to resolve conflicts 2024-03-19 10:41:31 -04:00
Mathias Vorreiter Pedersen
597f0082e7 Merge pull request #15958 from MathiasVP/ir-guards-from-switch-statements-2 
C++: Implement guards logic for switch statements
 2024-03-19 13:21:45 +00:00
Mathias Vorreiter Pedersen
b66b8785c4 Merge branch 'main' into unitialized-local-as-path 2024-03-18 17:42:53 +00:00
Mathias Vorreiter Pedersen
decede51dc C++: Use the new predicate in 'ScanfChecks.qll'. 2024-03-18 16:07:57 +00:00
Mathias Vorreiter Pedersen
b944f3b411 C++: Fix FP. 2024-03-18 15:57:20 +00:00
Mathias Vorreiter Pedersen
bd0969b87b C++: Add change note. 2024-03-18 15:04:19 +00:00
Mathias Vorreiter Pedersen
4a55b6fbdf C++: Make 'cpp/uninitialized-local' a path-problem query. 2024-03-18 15:02:33 +00:00
github-actions[bot]
aebe9f6992 Post-release preparation for codeql-cli-2.16.5 2024-03-18 12:16:26 +00:00
Mathias Vorreiter Pedersen
7b6accd33a Update cpp/ql/src/experimental/Security/CWE/CWE-416/IteratorToExpiredContainer.ql 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2024-03-18 12:01:51 +00:00
Mathias Vorreiter Pedersen
457d71d7bc Update cpp/ql/src/experimental/Security/CWE/CWE-416/IteratorToExpiredContainer.ql 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2024-03-18 12:01:44 +00:00
github-actions[bot]
0a6243d07b Release preparation for version 2.16.5 2024-03-18 10:14:07 +00:00
Mathias Vorreiter Pedersen
a8718f99a1 C++: Add qhelp for 'cpp/iterator-to-expired-container'. 2024-03-15 17:35:47 +00:00
Mathias Vorreiter Pedersen
23cf99734a C++: Add a new experimental query ' cpp/iterator-to-expired-container'. 2024-03-15 14:29:29 +00:00
Mathias Vorreiter Pedersen
2fc0922b29 Merge branch 'main' into bring-back-type-barriers-in-non-constant-format 2024-03-13 22:46:35 +00:00
Mathias Vorreiter Pedersen
61597f5ac7 C++: This commit does two things: 
1. It fixes a logic error in the cannotContainString predicate.
2. It reverts the changes to the `isSource` predicate that required the external
function to be within the source root.

The change to `isSource` was meant to fix the a performance problem that occurred
because of the logic error in the cannotContainString predicate. However, now that
the logic error is fixed this is no longer necessary 🎉
 2024-03-13 22:40:06 +00:00
Mathias Vorreiter Pedersen
465c3c18e3 C++: Add change note. 2024-03-13 11:49:26 +00:00
Mathias Vorreiter Pedersen
51f5740707 C++: Exclude functions that aren't declared inside the source root. This fixes performance on ImageMagick. 2024-03-12 14:20:16 +00:00
Mathias Vorreiter Pedersen
6a563c161e C++: Simplify the definition of 'isNonConst'. On ImageMagick I get the same exact sources before and after. 2024-03-12 14:20:09 +00:00
Mathias Vorreiter Pedersen
179a7d500e C++: Handle 'wchar_t' types that may be defined as unsigned short in C. This brings back SAMATE results. 2024-03-12 14:19:48 +00:00
Mathias Vorreiter Pedersen
9854ed4b89 C++: Delete comment. 2024-03-11 18:54:53 +00:00
Mathias Vorreiter Pedersen
2345907a52 C++: Reintroduce the 'cannotContainString' optimization that was removed in #15516. 2024-03-11 18:49:03 +00:00
Mathias Vorreiter Pedersen
f97b6e2848 C++: Stop conflating pointers and indirections in the query. 2024-03-11 18:48:19 +00:00
Mathias Vorreiter Pedersen
32e532ff3c C++: Some cleanup to avoid conflating the case of a function returning something as a return value, and a function updating one of its arguments. 2024-03-11 18:42:42 +00:00
Henry Mercer
c325ff8a23 Mark lines of code queries as telemetry queries 
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.

The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
 2024-03-11 16:40:31 +00:00
Mathias Vorreiter Pedersen
7b0df57d7a C++: Remove the two configurations that depend on flow state to speed up performance on ChakraCore. 2024-03-11 13:56:22 +00:00
Mathias Vorreiter Pedersen
761f6d3a7e C++: Disable field flow from the 'cpp/type-confusion' query to fix performance on ChakraCore. 2024-03-07 15:24:04 -08:00
Mathias Vorreiter Pedersen
4f9bdca4f0 C++: Optimize. 2024-03-07 13:08:26 -08:00
Mathias Vorreiter Pedersen
cedbfbe7ea C++: Use a more generous definition of compatible types. 2024-03-07 10:50:20 -08:00
Mathias Vorreiter Pedersen
9e77b89885 Update TypeConfusion.qhelp 
Co-authored-by: hubwriter <hubwriter@github.com>
 2024-03-07 08:33:49 -08:00
Mathias Vorreiter Pedersen
b876117ecc C++: Add more QLDoc. 2024-03-06 22:25:04 -08:00
Mathias Vorreiter Pedersen
3295d5cb9f C++: Add more QLDoc. 2024-03-06 21:17:57 -08:00
Mathias Vorreiter Pedersen
cd57cd0d8a C++: Add qhelp reference. 2024-03-06 21:15:27 -08:00
Mathias Vorreiter Pedersen
6dc0fa515d C++: Add change note. 2024-03-06 21:11:36 -08:00
Mathias Vorreiter Pedersen
8ae6fa5366 C++: Add a new query 'cpp/type-confusion' for detecting type confusion vulnerabilities. 2024-03-06 21:11:32 -08:00
github-actions[bot]
dc9092c9ec Post-release preparation for codeql-cli-2.16.4 2024-03-06 22:19:33 +00:00