Nora Dimitrijević
ad56274a73
C++: Small improvements to query qldoc and message
2022-08-25 15:22:41 +02:00
Nora Dimitrijević
a6a30b3725
C++: clarify ScanfOutput.getMinimumGuardConstant()
2022-08-25 15:07:39 +02:00
github-actions[bot]
0f63bc077f
Release preparation for version 2.10.4
2022-08-25 12:52:26 +00:00
Nora Dimitrijević
e39229d59e
C++: Remove unique-Instruction kludge in ScanfOutput
...
Passes tests.
2022-08-25 14:38:58 +02:00
Nora Dimitrijević
d8800c03b6
C++: new helper predicates in ScanfFunctionCall
...
Extract some of the logic from the `cpp/missing-check-scanf` query into
the more generally useful `getOutputArgument(int index)`, `getAnOutputArgument()`,
and `getNumberOfOutputArguments()` predicates.
2022-08-25 14:32:15 +02:00
Nora Dimitrijević
5c894ae40b
Merge branch 'main' into missing-check-scanf-squashed
2022-08-24 21:14:57 +02:00
Nora Dimitrijević
170d12bf5a
Write MissingCheckScanf.qhelp
2022-08-24 19:58:19 +02:00
erik-krogh
1c0f2251e2
Merge branch 'main' into msgConsis
2022-08-24 14:38:57 +02:00
Nora Dimitrijević
ca162a4365
C++: complete initial implementation of cpp/missing-check-scanf
...
There are still some remaining FPs (haven't fully tested them)
that should be ironed out in a follow-up to increase the precision, e.g.:
* if scanf(&i) != 1 return
if maybe() && scanf(&i) != 1 return
use(i) // should be OK on both counts
* The minimum guard constant for the *_s variants may not be right.
* int i[2]
scanf(i, i+1) // second i is flagged as a use of the first
* Maybe loosen the "unguarded or badly guarded use() = bad" policy to
"unguarded but already-initialized = good" and "badly guarded = bad",
since a lot of FPs in MRVA fall into the "unguarded but already-
initialized" bucket.
2022-08-24 11:25:06 +02:00
erik-krogh
a50234adb0
apply suggestion from review
2022-08-23 15:41:37 +02:00
erik-krogh
afadcd9b45
use a more detailed alert message in bitwise-sign-check
2022-08-23 11:18:45 +02:00
erik-krogh
d96d6721ba
change the alert message of unused-local-variable
2022-08-23 11:15:11 +02:00
erik-krogh
f7846a598e
add change-notes
2022-08-23 07:54:01 +02:00
erik-krogh
678e433013
update cpp/missing-case-in-switch to match java
2022-08-22 21:41:45 +02:00
erik-krogh
ea2777fa3e
update {cs/cpp}/equality-on-floats to use the same alert-message/description
2022-08-22 21:41:45 +02:00
erik-krogh
39c1832995
update {cpp/js}/bitwise-sign-check to match java
2022-08-22 21:41:45 +02:00
erik-krogh
cc41a83a8d
update {py/cpp}/commented-out-code to match csharp/java/javascript
2022-08-22 21:41:45 +02:00
erik-krogh
698ccd8850
update {cpp/java}/unused-local to match python
2022-08-22 21:41:45 +02:00
erik-krogh
5a312cd0da
update cpp/complex-block to match java/csharp
2022-08-22 21:41:45 +02:00
erik-krogh
b1c9843d15
update {cs/cpp}/empty-block so they have the same alert message
2022-08-22 21:41:45 +02:00
erik-krogh
a593a52b5e
add missing qldoc (that was already missing?)
2022-08-22 21:22:39 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Mathias Vorreiter Pedersen
831f143fe6
C++: Add change note.
2022-08-22 12:40:08 +01:00
Mathias Vorreiter Pedersen
65abb54a73
C++: Add a sanitizer to 'cpp/cleartext-storage-buffer' to improve the performance of the query.
2022-08-22 11:01:31 +01:00
Mathias Vorreiter Pedersen
d209231ff9
C++: Remove cartesian product in 'ExecTainted'.
2022-08-21 16:45:36 +01:00
Mathias Vorreiter Pedersen
c953b05cc2
Merge branch 'main' into fix-joins-in-using-expired-stack-address
2022-08-18 15:13:05 +01:00
Mathias Vorreiter Pedersen
5704995b62
C++: Fix joins in 'cpp/using-expired-stack-address'.
2022-08-18 13:23:39 +01:00
intrigus-lgtm
f978951cbe
Explain command substitution
2022-08-17 22:30:43 +02:00
erik-krogh
ffb65d054e
delete redundant inline casts
2022-08-17 13:34:22 +02:00
erik-krogh
2e44fba67d
add explicit this
2022-08-17 13:33:31 +02:00
erik-krogh
b9823cf335
fix ql/could-be-cast
2022-08-17 13:33:31 +02:00
intrigus-lgtm
45f708bb58
Fix typo.
2022-08-17 00:00:32 +02:00
intrigus
dabccd8686
Add query for tainted wordexp calls.
2022-08-16 23:56:50 +02:00
Robert Marsh
56eacce320
C++: restrict to end-of-allocation pointers
2022-08-16 17:52:06 -04:00
Robert Marsh
93de8e2308
C++: fix missing bounds in exp range analysis
2022-08-16 17:44:51 -04:00
Robert Marsh
0ebd7d0de5
C++: respond to PR comments
2022-08-16 17:44:47 -04:00
Robert Marsh
e4d0e7431c
C++: some experimental product flow queries
2022-08-16 17:44:46 -04:00
Jeroen Ketema
243dda79d2
C++: Expose PresentIRFunction and override in cpp/count-ir-inconsistencies
...
The `toString` implementtion that `PresentIRFunction` uses may result in very
long strings that may crash the evaluator. Overriding allows is to limit the
string size and still suffices when just counting the number of inconsistencies.
2022-08-16 16:30:38 +02:00
Sid Shankar
1e1e2318b7
Merge pull request #10052 from github/task/fix-broken-links
...
Docs: Replace HTTP broken links to equivalent HTTPS resources
2022-08-16 08:45:08 -04:00
Alex Ford
d02ad51d74
Merge pull request #10032 from github/post-release-prep/codeql-cli-2.10.3
...
Post-release preparation for codeql-cli-2.10.3
2022-08-16 12:04:07 +01:00
Sid Shankar
69de832f76
Replace invalid link to blogs.msdn.com
...
Replace with link to the same article on devblogs.microsoft.com. Unfortunately, blogs.msdn.com does not automatically redirect to the new location, making this replacement necessary.
2022-08-15 14:39:26 -04:00
github-actions[bot]
21d0c78376
Post-release preparation for codeql-cli-2.10.3
2022-08-11 23:20:39 +00:00
github-actions[bot]
57c4f9145b
Release preparation for version 2.10.3
2022-08-11 11:12:15 +00:00
Erik Krogh Kristensen
73df8e4c7d
Merge pull request #9832 from erik-krogh/misspellings
...
Fix lots of misspellings
2022-08-11 12:43:26 +02:00
Geoffrey White
c62ae3b350
C++: First working. We now prefer flagging the cases where the variable was initialized, as in real world cases we haven't seen it done safely.
2022-08-11 12:27:48 +02:00
Geoffrey White
76ef779f60
C++: Add test and placeholder query.
2022-08-11 12:27:39 +02:00
Jeroen Ketema
c89592cda7
C++: Add internal metrics query for IR consistency
2022-08-11 11:39:52 +02:00
Erik Krogh Kristensen
887f6557ed
fix common misspellings throughout github/codeql
2022-08-10 23:21:41 +02:00
Nora Dimitrijević
60f4049388
Re-autoformat StrncpyFlippedArgs.ql
2022-08-10 14:14:42 +02:00
Nora Dimitrijević
05f4f98aa0
Add change note
2022-08-10 13:42:21 +02:00
