hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
83,868 Commits 1,671 Branches 157 Tags
codeql-cli-2.23.4
Commit Graph

3007 Commits

Author SHA1 Message Date
Sylwia Budzynska
e66659276b Fix formatting 2025-05-27 13:51:03 +02:00
Sylwia Budzynska
8a1c323a98 Change naming to PascalCase 2025-05-27 13:45:40 +02:00
Sylwia Budzynska
84228e0ec8 Add Pandas SQLi sinks 2025-05-27 13:10:39 +02:00
Taus
579cf4a65a Merge pull request #19424 from github/tausbn/python-extract-hidden-file-by-default 
Python: Extract files in hidden dirs by default
 2025-05-16 14:43:47 +02:00
Taus
9ee3e4cdf3 Python: Update change note 
Co-authored-by: yoff <yoff@github.com>
 2025-05-16 13:50:22 +02:00
Taus
72ae633a64 Python: Update change note and extractor config 
Removes the previously added extractor option and updates the change
note to explain how to use `paths-ignore` to exclude files in hidden
directories.
 2025-05-15 14:58:32 +00:00
github-actions[bot]
5f9dd75d7d Post-release preparation for codeql-cli-2.21.3 2025-05-13 21:49:43 +00:00
github-actions[bot]
2de4a01c86 Release preparation for version 2.21.3 2025-05-13 21:14:27 +00:00
Taus
67d04d5477 Python: Add change note 2025-05-02 14:27:46 +00:00
Napalys Klicius
f652686607 Merge pull request #19444 from Napalys/python/hdbcli 
Python: modeling of `hdbcli`
 2025-05-01 17:58:31 +02:00
Napalys Klicius
da7c0931b8 Added hdbcli to be part of supported-framework as well as change note 2025-05-01 14:18:08 +02:00
Napalys Klicius
e1fc0ca051 Added implementation hdbcli as part of PEP249::PEP249ModuleApiNode 2025-05-01 14:18:02 +02:00
yoff
e63b38c515 python: add change note 2025-04-30 20:05:55 +02:00
yoff
cf45e771f3 python: remove copied comment 2025-04-30 20:01:43 +02:00
yoff
531f2a15a4 python: model send_header from http.server 2025-04-30 19:58:14 +02:00
github-actions[bot]
2e0699ab2b Post-release preparation for codeql-cli-2.21.2 2025-04-28 14:03:28 +00:00
github-actions[bot]
625354c46e Release preparation for version 2.21.2 2025-04-28 10:55:22 +00:00
Chuan-kai Lin
6c1e80df3a Python: disable diff-informed PolynomialReDoS.ql 
This commit disabled diff-informed for PolynomialReDoS.ql because it
could miss some alerts within diff ranges.
 2025-04-24 14:57:06 -07:00
github-actions[bot]
d78736b1bf Post-release preparation for codeql-cli-2.21.1 2025-04-15 16:33:15 +00:00
github-actions[bot]
b961c5961d Release preparation for version 2.21.1 2025-04-14 09:53:06 +00:00
github-actions[bot]
10205cb990 Post-release preparation for codeql-cli-2.21.0 2025-04-01 11:30:43 +00:00
github-actions[bot]
84f6564cc0 Release preparation for version 2.21.0 2025-03-31 17:35:15 +00:00
Arthur Baars
9dd7b20db7 Merge pull request #18960 from github/aibaars/rust-tainted-path 
Rust: TaintedPath query
 2025-03-27 10:37:36 +01:00
Arthur Baars
d3e28772ae Rust/Python improve qldoc of SafeAccessCheck 2025-03-20 11:16:45 +01:00
Chris Smowton
9a2a13ed55 Merge remote-tracking branch 'origin/main' into smowton/admin/merge-rc317-into-main 2025-03-19 16:01:29 +00:00
github-actions[bot]
51cdeefafb Post-release preparation for codeql-cli-2.20.7 2025-03-17 13:00:41 +00:00
github-actions[bot]
2d64a618e6 Release preparation for version 2.20.7 2025-03-17 12:15:54 +00:00
Taus
3d643c02be Merge pull request #18921 from github/tausbn/python-fix-unused-global-variable-in-forward-annotation-fp 
Python: Add support for forward references in unused var query
 2025-03-13 16:37:25 +01:00
Taus
f30ebf1571 Merge pull request #18871 from github/tausbn/python-modernise-special-method-signature-query 
Python: Move min/maxParameter methods to `Function` class
 2025-03-13 13:03:21 +01:00
Taus
6546bb1b1d Merge branch 'main' into tausbn/python-fix-match-pruning-logic 2025-03-06 14:37:58 +01:00
Taus
bf3d9ee6a9 Python: Address review comments 2025-03-04 22:30:55 +00:00
Taus
f246ef764a Python: Update change note 
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
 2025-03-04 18:09:54 +01:00
Taus
50a01b1244 Python: Remove superfluous reference to FunctionExpr 
This way we also get annotations that appear in `Lambda`s
 2025-03-04 15:53:34 +00:00
Taus
88615f427b Python: Add support for forward declarations in unused var query 
Fixes the false positive reported in
https://github.com/github/codeql/issues/18910

Adds a new `Annotation` class (subclass of `Expr`) which encompasses all
possible kinds of annotations in Python.

Using this, we look for string literals which are part of an annotation,
and which have the same content as the name of a (potentially) unused
global variable, and in that case we do not produce an alert.

In future, we may want to support inspecting such string literals more
deeply (e.g. to support stuff like "list[unused_var]"), but I think for
now this level of support is sufficient.
 2025-03-04 14:41:45 +00:00
github-actions[bot]
58f355ae5a Post-release preparation for codeql-cli-2.20.6 2025-03-03 18:18:15 +00:00
github-actions[bot]
fa850cccb1 Release preparation for version 2.20.6 2025-03-03 17:13:19 +00:00
Taus
83cdcdbb0b Python: Add change note 2025-02-26 13:53:49 +00:00
Taus
3956a1fea8 Python: Move min/maxParameter methods to Function 
These seem generally useful outside of points-to, and so it might be
better to add them to the `Function` class instead.

I took the liberty of renaming these to say `Arguments` rather than
`Parameters`, as this is more in line with the nomenclature that we're
using elsewhere. (The internal points-to methods retain the old names.)

I'm somewhat ambivalent about the behaviour of `getMaxParameters` on
functions with `*varargs`. The hard-coded `INT_MAX` return value is
somewhat awkward, but the alternative (to only have the predicate
defined when a specific maximum exists) seems like it would potentially
cause a lot of headaches.
 2025-02-26 13:51:12 +00:00
github-actions[bot]
ad24f94a77 Post-release preparation for codeql-cli-2.20.5 2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd Release preparation for version 2.20.5 2025-02-17 16:55:54 +00:00
Taus
a69e3f5236 Python: Add change note 
Co-authored-by: yoff <yoff@github.com>
 2025-02-11 13:02:09 +00:00
Asger F
eedfa4dbb2 Merge pull request #18341 from asgerf/py/diff-informed 
Python: enable diff-informed data flow queries
 2025-02-11 13:15:44 +01:00
yoff
37ddaa36ad Merge pull request #18702 from github/tausbn/python-allow-comments-in-subscripts 
Python: Allow comments in subscripts
 2025-02-06 23:31:29 +01:00
Taus
131ec8d22f Python: Handle loop constructs outside of loops 
Observed on some test files in Nuitka/Nuitka, having `break` and
`continue` outside of loops in Python is (to Python) a syntax error, but
our parser happily accepted this broken syntax.

This then caused issues further downstream in the control-flow
construction, as it broke some invariants.

To fix this we now skip the code that would previously fail when the
invariants are broken.

Co-authored-by: yoff <yoff@github.com>
 2025-02-06 14:30:16 +00:00
Taus
3d25cd3bb5 Python: Add change note 2025-02-06 14:08:20 +00:00
Asger F
d3b9d1d89d JS: Partial SSRF does not select the sink location 2025-02-06 11:30:32 +01:00
Asger F
7d6abb4e0a JS: Disable diff-informedness for full SSRF 
Partial SSRF uses its result in a way that prevents diff-informedness
 2025-02-06 11:30:18 +01:00
Asger F
d3ee658399 Python: resolve remaining TODOs 2025-02-06 10:27:56 +01:00
Asger F
975ce064fc Python: implement for polynomial redos 2025-02-06 10:27:45 +01:00
Asger F
e4a1847dad Python: mass enable diff-informed data flow 2025-02-06 10:27:19 +01:00