hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
83,868 Commits 1,672 Branches 157 Tags
codeql-cli-2.23.4
Commit Graph

9591 Commits

Author SHA1 Message Date
Rasmus Lerchedahl Petersen
f8b5a820f4 python: revert change in expected behaviour 2023-03-06 14:31:17 +01:00
Anders Schack-Mulligen
5c7f2ac7f7 Merge pull request #12186 from aschackmull/dataflow/refactor-configuration 
Data flow: Refactor configuration
 2023-03-06 13:38:59 +01:00
Rasmus Wriedt Larsen
35bd809baf Merge branch 'main' into import-refined 2023-03-06 11:22:56 +01:00
Anders Schack-Mulligen
557cb17f4d Dataflow: Minor perf fix for single config wrapper. 2023-03-06 10:24:33 +01:00
github-actions[bot]
af61b45785 Post-release preparation for codeql-cli-2.12.4 2023-03-04 14:16:55 +00:00
Jeroen Ketema
549fb0324b Apply suggestions from code review 2023-03-03 15:26:38 +01:00
github-actions[bot]
462da63970 Release preparation for version 2.12.4 2023-03-03 14:11:51 +00:00
Anders Schack-Mulligen
0addcfa7c5 Dataflow: Fix some perf issues. 2023-03-03 11:45:32 +01:00
erik-krogh
a928f4c9ef add change-notes 2023-03-03 09:23:10 +01:00
erik-krogh
f96d6accbb delete old deprecations 2023-03-03 09:23:02 +01:00
Anders Schack-Mulligen
b34f99f716 Dataflow: Add change notes. 2023-03-02 16:01:29 +01:00
Tony Torralba
59bd1e5ab1 Merge pull request #12228 from github/java/mad-decls-triage-request-2276 
Java: Update MaD sink decls after triage
 2023-03-01 17:08:38 +01:00
Anders Schack-Mulligen
34cc93846b Python: Adjust InsecureProtocol query. 2023-03-01 13:36:10 +01:00
Anders Schack-Mulligen
5469a82efb Go,Java,Python: Fix some tests. 2023-02-28 14:31:00 +01:00
Ahmed Farid
6a578c62b0 Update TimingAttack.qll 2023-02-27 22:16:09 +01:00
Rasmus Wriedt Larsen
d198b91c82 Python: Fix expected of call-graph after merge 
Since the import resolution was fixed, but tests not rerun, these
expectations were not updated to reflect that we now handle them
properly 💪
 2023-02-27 17:38:28 +01:00
Rasmus Wriedt Larsen
be7d6689b8 Merge branch 'main' into import-refined 2023-02-27 17:00:48 +01:00
Rasmus Wriedt Larsen
11000fd123 Python: Fix ModuleExport.ql test for Python 2 2023-02-27 17:00:17 +01:00
Taus
25043f51a4 Merge pull request #11376 from RasmusWL/call-graph-code 
Python: New type-tracking based call-graph
 2023-02-27 14:51:21 +01:00
Anders Schack-Mulligen
bf650c755c Dataflow: Sync changes to all languages. 2023-02-27 14:30:05 +01:00
Alex Ford
7c85448cba Merge pull request #12080 from alexrford/js-use-shared-cryptography 
JS: Use shared `CryptographicOperation` concept
 2023-02-27 12:26:38 +00:00
Rasmus Wriedt Larsen
b7bdc551d5 Python: Show import resolution is a bit generous with exported value 2023-02-23 00:55:58 +01:00
Rasmus Wriedt Larsen
96c0d95b10 Python: Illustrate that clashing_attr can be submodule 2023-02-23 00:55:58 +01:00
Rasmus Wriedt Larsen
13ae98ea76 Python: Fix submodule exported under wrong name (when attribute clash) 2023-02-23 00:55:30 +01:00
Rasmus Wriedt Larsen
373907265b Python: Fixed most problems from last commit 
That one line was an afterthought, and certainly did not work as
intended.
 2023-02-23 00:39:45 +01:00
Rasmus Wriedt Larsen
97fefd2545 Python: Attempt to fix import flow 
It's nice that it fixes the `InsecureProtocol` test-case (which maybe
should have been a test-case for the import resolution library in the
first place?)

But it's not quite right:

1. it adds spurious flow for `clashing_attr`
2. it runs into huge problems for typetracking_imports/tracked.expected
3. it runs into the problem for
   https://github.com/github/codeql/pull/10176 with an `from <pkg>
   import *` blocking flow from previously defined variable, that is NOT
   overridden. (simplistic_reexport.bar_attr)
 2023-02-23 00:36:30 +01:00
Rasmus Wriedt Larsen
bea0acb497 Python: Add barrier test to import resolution 
Just like the one added for `py/insecure-protocol` in fb425b7, but
instead added in the import-resolution tests, such that we don't have to
remember it's in a completely different directory.
 2023-02-23 00:33:12 +01:00
Rasmus Wriedt Larsen
321a4b4ef2 Python: ModuleExport.ql test: ignore main.py 
It's not very useful to look at, and it's a mess when you change any
tests to see all the changes lines in the expected output that you
really do not care about!
 2023-02-23 00:31:05 +01:00
Rasmus Wriedt Larsen
8eaaf8e3e5 Python: Ignore trace.py in ModuleExport.ql test 
I guess we could have done this at the very start of introducing this
test in this PR, but I think the last commit was mostly inspired from
looking at all the things that evidently was re-exported from the trace
import, even when I knew they were not available because of the
`__all__` definition.
 2023-02-22 15:42:28 +01:00
Rasmus Wriedt Larsen
c8a76246d8 Python: Take __all__ into consideration for re-export of from <pkg> import * 
However, we can see that `from <pkg> import *` and `import pkg` are
handled differently. Would have liked `has_defined_all_indirection` to
behave in the same way no matter how the import was made.
 2023-02-22 15:39:57 +01:00
Rasmus Wriedt Larsen
be5812cf91 Python: from <pkg> import * ignores __all__ regression 
Notice that `has_defined_all_indirection` all have both
`all_defined_bar_copy` and `all_defined_foo_copy` marked as exported,
even though only `all_defined_foo_copy` is available.
 2023-02-22 15:38:24 +01:00
Rasmus Wriedt Larsen
d77ce4f3d7 Python: minor rewrite of from <pkg> import * handling 2023-02-22 15:00:55 +01:00
Rasmus Wriedt Larsen
4df7dfbff6 Python: Don't import module as module_attr 
For `from <pkg> import <attr>` we would use to treat the `<pkg>`
(ImportExpr) as a definition of the name `<attr>`.

Since this removes bad import-flow, and nothing broke, I'm guessing this
was never intentional.
 2023-02-22 14:52:35 +01:00
Rasmus Wriedt Larsen
6ba39d5fb3 Python: Add import regression for re-exported things 2023-02-22 14:50:42 +01:00
Rasmus Wriedt Larsen
6a5eebe891 Python: Add test of module_export 2023-02-22 12:26:01 +01:00
Rasmus Wriedt Larsen
4a66e48dc5 Python: Allow import resolution with recursive phi/refine steps 2023-02-21 17:46:39 +01:00
Rasmus Wriedt Larsen
e522009666 Python: More complex import examples 
We need some recursive unwinding to get all of these right
 2023-02-21 17:46:28 +01:00
Rasmus Wriedt Larsen
00eec6986c Python: Allow import of refined variable 
However, as illustrated by the `CWE-327-InsecureProtocol` test, this fix
is NOT good enough, since now even the `secure_context` is considered to
be insecure (for both versions). Ouch.

Will fix this in a later commit, since it was only discoverd late on.
 2023-02-21 17:45:58 +01:00
Rasmus Wriedt Larsen
fb425b73fc Python: Add import test of py/insecure-protocol 2023-02-21 17:43:04 +01:00
Michael Nebel
813ffa440c Java: Consider ai-generated flow summaries to as generated summaries in dataflow. 2023-02-20 12:11:48 +01:00
Rasmus Lerchedahl Petersen
9e97877938 python: lower precision as discussed 2023-02-20 12:06:19 +01:00
Tom Hvitved
879eff41ea Merge branch 'main' into util/inline-expect-test-use-end-line 2023-02-20 10:03:38 +01:00
Rasmus Wriedt Larsen
efc75e02cc Merge pull request #12168 from RasmusWL/crypto-stdlib-modeling 
Python: Add modeling of `hmac`
 2023-02-20 09:26:53 +01:00
Rasmus Wriedt Larsen
27e2307d0c Python: Add import regression for refined variable 2023-02-17 16:34:34 +01:00
Nick Rolfe
3e5534f0ba Merge branch 'main' into post-release-prep/codeql-cli-2.12.3 2023-02-17 14:39:26 +00:00
Calum Grant
35a53fa990 Merge pull request #12183 from RasmusWL/example-update 
Python: Update a few examples so queries work on them
 2023-02-17 14:21:38 +00:00
Tom Hvitved
59efcd593a Python: Update test expectations 2023-02-17 15:20:21 +01:00
Rasmus Wriedt Larsen
39e7bba563 Merge pull request #12203 from RasmusWL/import-resolution-phi 
Python: Handle if-then-else definitions in import resolution
 2023-02-17 10:10:42 +01:00
yoff
2f8dddabb6 Merge pull request #11570 from Sim4n6/UnsafeUnpack 
Python: Unsafe unpacking using `shutil.unpack_archive()` query and tests
 2023-02-17 09:48:05 +01:00
github-actions[bot]
8eb8daa4d4 Post-release preparation for codeql-cli-2.12.3 2023-02-16 17:23:25 +00:00