hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-14 17:31:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
85,654 Commits 1,785 Branches 169 Tags
codeql-cli-2.24.1
Commit Graph

85654 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Wriedt Larsen
4ac8dd72a7 Merge pull request #15855 from yoff/python/add-MaD-test-tuple-output 
Python: Add test for `ReturnValue.TupleElement[n]`
 2024-03-11 12:05:31 +01:00
Owen Mansel-Chan
da8cc13506 go extractor: avoid long string concatenations 
When we see "a" + "b" + "c" + "d", do not add a
row to the constvalues table for the intermiediate
strings "ab" and "abc". We still have entries for
the string literals ("a", "b", "c", and "d") and
the whole string concatenation ("abcd").
 2024-03-11 10:53:26 +00:00
Mathias Vorreiter Pedersen
73c4fe08fa Merge pull request #15835 from MathiasVP/initial-def-of-addresses 
C++: Provide an initial SSA definition of the address of a variable
 2024-03-11 10:42:01 +00:00
Geoffrey White
4bc272da73 C++: Doc correction and TODOs for interpretOutput, interpretInput. 2024-03-11 10:16:46 +00:00
Erik Krogh Kristensen
00c228540e Merge pull request #15836 from github/dependabot/cargo/ql/chrono-0.4.35 
Bump chrono from 0.4.34 to 0.4.35 in /ql
 2024-03-11 11:13:15 +01:00
Tamás Vajk
35a8e7cbf0 Merge pull request #15854 from tamasvajk/buildless/change-assembly-id 
C#: Change ID of buildless output assembly
 2024-03-11 10:03:40 +01:00
Rasmus Wriedt Larsen
42acd9c22c Merge pull request #15695 from github/tausbn/python-add-copy-method-as-copy-step 
Python: Add `.copy()` method call as copy step
 2024-03-11 09:43:34 +01:00
Michael Nebel
6485dcc0fc Merge pull request #15859 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2024-03-11 09:10:52 +01:00
Tony Torralba
a09eb9f4c5 Update go/ql/src/Security/CWE-770/UncontrolledAllocationSize.ql 
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>
 2024-03-11 08:58:59 +01:00
Edward Minnix III
7fe378e831 Merge pull request #15756 from egregius313/egregius313/csharp/dataflow/threat-model/remove-addlocalsource 
C#: Remove `AddLocalSource` classes from queries
 2024-03-10 22:56:28 -04:00
Ed Minnix
3fdc7e95df Add local models to CodeInjection tests 2024-03-10 22:20:54 -04:00
Ed Minnix
8187b00562 Change note 2024-03-10 22:20:52 -04:00
Ed Minnix
d300736c7e Remove AddLocalSource classes 2024-03-10 22:20:51 -04:00
Edward Minnix III
58f2777532 Merge pull request #15629 from egregius313/egregius313/csharp/dataflow/threat-modeling/remove-stored-query-variants 
C#: Remove `Stored` variants of queries
 2024-03-10 22:17:03 -04:00
github-actions[bot]
589a34241c Add changed framework coverage reports 2024-03-11 00:16:32 +00:00
Owen Mansel-Chan
820c14577a Merge pull request #13553 from am0o0/amammad-go-bombs 
Go: Decompression Bombs
 2024-03-10 13:48:04 +00:00
Edward Minnix III
e7852f520f Merge pull request #15605 from egregius313/egregius313/csharp/dataflow/sources/commandargs-and-environment 
C#: Add more `environment` and `commandargs` sources for the C# Standard Library
 2024-03-08 14:10:09 -05:00
Geoffrey White
e8d0f1fa3e C++: Comments. 2024-03-08 18:25:01 +00:00
Edward Minnix III
5440dbf70d Merge pull request #15758 from egregius313/egregius313/csharp/docs/threat-modeling-in-mad-docs 
C#: Add references to threat modeling to C# Models-as-Data documentation
 2024-03-08 11:50:51 -05:00
am0o0
43df6a2c07 add comments for already implemented io.Read and io.WriteTo Sinks. 
remove some sinks about `"decompressor"` which was added wrongly.
change `GeneralReadIoSink` type from module to class.
separate `KlauspostGzipAndPgzip` `KlauspostPgzip` and `KlauspostGzip`.
 2024-03-08 20:05:46 +04:00
am0o0
66130d208e convert abstract predicate isAdditionalFlowStep to non-abstract 2024-03-08 19:30:41 +04:00
Joe Farebrother
dbd33d1cf0 Model Argument[1] of ActiveRecord from 2024-03-08 14:04:01 +00:00
Tamas Vajk
9b5cfc9026 Change assembly population in buildless 2024-03-08 15:02:30 +01:00
Rasmus Lerchedahl Petersen
3601773856 python: support encoding lower bound 2024-03-08 14:59:28 +01:00
Rasmus Wriedt Larsen
adf5a4b1e4 Python: Fix internal consistency failures 2024-03-08 14:13:47 +01:00
Tom Hvitved
9ee2314ef6 Merge pull request #15847 from hvitved/ruby/orm-field-as-source-no-args 
Ruby: Exclude calls with arguments from `OrmFieldAsSource`
 2024-03-08 13:52:34 +01:00
Asger F
7c35309732 Merge pull request #15823 from asgerf/js/lift-cg-restriction 
JS: Call graph improvements
 2024-03-08 13:40:38 +01:00
Rasmus Wriedt Larsen
87b6592dbc Python: Accept inconsistency for missing use-use flow 
At least until we have a proper fix
 2024-03-08 13:34:26 +01:00
Rasmus Wriedt Larsen
8fe483d9d8 Python: Add example of missing use-use flow 
(see PR for more detailed description)
 2024-03-08 13:26:01 +01:00
Asger F
245cd5c0b5 Merge pull request #15760 from asgerf/js/summarised-tt-store-steps 
JS: Summarise store steps for type tracking
 2024-03-08 13:16:25 +01:00
Asger F
ac4601cb8f Update javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2024-03-08 13:01:38 +01:00
Ian Lynagh
a9bab18804 Merge pull request #15848 from igfoo/igfoo/deleg2 
Kotlin 2: Accept some more loc changes in exprs test
 2024-03-08 11:49:11 +00:00
Michael Nebel
36a775502f Merge pull request #15851 from microsoft/54-csharp-add-missing-mad-for-httprequestmessage-upstream 
csharp update MaD for HttpRequestMessage
 2024-03-08 12:39:08 +01:00
Michael Nebel
7c46e9fcf4 Merge pull request #15838 from michaelnebel/csharp/deleteirqueries 
C#: Remove IR queries.
 2024-03-08 11:29:23 +01:00
Tamas Vajk
33eb69164c C#: Change ID of buildless output assembly 2024-03-08 11:20:04 +01:00
Rasmus Lerchedahl Petersen
6d8d106d91 Python: add test for ReturnValue.TupleElement[n] 2024-03-08 11:18:51 +01:00
Asger F
546b0a9a89 Merge pull request #15763 from asgerf/js/escaping-instance-detection 
JS: Improve detection of classes with escaping instances
 2024-03-08 11:13:50 +01:00
Asger F
fc5b9e2796 JS: Expand test case 2024-03-08 10:34:39 +01:00
Tom Hvitved
24e35f6f3d Update expected test output 2024-03-08 10:00:43 +01:00
Tom Hvitved
63bb772ef9 Variable capture: Avoid overlapping and false-positive data flow paths 2024-03-08 10:00:42 +01:00
Tom Hvitved
e793a1e9fe Ruby: Add variable capture spurious flow test 2024-03-08 10:00:42 +01:00
Tom Hvitved
2896bfbd9f Merge pull request #15821 from hvitved/dataflow/clears-content-store 
Data flow: Allow for direct stores into nodes with `clearsContent`
 2024-03-08 09:59:29 +01:00
Ed Minnix
7f950d8e0d Fix ExpandEnvironmentVariables test case 2024-03-07 21:48:05 -05:00
Lindsay Simpkins
7dd175d938 change note 2024-03-07 17:16:17 -08:00
Mathias Vorreiter Pedersen
761f6d3a7e C++: Disable field flow from the 'cpp/type-confusion' query to fix performance on ChakraCore. 2024-03-07 15:24:04 -08:00
Lindsay Simpkins
feb1ca29cc csharp update MaD for HttpRequestMessage 2024-03-07 15:00:05 -08:00
Chris Smowton
e4f680d476 Merge pull request #15778 from smowton/smowton/admin/test-multi-release-jars 
Java: Add tests for multi-release jars under Java 11 and 17
 2024-03-07 22:59:35 +00:00
Mathias Vorreiter Pedersen
a548316747 C++: Accept test changes. 2024-03-07 13:55:31 -08:00
Alvaro Muñoz
86075c95bd Improve ExpressionNode Location handling 2024-03-07 22:28:54 +01:00
Mathias Vorreiter Pedersen
4f9bdca4f0 C++: Optimize. 2024-03-07 13:08:26 -08:00