hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-01 01:25:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
87,274 Commits 1,790 Branches 169 Tags
codeql-cli-2.25.4
Commit Graph

87274 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ian Lynagh
2783668092 Kotlin: compiler_arguments test: Fix running gradle on Windows 2022-10-31 15:29:23 +00:00
erik-krogh
86e81f523c add explicit this 2022-10-31 15:56:01 +01:00
Ian Lynagh
6b5deee9a8 Kotlin: Reunite the parts of gradle_kotlinx_serialization 2022-10-31 14:55:58 +00:00
Ian Lynagh
d3934c97ed Kotlin: Run java-interface-redeclares-tostring on all platforms 2022-10-31 14:52:19 +00:00
Ian Lynagh
7c4df8c81f Kotlin: Run default-parameter-mad-flow on all platforms 2022-10-31 14:51:15 +00:00
erik-krogh
7d0beeafad QL: prevent some cross-talk between modules 2022-10-31 15:51:05 +01:00
Ian Lynagh
b1d9f9f9d5 Kotlin: Run compiler_arguments test on all platforms 2022-10-31 14:46:46 +00:00
Jeroen Ketema
abe9258943 C++: Add strcpy test for cpp/non-constant-format 2022-10-31 15:29:17 +01:00
Jeroen Ketema
83afc2a0ad C++: Add strcpy prototype to test 2022-10-31 15:25:35 +01:00
Ian Lynagh
21600c612d Merge pull request #11037 from igfoo/igfoo/log 
Kotlin: Integration tests: Allow \ as a path separator in logs test
 2022-10-31 14:03:57 +00:00
Tamás Vajk
e356720c73 Merge pull request #11014 from tamasvajk/kotlin-for-loop-var 
Kotlin: Resugar `for` loops
 2022-10-31 14:48:21 +01:00
Asger F
ab4e341e65 Ruby: fix handling of namespaces with no 'self' 2022-10-31 14:05:11 +01:00
Asger F
9da5ec79c5 Ruby: Drive-by fix a QL4QL alert 2022-10-31 14:05:11 +01:00
Asger F
e549f15b1c Ruby: fix implicit 'this' 2022-10-31 14:05:11 +01:00
Asger F
056b1e8d63 Ruby: add some basic tests 2022-10-31 14:05:11 +01:00
Chris Smowton
d959630991 Merge pull request #11040 from smowton/smowton/fix/inherited-method-implementing-collection-interface 
Kotlin: fix method types when an inherited method implements a collection type
 2022-10-31 12:40:28 +00:00
Asger F
9be2512050 Ruby: rename one of the PostsController2 classes 
These had the same name and ended up being unified
 2022-10-31 13:33:41 +01:00
Asger F
b4b34cc994 Ruby: port part of ActionController model 2022-10-31 13:33:41 +01:00
Asger F
12ce46e4b1 Ruby: port part of Railties model 2022-10-31 13:33:41 +01:00
Asger F
38955d1761 Ruby: port part of the Rails model 2022-10-31 13:33:41 +01:00
Asger F
9f59b6b439 Update type-tracking test 2022-10-31 13:33:41 +01:00
Asger F
0a8f39fe96 Ruby: recover some incomplete capture flow 2022-10-31 13:33:41 +01:00
Asger F
ff02ba5965 Ruby: include SSA param input step for flowsTo 2022-10-31 13:33:41 +01:00
Asger F
017157820a Ruby: make ParameterNode extend LocalSourceNode 2022-10-31 13:33:41 +01:00
Asger F
b29ac5249e Ruby: add type-tracking inline test in global flow test 2022-10-31 13:33:41 +01:00
Asger F
4ed61c13f8 Ruby: add some captured-variable flow tests 2022-10-31 13:33:41 +01:00
Asger F
b632e21ba0 Ruby: add ConstRef 2022-10-31 13:33:41 +01:00
Karim Ali
3911f3b202 update query description following docs review 2022-10-31 13:54:35 +02:00
Karim Ali
76a330d4b9 update code example to be OWASP compliant 2022-10-31 13:52:49 +02:00
Karim Ali
723ca8ed88 update documentation following docs review 2022-10-31 13:50:30 +02:00
Ian Lynagh
a53c2104d1 Kotlin: Integration tests: Allow \ as a path separator in logs test 2022-10-31 11:24:39 +00:00
Nick Rolfe
5369ba1d83 ruby docs: remove distracting sentence 2022-10-31 11:24:30 +00:00
Tony Torralba
b62ede1544 Fix issue in JsExportedSource 
Model the source as an access to the tainted field, instead of the field itself (which didn't work)
 2022-10-31 12:08:03 +01:00
Chris Smowton
c11d63e4d2 Merge pull request #11015 from smowton/smowton/fix/go-cleartext-logging-exclude-protobuf-getters 
Go: exclude protobuf read steps from cleartext-logging query
 2022-10-31 10:43:52 +00:00
Geoffrey White
ca586b4f3d Merge remote-tracking branch 'upstream/main' into global 2022-10-31 10:28:29 +00:00
Geoffrey White
0dd8f574a7 Swift: Redesign as a FreeFunctionDecl class + add some qldoc. 2022-10-31 10:24:12 +00:00
Geoffrey White
c161bb5e95 Merge pull request #11035 from geoffw0/simplify2 
Swift: Simplify some more QL
 2022-10-31 09:50:55 +00:00
Rasmus Wriedt Larsen
ead0844174 Merge pull request #10998 from RasmusWL/essa-use-use-test 
Python: Add failing ESSA use-use test
 2022-10-31 10:38:26 +01:00
Paolo Tranquilli
2b395985e6 Swift: remove unneeded trailing / in README.md 2022-10-31 09:55:03 +01:00
Paolo Tranquilli
e62acb1e8c Swift: revert wrong paragraph edit in README.md 2022-10-31 09:54:15 +01:00
Paolo Tranquilli
7237362feb Swift: add debug path mapping to README.md 
This allows breakpoints to work more reliably, including on a bazel
project in CLion.
 2022-10-31 09:51:41 +01:00
Paolo Tranquilli
46c7ee0e4f Swift: refactor RUN_UNDER code 2022-10-31 09:51:20 +01:00
Paolo Tranquilli
80debe19e0 Swift: fix RUN_UNDER_FILTER check 2022-10-31 09:50:45 +01:00
Tamas Vajk
4cd0f1ca66 Apply code review findings 2022-10-31 08:43:53 +01:00
Harry Maclean
0dd63c007e Ruby: Add change note 2022-10-31 11:53:22 +13:00
Harry Maclean
fd61a5253d Ruby: Recognise try/try! as code executions 2022-10-31 11:53:22 +13:00
Harry Maclean
3f403f0f87 Merge pull request #10700 from hmac/activesupport 
Ruby: Model some ActiveSupport methods
 2022-10-31 11:50:44 +13:00
erik-krogh
fc2112831c add second-order-command-injection query 2022-10-30 21:20:47 +01:00
Mathias Vorreiter Pedersen
1b50168d08 C++: Add an initial pruning stage to prevent this 
large TC in 'localFlowToExpr':
```
Evaluated relational algebra for predicate Buffer#61e3d199::localFlowStepToExpr#2#ff@0a49913i with tuple counts:
    4713946   ~0%    {2} r1 = SCAN DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff OUTPUT In.1, In.0

  40897385  ~46%    {2} r2 = JOIN boundedFastTC:Buffer#61e3d199::localFlowToExprStep#2#ff_10#higher_order_body:DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff_0#higher_order_body WITH DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1

  45611331  ~43%    {2} r3 = r1 UNION r2
    3376553  ~14%    {2} r4 = JOIN r3 WITH DataFlowUtil#47741e1f::ExprNode::getExpr#0#dispred#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
                    return r4
```

After this commit the tuple counts looks like:
```
Evaluated relational algebra for predicate Buffer#61e3d199::localFlowStepToExpr#2#ff@8cc38x5k on iteration 2 running pipeline standard with tuple counts:
         51367   ~3%    {2} r1 = JOIN Buffer#61e3d199::getBufferSize0#1#f#prev_delta WITH DataFlowUtil#47741e1f::ExprNode::getExpr#0#dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.0

        124933  ~18%    {2} r2 = JOIN r1 WITH #Buffer#61e3d199::localFlowToExprStep#2Plus#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1

        176300  ~17%    {2} r3 = r1 UNION r2
        184685  ~22%    {2} r4 = JOIN r3 WITH DataFlowUtil#47741e1f::simpleLocalFlowStep#2#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1
         56646  ~47%    {2} r5 = JOIN r4 WITH DataFlowUtil#47741e1f::ExprNode::getExpr#0#dispred#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
         44635  ~16%    {2} r6 = r5 AND NOT Buffer#61e3d199::localFlowStepToExpr#2#ff#prev(Lhs.0, Lhs.1)
                        return r6
```
 2022-10-30 14:20:15 +01:00
Mathias Vorreiter Pedersen
aa8214addf C++: Simplify 'Buffer.qll' by avoiding 'asIndirectExpr'. This removes the flow from 'x' to 'x++', which makes the whole library a lot simpler. 2022-10-30 12:58:53 +01:00