hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity
31,240 Commits 1,672 Branches 157 Tags
codeql-cli-2.7.6
Commit Graph

5056 Commits

Author SHA1 Message Date
Esben Sparre Andreasen
894033df8a JS: de-boilerplate the fastify model: address expr/dataflow comments 2020-05-21 13:42:28 +02:00
Esben Sparre Andreasen
74fc33e2a8 JS: make the qldoc check happy 2020-05-21 13:42:27 +02:00
Esben Sparre Andreasen
a76c70d2d7 JS: model fastify 2020-05-21 13:42:27 +02:00
semmle-qlci
8df7b7c42a Merge pull request #3525 from erik-krogh/ZipTaint 
Approved by asgerf
 2020-05-20 16:45:02 +01:00
Erik Krogh Kristensen
a23cde1354 autoformat 2020-05-20 15:36:46 +02:00
Erik Krogh Kristensen
5a3eec87c0 rename isTaintedPathStep to isPosixPathStep 2020-05-20 13:44:14 +02:00
Erik Krogh Kristensen
97c199e10d update docstring 
Co-authored-by: Asger F <asgerf@github.com>
 2020-05-20 13:40:12 +02:00
semmle-qlci
2bbc1c2af0 Merge pull request #3478 from erik-krogh/PromiseAll 
Approved by asgerf, esbena
 2020-05-20 11:03:05 +01:00
semmle-qlci
29b8a0db92 Merge pull request #3508 from asger-semmle/js/shared-data-flow-node 
Approved by esbena
 2020-05-20 10:58:09 +01:00
Erik Krogh Kristensen
33e0f25f3c use NodeJSLib::Path instead of DataFlow::moduleMember 2020-05-20 10:30:23 +02:00
Erik Krogh Kristensen
7c51dff0f7 share implementation between TaintedPath and ZipSlip 2020-05-20 10:10:04 +02:00
Erik Krogh Kristensen
5b569a4d6d add a sanitizer for chained replace-calls 2020-05-19 19:16:58 +02:00
Asger Feldthaus
9d006327df JS: Update qldoc for ValueNode 2020-05-19 15:57:07 +01:00
semmle-qlci
26dfca80f6 Merge pull request #3510 from max-schaefer/cull-boring-queries 
Approved by asgerf, esbena
 2020-05-19 15:41:53 +01:00
Max Schaefer
a803120414 Lower precision for a number of queries. 
These queries are currently run by default, but don't have their results displayed.

Looking through results on LGTM.com, they are either false positives (e.g., `BitwiseSignCheck` which flags many perfectly harmless operations and `CompareIdenticalValues` which mostly flags NaN checks) or harmless results that developers are unlikely to care about (e.g., `EmptyArrayInit` or `MisspelledIdentifier`).

With this PR, the only queries that are still run but not displayed are security queries, where different considerations may apply.
 2020-05-19 13:43:17 +01:00
Erik Krogh Kristensen
b71919299b Apply suggestions from code review 
Co-authored-by: Asger F <asgerf@github.com>
 2020-05-19 14:03:03 +02:00
Asger F
875c3706e3 Update javascript/ql/src/semmle/javascript/CFG.qll 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-05-19 12:08:51 +01:00
Asger Feldthaus
3f30564d93 JS: Autoformat 2020-05-19 12:05:32 +01:00
semmle-qlci
0c081a8e87 Merge pull request #3497 from esbena/js/yield-and-local-objects 
Approved by asgerf, erik-krogh
 2020-05-19 09:02:22 +01:00
semmle-qlci
0d762066f5 Merge pull request #3504 from erik-krogh/unique 
Approved by esbena
 2020-05-19 08:35:08 +01:00
Asger Feldthaus
91b9e95010 JS: Fix join ordering in analysis of add expressions 2020-05-18 22:45:59 +01:00
Asger Feldthaus
6a37e4b7a3 JS: Cache clobberedProp 2020-05-18 22:45:59 +01:00
Asger Feldthaus
5213c511b9 JS: Improve perf of GlobalVarUse.isIncomplete 2020-05-18 22:45:59 +01:00
Asger Feldthaus
7d9923038e JS: Fix perf issue from overriding isIncomplete 2020-05-18 22:45:59 +01:00
Asger Feldthaus
e58683769d JS: Fix bad join order in exploratoryBoundInvokeStep 2020-05-18 22:45:59 +01:00
Asger Feldthaus
430bf2da8a JS: Fix whitelisting in UselessConditional 2020-05-18 22:45:56 +01:00
Asger Feldthaus
1d994b017f JS: Update type inference 2020-05-18 22:42:12 +01:00
Asger Feldthaus
d5d08da545 JS: Update getEnclosingExpr 2020-05-18 22:42:12 +01:00
Asger Feldthaus
12cc228946 JS: Update getFallbackTypeAnnotation 2020-05-18 22:42:12 +01:00
Asger Feldthaus
b06cd6db30 JS: Update Node.isIncomplete 2020-05-18 22:42:12 +01:00
Asger Feldthaus
5568f0e182 JS: Pass local arguments to parameter value node, not SSA node 2020-05-18 22:34:42 +01:00
Asger Feldthaus
dc2d6a5fd9 JS: Make ValueNode the ParameterNode with a step to the SSA node 2020-05-18 22:34:42 +01:00
Asger Feldthaus
37ddccfa15 JS: Merge DestructuringPatternNode into ValueNode 2020-05-18 22:29:33 +01:00
Asger Feldthaus
b3161b1c41 JS: Factor TNode into a separate file 2020-05-18 22:29:33 +01:00
Asger Feldthaus
d9123833af JS: Avoid misoptimization in mayReturnImplicitValue 2020-05-18 22:29:33 +01:00
Asger Feldthaus
6a63f5b677 JS: Avoid bad join order in ImplicitProcessImport 2020-05-18 22:29:32 +01:00
Erik Krogh Kristensen
aa396a39d3 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3478 2020-05-18 20:57:51 +00:00
Erik Krogh Kristensen
b8ba31aaa0 autoformat 2020-05-18 21:06:19 +02:00
Erik Krogh Kristensen
0758413cc7 revert change to import 2020-05-18 21:06:19 +02:00
Erik Krogh Kristensen
742abf8751 refactor package export into a library, and add tests for the library 2020-05-18 21:06:14 +02:00
Erik Krogh Kristensen
d7b852f408 use count aggregate to count 2020-05-18 21:03:26 +02:00
Erik Krogh Kristensen
202b8a56b7 apply the unique aggregate where trivially applicable 2020-05-18 20:37:38 +02:00
Asger F
96d6115452 Merge branch 'master' into js/sql-type-tracking 2020-05-18 15:58:42 +01:00
Erik Krogh Kristensen
70a28f60e3 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3478 2020-05-18 14:05:37 +00:00
Asger F
a9983fdb49 Update javascript/ql/src/semmle/javascript/frameworks/SQL.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-18 13:23:22 +01:00
Max Schaefer
6797fec1a3 JavaScript: Add more models of packages that execute commands over SSH. 2020-05-18 12:08:14 +01:00
Esben Sparre Andreasen
a9ba6ac659 JS: make LocalObjects::isEscape aware of yield 2020-05-18 12:43:46 +02:00
Erik Krogh Kristensen
0f82370f4e rename getHighLight() -> getAlertLocation() 2020-05-18 12:28:28 +02:00
Erik Krogh Kristensen
2b1724291b adjust qhelp to focus on user-controlled data 2020-05-18 12:27:20 +02:00
Erik Krogh Kristensen
d18808698a adjust qhelp to focus on the execFile API 2020-05-18 12:22:46 +02:00