hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
78,334 Commits 1,671 Branches 157 Tags
ginsbach/OverlayLocalJava
Commit Graph

1884 Commits

Author SHA1 Message Date
Robert Marsh
500004dbe0 Merge pull request #10841 from MathiasVP/repair-command-line-injection-2 
C++: Prepare `cpp/command-line-injection` for IR-based use-use dataflow
 2022-10-17 13:42:32 -04:00
Robert Marsh
ccea372fd0 Merge pull request #10842 from MathiasVP/repair-non-constant-format-2 
C++: Prepare `cpp/non-constant-format` for IR-based use-use dataflow
 2022-10-17 13:39:56 -04:00
Mathias Vorreiter Pedersen
e7b0536896 C++: Repair 'cpp/non-constant-format' in preparation for IR-based use-use dataflow. 2022-10-14 15:26:25 +02:00
Mathias Vorreiter Pedersen
b1f93b07c9 C++: Repair the 'cpp/command-line-injection' query in preparation for IR-based use-use dataflow. 2022-10-14 15:11:41 +02:00
Mathias Vorreiter Pedersen
00a25dbe45 C++: Accept test changes. 2022-10-14 15:01:31 +02:00
Mathias Vorreiter Pedersen
7ad781e91c C++: Repair the 'cpp/cleartext-transmission' query in preparation for IR-based use-use dataflow. 2022-10-14 14:37:59 +02:00
Mathias Vorreiter Pedersen
49f39d7602 C++: Accept test changes. 2022-10-14 12:35:46 +02:00
Mathias Vorreiter Pedersen
4c5953fce0 C++: Accept query-test changes. 2022-10-14 10:14:52 +02:00
Nora Dimitrijević
949d3e13fe Merge branch 'main' into cpp/comma-before-misleading-indentation 2022-10-12 13:25:22 +02:00
Nora Dimitrijević
93c01371c3 C++: no parens in select message 
Debatable; see comment thread in PR.
 2022-10-12 13:01:37 +02:00
Geoffrey White
fd571538fb Merge pull request #10706 from geoffw0/vaheuristic 
C++: Tune cpp/unterminated-variadic-call
 2022-10-10 13:39:40 +01:00
erik-krogh
66c9705502 fix some more style-guide violations in the alert-messages 2022-10-07 11:19:46 +02:00
Geoffrey White
3f78a244b9 C++: Make the tests use more repetitions. 2022-10-06 09:14:24 +01:00
Geoffrey White
9a365d83cf C++: Tighten up the heuristic in cpp/unterminated-variadic-call. 2022-10-06 09:14:16 +01:00
Nora Dimitrijević
28606c561d C++: Simplify normalizeExpr 
This has a comparable but different set of FPs as the previous version.
But arguably it's an improvement.
 2022-09-30 14:35:54 +02:00
Nora Dimitrijević
c37c6a004e Merge branch 'main' into cpp/comma-before-misleading-indentation 2022-09-30 00:28:33 +02:00
Nora Dimitrijević
6eac4f52d9 C++: Accept Test Output 
Some tricky FPs are preserved in there.
 2022-09-30 00:13:23 +02:00
Nora Dimitrijević
891bc342be C++: Fix another implicit/explicit this FP 2022-09-29 18:42:23 +02:00
Nora Dimitrijević
28bd591107 C++: Fix explicit this-> FP. 2022-09-29 17:04:11 +02:00
Nora Dimitrijević
29d7c0e21b C++: Exclude commas in if-conditions. 2022-09-29 16:29:57 +02:00
Nora Dimitrijević
64903336f7 C++: Exclude all parenthesized CommaExprs. 2022-09-29 15:49:29 +02:00
Nora Dimitrijević
909b36a078 C++: Fix implicit-this FP, uncovered non-funptr FP 2022-09-29 13:14:36 +02:00
Nora Dimitrijević
19a9c5d7d3 C++: Identified another real-life FP 2022-09-28 21:19:45 +02:00
Nora Dimitrijević
96c73bcb19 C++: Fix FP: bad Location for FieldAccess exprs 2022-09-28 20:37:22 +02:00
Nora Dimitrijević
6d5df14547 C++: Remove arguable FPs re: sizeof/decltype 2022-09-28 20:01:14 +02:00
Nora Dimitrijević
592bc18a97 C++: Reduce FPs by excluding all commas in loop heads 
This leads to a 50% reduction of alerts in MRVA 1000.
 2022-09-28 19:38:41 +02:00
Nora Dimitrijević
823b0109f0 C++: Mark FPs that are hard to solve w/o source code 2022-09-28 16:20:13 +02:00
Nora Dimitrijević
0128b1702e C++: Fix "LHS-end = RHS-begin" FP 2022-09-28 15:36:01 +02:00
Nora Dimitrijević
e7c1fadd94 C++: Fix member-call- and C-cast-related FPs 2022-09-28 15:02:22 +02:00
Nora Dimitrijević
cacf78838c C++: Tests (w/ FPs) from MRVA top 1000 run 2022-09-27 18:48:32 +02:00
erik-krogh
96b46de7c8 update alert-messages based on review feedback 2022-09-23 14:53:54 +02:00
erik-krogh
edd03020c2 fix the casing in the alert-message of cpp/unclear-array-index-validation 2022-09-23 14:48:01 +02:00
erik-krogh
9e4843d53e update the alert-message of cpp/file-may-not-be-closed based on feedback 2022-09-23 14:46:00 +02:00
erik-krogh
2351884352 update some alert-messages based on review feedback 2022-09-23 14:45:59 +02:00
erik-krogh
40bea78186 remove more instances of the alert-loc being repeated as a link 2022-09-23 14:45:59 +02:00
erik-krogh
33165f4f55 CPP: update expected output 2022-09-23 14:45:59 +02:00
Nora Dimitrijević
dca13f5c89 C++: Initial cpp/comma-before-misleading-indentation 
MRVA top 1000 run at: https://github.com/github/semmle-code/actions/runs/3106828111
 2022-09-22 17:44:18 +02:00
Nora Dimitrijević
f1efc76e8c C++: Initial commit of cpp/comma-before-missing-indentation 2022-09-22 17:06:04 +02:00
Andrew Eisenberg
99e8cb78b0 Merge pull request #10496 from aeisenberg/aeisenberg/merge-rc3.7-into-main 
Aeisenberg/merge rc3.7 into main
 2022-09-21 08:09:47 -07:00
Geoffrey White
518b45bc8e C++: Add two more test cases. 2022-09-21 15:41:27 +01:00
Geoffrey White
2756c0e7af C++: Don't report results in files with compilation errors. 2022-09-21 10:45:28 +01:00
Andrew Eisenberg
58e4861b45 Merge branch 'main' into rc/3.7 2022-09-20 12:43:20 -07:00
Geoffrey White
c599b02e98 C++: Add test case. 2022-09-20 15:23:13 +01:00
Mathias Vorreiter Pedersen
d6b8f25312 C++: Add more tests. 2022-09-06 15:22:10 +01:00
Geoffrey White
946456acc2 C++: Apply the sanitizer improvement from cpp/cleartext-storage-buffer in cpp/cleartext-storage-file and cpp/cleartext-transmission. 2022-09-05 14:44:33 +01:00
Nora Dimitrijević
ce1e4ad422 Merge branch 'main' into missing-check-scanf-squashed 2022-08-30 11:34:00 +02:00
Nora Dimitrijević
02772ed20c Revert changes to .gitignore and .clang-format 
because they are potentially too global, belong in a separate PR.
 2022-08-25 16:37:39 +02:00
Nora Dimitrijević
ad56274a73 C++: Small improvements to query qldoc and message 2022-08-25 15:22:41 +02:00
Nora Dimitrijević
170d12bf5a Write MissingCheckScanf.qhelp 2022-08-24 19:58:19 +02:00
Nora Dimitrijević
ca162a4365 C++: complete initial implementation of cpp/missing-check-scanf 
There are still some remaining FPs (haven't fully tested them)
that should be ironed out in a follow-up to increase the precision, e.g.:

  * if scanf(&i) != 1 return
    if maybe() && scanf(&i) != 1 return
    use(i) // should be OK on both counts

  * The minimum guard constant for the *_s variants may not be right.

  * int i[2]
    scanf(i, i+1) // second i is flagged as a use of the first

  * Maybe loosen the "unguarded or badly guarded use() = bad" policy to
    "unguarded but already-initialized = good" and "badly guarded = bad",
    since a lot of FPs in MRVA fall into the "unguarded but already-
    initialized" bucket.
 2022-08-24 11:25:06 +02:00