hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 03:06:31 +01:00
Code Issues Packages Projects Releases Wiki Activity
33,347 Commits 1,672 Branches 157 Tags
hmac-cli-injection-from-library-inputs
Commit Graph

33347 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ethan Palm
2f7f9d9032 Move explanation of example above sample code 2022-02-09 10:45:24 -08:00
Jonathan Leitschuh
ded8d64301 Remove CAPC and add CWE-93 2022-02-09 12:31:53 -05:00
Jonathan Leitschuh
03fdee3767 Cleanup Netty Response Splitting Query 2022-02-09 12:28:11 -05:00
Jonathan Leitschuh
8ffe878722 Apply suggestions from code review 
Co-authored-by: Matt Pollard <mattpollard@users.noreply.github.com>
 2022-02-09 12:28:11 -05:00
Jonathan Leitschuh
c732cb7759 Add HTTP Request Splitting to Netty Query 2022-02-09 12:28:10 -05:00
Stephan Brandauer
3e88d46e0f add a getFlowLabel method to the PathNode class 2022-02-09 17:28:25 +01:00
Jonathan Leitschuh
49a73673b6 Fix FP from mkdirs call on exact temp directory 2022-02-09 11:04:23 -05:00
Tamás Vajk
6483a92587 Merge pull request #7865 from github/post-release-prep/codeql-cli-2.8.0 
Post-release preparation for codeql-cli-2.8.0
 2022-02-09 16:42:38 +01:00
Jonathan Leitschuh
787e3dac31 Update java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql 
Co-authored-by: Chris Smowton <smowton@github.com>
 2022-02-09 10:07:56 -05:00
Tom Hvitved
c695388c29 Merge pull request #7891 from hvitved/ruby/dataflow/hide-ssa-nodes 
Ruby: Hide more SSA nodes from data-flow path explanations
 2022-02-09 15:56:15 +01:00
Tom Hvitved
0bd8411cb6 Ruby: Hide more SSA nodes from data-flow path explanations 2022-02-09 15:31:10 +01:00
Rasmus Lerchedahl Petersen
aa010e420b python: update qhelp 2022-02-09 15:27:39 +01:00
Rasmus Lerchedahl Petersen
75a2f92ce4 pthon: add change note 2022-02-09 15:23:36 +01:00
Mathias Vorreiter Pedersen
336c25d929 Merge pull request #7913 from RasmusWL/ql-qlpacks 
QL: Streamline qlpacks
 2022-02-09 13:37:19 +00:00
Rasmus Lerchedahl Petersen
313f9f056c python: switch to using concepts 2022-02-09 14:36:48 +01:00
Rasmus Lerchedahl Petersen
17aa2898f9 python: model (xpathEval from) libxml2 2022-02-09 14:25:43 +01:00
Rasmus Lerchedahl Petersen
e8649d8947 python: model (etree from) lxml 2022-02-09 14:15:17 +01:00
Rasmus Wriedt Larsen
1f50624cf4 QL: Streamline qlpacks 
So they follow the same format as the other languages.

`git grep codeql-ql` in the ql/ subfolder does not yield any results
now.
 2022-02-09 14:08:36 +01:00
Rasmus Wriedt Larsen
9d5e8d5bd8 Merge pull request #7842 from RasmusWL/consistency-queires 
Misc: Streamline `consistency-queries/qlpack.yml`
 2022-02-09 13:42:18 +01:00
Nick Rolfe
1eba8277ee Merge pull request #7614 from github/nickrolfe/array_flow_summaries 
Ruby: add more Array/Enumerable flow summaries
 2022-02-09 09:57:59 +00:00
Harry Maclean
f276904fa9 Ruby: Add nomagic pragma to helper 2022-02-09 22:38:35 +13:00
Michael Nebel
ff369f2a36 Merge pull request #7846 from michaelnebel/csharp/deconstruction 
C# 10: Tuple deconstruction.
 2022-02-09 10:08:16 +01:00
Mathias Vorreiter Pedersen
bbbb5268ce Merge pull request #7881 from geoffw0/clrtxtperf 
CPP: Fix performance for cpp/cleartext-transmission
 2022-02-09 09:03:44 +00:00
Erik Krogh Kristensen
5340530cb7 use the number guard in existing queries that contained typeof checks 2022-02-09 09:51:57 +01:00
Erik Krogh Kristensen
d6721ec574 implement a isNaN guard for unsafe-shell-command-construction 2022-02-09 09:51:57 +01:00
Tom Hvitved
9440a45015 Merge branch 'main' into post-release-prep/codeql-cli-2.8.0 2022-02-09 09:40:33 +01:00
yoff
f21ac04285 Update python/ql/lib/semmle/python/frameworks/Stdlib.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2022-02-09 09:22:31 +01:00
luchua-bc
4609227e76 Use data model for request/session attribute operations 2022-02-09 03:24:46 +00:00
jorgectf
3ccac4ed8a Update .expected 2022-02-08 23:59:36 +01:00
Jonathan Leitschuh
7f46640176 Consider calls to setReadable(false, false) then setReadable(true, true) to be safe 2022-02-08 17:57:10 -05:00
jorgectf
c6d8b97871 Make verifyCall() a private predicate 2022-02-08 23:37:17 +01:00
jorgectf
7b51b91d13 Improve test 2022-02-08 23:33:43 +01:00
jorgectf
ed60d16367 Refactor the way to check the verifying call 2022-02-08 23:33:30 +01:00
Jorge
f1fab98ea2 Merge branch 'github:main' into python_jwt 2022-02-08 23:12:58 +01:00
Taus Brock-Nannestad
54ae744b2c Python: Also update Python 2 file 2022-02-08 22:08:53 +01:00
Harry Maclean
3206384884 Merge pull request #7824 from github/hmac/constantize 2022-02-09 08:30:21 +13:00
Chuan-kai Lin
a7f1ee574c Upgrade scripts testing: set initial dbschemes 
This commit sets initial dbschemes for cpp, csharp, java, javascript, and
python so that automated testing for upgrade scripts would also cover legacy
upgrades.
 2022-02-08 11:11:41 -08:00
Tom Hvitved
b2419d60bd Merge pull request #7090 from hvitved/ruby/perf 
Ruby: Cache more predicates
 2022-02-08 20:02:33 +01:00
Chris Smowton
143d64c92c Merge pull request #7879 from github/smowton/admin/getting-started-mention-codeql-go-deps 
Docs: Note codeql-go needs an install step before use
 2022-02-08 18:07:26 +00:00
Alex Ford
81ed5d0ff7 Ruby: comment and node description fixes 
Co-authored-by: Harry Maclean <hmac@github.com>
 2022-02-08 18:03:29 +00:00
Taus Brock-Nannestad
6ea8986daa Python: Normalise string prefixes 2022-02-08 16:48:17 +01:00
Erik Krogh Kristensen
4bbb7ad320 Merge pull request #7876 from erik-krogh/zipRelative 
JS: recognize more startswith sanitizers for path-injection queries
 2022-02-08 15:22:39 +01:00
Nick Rolfe
ade7921079 Merge pull request #7890 from github/nickrolfe/unique_node 
Ruby/QL: add `unique` annotation on `node` column
 2022-02-08 13:15:17 +00:00
Tom Hvitved
984e01ecf0 C#: Remove FPs from cs/dereferenced-value-may-be-null 
Apply a conservative approach by filtering out results for accesses to
captured nullable values, when there is an (implicit) call to the capturing
callable which is `null`-guarded. For example:

```
bool M(int? i, IEnumerable<int> @is)
{
    if (i.HasValue)
        return @is.Any(j => j == i.Value); // GOOD
    return false;
}
```
 2022-02-08 14:01:57 +01:00
Tom Hvitved
7948d965a0 C#: Add nullness tests for captured variables 2022-02-08 13:52:29 +01:00
Tom Hvitved
3b5267eca5 Ruby: Cache DataFlow::Node::{toString,getLocation} 2022-02-08 13:03:42 +01:00
Tom Hvitved
f337459a4a Ruby: Cache capturedEntryWrite 2022-02-08 13:03:42 +01:00
Tom Hvitved
b041bc03d1 Ruby: Cache ConditionBlock::(immediately)Controls 2022-02-08 13:03:41 +01:00
Tom Hvitved
4037d1ff96 Ruby: Cache ErbDirective::getAChildStmt 2022-02-08 13:03:41 +01:00
Tom Hvitved
4c5f32ba4a Ruby: Cache exprNodeReturnedFrom 2022-02-08 13:03:31 +01:00