Erik Krogh Kristensen
708c18d4c2
QL: update the name of the consistency query to make code-scanning alerts more clear
2022-01-20 09:41:13 +01:00
Erik Krogh Kristensen
b8f1fb3954
JS: fix ql/field-only-used-in-charpred within JavaScript
2022-01-20 09:41:13 +01:00
Erik Krogh Kristensen
3d3c6875a6
QL: add query detecting fields that are only used within the charpred
2022-01-20 09:41:10 +01:00
github-actions[bot]
4ce8ccc52b
Release preparation for version 2.7.6
2022-01-20 08:21:18 +00:00
Harry Maclean
5dcee6ba27
Ruby: Add File.open as a FileSystemAccess
2022-01-20 21:09:41 +13:00
Rasmus Lerchedahl Petersen
32cbeae05f
python: missing start tag for relation
2022-01-20 08:56:12 +01:00
Rasmus Lerchedahl Petersen
d10ad3bdd4
python: update stats for tables
2022-01-20 08:42:32 +01:00
Harry Maclean
6bae03a7cc
Ruby: Update string const barrier guard
...
This change recognises guards like `FOO.include?`, where `FOO` is an array
constant.
2022-01-20 17:34:12 +13:00
Harry Maclean
13a0ece25c
Ruby: Add test case: array constant barrier guard
...
This guard isn't yet recognised as a `StringConstArrayInclusionCall`.
2022-01-20 17:07:01 +13:00
Andrew Eisenberg
95355b5854
Docs: Add back removed section on getting started
...
Adds a second getting started, specifically for checking out the
codeql repo as a way to get the core queries.
This ensures that people wanting to work in the traditional way still
have the old docs available.
2022-01-19 13:36:57 -08:00
Jonathan Leitschuh
23548c50e1
Fix typo in FileWritable
2022-01-19 16:14:38 -05:00
Tom Hvitved
70f4efb834
Merge pull request #7646 from hvitved/csharp/roslyn-tuple-elements-workaround
...
C#: Workaround Roslyn bug in `INamedTypeSymbol.TupleElements`
2022-01-19 19:54:29 +01:00
Tom Hvitved
128682b59e
C#: Replace Argument[-1] with Argument[Qualifier] in all flow summaries
2022-01-19 18:54:24 +01:00
Rasmus Lerchedahl Petersen
7e9a9e3d9a
python: remove compiler warnings
2022-01-19 18:01:58 +01:00
shati-patel
dc71ecef83
Docs: Mention packaging commands in CodeQL extension
2022-01-19 16:36:01 +00:00
Rasmus Wriedt Larsen
b9ee2960e2
Python: Add change-note
2022-01-19 17:24:53 +01:00
Rasmus Wriedt Larsen
aa10ad6a8a
Python: Fix RegexInjection query, add old deprecated versions
2022-01-19 17:22:44 +01:00
Rasmus Wriedt Larsen
e82ea7ad17
Python: move regex injection configuration files
...
I did not notice that these went to the wrong location in
https://github.com/github/codeql/pull/6693 . They should be in the
dataflow folder with the rest of the data-flow configurations files, the
injection folder is for old points-to based modeling.
2022-01-19 17:21:46 +01:00
Tom Hvitved
0990a1b404
C#: Get rid of negative parameter/argument data-flow positions
2022-01-19 17:14:37 +01:00
Tony Torralba
695e77a219
Simplify isSslSocket predicate
2022-01-19 17:01:28 +01:00
Mathias Vorreiter Pedersen
40c8881575
Merge pull request #7472 from erik-krogh/redundant-aggregate
...
QL-for-QL: Add a could-be-cast query
2022-01-19 15:48:00 +00:00
Henry Mercer
58b1a6fd40
Merge pull request #7655 from github/henrymercer/bump-atm-query-pack-v0.0.6
...
JS: Bump ML-powered query packs to v0.0.6
2022-01-19 15:44:55 +00:00
Tony Torralba
e442e50e6b
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2022-01-19 16:43:48 +01:00
Tony Torralba
101ad777e3
Move things around after rebase
2022-01-19 16:43:48 +01:00
Tony Torralba
03020582af
Apply suggestions from code review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2022-01-19 16:43:47 +01:00
Tony Torralba
9ffc5ab183
Update java/ql/src/semmle/code/java/security/UnsafeCertTrustQuery.qll
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2022-01-19 16:43:47 +01:00
Tony Torralba
c16181dd2f
QLDocs
2022-01-19 16:43:46 +01:00
Tony Torralba
000a544729
Decouple UnsafeCertTrust.qll to reuse the taint tracking configuration
2022-01-19 16:43:43 +01:00
Tony Torralba
1e2a956a30
Remove unused stub
2022-01-19 16:43:02 +01:00
Tony Torralba
d9e98ceacc
Consider setSslContextFactory and fix tests
2022-01-19 16:43:01 +01:00
Tony Torralba
4d207101e2
Fix QLDoc
2022-01-19 16:43:00 +01:00
Tony Torralba
999acb0021
Improve qhelp references
2022-01-19 16:43:00 +01:00
Tony Torralba
e9712f04a4
Add missing QLDoc
2022-01-19 16:42:59 +01:00
Tony Torralba
698fd64f7f
Adjust test after rebase
2022-01-19 16:42:59 +01:00
Tony Torralba
68fe3dd9f4
Fix conflicts in experimental query
2022-01-19 16:42:58 +01:00
Tony Torralba
c24520cb75
Adjust qhelp after rebase
2022-01-19 16:42:58 +01:00
Tony Torralba
5997b874de
Add change note
2022-01-19 16:42:53 +01:00
Tony Torralba
9e93aecf75
Add spurious test case
2022-01-19 16:42:06 +01:00
Tony Torralba
19d1a780ca
Generalize sanitizer using local flow
2022-01-19 16:42:05 +01:00
Tony Torralba
64518bf91a
Handle a specific pass-by-reference flow issue
2022-01-19 16:42:04 +01:00
Tony Torralba
4508945f85
Fix assumption regarding when an SSLSocket does the TLS handhsake
2022-01-19 16:42:03 +01:00
Tony Torralba
e842acf9e0
Improve qhelp
2022-01-19 16:42:03 +01:00
Tony Torralba
5d4cd70f8c
Adjusted sources and sanitizer of UnsafeCertTrust taint tracking config
2022-01-19 16:42:02 +01:00
Tony Torralba
e43fff2d30
Use InlineExpectationsTest
2022-01-19 16:42:02 +01:00
Tony Torralba
02d0fa9188
Minor changes in QLDocs and a sanitizer's type
2022-01-19 16:42:01 +01:00
Tony Torralba
4313baf622
Big refactor:
...
- Move classes and predicates to appropriate libraries
- Overhaul the endpoint identification algorithm logic to use taint tracking
- Adapt tests
2022-01-19 16:42:00 +01:00
Tony Torralba
e0f4c73aed
Move from experimental
2022-01-19 16:42:00 +01:00
Rasmus Lerchedahl Petersen
a0e79c1d7a
update stats for types
...
- should still update stats for tables
2022-01-19 16:38:19 +01:00
Tony Torralba
6096080156
Use all possible packages for Fragment classes
...
Also fix stub
2022-01-19 16:23:11 +01:00
Benjamin Muskalla
52406dc8df
Exclude logging sinks
...
Those sinks are too coarse grained to be exposed as sinks on any model.
2022-01-19 16:11:59 +01:00
