hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 02:44:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
17,999 Commits 1,672 Branches 157 Tags
query-help-tests-lgtm
Commit Graph

3856 Commits

Author SHA1 Message Date
intrigus-lgtm
5a3acc231e Fix typo 2020-08-11 01:01:53 +02:00
Erik Krogh Kristensen
dc5167bbe7 autoformat 2020-08-10 11:52:45 +00:00
Erik Krogh Kristensen
34778578db fill in docstring 2020-08-10 13:34:36 +02:00
Erik Krogh Kristensen
9bcac10d9e summarize exceptions thrown by immidiatly awaited function calls 2020-08-10 13:28:25 +02:00
Erik Krogh Kristensen
85de5aa16b add deprecated modifier 
Co-authored-by: Asger F <asgerf@github.com>
 2020-08-10 10:51:21 +02:00
Erik Krogh Kristensen
410b696562 add deprecated aliases getId() forwarding to getIdentifier() 2020-08-10 09:11:38 +02:00
CodeQL CI
7c4e10df17 Merge pull request #4014 from erik-krogh/stringify 
Approved by esbena
 2020-08-10 07:50:21 +01:00
Erik Krogh Kristensen
244052f419 autoformat 2020-08-08 21:20:20 +02:00
Erik Krogh Kristensen
2680afcdc9 deduplicate some implementation in storeStep and loadStep 2020-08-07 19:16:28 +02:00
Erik Krogh Kristensen
54fd7d97c0 share implementation instead of copy-pasting 2020-08-07 18:00:10 +02:00
Erik Krogh Kristensen
94cf3a8ddb correct copy-paste note after refactorings 2020-08-07 17:48:55 +02:00
Erik Krogh Kristensen
0edb46c20d improve precision for load/store steps with async functions 2020-08-07 17:39:59 +02:00
Erik Krogh Kristensen
26ef2f34da add precise return-flow for async functions 2020-08-07 17:33:26 +02:00
Erik Krogh Kristensen
cc94c5ec60 remove imprecise return-flow from async functions 2020-08-07 17:33:24 +02:00
Erik Krogh Kristensen
0004c28fe8 introduce and use FunctionReturnNode 2020-08-07 17:32:25 +02:00
Erik Krogh Kristensen
f1dc36244c update tests and queries that used getId() 2020-08-05 14:32:09 +00:00
Erik Krogh Kristensen
cc5ef4d5e1 rename JsonSerializeCall to JsonStringifyCall 2020-08-05 13:22:41 +02:00
Erik Krogh Kristensen
5a3f67a682 introduce model for JSON.stringify and similar libraries 2020-08-05 12:14:51 +02:00
Erik Krogh Kristensen
67c4320287 make JumpStmt non abstract 2020-08-05 10:03:46 +02:00
Erik Krogh Kristensen
016bdc1614 make ControlStmt non abstract 2020-08-05 09:59:30 +02:00
Erik Krogh Kristensen
5727e6f9f8 make CompoundAssignExpr non-abstract 2020-08-04 16:17:08 +02:00
Erik Krogh Kristensen
cf3f275aa1 make DestructuringPattern non-abstract 2020-08-04 16:02:32 +02:00
Erik Krogh Kristensen
0867c5567e rename getId() to getIdentifier() 2020-08-04 13:22:19 +02:00
Erik Krogh Kristensen
eccfade928 rewrite parts of the DeadStoreOfProperty query 2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
e629e6bbb0 changes based on review 2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
8131618382 revert making rankedAccessPath private 2020-08-04 10:25:05 +02:00
Erik Krogh Kristensen
97aa3cc8a3 rewrite DeadStoreOfProperty to improve worst-case complexity 2020-08-04 10:25:05 +02:00
CodeQL CI
8855ab8c8c Merge pull request #3835 from Raz0r/js/xss-protocol-sinks 
Approved by erik-krogh
 2020-08-03 15:40:05 +01:00
CodeQL CI
a4f8b19ae4 Merge pull request #3876 from erik-krogh/CWE078-Correctness 
Approved by esbena
 2020-08-03 15:38:51 +01:00
CodeQL CI
c8e5db189a Merge pull request #3913 from erik-krogh/topmost 
Approved by asgerf
 2020-08-03 13:18:22 +01:00
CodeQL CI
0bbdc70cdb Merge pull request #3864 from erik-krogh/exprString 
Approved by asgerf, esbena
 2020-08-03 09:25:17 +01:00
Arthur Baars
7e72ef350e Merge pull request #3975 from aibaars/lgtm-suites 
CodeQL: complete LGTM suites
 2020-07-30 18:39:01 +02:00
Arthur Baars
c4041e55ba CodeQL: complete LGTM suites 2020-07-28 20:40:44 +02:00
Max Schaefer
91762ec274 JavaScript: Add partial model for opener. 
3.5M weekly downloads.

Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
 2020-07-27 11:42:32 +01:00
Max Schaefer
9aa26fa4bc JavaScript: Add model for foreground-child. 
>1M weekly downloads, so seems worth doing.
 2020-07-27 11:37:06 +01:00
Max Schaefer
2f842042ea JavaScript: Model another execa function relevant for command injection. 2020-07-27 11:34:04 +01:00
ubuntu
8dee3da4fe Update .qhelp 2020-07-26 23:50:22 +02:00
ubuntu
ac7c511d86 Update .qhelp 2020-07-26 23:47:53 +02:00
ubuntu
2cec8f7e9d Update .qhelp 2020-07-26 23:23:56 +02:00
ubuntu
c469f71957 Add Codeql query to detect if cookies are sent without the flag being set 2020-07-26 22:56:36 +02:00
semmle-qlci
e167b87150 Merge pull request #3932 from max-schaefer/portals-additions 
Approved by esbena
 2020-07-09 11:43:45 +01:00
Max Schaefer
1c47260bde JavaScript: Add support for global variables to portals. 2020-07-09 09:12:56 +01:00
Max Schaefer
c40ef0556a JavaScript: Broaden scope of imports considered relevant to portals. 
Previously, we only considered an import relevant to portals if the path it imported was declared as a dependency. This falls down for deep imports where a specific module inside the package is imported rather than the default entry point, for imports of built-in modules like `fs`, and in cases where a developer simply forgets to declare a dependency.

So instead we now consider all imports relevant whose path does not start with a dot or a slash.
 2020-07-09 09:09:44 +01:00
Max Schaefer
8b4b5781e6 JavaScript: Add utility predicate getBasePortal(i). 
This iterates the existing `getBasePortal()` predicate `i` times.
 2020-07-09 09:08:18 +01:00
Erik Krogh Kristensen
00e900f1b1 only include named topmost package.json files for js/shell-command-constructed-from-input 2020-07-08 09:25:08 +02:00
Erik Krogh Kristensen
d85d9b9b5b autoformat 2020-07-07 16:21:03 +03:00
Arseny Reutov
b46b49586a Apply suggestions from code review 
`interpretsValueAsJavaScript` -> `interpretsValueAsJavaScriptUrl`

Co-authored-by: Asger F <asgerf@github.com>
 2020-07-07 16:21:03 +03:00
Raz0r
54db6c4a39 [js/client-side-unvalidated-url-redirection] add interpretsValueAsJavaScript predicate 2020-07-07 16:21:03 +03:00
Anders Schack-Mulligen
67db1df00c C++/C#/JavaScript/Python: Port Location qldoc update. 2020-07-07 11:39:27 +02:00
Erik Krogh Kristensen
442ee8d1cc add consistency-checking for CWE-089 2020-07-06 19:02:50 +02:00