hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 11:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
26,405 Commits 1,672 Branches 157 Tags
remove-javascript
Commit Graph

26405 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Dominik Bamberger
7519288bfb Add example for 'Running a CodeQL pack'. 2021-07-22 17:35:39 +02:00
Joe Farebrother
6be9c705f0 Update usage text 2021-07-22 16:30:26 +01:00
Chris Smowton
5c917b4a23 Merge pull request #6353 from sauyon/sauyon/java/model-constructors 
Java: Add models for collection constructors
 2021-07-22 16:27:59 +01:00
Sauyon Lee
150f3fd352 improve windows compatibility 2021-07-22 08:00:14 -07:00
Rasmus Wriedt Larsen
f71c99af22 Merge pull request #5444 from jorgectf/jorgectf/python/ldapimproperauth 
Python: Add LDAP Improper Authentication query
 2021-07-22 17:00:09 +02:00
Sauyon Lee
5d716b95b1 Allow use of pom.xml to generate stubs 2021-07-22 07:52:35 -07:00
Geoffrey White
1d582182b0 C++: Exclude 'path'. 2021-07-22 15:49:30 +01:00
Geoffrey White
86ee5fea40 C++: More test cases and correct an existing one. 2021-07-22 15:47:06 +01:00
haby0
2a50cf8244 Fix 2021-07-22 22:24:09 +08:00
Sauyon Lee
fd02dcdf2e Java: Add models for collection constructors 2021-07-22 07:23:26 -07:00
Rasmus Wriedt Larsen
42a997cbcb Python: Fix deprecation warning 2021-07-22 15:59:13 +02:00
Ethan P
1606d96859 fix typo 2021-07-22 09:58:43 -04:00
Rasmus Wriedt Larsen
71e6db8a01 Merge branch 'main' into jorgectf/python/ldapimproperauth 2021-07-22 15:57:43 +02:00
haby0
d8f5f6987b Fix 2021-07-22 21:53:41 +08:00
Taus
6ea8ef5d16 Merge branch 'rc/3.2' into mergeback-rc/3.2-to-main 2021-07-22 13:52:56 +00:00
haby0
e160352b38 Fix 2021-07-22 21:48:46 +08:00
Taus
08f480a556 Merge pull request #6351 from tausbn/python-hotfix-localsourcenode-typetrackingnode 
Python: Hotfix `LocalSourceNode`
codeql-cli/v2.5.9 		2021-07-22 15:47:59 +02:00
haby0
735ab28040 Update java/ql/src/experimental/Security/CWE/CWE-470/UnsafeReflection.qhelp 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-07-22 21:45:30 +08:00
haby0
7cf2e9ed79 Update java/ql/src/experimental/Security/CWE/CWE-470/UnsafeReflection.qhelp 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-07-22 21:45:29 +08:00
haby0
46a212b712 Update java/ql/src/experimental/Security/CWE/CWE-470/UnsafeReflection.ql 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-07-22 21:45:29 +08:00
haby0
676f0ad817 Update java/ql/src/experimental/Security/CWE/CWE-470/UnsafeReflection.ql 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-07-22 21:45:29 +08:00
haby0
4ebf0ed7c5 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') 2021-07-22 21:45:29 +08:00
Chris Smowton
40173f7abb Remove stubbing script outputs 2021-07-22 14:33:34 +01:00
Rasmus Wriedt Larsen
802d9bda83 Merge pull request #5680 from mrthankyou/python-use-sqlalchemy 
Python: Add SqlAlchemy model
 2021-07-22 15:31:39 +02:00
Mathias Vorreiter Pedersen
f6f9c8af65 Merge pull request #6350 from MathiasVP/mergeback-2021-07-22 
Mergeback `rc/3.2`
 2021-07-22 15:13:44 +02:00
Taus
020c6e3b3b Python: Update change note 2021-07-22 13:11:29 +00:00
Taus
badf6311c9 Python: Remove flow between globals... 
... in a local scope. Or rather, remove these from the `hasLocalSource`
relation.

This prevents a quadratic blowup when the same global is mentioned
_a lot_ of times within a single function scope.
 2021-07-22 13:10:40 +00:00
Taus
ed794f42b5 Python: Soft revert TypeTrackingNode 
Temporarily instates `TypeTrackingNode` as an alias of `LocalSourceNode`
as having it as a separate class lead to performance regressions.

In the hopes that this will be resolved in the near future, I have left
the current `TypeTrackingNode` implementation in situ, but hidden inside
a `FutureWork` private module.
 2021-07-22 13:10:07 +00:00
Mathias Vorreiter Pedersen
e34261accf Merge branch 'rc/3.2' into mergeback-2021-07-22 2021-07-22 14:40:22 +02:00
Geoffrey White
7fdac2a792 Merge pull request #6347 from MathiasVP/import-gvn-to-prevent-ir-reevaluation 
C++: Import 'GVN' in 'Overflow.qll' to prevent IR reevaluation.
codeql-cli/v2.5.8 		2021-07-22 13:37:03 +01:00
Ethan P
09c2ccafd8 Formatting fixes 2021-07-22 08:31:28 -04:00
Rasmus Wriedt Larsen
38875ca0c7 Python: Improve handling of async methods 2021-07-22 14:17:07 +02:00
Rasmus Wriedt Larsen
c3f942f899 Python: Provide internal InstanceTaintStepsHelper 
I realized that if you ever wanted to the way taint-steps works again,
you would have to go to all the 117 places it has been implemented, and
change EVERY ONE OF THEM :( so trying to solve that problem here.

Not super happy with the name, but that was just the best I could come up with :D
 2021-07-22 14:16:50 +02:00
Rasmus Wriedt Larsen
6e9d9fcbbd Python: Improve taint steps in for & iterable unpacking 
These were written way before the ones in DataFlowPrivate, but
apparently didn't cover quite as much :|
 2021-07-22 14:16:17 +02:00
Taus
b8a40bb7f1 Merge pull request #6348 from tausbn/python-hotfix-disable-redos-queries 
Python: Hotfix: Disable ReDoS queries
 2021-07-22 13:32:14 +02:00
Dominik Bamberger
6d869f2572 Remove section on 'Creating a custom QL pack'. 2021-07-22 13:25:01 +02:00
Taus
bfe42ae146 Python: Update change note 2021-07-22 11:10:08 +00:00
Taus
e9a4114c04 Python: Hotfix: Disable ReDoS queries 2021-07-22 10:58:49 +00:00
Geoffrey White
a4c137fae5 C++: Add '_fsopen' as well. 2021-07-22 11:31:41 +01:00
Rasmus Wriedt Larsen
d3163d8a76 Python: Add iterable-unpacking in for test 2021-07-22 11:59:46 +02:00
Rasmus Wriedt Larsen
e2d3fa7093 Python: Add list-comprehension taint test 2021-07-22 11:59:46 +02:00
Rasmus Wriedt Larsen
f5ae5a581b Python: A bit more additional taint clean up 
A few stragglers that did not have the same TODO comments as the others
 2021-07-22 11:59:46 +02:00
Rasmus Wriedt Larsen
d2efe0b84d Python: Normalize additional taint steps for modeled classes 
Such that it should be next to the other class-related predicates (such
as `instance()`), the class is called `AdditionalTaintStep`, and it
marked private.

I also moved any modeling of attributes as well, while I was at it.
 2021-07-22 11:59:46 +02:00
Rasmus Wriedt Larsen
be1cad864b Python: Resolve all meth = obj.meth; meth() TODOs 
It would probably have been easier to do this as the _first_ thing...
but that's too late now 😓
 2021-07-22 11:59:46 +02:00
Mathias Vorreiter Pedersen
39144ee02b C++: Import 'GVN' in 'Overflow.qll' to prevent IR reevaluation. 2021-07-22 11:35:16 +02:00
Chris Smowton
e2a533c7de Merge pull request #6346 from aschackmull/java/perf-fix 
Java: Fix bad magic.
 2021-07-22 10:15:16 +01:00
Chris Smowton
605f037af8 Merge pull request #6247 from p0wn4j/spring-responseentity-redirect-sink 
[Java] CWE-601: Add Spring URL Redirect ResponseEntity sink
 2021-07-22 09:45:30 +01:00
Rasmus Wriedt Larsen
6f63c03558 Python: Model http.cookies.Morsel and usage in Tornado 2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
7e09a1cbfd Python: Model tornado.httputil.HTTPHeaders 2021-07-22 10:43:18 +02:00
Rasmus Wriedt Larsen
7020e4132b Python: Model BaseHTTPRequestHandler.rfile as file-like object 2021-07-22 10:43:18 +02:00