hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-04 09:23:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
30,023 Commits 1,818 Branches 172 Tags
ruby/system-command-execution-extension
Commit Graph

30023 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tom Hvitved
11792e17a9 Add missing DataFlowImpl2.qll entry to identical-files.json 2021-10-13 15:50:29 +02:00
Andrew Eisenberg
01819cdbde Merge pull request #344 from github/aeisenberg/tutorial 2021-10-13 06:48:55 -07:00
Taus
a6115687aa Python: More implicit this 2021-10-13 13:43:37 +00:00
Taus
a9c8163ab3 Python: Fix uses of implicit this 
Quoting the style guide:

"14. _Always_ qualify _calls_ to predicates of the same class with
`this`."
 2021-10-13 13:43:36 +00:00
Andrew Eisenberg
0e0441743b Move tutorial directly into each qlpack 
See also https://github.com/github/codeql/pull/6862
 2021-10-13 15:28:17 +02:00
Arthur Baars
aa4d0021a8 Merge pull request #349 from github/aibaars/bump-codeql-main 
Bump codeql submodule on main
 2021-10-13 15:26:59 +02:00
Arthur Baars
078cebe822 Merge pull request #351 from github/aibaars/fix-broken-links 
Update broken links
 2021-10-13 15:25:23 +02:00
Philip Ginsbach
a204b7f3e7 Merge pull request #6866 from github/ginsbach/MoreInstanceofExtensions 
more instanceof extensions
 2021-10-13 14:21:50 +01:00
Jonas Jensen
c215838531 Merge pull request #6867 from nickrolfe/mergeback 
Merge rc/3.3 into main
 2021-10-13 15:19:18 +02:00
Mathias Vorreiter Pedersen
6ece3c2b46 Merge pull request #6870 from jbj/cp-fixes 
C++: Fix potential Cartesian products
 2021-10-13 14:15:33 +01:00
Arthur Baars
f4003406cf Apply suggestions from code review 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-10-13 15:11:04 +02:00
Arthur Baars
112b7a8e27 Update broken links 2021-10-13 15:03:19 +02:00
Tom Hvitved
436f678c94 Speedup ErbDirective::containsStmtStart 2021-10-13 14:41:04 +02:00
Jonas Jensen
e80c1ad91f C++: Fix resource-not-released-in-destructor CP 
By moving a disjunct outside the scope of an `exists(Function f`
variable it doens't use, the code becomes clearer and can be optimized
better.

The CP in the QL code did not lead to a CP at evaluation time since the
optimizer was smart enough to compensate for it:

    376161  ~37597630%     {0} r1 = SCAN functions OUTPUT {}
    1       ~0%            {0} r2 = STREAM DEDUP r1

Before this change, the largest tuple count in `leakedInSameMethod` on
bitcoin/bitcoin was 2M. Now it's 400k.
 2021-10-13 14:24:26 +02:00
Mathias Vorreiter Pedersen
a80860cdc6 Python: Replace '.prefix'/'.suffix' with '.matches'. 2021-10-13 13:23:12 +01:00
Mathias Vorreiter Pedersen
f3bb0a676e JS: Replace '.prefix'/'.suffix' with '.matches'. 2021-10-13 13:23:07 +01:00
Mathias Vorreiter Pedersen
d85d009a54 Java: Replace '.prefix'/'.suffix' with '.matches'. 2021-10-13 13:19:06 +01:00
Jonas Jensen
955344e175 C++: Inline a predicate that contains CPs 
The `overflows` predicate had quite severe Cartesian products. We didn't
see them in practice because magic saved us, but we can't rely on magic
in the future, so it seems better to inline this predicate.

Tuple counts and speed look good both before and after.
 2021-10-13 14:11:47 +02:00
Philip Ginsbach
c9c0c7f24f fix formatting 2021-10-13 13:10:37 +01:00
Arthur Baars
bf3d291a1c Updates after codeql file sync 2021-10-13 13:24:20 +02:00
Arthur Baars
80ac05d5c6 Bump codeql submodule to 'main' 2021-10-13 13:24:08 +02:00
Alex Ford
0d72a51334 Merge pull request #342 from github/improve-xss-isAdditionalFlowStep 
Improve `XSS::Shared::isAdditionalFlowStep` performance
 2021-10-13 12:15:52 +01:00
Mathias Vorreiter Pedersen
bdc54bcda7 Python: Replace 'if p() then q() else none()' with a conjunction. 2021-10-13 12:13:55 +01:00
Mathias Vorreiter Pedersen
887849857d JS: Replace 'if p() then q() else none()' with a conjunction. 2021-10-13 12:13:55 +01:00
Mathias Vorreiter Pedersen
7690625114 C#: Replace 'if p() then q() else none()' with a conjunction. 2021-10-13 12:11:50 +01:00
Mathias Vorreiter Pedersen
ba981c525b C++: Replace 'if p() then q() else none()' with a conjunction. 2021-10-13 12:11:42 +01:00
Arthur Baars
6a18aa4e2a Merge pull request #348 from github/rc/3.3 
Merge rc/3.3 into main
 2021-10-13 13:08:55 +02:00
Arthur Baars
287046e9b0 Merge pull request #346 from github/erik-krogh/fix-primary-class-typo 
fix typo for getAPrimaryQlClass
 2021-10-13 12:53:51 +02:00
Philip Ginsbach
6b9ddf1f65 Guard non-extending subtype of G::Guard 2021-10-13 11:44:22 +01:00
Philip Ginsbach
e3e741251f ParameterNode non-extending subtype of ParameterNodeImpl 2021-10-13 11:42:41 +01:00
Philip Ginsbach
aa656f7542 ArgumentNode non-extending subtype of ArgumentNodeImpl 2021-10-13 11:41:40 +01:00
Philip Ginsbach
4a0aac8505 SuppressionScope non-extending subtype of SuppressionComment 2021-10-13 11:40:32 +01:00
Philip Ginsbach
d0ecabad19 DataFlowCall non-extending subtype of Call 2021-10-13 11:39:25 +01:00
Nick Rolfe
1c5dcecf1e Update expected output to match getAPrimaryQlClass change 2021-10-13 12:39:13 +02:00
Erik Krogh Kristensen
e1675ff055 fix typo for getAPrimaryQlClass 2021-10-13 12:39:13 +02:00
Arthur Baars
d448e208ab Merge pull request #347 from github/aibaars/bump-codeql 
Bump codeql submodule to rc/3.3
 2021-10-13 12:28:17 +02:00
Arthur Baars
8ef1af9de0 Bump codeql submodule to rc/3.3 2021-10-13 12:03:49 +02:00
Tom Hvitved
e2db11b31f Performance improvements in XSS.qll 
Various performance improvements to make sure that we never join methods
and calls (or variables and accesses) on only name (or file), but always
perform a multi-join on both values.
 2021-10-13 11:53:49 +02:00
Calum Grant
59e4a6ff7b Move file to correct location 2021-10-13 09:23:04 +01:00
Calum Grant
f575139180 Add Ruby to toctree 2021-10-13 09:10:46 +01:00
Anders Schack-Mulligen
d4fd8780e9 Merge pull request #6863 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2021-10-13 08:58:18 +02:00
Anders Schack-Mulligen
306388a6bc Update java/ql/src/Likely Bugs/Comparison/StringComparison.ql 2021-10-13 08:57:31 +02:00
github-actions[bot]
2f27a0c9f9 Add changed framework coverage reports 2021-10-13 00:09:35 +00:00
Andrew Eisenberg
8285878504 Merge pull request #6861 from github/aeisenberg/qlpack-defaultSuite 
QlPacks: Add the defaultSuite to query packs that are missing it
 2021-10-12 14:27:09 -07:00
Andrew Eisenberg
7a0437f159 Merge pull request #343 from github/aeisenberg/defaultSuite 
Add defaultSuite
 2021-10-12 14:26:35 -07:00
Andrew Eisenberg
d9ab13b43d Update ql/src/qlpack.yml 
Co-authored-by: Arthur Baars <aibaars@github.com>
 2021-10-12 13:01:03 -07:00
Andrew Eisenberg
2fca1f57c6 Add defaultSuite 
Also, change the dependencies to be in alignment with other standard qlpacks.
 2021-10-12 21:57:53 +02:00
Arthur Baars
4e79d9fad6 Merge pull request #334 from github/RasmusWL/normalize-qlpack 
Packaging: Normalize src/qlpack.yml
 2021-10-12 21:56:31 +02:00
Alex Ford
ad5c1f9b32 ql format 2021-10-12 20:43:20 +01:00
Alex Ford
d7b5e4c779 update predicate visibility 2021-10-12 20:43:20 +01:00