hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
78,658 Commits 1,671 Branches 157 Tags
rust-ti-implementing-type-method
Commit Graph

1667 Commits

Author SHA1 Message Date
Erik Krogh Kristensen
be18adca3c update description in change-notes 2019-10-08 11:54:56 +02:00
Erik Krogh Kristensen
9788b16dee add change note for js/use-of-returnless-function 2019-10-08 11:54:08 +02:00
Esben Sparre Andreasen
24a5301d87 Merge pull request #2056 from erik-krogh/suspiciousMethodName 
JS: add query for detecting suspicious method names in TypeScript
 2019-10-08 10:49:57 +02:00
Calum Grant
af25536648 C#: Add localExprFlow and localExprTaint, and change notes. 2019-10-04 16:46:02 +01:00
Tom Hvitved
b55e2948be Merge pull request #1986 from calumgrant/cs/switch-cfg 
C#: Fix CFG for switch statements where the default case is not the last
 2019-10-04 16:54:04 +02:00
Calum Grant
48dee29620 Merge pull request #2021 from hvitved/csharp/local-not-disposed 
C#: Refactor `cs/local-not-disposed` using data flow library
 2019-10-03 15:21:06 +01:00
AlexTereshenkov
3e6f8fb6be Add bind-socket-all-network-interfaces Python query (#2048) 
Add bind-socket-all-network-interfaces Python query
 2019-10-03 11:23:11 +01:00
Jonas Jensen
8bed418022 C++: enable the QL-based CFG code 2019-10-03 10:04:24 +02:00
Robert Marsh
68c38ba34a C++: Add change note 2019-10-02 11:38:20 -07:00
yh-semmle
3313af5189 Merge pull request #2036 from aschackmull/java/eq-ssa-guard 
Java: Improve guards for equal ssa variables.
 2019-10-02 12:00:59 -04:00
Tom Hvitved
b66479c028 C#: Add change note 2019-10-02 16:31:26 +02:00
Anders Schack-Mulligen
0154e31e64 Java: Add change note. 2019-10-02 11:47:53 +02:00
Erik Krogh Kristensen
aa1368741b rename suspicious-method-name to suspicious-method-name-declaration 2019-10-01 14:37:07 +02:00
Jonas Jensen
7c319efb8b C++: Data flow through reference parameters 2019-10-01 10:43:49 +02:00
Jonas Jensen
f417640da4 Merge pull request #1938 from dave-bartolomeo/dave/InNOut 
C++: Rename predicates in `FunctionInputsAndOutputs.qll` and add QLDoc
 2019-09-30 13:30:19 +02:00
Erik Krogh Kristensen
0320f0f26b add query for detecting suspisous method names in TypeScript 2019-09-30 13:05:50 +02:00
Dave Bartolomeo
28aa7dcae2 C++: Fix PR feedback 2019-09-26 13:56:43 -07:00
Erik Krogh Kristensen
69365ccd03 remove false positive in missingSpaceInAppend by requring the presence of a word-like fragment 2019-09-26 12:59:05 +02:00
Max Schaefer
d4fca84898 JavaScript: Improve XSS sanitizer detection. 
We now use local data flow to detect more regexp-based sanitizers.
 2019-09-23 17:07:06 +01:00
Jonas Jensen
898976121b Merge pull request #1987 from geoffw0/toomanyformat 
CPP: WrongNumberOfFormatArguments.ql Fix
 2019-09-23 16:05:11 +02:00
semmle-qlci
e2c941c577 Merge pull request #1916 from erik-krogh/taintedLength 
Approved by asger-semmle, xiemaisi
 2019-09-23 11:47:48 +01:00
semmle-qlci
7a57a3c743 Merge pull request #1996 from xiemaisi/js/fix-illegal-invocation-refl 
Approved by esben-semmle
 2019-09-23 09:16:33 +01:00
Max Schaefer
149ae5d7ab JavaScript: Fix IllegalInvocation. 
This fixes false positives that arise when a call such as `f.apply` can either be interpreted as a reflective invocation of `f`, or a normal call to method `apply` of `f`.
 2019-09-23 07:44:14 +01:00
Erik Krogh Kristensen
814c5537be update name of loop bound injection in change-notes 2019-09-20 22:56:08 +02:00
Geoffrey White
accb8246d4 CPP: Change note. 2019-09-20 15:15:35 +01:00
Calum Grant
b31cd8ab32 Merge pull request #1982 from hvitved/csharp/null-maybe-dynamic 
C#: Remove false positives from `cs/dereferenced-value-may-be-null`
 2019-09-20 14:46:01 +01:00
Calum Grant
8408e90b5f C#: Change note & docs. 2019-09-20 14:44:07 +01:00
semmle-qlci
6d9d859119 Merge pull request #1934 from asger-semmle/node-js-classification 
Approved by esben-semmle
 2019-09-20 09:50:34 +01:00
Tom Hvitved
fb68d839a9 C#: Add change note 2019-09-20 10:40:20 +02:00
Robert Marsh
fd88f7a3ce Merge pull request #1884 from jbj/dataflow-addressof 
C++: Data flow through address-of operator (&)
 2019-09-19 09:15:43 -07:00
semmle-qlci
6f2e485ace Merge pull request #1950 from xiemaisi/js/rate-limiter-flexible 
Approved by esben-semmle
 2019-09-19 12:45:45 +01:00
Erik Krogh Kristensen
3ef187f7f2 Add external/cwe/cwe-834 tag in change notes for js/loop-bound-injectoin 
Co-Authored-By: Max Schaefer <max@semmle.com>
 2019-09-19 11:30:15 +02:00
Esben Sparre Andreasen
b631bfc8eb Merge branch 'master' into node-js-classification 2019-09-19 09:42:26 +02:00
semmle-qlci
57a6c0c20d Merge pull request #1918 from esben-semmle/js/improve-getAResponseDataNode 
Approved by asger-semmle
 2019-09-18 14:03:45 +01:00
semmle-qlci
479fca9e30 Merge pull request #1946 from xiemaisi/js/top-level-await 
Approved by asger-semmle
 2019-09-18 12:32:09 +01:00
Max Schaefer
3970ead7ab JavaScript: Add support for rate-limiter-flexible package. 2019-09-18 12:25:33 +01:00
Max Schaefer
9ff5c7007a JavaScript: Add support for top-level await. 2019-09-18 09:56:21 +01:00
Esben Sparre Andreasen
ac6554b7da Merge branch 'master' into js/improve-getAResponseDataNode 2019-09-17 13:18:41 +02:00
Jonas Jensen
fd6d06fe6f C++: Data flow through address-of operator (&) 
The data flow library conflates pointers and their objects in some
places but not others. For example, a member function call `x.f()` will
cause flow from `x` of type `T` to `this` of type `T*` inside `f`. It
might be ideal to avoid that conflation, but that's not realistic
without using the IR.

We've had good experience in the taint tracking library with conflating
pointers and objects, and it improves results for field flow, so perhaps
it's time to try it out for all data flow.
 2019-09-17 13:16:34 +02:00
Asger F
f8eff06aa1 JS: Change note 2019-09-17 11:20:39 +01:00
Esben Sparre Andreasen
c9d31e90fe JS: add change notes 2019-09-16 10:11:43 +02:00
Erik Krogh Kristensen
3fb64abb09 fix consistency and spelling in the documentation 
suggestions from the documentation team

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
 2019-09-13 14:52:11 +01:00
Erik Krogh Kristensen
5b2b60f132 change DOS to DoS, and other small documentation fixes 
Co-Authored-By: Max Schaefer <max@semmle.com>
 2019-09-13 10:26:01 +01:00
Erik Krogh Kristensen
17a71a97c5 add loop-bound-injection to change-notes 2019-09-12 15:28:14 +01:00
Calum Grant
e330d5a6c6 Merge pull request #1549 from hvitved/csharp/cfg/loop-unrolling 
C#: Loop unrolling for `foreach` statements
 2019-09-12 10:24:26 +01:00
semmle-qlci
72db219c13 Merge pull request #1910 from xiemaisi/js/unused-index-variable 
Approved by esben-semmle, shati-semmle
 2019-09-11 14:33:32 +01:00
Max Schaefer
500cde68c3 JavaScript: Add new query UnusedIndexVariable. 2019-09-11 11:36:50 +01:00
Esben Sparre Andreasen
086c473c18 JS: sharpen js/http-to-file-access 2019-09-11 12:05:33 +02:00
semmle-qlci
16c95d8c5e Merge pull request #1876 from esben-semmle/js/more-delimiter-stripping-whitelisting 
Approved by xiemaisi
 2019-09-11 09:16:57 +01:00
Esben Sparre Andreasen
f7bfc472c1 JS: treat server responses as untrusted for command injections 2019-09-11 09:38:18 +02:00