hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 09:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
21,517 Commits 1,671 Branches 157 Tags
sauyon/java-spring-stringutils
Commit Graph

2579 Commits

Author SHA1 Message Date
Jonas Jensen
6fecc38004 Merge pull request #4726 from MathiasVP/revert-4558 
C++: Revert 4558
 2020-11-26 08:44:32 +01:00
Cornelius Riemenschneider
0b8403fc05 C++: Add one more test. 2020-11-25 16:24:55 +01:00
Mathias Vorreiter Pedersen
4c3a26fea8 Revert "Merge pull request #4558 from rdmarsh2/rdmarsh2/cpp/remove-initialize-nonlocal" 
This reverts commit 08efd7fbd9, reversing
changes made to cb8c5e8cca.
 2020-11-25 15:51:52 +01:00
Geoffrey White
2b349f299a C++: Replace 'odasa qltest' with 'codeql test run'. 2020-11-25 13:16:50 +00:00
Cornelius Riemenschneider
7f13d4c356 C++: Improve EscapesTree analysis in the presence of temporary objects. 2020-11-25 10:41:15 +01:00
Cornelius Riemenschneider
8d024c7ff1 C++: Add tests around references to pointers with temporary objects. 2020-11-25 10:40:33 +01:00
Cornelius Riemenschneider
e68352bcde C++: Add testcase for false positive. 2020-11-25 10:40:33 +01:00
Jonas Jensen
5f0141953d Merge pull request #4644 from MathiasVP/unsafe-use-of-this-query 
C++: Add 'unsafe use of this' query
 2020-11-25 08:40:12 +01:00
Geoffrey White
d677305c90 C++: Create tests readme. 2020-11-24 16:08:02 +00:00
Mathias Vorreiter Pedersen
8bd14c5af6 C++: Remove duplication-tests directory since we no longer detect duplication. 2020-11-24 10:10:31 +01:00
Mathias Vorreiter Pedersen
2e6a3cd33b Merge branch 'main' into unsafe-use-of-this-query 2020-11-19 13:03:29 +01:00
Mathias Vorreiter Pedersen
072adaa279 C++: Require that no override of the called pure virtual function exists in any base class. This removes the false positive in the testcase. Based on the results on LGTM we have agreed to set the @precision to very-high. 2020-11-19 12:10:57 +01:00
Dave Bartolomeo
08efd7fbd9 Merge pull request #4558 from rdmarsh2/rdmarsh2/cpp/remove-initialize-nonlocal 
Remove InitializeNonlocalInstruction
 2020-11-18 20:23:08 -05:00
Robert Marsh
77729918c1 Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt 
Update for submodule pointer
 2020-11-18 13:09:02 -08:00
Robert Marsh
693626e460 C++: accept value numbering test changes 2020-11-18 11:00:31 -08:00
Robert Marsh
c2e44fa180 C++: autoformat 2020-11-17 09:28:39 -08:00
Matthew Gretton-Dann
62767e7e0d Update expected results for `constinit' support 2020-11-17 14:01:00 +00:00
Robert Marsh
525aeb6551 C++: autoformat 2020-11-13 16:14:07 -08:00
Robert Marsh
29eacbd28b Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt 
Update for submodule bump
 2020-11-13 12:22:41 -08:00
Mathias Vorreiter Pedersen
0a6a22562b C++: Respond to more review comments. 
- Remove post-dominance requirement. It was really just hiding good
  results.
- Fix test annotations. Turns out Clang and GCC's 'undefined behavior'
  warning didn't align with the C++ standard.
 2020-11-13 15:44:33 +01:00
Jonas Jensen
8bb9e8a4af Merge pull request #4592 from geoffw0/varnotused 
C++: Work around two false positive issues with the UnusedLocals.ql query
 2020-11-13 14:53:58 +01:00
Mathias Vorreiter Pedersen
b249777bfb C++: Respond to review comments. 2020-11-13 10:44:06 +01:00
Robert Marsh
bd00988c37 C++: accept test output for DefaultTaintTracking 2020-11-12 14:38:53 -08:00
Robert Marsh
68040b717e C++: autoformat 2020-11-12 14:32:19 -08:00
Robert Marsh
275d75295c Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt 
Fix test conflict
 2020-11-12 13:28:10 -08:00
Mathias Vorreiter Pedersen
f417831a23 C++: Add two more tests to 'unsafe use of this'. First, test that post-dominance removes some results. Second, that a cast to the pure virtual function's defining class (skipping past a derived class that overrides the function) followed by a call to the function still results in an alert. This is also undefined behavior. 2020-11-12 15:51:04 +01:00
Robert Marsh
049bff09e6 Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt 
Make this branch a valid taget for a submodule bump
 2020-11-10 14:25:05 -08:00
Robert Marsh
2a6ba40a93 C++: Accept more test changes 2020-11-10 13:59:35 -08:00
Mathias Vorreiter Pedersen
8d4b948acf Merge branch 'main' into interleave-op-instr-field-flow 2020-11-10 21:15:50 +01:00
Robert Marsh
14f1fa50f1 Merge branch 'main' into rdmarsh2/cpp/remove-initialize-nonlocal 
Accept test changes from IR temporaries and block ordering
 2020-11-10 11:14:26 -08:00
Mathias Vorreiter Pedersen
4bcf1f498b C++: Add new query for unsafe use of this. 2020-11-10 17:23:55 +01:00
Geoffrey White
c4fe8df04c C++: Support data flow from parameter deref to return value. 2020-11-10 13:17:34 +00:00
Geoffrey White
4563e32e92 C++: Remove data flows we shouldn't need in MemberFunction. 2020-11-10 13:17:24 +00:00
Robert Marsh
c00587d2cb C++/C#: Conflated memory as IR dump annotation 
Removes the IR consistency checks for conflated memory and marks
instructions that have a conflated result with a percent sign (%)
instead. This avoids reimplementing part of the alias analysis logic
in the consistency check.
 2020-11-09 14:55:47 -08:00
Robert Marsh
04ad94d1cc C++: model taint from pointers to aliased buffers 2020-11-09 13:52:08 -08:00
Robert Marsh
afbeca0d54 C++: Accept test outputs 2020-11-09 13:24:31 -08:00
Robert Marsh
95ed5465de C++: improve handling of function arguments in DTT 2020-11-09 13:02:06 -08:00
Robert Marsh
fbe857d1fa C++: require that other operands be predictable 
This brings back a constraint that was lost when switching
DefaultTaintTracking to use a TaintTracking::Configuration
 2020-11-09 13:00:55 -08:00
Robert Marsh
7d79be71d1 C++: taint tracking conf in DefaultTaintTracking 
Switch from using additional flow steps with a DataFlow::Configuration
in DefaultTaintTracking to using a TaintTracking::Configuration. This
makes future improvements to TaintTracking::Configuration reflected in
DefaultTaintTracking without further effort. It also removes the
predictability constraint in DefaultTaintTracking, which increases the
number of results, with both new true positives and new false positives.
Those may need to be addressed on a per-query basis.

There are some additional regressions from losing pointer/object
conflation for arguments. Those can be worked around by adding that
conflation to TaintTracking::Configuration until precise indirect
parameter flow is ready.
 2020-11-09 13:00:55 -08:00
Mathias Vorreiter Pedersen
3c2fb5a93f Merge branch 'main' into interleave-op-instr-field-flow 2020-11-09 09:58:19 +01:00
Robert Marsh
2f204869e7 Merge pull request #4604 from criemen/ir-block-sort-order 
C++, C# IR: Stabilize sort order for basic blocks.
 2020-11-04 18:22:23 -05:00
Cornelius Riemenschneider
78d885ee7d C++: Accept test output. 2020-11-04 16:45:07 +01:00
Cornelius Riemenschneider
e7e5754270 C++: Add taint model for std::vector::emplace/_back. 2020-11-04 16:20:01 +01:00
Cornelius Riemenschneider
62a02cde73 C++: Add test to show missing taint steps for std::vector::emplace/_back 2020-11-04 16:07:15 +01:00
Cornelius Riemenschneider
081ab1e2bb C++: Add std::vector::emplace/_back to our STL model. 2020-11-04 16:07:08 +01:00
Dave Bartolomeo
4cc9110dbd Fix test expectation 2020-11-03 13:39:33 -05:00
Dave Bartolomeo
f0b9794907 Merge remote-tracking branch 'upstream/main' into work 2020-11-03 11:33:44 -05:00
Dave Bartolomeo
0d1fbd1bdc Fix annotations 2020-11-02 18:03:40 -05:00
Robert Marsh
f917cf826f C++: accept test output 2020-11-02 13:59:23 -08:00
Geoffrey White
e9bde9b711 C++: Work around issue with ConditionalDeclExpr. 2020-11-02 15:46:38 +00:00