hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 02:13:17 +01:00
Code Issues Packages Projects Releases Wiki Activity
21,517 Commits 1,671 Branches 157 Tags
sauyon/java-spring-stringutils
Commit Graph

3069 Commits

Author SHA1 Message Date
Taus Brock-Nannestad
817a142abc Python: Add getLocation to EssaVariable. 
This may be a slightly "bogus" location to provide for ESSA variables,
but it can be useful for debugging. For instance, where previously you
might just see

```
SSA variable x | ...
SSA variable x | ...
SSA variable x | ...
SSA variable x | ...
SSA variable x | ...
SSA variable x | ...
```

where each instance of `SSA variable x` was just a bare string, now
each occurrence will tell you (via its location) _where_ this variable
is being (re)defined.
 2021-01-29 14:45:12 +01:00
Taus
cb195a0dc4 Merge pull request #4752 from yoff/python-dataflow-unpacking-assignment 
Python: Dataflow, unpacking assignment
 2021-01-29 14:15:28 +01:00
Taus
be5b7bb4c4 Merge pull request #5022 from yoff/python-split-lambdas 
Python: Callable for lambdas
 2021-01-29 14:12:26 +01:00
Rasmus Wriedt Larsen
b6007cf324 Merge pull request #5023 from yoff/python-unify-synthetic-post-update-nodes 
Python: Only generate one post-update node, even if there are multiple reasons for doing so.
 2021-01-28 13:11:50 +01:00
Rasmus Wriedt Larsen
173012578e Python: Add missing type-tracking step for django.views 
Easy to overlook, and will onyl be caught by tests if they use `import
parent.thing` and not `from parent import thing`
 2021-01-28 12:10:42 +01:00
Rasmus Wriedt Larsen
54725ccbb9 Python: Support full-path import of Django View class 
requestHandler still MISSING :(
 2021-01-28 12:10:40 +01:00
Rasmus Wriedt Larsen
61d69f2cc8 Python: Add test for full-path import of Django View class 2021-01-28 12:10:39 +01:00
Rasmus Lerchedahl Petersen
0e0b18c214 Python: Adjust comment based on review. 2021-01-28 01:09:03 +01:00
Rasmus Lerchedahl Petersen
ae2c122159 Python: Small refactor 
- align synthetic pre-update nodes with synthetic post -update nodes
- move the classes into the modules
- rename modules after the new main class (eliding "needs")
 2021-01-27 23:15:50 +01:00
Rasmus Lerchedahl Petersen
2120868939 Python: format 2021-01-27 19:48:01 +01:00
yoff
2c5da85e3b Update python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll 
Co-authored-by: Taus <tausbn@github.com>
 2021-01-27 19:43:40 +01:00
Rasmus Wriedt Larsen
5646af56dd Python: Fix too many results from DataFlow::importNode 2021-01-27 19:11:55 +01:00
Rasmus Wriedt Larsen
0d42e546a0 Python: Add deep import chain to import-helper tests 2021-01-27 19:09:09 +01:00
Rasmus Wriedt Larsen
44bb41e84b Python: Add extra type-tracking test for "long" import chain 
While trying to debug an other problem related to full import of django view, I
stumbled upon this oddity. (yikes)
 2021-01-27 19:06:51 +01:00
yoff
f2241e04e5 Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2021-01-27 12:15:35 +01:00
Rasmus Lerchedahl Petersen
5d62a56ed8 Python: Remove debug function 2021-01-27 08:24:11 +01:00
Rasmus Lerchedahl Petersen
d18c1602cd Python: autoformat 2021-01-27 01:25:38 +01:00
Rasmus Lerchedahl Petersen
d29fdda779 Python: Only generate one post-update node, 
even if there are multiple reasons for doing so.
Solves `uniqueNodeToString` inconsistencies
(and probably saves quite a lot of nodes).
 2021-01-27 01:20:51 +01:00
Rasmus Lerchedahl Petersen
9b13834d28 Python: small refactor 2021-01-26 21:17:59 +01:00
Rasmus Lerchedahl Petersen
d3e0e84c37 Python: Separate callable for lambdas 
Since lambdas are split, but their children are not,
we use the Function as the callable.
 2021-01-26 21:17:59 +01:00
Rasmus Lerchedahl Petersen
4526a1dd2f Python: test for split lambda 2021-01-26 21:17:59 +01:00
yoff
cd85cf1645 Update python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll 2021-01-26 19:16:54 +01:00
yoff
500ea12224 Apply suggestions from code review 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2021-01-26 19:14:46 +01:00
Henning Makholm
54f00de3e0 Add "tests" fields to test qlpacks 
This will allow `codeql resolve tests --ignore-dubious-cases`
(and thus the VSCode extension) to recognize all `.ql` files in those
packs as test cases, even if they don't have accompanying `.expected`
files.

CLI versions prior to 2.1.0 will choke on this, but it's almost 10
months since that came out.
 2021-01-26 18:15:22 +01:00
Rasmus Wriedt Larsen
902bade5ae Merge pull request #5015 from yoff/python-add-missing-postupdate-nodes 
Python: add missing postupdate nodes
 2021-01-26 14:39:29 +01:00
Taus
4c0f54f5d3 Merge pull request #5007 from yoff/python-disregard-comp-args 2021-01-26 12:53:33 +01:00
Rasmus Lerchedahl Petersen
e253855999 Python: Add comment about reverse reads. 2021-01-26 12:11:21 +01:00
Rasmus Lerchedahl Petersen
e44f1813fa Python: Add TODO comment 2021-01-26 11:29:14 +01:00
Rasmus Lerchedahl Petersen
2c58643fd1 Python: Test for parameters without nodes. 2021-01-26 11:28:31 +01:00
CodeQL CI
c1726ed868 Merge pull request #5014 from RasmusWL/typetracking-test-track-self 
Approved by tausbn
 2021-01-26 02:10:52 -08:00
Rasmus Lerchedahl Petersen
7b9ca7171a Python: update test expectations 2021-01-26 09:47:48 +01:00
Rasmus Lerchedahl Petersen
dacc21d0b5 Python: update test expectation 2021-01-26 09:45:41 +01:00
yoff
09bb3001d6 Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2021-01-25 21:58:20 +01:00
yoff
7ba0939239 Merge pull request #4995 from RasmusWL/tornado-model-http-sinks 
Python: model HTTP sink in Tornado
 2021-01-25 21:53:44 +01:00
Rasmus Lerchedahl Petersen
96b7f75905 Python: add postupdate nodes for kwargs 
drops remaining reverse read failures on saltstack.
 2021-01-25 17:34:49 +01:00
Rasmus Wriedt Larsen
a8186be2fa Python: Add test of type-tracking self in methods 2021-01-25 17:20:11 +01:00
Rasmus Lerchedahl Petersen
ad39bfb2ff Python: Add postupdate nodes for subscripts. 
This drops reverse read inconsistencies on saltstack from 14909 to 1353.
 2021-01-25 17:01:25 +01:00
Rasmus Lerchedahl Petersen
361bee851a Python: Tests inspired by reverse read check 2021-01-25 17:01:25 +01:00
Rasmus Lerchedahl Petersen
4ff2c6d85a Python: fix test expectation 
probably a copy-paste error..
 2021-01-25 16:49:51 +01:00
Rasmus Lerchedahl Petersen
89e56707c3 Python: Omit all unresolved parameter nodes. 
Drops the results further to 139.
 2021-01-24 16:16:07 +01:00
Rasmus Lerchedahl Petersen
baf0917524 On saltstack this drops the number of consistency errors 
of type uniqueEnclosingCallable from 4026 to 614.
 2021-01-24 15:30:59 +01:00
Rasmus Lerchedahl Petersen
0d20a4cb4a Python: Simplify modelling 2021-01-22 19:40:34 +01:00
Rasmus Lerchedahl Petersen
f948ef8f27 Merge branch 'main' of github.com:github/codeql into python-dataflow-unpacking-assignment 2021-01-22 16:26:48 +01:00
Rasmus Wriedt Larsen
7a76a5134e Python: Add redirect modeling for Tornado 
After making https://github.com/github/codeql/pull/4995, I realized how easy
this would be :D

Will need to do some manual merge-conflict handling, but it should be all good
:)
 2021-01-21 14:04:11 +01:00
Rasmus Wriedt Larsen
2f86937e5a Python: Remove unused param in test code 2021-01-21 13:44:56 +01:00
Rasmus Wriedt Larsen
48083d657a Python: Apply code-review suggestion 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-01-21 13:40:58 +01:00
Rasmus Wriedt Larsen
ee2d18afd8 Merge pull request #4665 from yoff/python-dataflow-modernize-tests 
Python: Add new-style tests
 2021-01-21 13:35:39 +01:00
Rasmus Wriedt Larsen
b55817a5b2 Python: Model HTTP responses in tornado 
This is quite a simpel model, but ends up matching what we were able to do with
points-to.

I think this modeling excercise really shows that we need a bit of a different
way to model HTTP responses... but I'm not going to try to fix that in this PR.
 2021-01-21 13:26:31 +01:00
Rasmus Wriedt Larsen
ac77a8b8a8 Python: Add proper HTTP response tests for Tornado 2021-01-21 13:22:31 +01:00
Rasmus Lerchedahl Petersen
e786be06ae Python: Fix broken references 2021-01-21 12:40:35 +01:00