hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
84,738 Commits 1,672 Branches 157 Tags
tausbn/python-add-models-for-zstd-compression
Commit Graph

4944 Commits

Author SHA1 Message Date
Nick Rolfe
7d0bfe8f98 Merge pull request #10531 from github/nickrolfe/title-case 
Ruby: use consistent capitalization with `import ... as`
 2022-09-22 12:05:44 +01:00
Nick Rolfe
df8a182ac2 Ruby: use consistent capitalization with import ... as 2022-09-22 11:13:41 +01:00
Nick Rolfe
ee34ac5394 Merge pull request #10512 from github/nickrolfe/hash_from_trusted_xml 
Ruby: add Hash.from_trusted_xml as an unsafe deserialization sink
 2022-09-22 10:59:49 +01:00
Tom Hvitved
ac594842c8 Merge pull request #10504 from hvitved/ruby/private-methods 
Ruby: Two fixes for `private` methods
 2022-09-22 11:54:28 +02:00
Tom Hvitved
10a584ffb9 Merge pull request #10517 from hvitved/ruby/regexp-debug 
Ruby: Add query for debugging regexp flow
 2022-09-22 11:50:50 +02:00
Tom Hvitved
47411e3548 Ruby: Add query for debugging regexp flow 2022-09-21 19:22:10 +02:00
Andrew Eisenberg
99e8cb78b0 Merge pull request #10496 from aeisenberg/aeisenberg/merge-rc3.7-into-main 
Aeisenberg/merge rc3.7 into main
 2022-09-21 08:09:47 -07:00
Alex Ford
260db1aea2 Ruby: drop getAQualifiedName predicate from ConstantAccess 2022-09-21 14:28:43 +01:00
Alex Ford
3bbb166642 Ruby: handle block param types more neatly 2022-09-21 13:52:19 +01:00
Nick Rolfe
2edbc16829 Ruby: add Hash.from_trusted_xml as an unsafe deserialization sink 2022-09-21 13:01:21 +01:00
Tom Hvitved
61e9c6f658 Ruby: Fix call graph for overridden private methods 2022-09-21 14:00:17 +02:00
Tom Hvitved
e7649fc61a Ruby: Fix ModuleBase::get(A)Method for private methods 2022-09-21 14:00:17 +02:00
Tom Hvitved
37a2b7d0b3 Ruby: Add more call graph tests for private methods 2022-09-21 14:00:17 +02:00
Tom Hvitved
a9f2e5272f Merge pull request #10376 from hvitved/ruby/no-ast-by-default 
Ruby: Do not expose AST layer through `ruby.qll`
 2022-09-21 13:15:30 +02:00
Tom Hvitved
0064451ff0 Merge pull request #10491 from hvitved/ruby/fix-bad-join 
Ruby: Fix bad join-order
 2022-09-21 11:13:09 +02:00
Tom Hvitved
59caa977d0 Ruby: Add post-update nodes for compound arguments 2022-09-21 11:02:24 +02:00
Tom Hvitved
1f4573cf25 Ruby: Add more field flow tests 2022-09-21 10:32:38 +02:00
Erik Krogh Kristensen
7e17a919ae Merge pull request #10304 from erik-krogh/rb-followMsg 
RB: make the alert messages of taint-tracking queries more consistent
 2022-09-20 22:58:31 +02:00
Andrew Eisenberg
58e4861b45 Merge branch 'main' into rc/3.7 2022-09-20 12:43:20 -07:00
Harry Maclean
d9487a07b1 Ruby: Make helper predicate private 2022-09-20 15:55:35 +01:00
Harry Maclean
6d3f87f610 Ruby: Small fixes 2022-09-20 15:55:35 +01:00
Harry Maclean
bc1723c0ee Fix typos 2022-09-20 15:55:35 +01:00
Harry Maclean
cdc640b544 Revert "Ruby: Allow custom edges in API graph EntryPoints" 
This reverts commit ab061fb1e1d21877fc817c4c66b48fb2d3650fa8.
 2022-09-20 15:55:35 +01:00
Harry Maclean
d5ef853343 Ruby: Remove ActiveStorage entry points 2022-09-20 15:55:35 +01:00
Harry Maclean
54b05e48a9 Ruby: Add change note 2022-09-20 15:55:35 +01:00
Harry Maclean
d68674a660 Ruby: disable problematic MaD path 2022-09-20 15:55:35 +01:00
Harry Maclean
ba5cd08a09 Update ActionController fixture 2022-09-20 15:55:35 +01:00
Harry Maclean
c97fadd7a3 Fix version number. 2022-09-20 15:55:35 +01:00
Harry Maclean
24b582d77a Add missing QLDoc 2022-09-20 15:55:34 +01:00
Harry Maclean
96a34c3690 QL4QL fix 2022-09-20 15:55:34 +01:00
Harry Maclean
53a34174b9 Model ActiveStorage 2022-09-20 15:55:34 +01:00
Harry Maclean
39a1cf5bd8 Ruby: Allow custom edges in API graph EntryPoints 2022-09-20 15:55:34 +01:00
Tom Hvitved
2677ab6b19 Ruby: Fix bad join-order 
Before
```
Evaluated relational algebra for predicate Module#fe82a56b::lookupMethodOrConst0#2#fff#antijoin_rhs@e23c32nf with tuple counts:
          118006   ~0%    {3} r1 = SCAN Module#fe82a56b::getMethodOrConst#2#fff OUTPUT In.1, In.0, In.2
        35267848   ~3%    {4} r2 = JOIN r1 WITH project#Module#fe82a56b::getMethodOrConst#2#fff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Lhs.2, Rhs.1
           21883   ~0%    {5} r3 = JOIN r2 WITH Module#fe82a56b::Cached::getAPrependedModule#1#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.3, Lhs.0, Lhs.1, Lhs.2
               7  ~16%    {3} r4 = JOIN r3 WITH Module#fe82a56b::getAncestors#1#ff ON FIRST 2 OUTPUT Lhs.2, Lhs.3, Lhs.4
                          return r4
```

After
```
Evaluated relational algebra for predicate Module#fe82a56b::lookupMethodOrConst0#2#fff#antijoin_rhs@839f6a1k with tuple counts:
        118006  ~1%    {3} r1 = SCAN Module#fe82a56b::getMethodOrConst#2#fff OUTPUT In.0, In.2, In.1
           151  ~0%    {4} r2 = JOIN r1 WITH Module#fe82a56b::Cached::getAPrependedModule#1#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.0, Lhs.1, Lhs.2
           155  ~1%    {4} r3 = JOIN r2 WITH Module#fe82a56b::getAncestors#1#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.3, Lhs.1, Lhs.2
             7  ~0%    {3} r4 = JOIN r3 WITH project#Module#fe82a56b::getMethodOrConst#2#fff ON FIRST 2 OUTPUT Lhs.2, Lhs.3, Lhs.1
                       return r4
```
 2022-09-20 16:24:39 +02:00
Tom Hvitved
647397759e Merge pull request #10336 from hvitved/ruby/call-graph-rework 
Ruby: Rework call graph implementation
 2022-09-20 15:29:40 +02:00
Nick Rolfe
30b54b2abe Merge pull request #10450 from github/nickrolfe/filesystemresolver 
Ruby: model ActionView::FileSystemResolver as a FileSystemAccess
 2022-09-20 14:21:28 +01:00
Asger F
51618b46a8 Sync ApiGraphModels.qll 2022-09-20 11:47:37 +02:00
Alex Ford
7720d85c98 Ruby: use camelcase verion of Http module 2022-09-20 08:58:35 +01:00
Alex Ford
52305da5a3 Ruby: move string getAQualifiedName() up to ConstantAccess 2022-09-19 21:03:05 +01:00
Alex Ford
d00c9ea2c8 Ruby: RBI library improvements, mostly for parameter types 2022-09-19 21:03:05 +01:00
Alex Ford
8d264e7e65 Ruby: add ConstanReadAcess#getAQualifiedName() predicate 2022-09-19 21:03:05 +01:00
Alex Ford
be1ac17a60 Merge branch 'main' into rb/sensitive-get-query 2022-09-19 20:57:20 +01:00
erik-krogh
0645b11cb1 ruby: remove unused predicate from NfaUtilsSpecific 2022-09-19 15:25:00 +02:00
Tom Hvitved
bb08e6f0fd Ruby: Three call graph fixes for singleton methods 2022-09-19 14:20:12 +02:00
Tom Hvitved
d13332cff1 Ruby: Add more call graph tests 2022-09-19 14:19:25 +02:00
Erik Krogh Kristensen
a4cd913aea Merge pull request #10312 from erik-krogh/fix-caseDiff 
ensure consistent casing of names
 2022-09-19 10:43:12 +02:00
Tom Hvitved
a8cc669251 Ruby: Address review comments 2022-09-18 19:34:54 +02:00
Tom Hvitved
9004e82820 Ruby: Add another call graph test 2022-09-18 19:34:00 +02:00
Tom Hvitved
29bfb4d185 Ruby: Revert changes to isLocalSourceNode and localFlowStepTypeTracker 
Instead, use small-step type tracking, as suggested by @rasmuswl offline.
 2022-09-16 19:38:26 +02:00
Alex Ford
08c8db8937 Ruby: stop rb/sensitive-get-query from considering ID type data as sensitive 2022-09-16 15:40:13 +01:00
Alex Ford
79ad7d293f Ruby: make SensitiveExpr a dataflow node rather than an Expr 2022-09-16 15:39:16 +01:00