hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 09:13:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
82,275 Commits 1,671 Branches 157 Tags
tausbn/python-refine-location-of-flask-request-sources
Commit Graph

3153 Commits

Author SHA1 Message Date
Anders Schack-Mulligen
f833fe0e6e Merge pull request #20300 from aschackmull/cfg/successortype 
Shared: Add a shared SuccessorType implementation
 2025-09-02 14:09:35 +02:00
Michael Nebel
2a932f0748 Merge pull request #20328 from michaelnebel/java/ql4ql 
Java: Fix some Ql4Ql violations.
 2025-09-02 12:01:16 +02:00
Michael Nebel
77113b2e42 Java: Fix some Ql4Ql violations. 2025-09-01 15:04:08 +02:00
Anders Schack-Mulligen
4e70627629 Guards: Use shared SuccessorType. 2025-09-01 13:55:29 +02:00
Anders Schack-Mulligen
144e34c669 Shared: Use shared SuccessorType in shared Cfg and BasicBlock libs. 2025-09-01 13:43:32 +02:00
Anders Schack-Mulligen
4685b4f8a9 Java: Use shared SuccessorType. 2025-09-01 13:00:20 +02:00
Anders Schack-Mulligen
09b2c5abf0 BasicBlock: Replace entryBlock predicate with subclass. 2025-09-01 11:48:44 +02:00
Anders Schack-Mulligen
3821f172df Guards/Java: Use BasicBlock signature in Guards library. 2025-09-01 11:26:36 +02:00
Anders Schack-Mulligen
f459ddc40a Languages: Adapt to api changes. 2025-09-01 11:26:33 +02:00
Anders Schack-Mulligen
bb3abc815f SSA: Update input to use member predicates. 2025-09-01 11:19:48 +02:00
Jami
3675e4bb4f Merge branch 'main' into jcogs33/java/insecure-spring-actuator-config-promotion 2025-08-26 08:02:17 -04:00
Anders Schack-Mulligen
f2352f76c0 Java: Teach guards that exceptions in catch-clauses are non-null. 2025-08-22 10:16:42 +02:00
Anders Schack-Mulligen
02452704b2 Java: Fix bug in nullness 2025-08-22 10:15:22 +02:00
Anders Schack-Mulligen
492a5ca087 Java: Add some more exception edges to the CFG to facilitate guard wrappers. 2025-08-08 10:40:07 +02:00
Anders Schack-Mulligen
e94f018e14 Kotlin: Support kotlin Throws annotations. 2025-08-08 10:28:58 +02:00
Anders Schack-Mulligen
3b3f4bc782 Java/Guards: Remove unused. 2025-08-07 15:43:00 +02:00
Anders Schack-Mulligen
b19f15b3aa Java: Simplify ArithmeticCommon using BarrierGuards. 2025-08-07 15:43:00 +02:00
Anders Schack-Mulligen
9957cbe656 Java/Guards: Improve BarrierGuards to include validate(x = ...) checks. 2025-08-07 15:42:59 +02:00
Anders Schack-Mulligen
a04ff18ba4 Java: Enable validation wrappers in BarrierGuards. 2025-08-07 15:42:59 +02:00
Anders Schack-Mulligen
f90b6ab005 Guards: Add support for wrappers that may throw exceptions. 2025-08-07 14:51:48 +02:00
Anders Schack-Mulligen
0c31a80f3c Guards: Generalise wrapper guards. 2025-08-07 14:51:47 +02:00
Anders Schack-Mulligen
1bdaa2420d Java: Simplify Guards instantiation a bit. 2025-08-07 14:51:46 +02:00
Anders Schack-Mulligen
3aaf48de11 Guards: Remove CustomGuard nesting in Guards instantiation. 2025-08-07 14:51:46 +02:00
Anders Schack-Mulligen
94274288d3 Merge pull request #20127 from aschackmull/java/joinorder3 
Java: Improve a couple of join-orders
 2025-08-05 14:15:42 +02:00
Anders Schack-Mulligen
0a27a8c255 Java: Assume normal termination in post-dominance. 2025-08-04 15:08:26 +02:00
Anders Schack-Mulligen
5ca9c090a8 Merge pull request #20132 from aschackmull/ssa/guardvalue 
SSA: Update data flow integration and BarrierGuard interface to use GuardValue.
 2025-07-30 12:23:17 +02:00
idrissrio
ac52a1b123 Java: Move extractorInformationSkipKey predicate to library pack 2025-07-29 09:45:18 +02:00
Anders Schack-Mulligen
3b8234ecec SSA: Update data flow integration and BarrierGuard interface to use GuardValue. 2025-07-28 11:29:12 +02:00
Anders Schack-Mulligen
6c8275298b Java: Improve ObjFlow performance. 2025-07-25 14:41:06 +02:00
Anders Schack-Mulligen
5ca35afb8c Java: Improve joinorder in getErasedRepr. 2025-07-25 13:34:11 +02:00
Nora Dimitrijević
fbee6bbe21 Merge pull request #20077 from d10c/d10c/diff-informed-phase-3-java 
Java: Diff-informed queries: phase 3 (non-trivial locations)
 2025-07-21 11:23:12 +02:00
Anders Schack-Mulligen
937e3dc469 Merge pull request #20091 from aschackmull/java/fix-cfg-cp-assert 
Java: Fix accidental CP in CFG for asserts.
 2025-07-21 09:07:19 +02:00
Jami Cogswell
0dd33b2734 Java: remove version debugging from alert message 2025-07-19 13:01:00 -04:00
Jami Cogswell
7250265c1f Java: consider all endpoints except for health and info as sensitive to align with Spring docs 2025-07-18 17:50:18 -04:00
Jami Cogswell
685f68d9d3 Java: support 'management.endpoints.web.expose' property 2025-07-18 17:50:17 -04:00
Jami Cogswell
7d5e939a86 Java: minor refactoring 2025-07-18 17:50:09 -04:00
Jami Cogswell
ea35fbbe3b Java: support version 3.x 2025-07-18 17:50:07 -04:00
Anders Schack-Mulligen
d64a9368d2 Merge pull request #20088 from aschackmull/java/joinorders1 
Java: Improve several join-orders
 2025-07-18 14:54:26 +02:00
Anders Schack-Mulligen
bc2e7d4e0d Java: Fix accidental CP in CFG for asserts. 2025-07-18 13:53:15 +02:00
Anders Schack-Mulligen
d9f47bdec9 Java: Improve join-order by properly annotating haveIntersection. 2025-07-18 11:48:50 +02:00
Anders Schack-Mulligen
12732525b5 Java: Allow 2-column join on delta to improve join-order. 2025-07-18 11:45:45 +02:00
Jami Cogswell
0d2a4222fd Java: add related location to alert message 2025-07-17 19:22:18 -04:00
Jami Cogswell
ae163a9f36 Java: add overlay annotations 2025-07-17 19:22:17 -04:00
Jami Cogswell
2bfc4b4ee2 Java: fix test case for version 1.4 
Need the existence of an ApplicationProperties File, not an ApplicationProperties ConfigPair
 2025-07-17 19:22:15 -04:00
Jami Cogswell
1b90a30d45 Java: move code to .qll file 2025-07-17 19:22:11 -04:00
Nora Dimitrijević
24c28ed873 [DIFF-INFORMED] Java: UnsafeCertTrust 
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-273/UnsafeCertTrust.ql#L21
 2025-07-17 19:02:13 +02:00
Nora Dimitrijević
ea4af8323c [DIFF-INFORMED] Java: TrustBoundaryViolation 
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-501/TrustBoundaryViolation.ql#L18
 2025-07-17 19:02:09 +02:00
Nora Dimitrijević
7888dcbce2 [DIFF-INFORMED] Java: TempDirLocalInformationDisclosure 
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql#L56
 2025-07-17 19:02:07 +02:00
Nora Dimitrijević
3785dbec9e [DIFF-INFORMED] Java: TaintedEnvironmentVariable 
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironment.ql#L22
 2025-07-17 19:02:05 +02:00
Nora Dimitrijević
b3b139bb02 [DIFF-INFORMED] Java: SqlConcatenated 
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-089/SqlConcatenated.ql#L27
 2025-07-17 19:02:04 +02:00