hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-02 00:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,380 Commits 1,817 Branches 172 Tags
temp-dca-python
Commit Graph

88380 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jaroslav Lobačevski
048884bb78 Remove redundant cast 2026-06-15 06:12:45 +00:00
Jaroslav Lobačevski
2eed6c1736 Fix dominates() false positive in reusable workflows 2026-06-15 05:42:59 +00:00
Owen Mansel-Chan
9c65082189 Fix MISSING alert 2026-06-15 00:14:52 +01:00
Owen Mansel-Chan
359e272577 Merge pull request #21979 from owen-mc/code-owners-rasmuswl 
Remove @RasmusWL from CODEOWNERS
 2026-06-14 23:50:05 +01:00
Chad Bentz
23567eba3d C#: Add change note for Razor Page handler flow sources 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:53:00 -04:00
Chad Bentz
ce9e61dbfd C#: Add Razor Page handler method parameters as remote flow sources 
ASP.NET Core Razor Page handler method parameters (OnGet, OnPost, etc.)
were not modeled as remote flow sources, causing security queries like
SQL injection to miss vulnerabilities in PageModel subclasses.

This adds AspNetCorePageHandlerMethodParameter, analogous to the existing
AspNetCoreActionMethodParameter for MVC controllers, using the existing
PageModelClass.getAHandlerMethod() from Razor.qll.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:50:12 -04:00
Owen Mansel-Chan
99538f0f07 Delete unused predicate (leftover from old implementation) 2026-06-12 22:21:07 +01:00
Owen Mansel-Chan
0dc95deca4 Test changes to investigate 2026-06-12 22:21:05 +01:00
Owen Mansel-Chan
0e902d0fe3 Fix captured variable liveness 
- Extend synthetic uncertain reads to function exits of any function
  that writes a captured variable, not just the declaring function.
  This ensures writes to captured variables inside closures remain
  live (matching the old `v.isCaptured()` liveness shortcut).
- Uncomment toString overrides for SsaExplicitDefinition, SsaVariableCapture,
  SsaPhiNode, and SsaVariable to restore original output formats.
- Revert test expected files to pre-test-changes state matching the
  correct toString formats and capture variable results.

Agent-Logs-Url: https://github.com/github/codeql/sessions/6dbf9d42-b2e2-42a2-984b-8ea31df4e633

Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
 2026-06-12 22:21:03 +01:00
copilot-swe-agent[bot]
6ccbf16f3c Make Go use the shared SSA library (codeql.ssa.Ssa) 
Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/codeql/sessions/b400ebd5-4095-401e-8811-fb550600b3c4
 2026-06-12 22:21:02 +01:00
Owen Mansel-Chan
7a5219f06e Improve SSA tests for variables in closures 2026-06-12 22:21:00 +01:00
copilot-swe-agent[bot]
7a991e17b8 Initial plan 2026-06-12 22:20:58 +01:00
Owen Mansel-Chan
0b493c30cc Preemptively change toString() for SSA classes 2026-06-12 22:20:51 +01:00
Owen Mansel-Chan
daefaff969 Merge pull request #21975 from github/dependabot/go_modules/go/extractor/extractor-dependencies-563a210b6d 
Bump golang.org/x/tools from 0.45.0 to 0.46.0 in /go/extractor in the extractor-dependencies group
 2026-06-12 22:04:57 +01:00
Owen Mansel-Chan
4bc083fd7f Remove confusing comments 2026-06-12 21:51:52 +01:00
Owen Mansel-Chan
89c1d66f90 Add SPURIOUS and MISSING alerts based on existing comments 2026-06-12 21:51:50 +01:00
Owen Mansel-Chan
b9670ef831 Merge pull request #21966 from owen-mc/java/convert-to-inline-expectation-tests 
Java: convert all qlref tests to inline expectation tests using postprocessing
 2026-06-12 21:48:49 +01:00
Asger F
6000c18c24 Unified: also QLDoc for unified.qll 2026-06-12 16:48:25 +02:00
Asger F
e81a3bcbc3 Unified: Add QLDoc 2026-06-12 16:47:06 +02:00
Asger F
7d6d5bfb4a Unified: add test for comments 2026-06-12 16:36:33 +02:00
Asger F
f83adb55ce Unified: regenerate AST 2026-06-12 16:33:51 +02:00
Asger F
5608369abe Extract trivia tokens from original parse tree 2026-06-12 16:32:57 +02:00
Michael Nebel
346d140c87 C#: Add change-note. 2026-06-12 15:33:49 +02:00
Michael Nebel
9f0feb467a C#: Add upgrade/downgrade scripts. 2026-06-12 15:26:16 +02:00
Owen Mansel-Chan
434a99447e Add thorough tests, including one MISSING alert 2026-06-12 13:45:02 +01:00
Owen Mansel-Chan
d389ea4039 Convert sql-injection test to inline expectations 2026-06-12 13:44:56 +01:00
Anders Schack-Mulligen
ff61344afa Cfg: Add support for until-statements. 2026-06-12 13:55:05 +02:00
Anders Schack-Mulligen
fe8c029ac7 Cfg: Add support for unless-statements. 2026-06-12 13:50:41 +02:00
Michael Nebel
8d46bfcbd4 C#: Update some of the QL docs. 2026-06-12 12:41:27 +02:00
Michael Nebel
f0640d78d2 C#: Deprecate the operation module. 2026-06-12 12:41:24 +02:00
Michael Nebel
fb9e4a8c40 C#: Move logical operation class from Operation.qll to LogicalOperation.qll. 2026-06-12 12:41:22 +02:00
Michael Nebel
3c407f77a9 C#: Update the QL library implementation for logical operations. 2026-06-12 12:41:19 +02:00
Michael Nebel
9465a1d063 C#: Update DB scheme for logical assignments and expressions (and some other minor changes). 2026-06-12 12:41:16 +02:00
Michael Nebel
072c4837d2 C#: Move bitwise operation classes from Operation.qll to BitwiseOperation.qll. 2026-06-12 12:41:14 +02:00
Michael Nebel
ee040da575 C#: Update test expected output. 2026-06-12 12:41:11 +02:00
Michael Nebel
524330c188 C#: Update the QL library implementation for Bitwise operations. 2026-06-12 12:41:09 +02:00
Michael Nebel
7d54669696 C#: Update DB scheme for bitwise assignments and expressions (and some other minor changes). 2026-06-12 12:41:06 +02:00
Michael Nebel
951a26a01a C#: Move arithmetic like classes from Operation.qll to ArithmeticOperation.qll. 2026-06-12 12:41:03 +02:00
Michael Nebel
2bbcc1e88c C#: Update the QL library implementation for Arithmetic operations. 2026-06-12 12:41:01 +02:00
Michael Nebel
d101e45efc C#: Update DB scheme for arithmetic assignments and expressions (and some other minor changes). 2026-06-12 12:40:58 +02:00
Anders Schack-Mulligen
912dc9c0bd Merge pull request #21955 from aschackmull/cfg/try-body-index 
Cfg: Fold getTryInit into indexed getBody.
 2026-06-12 11:36:25 +02:00
Owen Mansel-Chan
eea406f622 Remove @RasmusWL from CODEOWNERS 
He hasn't worked on CodeQL for a few years now. He
told me that he doesn't remember how these scripts
work.
 2026-06-12 10:33:37 +02:00
Owen Mansel-Chan
17b9a66895 Make alert coverage team the code owners for /actions/ 2026-06-12 10:17:12 +02:00
Owen Mansel-Chan
de7afcaec3 Merge pull request #21976 from JarLob/patch-1 
Update regex for GitHub hosted runner matching
 2026-06-12 09:09:40 +01:00
Anders Schack-Mulligen
f3ec7087e3 Cfg: Fix type. 2026-06-12 10:02:48 +02:00
Michael Nebel
0a0867a34f C#: Add change-note. 2026-06-12 10:01:13 +02:00
Michael Nebel
4f93dfbd6a C#: Update test expected output. 2026-06-12 10:01:10 +02:00
Michael Nebel
b280dd51f2 C#: Use the first getter/setter when calling a property (override can apply to only a getter or a setter). 2026-06-12 10:01:08 +02:00
Michael Nebel
d8e10b8c21 C#: Add some more properties test examples and update expected test output. 2026-06-12 10:01:05 +02:00
Michael Nebel
01b463f442 C#: Exclude function pointer calls for the DB isNotOk missing target. 2026-06-12 10:01:02 +02:00