hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-11 18:14:01 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,048 Commits 1,740 Branches 164 Tags
00a0b93172e552d0c6d391563cabecb5fd192697
Commit Graph

1048 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Arthur Baars
00a0b93172 Add erb file 2021-07-29 19:09:56 +02:00
Arthur Baars
c568162256 Use a single TrapWriter 
The output of two distinct TrapWriters should not be written to the
same TRAP file because this causes name clashes between TRAP labels.
 2021-07-29 12:50:27 +02:00
Arthur Baars
cc1bdf1fc3 Add charpred to RubyFile class 2021-07-29 11:48:35 +02:00
Arthur Baars
fcf2d4cbd2 Apply suggestions from code review 
Co-authored-by: Nick Rolfe <nickrolfe@github.com>
 2021-07-29 09:02:57 +02:00
Arthur Baars
dacd3f3d19 Update dbscheme stats 2021-07-27 18:43:51 +02:00
Arthur Baars
4d18ec226a Fix dataset_measure.yml 2021-07-27 18:43:51 +02:00
Arthur Baars
38eb6c112f Add ERB extraction 2021-07-27 18:43:51 +02:00
Arthur Baars
768a751271 Add upgrade script 2021-07-27 18:43:51 +02:00
Arthur Baars
866ff7b1f6 Replace Generated module with Ruby 2021-07-27 18:43:44 +02:00
Arthur Baars
02bf895a4a Update dbscheme type references 2021-07-27 18:42:21 +02:00
Arthur Baars
2e10f8f054 Prefix dbscheme entries with language name 2021-07-27 18:17:19 +02:00
Arthur Baars
fe868e4c05 Ruby-Generator: add --dbscheme and --library flags 2021-07-27 18:17:19 +02:00
Arthur Baars
fc8f5919f3 Remove Ruby specific parts from FileSystem.qll 2021-07-27 18:17:15 +02:00
Arthur Baars
3790611ca1 Merge pull request #233 from github/tausbn/bump-typetrackingnode-changes 
Bump `codeql` submodule
 2021-07-20 13:24:30 +02:00
Nick Rolfe
8d21f95ffc Merge pull request #235 from github/comment_fix 
Move comment so it's not treated as part of the precision metadata
 2021-07-19 12:39:13 +01:00
Nick Rolfe
ce35d74447 Move comment so it's not treated as part of the precision metadata 2021-07-19 12:29:16 +01:00
Calum Grant
8d71d09b94 Merge pull request #234 from github/calumgrant/security-severities 
Add security-severity metadata
 2021-07-16 15:40:03 +01:00
Calum Grant
46a03795c2 Add security-severity metadata 2021-07-16 14:05:54 +01:00
Taus
258f85d6d0 Add defaultImplicitTaintRead 2021-07-15 15:52:59 +00:00
Taus
dc4d353a01 Bump shared dataflow library 2021-07-15 15:08:59 +00:00
Taus
ec645725f0 Bump codeql submodule 
Syncs up the shared type tracking implementation with Python.
 2021-07-15 14:35:33 +00:00
Tom Hvitved
42c06bfde4 Merge pull request #226 from github/hvitved/const-flow 
Data flow through constants
 2021-07-14 13:21:07 +02:00
Tom Hvitved
9463927409 Address review comments 2021-07-14 11:05:55 +02:00
Arthur Baars
64a55ba6cf Merge pull request #232 from github/regexp_test_order 
Stabilise node ordering for regexp parsing test
 2021-07-13 17:36:21 +02:00
Nick Rolfe
1fe5162b67 Stabilise node ordering for regexp parsing test 2021-07-13 16:18:21 +01:00
Tom Hvitved
23447e6d58 Reduce size of lookupMethodOrConst 2021-07-02 14:02:26 +02:00
Tom Hvitved
bf696df788 Data flow through constants 2021-07-02 14:02:26 +02:00
Tom Hvitved
3b6e5881c8 Update constants.rb test 2021-07-02 14:02:26 +02:00
Arthur Baars
0eae89a41b Merge pull request #228 from github/qhelp 
QHelp preview
 2021-07-02 14:00:51 +02:00
Arthur Baars
5afd3c7846 Merge pull request #213 from github/aibaars/api-graphs2 
First version of ApiGraphs
 2021-07-02 13:58:00 +02:00
Arthur Baars
48ad0aa1ee Escape file paths 2021-07-02 13:51:22 +02:00
Arthur Baars
b2ba8e664c Handle .inc.qhelp files 2021-07-02 13:32:43 +02:00
Arthur Baars
20570eb1d1 QHelp preview 2021-07-02 13:10:51 +02:00
Tom Hvitved
703e9e726d Merge pull request #225 from github/hvitved/private-methods 
Model private methods and "main objects"
 2021-07-02 11:02:41 +02:00
Tom Hvitved
330b33638e Address review comments 2021-07-02 10:41:10 +02:00
Tom Hvitved
52529d590b Model private methods and "main objects" 2021-07-02 10:41:06 +02:00
Tom Hvitved
9de4ed4d4d Add tests for private methods 2021-07-02 10:39:49 +02:00
Tom Hvitved
8de1eedb41 Merge pull request #227 from github/hvitved/expose-call-graph 2021-07-01 18:29:14 +02:00
Tom Hvitved
c3cff3e113 Expose call graph through Call::getATarget() 2021-07-01 16:40:45 +02:00
Nick Rolfe
d99b5510e5 Merge pull request #219 from github/regex 
Add regexp parser and exponential ReDoS query
 2021-06-30 17:23:29 +01:00
Alex Ford
7cc6b3a7b0 Merge pull request #224 from github/sqli-override-fp 
rb/sql-injection: fix FPs stemming from not accounting for overridden methods
 2021-06-30 17:20:14 +01:00
Alex Ford
3f76075fe6 improve some rails framework tests 2021-06-29 13:56:28 +01:00
Alex Ford
31cbf818ab fix rb/sql-injection FPs due to not accounting for overridden ActiveRecord methods 2021-06-29 13:54:15 +01:00
Nick Rolfe
97ae9ed181 Add more qldoc comments from Python version 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
 2021-06-29 11:22:47 +01:00
Tom Hvitved
20f239fd0a Improve performance of seqChild/4 
Gets rid of the following bad join-order
```
[2021-06-29 09:40:44] (5s) Starting to evaluate predicate RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3/5@i2#fe59dz (iteration 2)
[2021-06-29 09:46:34] (354s) Tuple counts for RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3/5@i2#fe59dz:
                      222277     ~0%     {5} r1 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.1 're', In.2 'start', In.3, 0, In.0 'result'
                      207749     ~3%     {4} r2 = JOIN r1 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.1 'start', 0, Lhs.4 'result'
                      11636      ~2%     {5} r3 = JOIN r2 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 2 OUTPUT 0, Lhs.3 'result', Lhs.0 're', Lhs.1 'start', Rhs.2 'end'

                      222277     ~0%     {4} r4 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.1 're', In.2 'start', In.3, In.0 'result'
                      207749     ~0%     {3} r5 = JOIN r4 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.1, Lhs.3 'result', Lhs.0 're'
                      902017671  ~2%     {3} r6 = JOIN r5 WITH RegExpTreeView::RegExpTerm#ffff#reorder_3_0_1_2#prev ON FIRST 1 OUTPUT Lhs.2 're', Lhs.1 'result', Rhs.1
                      1193975963 ~2%     {5} r7 = JOIN r6 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 1 OUTPUT Lhs.0 're', Rhs.1, Rhs.2 'end', Lhs.2, Lhs.1 'result'
                      0          ~0%     {6} r8 = JOIN r7 WITH RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev ON FIRST 4 OUTPUT Lhs.4 'result', Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Rhs.4 're', (1 + Rhs.4 're')
                      0          ~0%     {6} r9 = SELECT r8 ON In.5 'i' > 0
                      0          ~0%     {5} r10 = SCAN r9 OUTPUT In.5 'i', In.0 'result', In.1 're', In.2 'start', In.3 'end'

                      11636      ~2%     {5} r11 = r3 UNION r10

                      222277     ~3%     {2} r12 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.3, In.0 'result'
                      961948702  ~4%     {5} r13 = JOIN r12 WITH RegExpTreeView::RegExpTerm#ffff#reorder_2_1_0_3#prev ON FIRST 1 OUTPUT Rhs.1 're', Lhs.0, Rhs.3, Lhs.1, Rhs.2 'result'
                      902017671  ~0%     {3} r14 = JOIN r13 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.3, Lhs.4 'result'
                      1193975963 ~2%     {5} r15 = JOIN r14 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 1 OUTPUT Lhs.0 're', Rhs.1, Rhs.2 'end', Lhs.1, Lhs.2 'result'
                      0          ~0%     {6} r16 = JOIN r15 WITH RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev ON FIRST 4 OUTPUT Lhs.4 'result', Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Rhs.4 're', (1 + Rhs.4 're')
                      0          ~0%     {6} r17 = SELECT r16 ON In.5 'i' > 0
                      0          ~0%     {5} r18 = SCAN r17 OUTPUT In.5 'i', In.0 'result', In.1 're', In.2 'start', In.3 'end'

                      0          ~0%     {5} r19 = SCAN RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev_delta OUTPUT In.0 're', In.1 'start', In.2 'end', In.4, In.3
                      0          ~0%     {6} r20 = JOIN r19 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Lhs.3, Lhs.4, (1 + Lhs.3)
                      0          ~0%     {6} r21 = SELECT r20 ON In.5 'i' > 0
                      0          ~0%     {5} r22 = SCAN r21 OUTPUT In.4, In.0 're', In.1 'start', In.2 'end', In.5 'i'
                      0          ~0%     {5} r23 = JOIN r22 WITH RegExpTreeView::RegExpTerm#ffff#prev ON FIRST 1 OUTPUT Rhs.3, Lhs.1 're', Lhs.2 'start', Lhs.3 'end', Lhs.4 'i'
                      0          ~0%     {7} r24 = JOIN r23 WITH RegExpTreeView::RegExpTerm#ffff#reorder_2_1_0_3#prev ON FIRST 2 OUTPUT Lhs.1 're', Lhs.0, Rhs.3, Lhs.2 'start', Lhs.3 'end', Lhs.4 'i', Rhs.2 'result'
                      0          ~0%     {5} r25 = JOIN r24 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.5 'i', Lhs.6 'result', Lhs.0 're', Lhs.3 'start', Lhs.4 'end'

                      0          ~0%     {5} r26 = r18 UNION r25
                      11636      ~2%     {5} r27 = r11 UNION r26
                      11636      ~2%     {5} r28 = r27 AND NOT RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev(Lhs.2 're', Lhs.3 'start', Lhs.4 'end', Lhs.1 'result', Lhs.0 'i')
                      11636      ~0%     {5} r29 = SCAN r28 OUTPUT In.2 're', In.3 'start', In.4 'end', In.1 'result', In.0 'i'
                                         return r29
```
 2021-06-29 09:57:23 +02:00
Nick Rolfe
ba7021086b Merge remote-tracking branch 'origin/main' into regex 2021-06-25 15:00:26 +01:00
Nick Rolfe
bee94757dd Add query test for ReDoS.ql, ported from JS 2021-06-25 12:51:35 +01:00
Nick Rolfe
6142029fdc Recognise \t as not escaping t 2021-06-25 12:46:25 +01:00
Nick Rolfe
a77e7761fd Make \h and \H character class escapes 2021-06-25 12:27:39 +01:00
Nick Rolfe
a5dff79e51 Fix locations of regexp nodes in AST viewer 2021-06-25 12:00:38 +01:00