hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-11 10:04:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,048 Commits 1,740 Branches 164 Tags
00a0b93172e552d0c6d391563cabecb5fd192697
Commit Graph

706 Commits

Author SHA1 Message Date
Arthur Baars
00a0b93172 Add erb file 2021-07-29 19:09:56 +02:00
Arthur Baars
cc1bdf1fc3 Add charpred to RubyFile class 2021-07-29 11:48:35 +02:00
Arthur Baars
dacd3f3d19 Update dbscheme stats 2021-07-27 18:43:51 +02:00
Arthur Baars
768a751271 Add upgrade script 2021-07-27 18:43:51 +02:00
Arthur Baars
866ff7b1f6 Replace Generated module with Ruby 2021-07-27 18:43:44 +02:00
Arthur Baars
02bf895a4a Update dbscheme type references 2021-07-27 18:42:21 +02:00
Arthur Baars
2e10f8f054 Prefix dbscheme entries with language name 2021-07-27 18:17:19 +02:00
Arthur Baars
fc8f5919f3 Remove Ruby specific parts from FileSystem.qll 2021-07-27 18:17:15 +02:00
Arthur Baars
3790611ca1 Merge pull request #233 from github/tausbn/bump-typetrackingnode-changes 
Bump `codeql` submodule
 2021-07-20 13:24:30 +02:00
Nick Rolfe
ce35d74447 Move comment so it's not treated as part of the precision metadata 2021-07-19 12:29:16 +01:00
Calum Grant
46a03795c2 Add security-severity metadata 2021-07-16 14:05:54 +01:00
Taus
258f85d6d0 Add defaultImplicitTaintRead 2021-07-15 15:52:59 +00:00
Taus
dc4d353a01 Bump shared dataflow library 2021-07-15 15:08:59 +00:00
Taus
ec645725f0 Bump codeql submodule 
Syncs up the shared type tracking implementation with Python.
 2021-07-15 14:35:33 +00:00
Tom Hvitved
42c06bfde4 Merge pull request #226 from github/hvitved/const-flow 
Data flow through constants
 2021-07-14 13:21:07 +02:00
Tom Hvitved
9463927409 Address review comments 2021-07-14 11:05:55 +02:00
Nick Rolfe
1fe5162b67 Stabilise node ordering for regexp parsing test 2021-07-13 16:18:21 +01:00
Tom Hvitved
23447e6d58 Reduce size of lookupMethodOrConst 2021-07-02 14:02:26 +02:00
Tom Hvitved
bf696df788 Data flow through constants 2021-07-02 14:02:26 +02:00
Tom Hvitved
3b6e5881c8 Update constants.rb test 2021-07-02 14:02:26 +02:00
Arthur Baars
5afd3c7846 Merge pull request #213 from github/aibaars/api-graphs2 
First version of ApiGraphs
 2021-07-02 13:58:00 +02:00
Tom Hvitved
330b33638e Address review comments 2021-07-02 10:41:10 +02:00
Tom Hvitved
52529d590b Model private methods and "main objects" 2021-07-02 10:41:06 +02:00
Tom Hvitved
9de4ed4d4d Add tests for private methods 2021-07-02 10:39:49 +02:00
Tom Hvitved
c3cff3e113 Expose call graph through Call::getATarget() 2021-07-01 16:40:45 +02:00
Nick Rolfe
d99b5510e5 Merge pull request #219 from github/regex 
Add regexp parser and exponential ReDoS query
 2021-06-30 17:23:29 +01:00
Alex Ford
3f76075fe6 improve some rails framework tests 2021-06-29 13:56:28 +01:00
Alex Ford
31cbf818ab fix rb/sql-injection FPs due to not accounting for overridden ActiveRecord methods 2021-06-29 13:54:15 +01:00
Nick Rolfe
97ae9ed181 Add more qldoc comments from Python version 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
 2021-06-29 11:22:47 +01:00
Tom Hvitved
20f239fd0a Improve performance of seqChild/4 
Gets rid of the following bad join-order
```
[2021-06-29 09:40:44] (5s) Starting to evaluate predicate RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3/5@i2#fe59dz (iteration 2)
[2021-06-29 09:46:34] (354s) Tuple counts for RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3/5@i2#fe59dz:
                      222277     ~0%     {5} r1 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.1 're', In.2 'start', In.3, 0, In.0 'result'
                      207749     ~3%     {4} r2 = JOIN r1 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.1 'start', 0, Lhs.4 'result'
                      11636      ~2%     {5} r3 = JOIN r2 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 2 OUTPUT 0, Lhs.3 'result', Lhs.0 're', Lhs.1 'start', Rhs.2 'end'

                      222277     ~0%     {4} r4 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.1 're', In.2 'start', In.3, In.0 'result'
                      207749     ~0%     {3} r5 = JOIN r4 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.1, Lhs.3 'result', Lhs.0 're'
                      902017671  ~2%     {3} r6 = JOIN r5 WITH RegExpTreeView::RegExpTerm#ffff#reorder_3_0_1_2#prev ON FIRST 1 OUTPUT Lhs.2 're', Lhs.1 'result', Rhs.1
                      1193975963 ~2%     {5} r7 = JOIN r6 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 1 OUTPUT Lhs.0 're', Rhs.1, Rhs.2 'end', Lhs.2, Lhs.1 'result'
                      0          ~0%     {6} r8 = JOIN r7 WITH RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev ON FIRST 4 OUTPUT Lhs.4 'result', Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Rhs.4 're', (1 + Rhs.4 're')
                      0          ~0%     {6} r9 = SELECT r8 ON In.5 'i' > 0
                      0          ~0%     {5} r10 = SCAN r9 OUTPUT In.5 'i', In.0 'result', In.1 're', In.2 'start', In.3 'end'

                      11636      ~2%     {5} r11 = r3 UNION r10

                      222277     ~3%     {2} r12 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.3, In.0 'result'
                      961948702  ~4%     {5} r13 = JOIN r12 WITH RegExpTreeView::RegExpTerm#ffff#reorder_2_1_0_3#prev ON FIRST 1 OUTPUT Rhs.1 're', Lhs.0, Rhs.3, Lhs.1, Rhs.2 'result'
                      902017671  ~0%     {3} r14 = JOIN r13 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.3, Lhs.4 'result'
                      1193975963 ~2%     {5} r15 = JOIN r14 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 1 OUTPUT Lhs.0 're', Rhs.1, Rhs.2 'end', Lhs.1, Lhs.2 'result'
                      0          ~0%     {6} r16 = JOIN r15 WITH RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev ON FIRST 4 OUTPUT Lhs.4 'result', Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Rhs.4 're', (1 + Rhs.4 're')
                      0          ~0%     {6} r17 = SELECT r16 ON In.5 'i' > 0
                      0          ~0%     {5} r18 = SCAN r17 OUTPUT In.5 'i', In.0 'result', In.1 're', In.2 'start', In.3 'end'

                      0          ~0%     {5} r19 = SCAN RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev_delta OUTPUT In.0 're', In.1 'start', In.2 'end', In.4, In.3
                      0          ~0%     {6} r20 = JOIN r19 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Lhs.3, Lhs.4, (1 + Lhs.3)
                      0          ~0%     {6} r21 = SELECT r20 ON In.5 'i' > 0
                      0          ~0%     {5} r22 = SCAN r21 OUTPUT In.4, In.0 're', In.1 'start', In.2 'end', In.5 'i'
                      0          ~0%     {5} r23 = JOIN r22 WITH RegExpTreeView::RegExpTerm#ffff#prev ON FIRST 1 OUTPUT Rhs.3, Lhs.1 're', Lhs.2 'start', Lhs.3 'end', Lhs.4 'i'
                      0          ~0%     {7} r24 = JOIN r23 WITH RegExpTreeView::RegExpTerm#ffff#reorder_2_1_0_3#prev ON FIRST 2 OUTPUT Lhs.1 're', Lhs.0, Rhs.3, Lhs.2 'start', Lhs.3 'end', Lhs.4 'i', Rhs.2 'result'
                      0          ~0%     {5} r25 = JOIN r24 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.5 'i', Lhs.6 'result', Lhs.0 're', Lhs.3 'start', Lhs.4 'end'

                      0          ~0%     {5} r26 = r18 UNION r25
                      11636      ~2%     {5} r27 = r11 UNION r26
                      11636      ~2%     {5} r28 = r27 AND NOT RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev(Lhs.2 're', Lhs.3 'start', Lhs.4 'end', Lhs.1 'result', Lhs.0 'i')
                      11636      ~0%     {5} r29 = SCAN r28 OUTPUT In.2 're', In.3 'start', In.4 'end', In.1 'result', In.0 'i'
                                         return r29
```
 2021-06-29 09:57:23 +02:00
Nick Rolfe
ba7021086b Merge remote-tracking branch 'origin/main' into regex 2021-06-25 15:00:26 +01:00
Nick Rolfe
bee94757dd Add query test for ReDoS.ql, ported from JS 2021-06-25 12:51:35 +01:00
Nick Rolfe
6142029fdc Recognise \t as not escaping t 2021-06-25 12:46:25 +01:00
Nick Rolfe
a77e7761fd Make \h and \H character class escapes 2021-06-25 12:27:39 +01:00
Nick Rolfe
a5dff79e51 Fix locations of regexp nodes in AST viewer 2021-06-25 12:00:38 +01:00
Arthur Baars
efde1f86d9 Fix test case 2021-06-25 10:59:10 +02:00
Alex Ford
2a7d8bbc0a Apply suggestions from code review 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 19:43:35 +01:00
Nick Rolfe
9ec503a3a5 Merge remote-tracking branch 'origin/main' into regex 2021-06-24 18:16:13 +01:00
Alex Ford
a45366e426 remove unnecessary ExprNodes prefix 2021-06-24 18:12:26 +01:00
Alex Ford
b27891b14e update ActiveRecord test output 2021-06-24 18:12:26 +01:00
Alex Ford
1f5a5181b9 StringInterpolationComponentCfgNode extends ExprNodes::StmtSequenceCfgNode 2021-06-24 18:12:26 +01:00
Alex Ford
a4a8f17a54 Update ql/src/codeql_ruby/dataflow/BarrierGuards.qll 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 18:12:26 +01:00
Alex Ford
9883a9b606 update SqlInjection tests 2021-06-24 18:12:26 +01:00
Alex Ford
d62f4f5bd4 Address review comments 2021-06-24 18:12:26 +01:00
Alex Ford
bc5a1b86ff Fix handling of arrays passed to ActiveRecord SQL methods 2021-06-24 18:12:26 +01:00
Alex Ford
fc8db88b66 Apply suggestions from code review 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 18:12:25 +01:00
Alex Ford
7415503772 update ActiveRecord test output 2021-06-24 18:12:25 +01:00
Alex Ford
12e4c9ee90 update SqlInjection tests 2021-06-24 18:12:25 +01:00
Alex Ford
734fe01867 Support named :conditions parameter to some SQL executing ActiveRecord calls 2021-06-24 18:12:25 +01:00
Alex Ford
91bde8d85d Support ActiveRecord SQL executing calls where there is a self receiver (implicit or explicit) 2021-06-24 18:12:25 +01:00