Mathias Vorreiter Pedersen
00a940fd58
Merge pull request #16524 from catenacyber/deref-null-result
...
Adds another rule for null deref
2024-05-22 12:37:39 +01:00
Alex Ford
8119a27540
Merge pull request #16185 from alexrford/rb/conditions-arr0
...
Ruby: ActiveRecord - refine `conditions` argument as an SQLi sink
2024-05-22 12:19:10 +01:00
Tom Hvitved
a006c29a00
Merge pull request #16481 from hvitved/treesitter/bump2
...
Tree-sitter: Bump to 0.22.6
2024-05-22 12:53:14 +02:00
Anders Schack-Mulligen
a078dcf1f2
Merge pull request #16550 from aschackmull/java/zipslip-number-sanitizer
...
Java: Improve sanitizer for java/zipslip
2024-05-22 12:43:44 +02:00
Mathias Vorreiter Pedersen
eda815789b
Update cpp/ql/src/experimental/Likely Bugs/DerefNullResult.ql
2024-05-22 11:21:04 +01:00
Michael Nebel
84e412fe36
Merge pull request #16477 from michaelnebel/csharp/madinlinetest
...
C#: Inline expectation for model generator test.
2024-05-22 11:05:23 +02:00
Anders Schack-Mulligen
7828cb8f5a
Java: Add change note.
2024-05-22 10:27:33 +02:00
Anders Schack-Mulligen
d82acf5866
Java: Add simple type sanitization to java/zipslip.
2024-05-22 10:23:30 +02:00
Tamás Vajk
855fe12c6c
Merge pull request #16549 from tamasvajk/fix/tsp-diag
...
C#: Fix TSP diagnostic message
2024-05-22 10:10:26 +02:00
Tamas Vajk
91aa182d53
C#: Fix TSP diagnostic message
2024-05-22 08:49:55 +02:00
Erik Krogh Kristensen
92df0a3d46
Merge pull request #16546 from erik-krogh/ts-big-file-fix
...
JS: fix that very large TypeScript files would crash the extractor
2024-05-22 07:41:58 +02:00
erik-krogh
a30bac14e9
add change-note
2024-05-21 22:14:39 +02:00
Philippe Antoine
ab4b823c2e
fixup unique assignment
2024-05-21 22:10:00 +02:00
Tom Hvitved
22aea47604
Repin
2024-05-21 20:59:54 +02:00
Tom Hvitved
a87ceed361
Merge pull request #16394 from hvitved/dataflow/synth-param-ret-node
...
Data flow: Synthesize parameter return nodes
2024-05-21 20:55:14 +02:00
Tom Hvitved
bc1283c715
Ruby: Reference official Tree-sitter grammar in Cargo.toml
2024-05-21 20:51:50 +02:00
erik-krogh
61c72361cd
move the "isFileTooLarge" earlier in the pipeline, so we're only doing it once
2024-05-21 20:01:24 +02:00
erik-krogh
241f977488
fix that very large TypeScript files would crash the extractor
2024-05-21 19:52:43 +02:00
Chuan-kai Lin
8a22e2283c
Merge pull request #16424 from github/cklin/ruby-entities-reorder
...
Ruby: Use entities in reorder directives
2024-05-21 07:32:28 -07:00
Tom Hvitved
bebcd679a4
Address review comments
2024-05-21 14:51:52 +02:00
Tom Hvitved
18f138e754
Add change note
2024-05-21 14:47:42 +02:00
Rasmus Wriedt Larsen
2451a6d3f6
Accept .expected changes
2024-05-21 14:47:42 +02:00
Tom Hvitved
454687d583
Data flow: Synthesize parameter return nodes
2024-05-21 14:47:42 +02:00
yoff
358c7410c8
Merge pull request #16490 from yoff/python/rich-type-column-MaD
...
Python: Rich `type` column in MaD
2024-05-21 11:55:41 +02:00
Tom Hvitved
158dafa7d0
Python: Dummy change to trigger CI
2024-05-21 11:25:21 +02:00
Tom Hvitved
80364e9570
Ruby: Repin in Cargo.toml
2024-05-21 11:25:21 +02:00
Jeroen Ketema
bddc69e409
Merge pull request #16537 from jketema/memcmp
...
C++: Fix typo in `cpp/network-to-host-function-as-array-bound`
2024-05-21 11:14:48 +02:00
Tom Hvitved
bf2ae9890f
Tree-sitter: Bump to 0.22.6
2024-05-21 11:14:06 +02:00
Jeroen Ketema
c8fec336ce
C++: Fix typo in cpp/network-to-host-function-as-array-bound
2024-05-21 10:29:17 +02:00
Jeroen Ketema
1a60c01723
C++: Add memcmp test for cpp/network-to-host-function-as-array-bound
2024-05-21 10:27:38 +02:00
Joe Farebrother
01a6c5e82f
Merge pull request #16446 from joefarebrother/shared-sensitive-heuristics
...
Ruby/Python/JS/Swift: Add category of Private information to shared sensitive data heuristics
2024-05-21 09:07:13 +01:00
Tom Hvitved
60ee7fb0d3
Merge pull request #16473 from hvitved/csharp/entity-framework-perf
...
C#: Fix performance issue in EntityFramework modelling
2024-05-21 10:03:21 +02:00
Tamás Vajk
1a20a624d6
Merge pull request #16498 from tamasvajk/buildless/use-nuget-from-path
...
C#: Use nuget.exe from the executing machine instead of always downlo…
2024-05-21 09:38:47 +02:00
Paolo Tranquilli
9d21e2cda3
Merge pull request #16522 from github/redsun82/lfs
...
Bazel: allow LFS rules to use cached downloads without internet
2024-05-21 08:56:47 +02:00
Tom Hvitved
d9019f9676
C#: Fix performance issue in EntityFramework modelling
2024-05-21 08:53:51 +02:00
Philippe Antoine
8ace9da14a
fixup dataflow path and formatting
2024-05-20 21:31:47 +02:00
Geoffrey White
13a7d9acb6
Merge pull request #16528 from geoffw0/docfix2
...
C++: Update an instance of the name 'Semmle' in a doc page.
2024-05-20 15:07:42 +01:00
Mathias Vorreiter Pedersen
c483a4bf04
Merge pull request #16527 from codeqlhelper/main
...
C++: Static variables are initialized to zero or null by compiler
2024-05-20 10:13:23 +01:00
Geoffrey White
0ba3cd96f5
C++: Update an instance of the name 'Semmle' in a doc page.
2024-05-20 10:02:50 +01:00
Mathias Vorreiter Pedersen
2f7766a557
C++: Autoformat.
2024-05-20 09:04:24 +01:00
Mathias Vorreiter Pedersen
df24e5982a
C++: Add tests and accept test changes.
2024-05-20 09:01:42 +01:00
Mathias Vorreiter Pedersen
e8b9d7e6fa
C++: Modify change note to be more aligned with existing change notes.
2024-05-20 08:52:18 +01:00
codeqlhelper
15667dcf1e
Create 2024-05-19-avoid-reporting-static-variable.md
2024-05-19 21:55:35 +08:00
codeqlhelper
1d8d45b3aa
Static variables are initialized to zero or null by compiler
...
Static variables are initialized to zero or null by compiler, no need to get an initializer of them
2024-05-19 21:48:43 +08:00
Erik Krogh Kristensen
bfc95c6f13
Merge pull request #16510 from erik-krogh/go-command
...
Go: Update the QHelp for `go/command-injection`.
2024-05-17 17:45:10 +02:00
Paolo Tranquilli
d01d657f89
Bazel: accept new SSH keys in git_lfs_probe.py
2024-05-17 16:39:18 +01:00
Philippe Antoine
73d306c8c8
Adds another rule for null deref
2024-05-17 17:35:07 +02:00
Paolo Tranquilli
170e2231d4
Bazel: allow LFS rules to use cached downloads without internet
...
If the cache is prefilled, LFS rules were still trying to query LFS
urls.
Now the strategy is to first try to fetch the files from the repository
cache (which is possible by providing an empty url list and `allow_fail`
to `repository_ctx.download`), and only run the LFS protocol if that
fails. Technically this is possible by enhancing `git_lfs_probe.py` with
a `--hash-only` flag.
This is also an optimization where no uneeded access is done (including
the slightly slow SSH call) if the repository cache is warm.
2024-05-17 16:24:38 +01:00
yoff
0ecefd6a24
Update python/ql/lib/change-notes/2024-05-17-maD-rich-type-column.md
...
Co-authored-by: Taus <tausbn@github.com >
2024-05-17 16:58:59 +02:00
Rasmus Lerchedahl Petersen
9534e56d1b
Python: address review comments
2024-05-17 16:25:22 +02:00
