hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-06 06:05:19 +02:00
Code Issues Packages Projects Releases Wiki Activity
64,436 Commits 1,747 Branches 166 Tags
020eb4aed7165e6ec4bd4e53d5594e0cefcef135
Commit Graph

64436 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael B. Gale
020eb4aed7 Go: Use slices.Concat for bazelPaths 2024-03-04 12:14:23 +00:00
Michael B. Gale
040a288bb3 Go: Update comment to replace Go.mod with go.mod 2024-03-04 12:14:23 +00:00
Michael B. Gale
37212737fb Go: Delete unused AnyGoFilesOutsideDirs 2024-03-04 12:14:22 +00:00
Michael B. Gale
ac484e5a04 Merge pull request #15793 from github/mbg/go/autobuilder-refactor-changelog 
Go: Add changenote for autobuilder refactor
 2024-03-04 12:10:24 +00:00
Michael B. Gale
a8ae2e2525 Go: Add changenote for autobuilder refactor 2024-03-04 12:02:51 +00:00
Michael B. Gale
4dd23d4767 Merge pull request #15791 from github/mbg/go/use-1.22-for-extractor 
Go: Use Go 1.22 for the extractor
 2024-03-04 11:53:37 +00:00
Michael B. Gale
726e0928ed Merge pull request #15790 from github/mbg/go/allow-1.22 
Go: Allow 1.22 as a supported version
 2024-03-04 11:49:33 +00:00
Chris Smowton
83cef78200 Merge pull request #15783 from github/smowton/fix/extractor-information-fractional-percentage 
Java: extractor information: tolerate fractional percentages
 2024-03-04 11:09:42 +00:00
Michael B. Gale
0e9a7c84d1 Go: Update go.work.sum 2024-03-04 10:59:23 +00:00
Michael B. Gale
ff82eb95f5 Go: Use 1.22 in go.mod 2024-03-04 10:58:51 +00:00
Michael B. Gale
6563414370 Go: Allow 1.22 as a supported version 2024-03-04 10:56:03 +00:00
Michael B. Gale
0c93641b54 Merge pull request #15361 from github/mbg/go/legacy-gopath-mode-deprecated 
Go: Update autobuilder to deal with the upcoming deprecation of the legacy GOPATH mode
 2024-03-04 10:23:37 +00:00
Harry Maclean
ce1d0d2375 Merge pull request #15780 from p-/p--method-injection 
Ruby: sinks for code injection via calls to `method`
 2024-03-04 10:02:40 +00:00
Owen Mansel-Chan
038afc4008 Merge pull request #15772 from owen-mc/java/model-generator-exclude-tostring 
Java: do not generate models for `toString` and lambda flow methods
 2024-03-04 07:57:48 +00:00
Michael Nebel
11142df4d0 Merge pull request #15764 from michaelnebel/csharp/csharptracerrunapp 
C#: Don't inject compiler flags when dotnet is used to execute an application.
 2024-03-04 08:13:11 +01:00
Michael B. Gale
9c2322dd82 Merge pull request #15362 from github/mbg/go/add-go-work 2024-03-03 11:59:18 +00:00
Owen Mansel-Chan
114c17ad57 Add more methods of java.util.Comparator 2024-03-02 20:55:30 +00:00
Chris Smowton
040395485e Update ExtractorInformation.expected 2024-03-02 10:20:45 +00:00
Owen Mansel-Chan
bf22c6dae0 Merge pull request #15766 from owen-mc/java/add-neutral-models 
Java: add neutral models
 2024-03-02 06:00:33 +00:00
Chris Smowton
0bb6a64e81 Java: extractor information: tolerate fractional percentages 2024-03-01 16:49:29 +00:00
Owen Mansel-Chan
0a8dfbafe4 Accept suggestion to put models under the right heading 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-03-01 16:05:28 +00:00
Ian Lynagh
fd82a06b93 Merge pull request #15777 from igfoo/igfoo/label-kot 
CI: Kotlin: Label Kotlin test changes as "Kotlin"
 2024-03-01 15:38:01 +00:00
Peter Stöckli
4adc373dfe Ruby: more test cases for code injection via method 2024-03-01 16:01:07 +01:00
Peter Stöckli
3418ec8a81 Ruby: Update method code injection sinks change note 
Co-authored-by: Harry Maclean <hmac@github.com>
 2024-03-01 15:54:58 +01:00
Michael B. Gale
bda8a804ec Go: Add go.work file 2024-03-01 14:50:00 +00:00
Owen Mansel-Chan
5399d88d15 Accept test change: slight change in gen vs man modelgen stats 2024-03-01 14:22:00 +00:00
Peter Stöckli
e43c368222 Ruby: change note for methode code injection sinks 2024-03-01 15:20:32 +01:00
Owen Mansel-Chan
6e63df9e32 Accept test change: toString method no longer generated 2024-03-01 14:16:14 +00:00
Owen Mansel-Chan
0e1c45e84b Accept test change: some more APIs have manual models now 2024-03-01 14:08:42 +00:00
Owen Mansel-Chan
df64e0bc5f Add neutral summary models for java.security.MessageDigest#digest 2024-03-01 14:08:31 +00:00
Owen Mansel-Chan
f89fedcbaf Add some neutral models for java.util 2024-03-01 14:07:45 +00:00
Peter Stöckli
a693c6d9b4 Ruby: sinks for code injection via calls to method 2024-03-01 14:42:22 +01:00
Michael Nebel
a97510a2fc Merge pull request #15419 from github/egregius313/csharp/dataflow/threat-modeling/refactor-to-threatmodelflowsource 
C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`
 2024-03-01 14:40:40 +01:00
Tom Hvitved
15d1105d8d Merge pull request #15779 from hvitved/csharp/build-mode-none 
C#: Add `build_modes: none` to `codeql-extractor.yml`
 2024-03-01 14:34:08 +01:00
Mathias Vorreiter Pedersen
9133a13fc7 Merge pull request #15628 from microsoft/cpp-non-constant-format-as-path-query 
Cpp non constant format as path query
 2024-03-01 13:05:44 +00:00
Tom Hvitved
6d9f3d4a3e C#: Add build_modes: none to codeql-extractor.yml 2024-03-01 13:54:57 +01:00
Owen Mansel-Chan
10f6329b3e Add manual neutral models for java.util.stream 
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll

   * Note: the following top JDK APIs are not modeled with MaD:
   * `java.util.stream.Collectors#joining(CharSequence)`: cannot be modeled completely without a model for `java.util.stream.Stream#collect(Collector)` as well
   * `java.util.stream.Collectors#toMap(Function,Function)`: specialized collectors flow
   * `java.util.stream.Stream#collect(Collector)`: handled separately on a case-by-case basis as it is too complex for MaD
 2024-03-01 12:32:04 +00:00
Owen Mansel-Chan
f907fd21ad Add manual neutral models for java.text.Format and java.text.MessageFormat 
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll

   * Note: the following top JDK APIs are not modeled with MaD:
   * `java.text.Format#format(Object)`: similar issue as `Object.toString`; depends on the object being passed as the argument
   * `java.text.MessageFormat#format(String,Object[])`: similar issue as `Object.toString`; depends on the object being passed as the argument
 2024-03-01 12:31:59 +00:00
Owen Mansel-Chan
0e95f41900 Add manual neutral models for java.lang 
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll

   * Note: the following top JDK APIs are not modeled with MaD:
   * `java.lang.System#getProperty(String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
   * `java.lang.System#setProperty(String,String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
 2024-03-01 12:31:49 +00:00
Michael Nebel
ac4ad0cbc0 C#: Add test where build should not be interpreted as a SDK sub command. 2024-03-01 13:24:04 +01:00
Michael Nebel
24572848f3 C#: Move helper function to other repo to allow sharing. 2024-03-01 13:24:04 +01:00
Michael Nebel
07fc84de8c C#: Don't inject compiler flags when dotnet is used to execute an application. 2024-03-01 13:24:04 +01:00
Tom Hvitved
cb128da5aa Merge pull request #15762 from hvitved/csharp/fetch-dotnet-dependency-fetching 
C#: Fetch .NET in dependency manager instead of autobuilder
 2024-03-01 13:19:20 +01:00
Owen Mansel-Chan
bb97df1d71 do not generate models for lambda flow methods 2024-03-01 12:11:40 +00:00
Tom Hvitved
20ff7def73 Address review comment 2024-03-01 12:54:47 +01:00
Ian Lynagh
86b4f27d12 CI: Kotlin: Label Kotlin test changes as "Kotlin" 2024-03-01 11:26:56 +00:00
Mathias Vorreiter Pedersen
a7547d516a Merge branch 'main' into cpp-non-constant-format-as-path-query 2024-03-01 11:08:58 +00:00
Florin Coada
1719fd8acb Merge pull request #15769 from github/coadaflorin/changelog-2.16.3-updates 
Match changelog updates with public unified changelog
 2024-03-01 10:57:02 +00:00
Joe Farebrother
0f1106b2f6 Merge pull request #15753 from joefarebrother/ruby-i18n-translation 
Ruby: Model Rails translation methods
 2024-03-01 10:35:12 +00:00
Owen Mansel-Chan
bbf3fa7506 do not generate models for toString 2024-03-01 09:59:27 +00:00