hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity
7,451 Commits 1,673 Branches 157 Tags
03f72d207cbcc02cedc5973d9ffcb0cd2f00ea00
Commit Graph

2177 Commits

Author SHA1 Message Date
Robert Marsh
03f72d207c C++: use Declaration.hasGlobalOrStdName 2019-10-02 11:37:37 -07:00
Robert Marsh
bff68a00ac C++: Add Declaration.hasStdName 2019-10-02 11:37:37 -07:00
Robert Marsh
98b97b09be C++: add hasGlobalOrStdName to Declaration 2019-10-02 11:37:37 -07:00
Tom Hvitved
e5380aa6a7 Merge pull request #2038 from aschackmull/java/dataflow-fixes 
Java/C++/C#: Misc. dataflow fixes.
 2019-10-02 16:39:01 +02:00
Anders Schack-Mulligen
f87cb4d6ac Java/C++/C#: Address review comments and fix test. 2019-10-02 14:32:17 +02:00
ian-semmle
e048207e2f Merge pull request #2055 from matt-gretton-dann/cpp-439-test-cases 
C++: Add test cases for constant initializers
 2019-10-01 12:43:46 +01:00
Robert Marsh
a45a6e48f8 C++: remove side effect operands from non-reads 2019-09-30 12:00:55 -07:00
Robert Marsh
9f20cb83c3 C++/C#: Autoformat 2019-09-30 12:00:55 -07:00
Robert Marsh
fcfc11052a C++: add QLDoc to side effect functions 2019-09-30 12:00:54 -07:00
Robert Marsh
8649978a43 C++: add indexes for specific side effects 2019-09-30 12:00:53 -07:00
Robert Marsh
24574be007 C++: add SizedBuffer side effect instructions 2019-09-30 12:00:53 -07:00
Robert Marsh
554d6390f7 C++: clean up after rebase 2019-09-30 12:00:53 -07:00
Robert Marsh
49088e7f09 C++: Fix formatting and dropped line 2019-09-30 12:00:53 -07:00
Robert Marsh
3d562243e4 C++: add side effects for outparams 2019-09-30 12:00:52 -07:00
Matthew Gretton-Dann
b76f66e83b C++: Add test cases for constant initializers 
Adds test cases for initialisation of constants which aren't simple
zeros.  Example: int x = int();
 2019-09-30 14:57:26 +01:00
Jonas Jensen
f417640da4 Merge pull request #1938 from dave-bartolomeo/dave/InNOut 
C++: Rename predicates in `FunctionInputsAndOutputs.qll` and add QLDoc
 2019-09-30 13:30:19 +02:00
Dave Bartolomeo
c1e5db0b96 C++ More PR feedback 2019-09-27 17:54:18 -07:00
Matthew Gretton-Dann
cc016d583d C++: Add further vector_size attribute tests 2019-09-27 11:28:31 +01:00
Matthew Gretton-Dann
c10ed5e114 C++: Update results for vector_size atrr changes 2019-09-27 11:28:31 +01:00
Dave Bartolomeo
28aa7dcae2 C++: Fix PR feedback 2019-09-26 13:56:43 -07:00
Geoffrey White
18b28b1b57 Merge pull request #1959 from jbj/const-pmf 
C++: Classify more expressions as constant
 2019-09-26 17:13:27 +01:00
Anders Schack-Mulligen
f97958296d Java/C++/C#: Sync. 2019-09-26 17:12:08 +02:00
semmle-qlci
24240177c5 Merge pull request #2023 from ian-semmle/agglit 
Approved by jbj
 2019-09-25 11:35:33 +01:00
Ian Lynagh
142e1cb9fb C++: Implement AggregateLiteral.mayBeImpure() 2019-09-25 10:34:30 +01:00
Jonas Jensen
0aafa0b0e2 C++: Accept test changes in IR sanity queries 
These looks harmless.
 2019-09-25 08:55:55 +02:00
Ziemowit Laski
a6d619cfe1 [zlaski/what-buffer-function] Rename CustomModels to Models 2019-09-24 18:17:34 -07:00
Ziemowit Laski
7e14e2a950 [zlaski/what-buffer-function] Rename references to BufferFunction to ArrayFunction. 2019-09-24 18:02:14 -07:00
Ian Lynagh
49276e09c5 C++: Add aggregate literals to sideEffects test 2019-09-24 11:28:57 +01:00
Matthew Gretton-Dann
6b28f33713 C++: Update test for fix to namespace members 
Generation of IDs for namespace members has been fixed to generate
unique IDs for variables of the same name but in different namespaces.

Update the same_name test to validate this.
 2019-09-23 16:04:59 +01:00
Jonas Jensen
22e57a6559 Merge pull request #1860 from matt-gretton-dann/add-using-aliases 
Add support for using aliases
 2019-09-23 16:53:51 +02:00
Jonas Jensen
898976121b Merge pull request #1987 from geoffw0/toomanyformat 
CPP: WrongNumberOfFormatArguments.ql Fix
 2019-09-23 16:05:11 +02:00
Robert Marsh
90c91a78f8 Merge pull request #1976 from pavgust/fix/hashcons-perf 
C++: HashCons: Further performance improvements
 2019-09-23 06:37:03 -07:00
Matthew Gretton-Dann
4606587fe8 C++: Apply style guide to TypedefType.qll 2019-09-23 13:57:50 +01:00
Matthew Gretton-Dann
af3b0d9e73 C++: Update stats. 2019-09-23 13:57:50 +01:00
Matthew Gretton-Dann
fc75a6af5a C++: Add tests for using aliases 2019-09-23 13:57:50 +01:00
Matthew Gretton-Dann
9ff38ebeee C++: Update tests for new CTypedefType. 2019-09-23 13:57:50 +01:00
Matthew Gretton-Dann
5468b8def7 C++: Add support for C++ using aliases 
Previously these were identified as typedefs.
 2019-09-23 13:57:50 +01:00
Geoffrey White
b3df289a80 CPP: Fix test. 2019-09-23 13:56:24 +01:00
Geoffrey White
2d8e4b3176 CPP: Additional cases resembling the ticket. 2019-09-23 13:04:14 +01:00
Geoffrey White
040bd89163 CPP: Correct expected results. 2019-09-23 11:02:36 +01:00
Geoffrey White
9100ab9360 CPP: Autoformat. 2019-09-20 15:30:59 +01:00
Geoffrey White
f7607313e7 CPP: Fix FPs. 2019-09-20 15:12:55 +01:00
Geoffrey White
9a407eb43c CPP: Test format args with mismatching declarations. 2019-09-20 14:54:44 +01:00
Pavel Avgustinov
1c971d3f88 HashCons: Further performance improvements 
The key insight here is that `HC_FieldCons` and `HC_Array` are
functionally determined by the things that arise in another
recursive call. Lifting them to their own predicate, therefore,
reduces nonlinearity and constrains the join order in a way that
cannot be asymptotically bad -- and, indeed, makes quite a big
difference in practice.
 2019-09-20 12:00:33 +01:00
Robert Marsh
d3f2d8169e Merge pull request #1967 from jbj/tainttracking-ir-2 
C++: DefaultTaintTracking flow from a to a[i]
 2019-09-19 15:00:29 -07:00
Robert Marsh
9c6a0ffc48 Merge pull request #1979 from nickrolfe/wrong_type_uninstantiated 
C++: ignore uninstantiated templates in WrongTypeFormatArguments.ql
 2019-09-19 14:51:45 -07:00
Nick Rolfe
56f4f86921 C++: ignore uninstantiated templates in WrongTypeFormatArguments.ql 2019-09-19 21:18:47 +01:00
Robert Marsh
fd88f7a3ce Merge pull request #1884 from jbj/dataflow-addressof 
C++: Data flow through address-of operator (&)
 2019-09-19 09:15:43 -07:00
Jonas Jensen
29c93488bc C++: DefaultTaintTracking flow from a to a[i] 
Switching `security.TaintTracking` to use `DefaultTaintTracking` causes
us to lose a result from `UnboundedWrite.ql`, while this commit restores
it:

diff --git a/semmlecode-cpp-tests/DO_NOT_DISTRIBUTE/security-tests/CWE-120/CERT/STR35-C/UnboundedWrite.expected b/semmlecode-cpp-tests/DO_NOT_DISTRIBUTE/security-tests/CWE-120/CERT/STR35-C/UnboundedWrite.expected
index 1eba0e52f0e..d947b33b9d9 100644
--- a/semmlecode-cpp-tests/DO_NOT_DISTRIBUTE/security-tests/CWE-120/CERT/STR35-C/UnboundedWrite.expected
+++ b/semmlecode-cpp-tests/DO_NOT_DISTRIBUTE/security-tests/CWE-120/CERT/STR35-C/UnboundedWrite.expected
@@ -1,2 +1,3 @@
+| main.c:54:7:54:12 | call to strcat | This 'call to strcat' with input from $@ may overflow the destination. | main.c:93:15:93:18 | argv | argv |
 | main.c:99:9:99:12 | call to gets | This 'call to gets' with input from $@ may overflow the destination. | main.c:99:9:99:12 | call to gets | call to gets |
 | main.c:213:17:213:19 | buf | This 'scanf string argument' with input from $@ may overflow the destination. | main.c:213:17:213:19 | buf | buf |
 2019-09-19 14:52:40 +02:00
Jonas Jensen
34a5368101 C++: Ignore templates in AmbiguouslySignedBitField 
If it's possible that the type is not fully resolved, it's better to
avoid giving an alert.

This fixes a FP in https://github.com/heremaps/flatdata.
 2019-09-19 14:21:53 +02:00