hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-18 17:04:50 +01:00
Code Issues Packages Projects Releases Wiki Activity
11,135 Commits 1,679 Branches 158 Tags
05ecfc83f797489e5d7bf7e6edface32b4febcc8
Commit Graph

11135 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Wriedt Larsen
05ecfc83f7 Python: Add test-case with swapped decorator order 2020-03-24 14:18:46 +01:00
Rasmus Wriedt Larsen
3ed48aae4c Python: remove leftover arg in test code 2020-03-24 11:49:08 +01:00
Rasmus Wriedt Larsen
5ec0716cb0 Python: Add points-to regression when using @classmethod decorators 
Specifically a problem when using a second decorator
 2020-03-24 11:39:08 +01:00
Luke Cartey
9eee16b2d6 Merge pull request #3091 from hvitved/csharp/xpath-injection-more-sinks 
C#: Teach XPath injection query about `XPathNavigator`
 2020-03-23 09:39:26 +00:00
semmle-qlci
2c7af72f14 Merge pull request #2858 from RasmusWL/python-support-django2 
Approved by tausbn
 2020-03-23 09:35:46 +00:00
Anders Schack-Mulligen
888c504f55 Merge pull request #2903 from hvitved/dataflow/performance 
Data flow: Refactoring + performance improvements
 2020-03-23 10:01:20 +01:00
yo-h
16f2957029 Merge pull request #3081 from aschackmull/java/urldecoder-step 
Java: Add URLDecoder.decode as taint step.
 2020-03-20 13:53:20 -04:00
yo-h
bcda481d4a Merge pull request #3086 from aschackmull/java/apache-base64-taint 
Java: Add apache Base64 taint steps.
 2020-03-20 13:49:20 -04:00
Tom Hvitved
2d90e7daca Autoformat 2020-03-20 09:34:34 +01:00
Mathias Vorreiter Pedersen
67cb8525bf Merge pull request #3082 from dbartol/dbartol/VarArgIR 
C++: Model varargs in IR, Part I
 2020-03-19 18:05:46 +01:00
Dave Bartolomeo
74f61dc148 C++: Fix formatting 2020-03-19 09:18:32 -04:00
Tom Hvitved
fc74a482a4 C#: More XPath injection sinks 2020-03-19 14:13:35 +01:00
Tom Hvitved
0d45700088 C#: Add change note 2020-03-19 13:41:22 +01:00
Tom Hvitved
4b3cf72c1c C#: Teach XPath injection query about XPathNavigator 2020-03-19 13:38:16 +01:00
Tom Hvitved
7f0181ccff C#: Add XPathNavigator test for cs/xml/xpath-injection 2020-03-19 13:37:03 +01:00
semmle-qlci
deb20fc37f Merge pull request #3076 from esbena/js/even-more-mongoose-improvements 
Approved by erik-krogh
 2020-03-19 12:03:53 +00:00
semmle-qlci
2821b01017 Merge pull request #2915 from tausbn/python-add-points-to-for-missing-builtin-return-types 
Approved by RasmusWL
 2020-03-19 11:02:46 +00:00
Rasmus Wriedt Larsen
f4e5079dd3 Merge pull request #2991 from BekaValentine/python-objectapi-to-valueapi-unguardednextingenerator 
Python: ObjectAPI to ValueAPI: UnguardedNextInGenerator
 2020-03-19 10:33:32 +01:00
Rebecca Valentine
06f0947318 Update python/ql/src/Exceptions/UnguardedNextInGenerator.ql 
Co-Authored-By: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2020-03-18 14:16:00 -07:00
Rebecca Valentine
9560c804b8 Update python/ql/test/query-tests/Exceptions/generators/test.py 
Co-Authored-By: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2020-03-18 14:15:49 -07:00
Robert Marsh
a30954599d Merge pull request #3085 from jbj/inStaticInitializer-AggregateLiteral 
C++: Manual magic in inStaticInitializer
 2020-03-18 13:23:04 -07:00
Dave Bartolomeo
30d2b865c6 C++: Fix formatting 2020-03-18 14:06:28 -04:00
Tom Hvitved
937924571c Data flow: Sync files 2020-03-18 18:16:27 +01:00
Tom Hvitved
d0aaaad537 Address review comments 2020-03-18 18:16:11 +01:00
Rasmus Wriedt Larsen
9a0b2b1843 Merge pull request #2989 from BekaValentine/python-objectapi-to-valueapi-incorrectexceptorder 
Python: ObjectAPI to ValueAPI: IncorrectExceptOrder
 2020-03-18 18:03:25 +01:00
Taus
ae1268f241 Merge branch 'master' into python-add-points-to-for-missing-builtin-return-types 2020-03-18 17:59:17 +01:00
Rasmus Wriedt Larsen
290e33a912 Merge pull request #2922 from tausbn/python-fix-multi-assign-points-to 
Python: Fix bug in `multi_assignment_points_to`.
 2020-03-18 17:50:37 +01:00
Rasmus Wriedt Larsen
b0303158a5 Merge pull request #3088 from tausbn/python-prepare-autoformatting 
Python: Prepare for autoformatting.
 2020-03-18 17:48:46 +01:00
Dave Bartolomeo
0329327f9f C++: Move VarArgs utilities location 2020-03-18 11:24:44 -04:00
Dave Bartolomeo
fed1bce015 C++: Make vararg utilities internal for now. 2020-03-18 11:18:38 -04:00
Dave Bartolomeo
4fce20116e C++: Fix formatting 2020-03-18 09:53:01 -04:00
Dave Bartolomeo
26ea93af58 Merge remote-tracking branch 'upstream/master' into dbartol/VarArgIR 2020-03-18 09:52:21 -04:00
Jonas Jensen
a23077af11 C++: Comments for future maintainers 2020-03-18 14:11:37 +01:00
Taus Brock-Nannestad
57af7b84aa Python: Prepare for autoformatting. 
Mostly fixes up a bunch of comments that were made wonky by the autoformatter.
 2020-03-18 13:59:38 +01:00
Tom Hvitved
3bd6429072 Data flow: Sync files 2020-03-18 13:28:26 +01:00
Tom Hvitved
321b91209f Address review comments 2020-03-18 13:28:16 +01:00
Jonas Jensen
f1ad0dafdc Merge pull request #2849 from geoffw0/model-gets 
C++: Model for gets
 2020-03-18 11:06:23 +01:00
Anders Schack-Mulligen
396678fd55 Java: Add apache Base64 taint steps. 2020-03-18 10:54:40 +01:00
Esben Sparre Andreasen
b1a722fcda JS: typo fix 2020-03-18 10:11:38 +01:00
Esben Sparre Andreasen
12d8177b4b Update javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-03-18 10:12:05 +01:00
Esben Sparre Andreasen
ce3b196b93 Update javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-03-18 10:11:57 +01:00
Esben Sparre Andreasen
b9860d3444 Update javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-03-18 10:11:49 +01:00
Esben Sparre Andreasen
d74c16f86c Update javascript/ql/src/semmle/javascript/frameworks/NoSQL.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-03-18 10:11:36 +01:00
Jonas Jensen
260bfe7b1d C++: Manual magic in inStaticInitializer 
Since `runtimeExprInStaticInitializer` only looks at expressions at the
top level of an initializer or directly below some number of top-level
aggregate literals, there is no need for `inStaticInitializer` to
include expressions strictly below those in the AST.

I tested this on Wireshark, which has very large static initializers,
but found no measureable difference in run time. There are some
differences in tuple counts and iteration counts, though:

- `inStaticInitializer` changes from 6,241,153 rows (86 iterations) to
  5,031,617 rows (7 iterations).
- `runtimeExprInStaticInitializer` changes from 386,350 rows to 4,705
  rows.
- `hasDynamicInitialization` has 410 rows both before and after, which
  suggests that this change does not affect results.

Even though there is no impact on this snapshot at this time, things
might look different if/when the restriction on aggregate literals to
100 children is removed in the extractor.
 2020-03-18 09:28:45 +01:00
Jonas Jensen
93c6f8f1f7 Merge pull request #3056 from dbartol/dbartol/static-locals 
C++: Model dynamic initialization of static local variables in IR
 2020-03-18 08:16:21 +01:00
Dave Bartolomeo
309ccf3daf C++: Factor out common code to avoid recursion 2020-03-17 18:44:29 -04:00
Dave Bartolomeo
772324fafa C++: Add comment with IR for dynamic init of static var 2020-03-17 18:44:00 -04:00
Dave Bartolomeo
709757f7f2 Merge remote-tracking branch 'upstream/master' into dbartol/static-locals 2020-03-17 18:35:13 -04:00
Taus
46567a5842 Merge pull request #3029 from BekaValentine/python-objectapi-to-valueapi-handles 
Python: ObjectAPI to ValueAPI: Handles
 2020-03-17 22:37:27 +01:00
Rebecca Valentine
f351916418 Merge branch 'master' into testmerge 2020-03-17 12:32:45 -07:00