hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 23:02:56 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,097 Commits 1,684 Branches 159 Tags
111d2a745be5aa2d06d740c1ed3a60eae898fa21
Commit Graph

92 Commits

Author SHA1 Message Date
Max Schaefer
fe6cf8c625 Merge pull request #275 from owen-mc/incorrect-integer-conversion 
Incorrect integer conversion
 2020-08-13 20:19:47 +01:00
Owen Mansel-Chan
97bbdca8a3 Extend negativeLengthCheck query to unsigned integers 
Like return values from len and cap, unsigned integers are never negative
 2020-08-11 10:48:03 +01:00
Owen Mansel-Chan
681ca9065a Add change note 2020-08-10 11:04:25 +01:00
Max Schaefer
b057cbee7b Merge pull request #256 from smowton/smowton/admin/cwe-327-cleanup 
Polish CWE-327 (weak TLS config) query
 2020-08-03 10:28:53 +01:00
Max Schaefer
2134757ebf Merge pull request #261 from smowton/smowton/admin/cleanup-cwe-322 
Polish CWE-322: detect and exclude cases where host-checking is optional
 2020-07-30 10:38:57 +01:00
Chris Smowton
f162a5be94 Promote CWE-322 out of experimental status 2020-07-29 14:43:47 +01:00
Chris Smowton
026dc5c97f Add changelog notes regarding added library support 2020-07-28 14:57:14 +01:00
Chris Smowton
718c4e8531 Add change note for insecure-TLS query 2020-07-28 11:55:58 +01:00
Max Schaefer
302eb55d23 Merge pull request #245 from smowton/smowton/feature/missing-error-check-query-conservative 
Add query searching for missing error checks on functions that return a (pointer, error) pair
 2020-07-09 15:37:32 +01:00
Chris Smowton
429a385a20 Add query searching for missing error checks on functions that return a (pointer, error) pair 2020-07-09 13:06:31 +01:00
Max Schaefer
bc778b5899 Merge pull request #243 from max-schaefer/cve-2019-11250 
Improvements to clear-text logging query
 2020-07-07 16:03:40 +01:00
Chris Smowton
5b34c05916 UnreachableStatement: tolerate more harmless unreachable return statements 
The Golang compiler isn't particularly good at spotting paths that don't need a return statement due to a dominating noreturn statement (e.g. os.Exit(1)), so dead return statements are common. We already tried to tolerate some instances of this pattern; this additionally allows 'true' and 'false' literals, and anything of type 'error'.

The carte-blanche for error values aims to accommodate the pattern "abort(); return whateverErrorWouldOtherwiseBeAppropriate();", which is probably preferable to "return nil", a misleading no-error indication.
 2020-07-06 17:02:26 +01:00
Max Schaefer
b83076853f Add change note. 2020-07-02 12:03:43 +01:00
Max Schaefer
f74a94e382 Merge pull request #170 from sauyon/tracing 
Extract more dependency ASTs
 2020-07-01 14:25:52 +01:00
Max Schaefer
76f482682c Merge pull request #182 from owen-mc/gin-framework 
Move model for Gin framework out of experimental
 2020-06-26 20:26:48 +01:00
Max Schaefer
91ca2bb434 Merge pull request #231 from max-schaefer/taint-through-range 
Propagate taint through `range` statements
 2020-06-26 19:58:53 +01:00
Max Schaefer
66ec160f64 Add change note. 2020-06-26 11:20:45 +01:00
Max Schaefer
3bf934d64b Add change note. 2020-06-25 22:23:49 +01:00
Sauyon Lee
9e8d386f3c Clarify change note 2020-06-24 23:29:55 -07:00
Sauyon Lee
de2f407c69 Add change note for more dependency AST extraction 2020-06-24 23:29:50 -07:00
Max Schaefer
1f68a32cdc Add change note. 2020-06-22 09:22:47 +01:00
Max Schaefer
2df8c275e0 Fix field lookup in cyclic structs. 2020-06-19 08:16:09 +01:00
Max Schaefer
7c2358c1d0 Merge pull request #181 from sauyon/reflectedxss-fps 
ReflectedXSS refinement
 2020-06-18 11:14:13 +01:00
Owen Mansel-Chan
c5cb55afc6 Add a change note 2020-06-17 15:14:16 +01:00
Sauyon Lee
95235c8415 Add change note for reflected xss regexp fixes 2020-06-17 00:28:03 -07:00
Owen Mansel-Chan
a3bc094731 Add change note 2020-06-16 15:48:39 +01:00
Max Schaefer
8f0592a079 Consider Request.FormValue(...) as a source for URL redirects. 
Despite its name, this method doesn't just handle form values but also query parameters.
 2020-05-29 15:03:05 +01:00
Max Schaefer
1d479d9a73 Add change note. 2020-05-22 11:11:58 +01:00
Max Schaefer
9a4bee9448 Add change note. 2020-05-20 10:10:28 +01:00
Max Schaefer
6d93f48933 Merge pull request #147 from owen-mc/redundant-recover 
Go: Add query for redundant calls to recover
 2020-05-19 07:14:27 +01:00
Owen Mansel-Chan
275be36e4a Update change-notes/2020-05-18-redundant-recover.md 
Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com>
 2020-05-19 06:31:47 +01:00
Owen Mansel-Chan
fbee7fe983 Add new query for redundant calls to recover 2020-05-18 16:13:46 +01:00
Max Schaefer
d41e41812b Merge pull request #141 from sauyon/reflectedxss-fps 
ReflectedXss improvements
 2020-05-15 07:23:39 +01:00
Max Schaefer
d5fcf28e03 Add change note. 
While we didn't see any new results in the evaluation, this is a fairly substantial amount of changes, so adding a change note is probably justified.
 2020-05-13 15:55:52 +01:00
Sauyon Lee
83a3b6336f Add change note 2020-05-13 04:31:23 -07:00
Sauyon Lee
21bfaec0d3 TaintedPath: Add change note for tempfiles 2020-05-12 05:44:19 -07:00
Max Schaefer
994536e93b Add change note. 2020-05-07 11:46:31 +01:00
Sauyon Lee
164149b29a Merge pull request #129 from max-schaefer/fix-argument-post-update-nodes 
Fix and improve taint-tracking through function arguments
 2020-05-06 02:57:01 -07:00
Max Schaefer
a79f2b4f44 Add change note for CleartextLogging. 2020-05-05 12:05:09 +01:00
Sauyon Lee
a841077cbe Add support for Mux library 2020-05-05 03:25:08 -07:00
Max Schaefer
980241603b Switch to new-style change notes. 2020-05-01 07:57:13 +01:00
Sauyon Lee
cd1d699208 Improve BadRedirectCheck query 
We now look for a path from the variable being checked to a redirect.

Additionally, several sources of false positives have been eliminated, and a model of relevant parts of the Macaron framework has been added.
 2020-05-01 07:13:16 +01:00
Felicity Chapman
70525d0e64 Minor editorial changes 2020-04-17 13:19:11 +01:00
Sauyon Lee
8ca310e6b6 Add change note for buffered i/o 2020-04-15 00:37:50 -07:00
Max Schaefer
95c2cb19cf Add two missing change notes. 2020-04-15 07:57:47 +01:00
Max Schaefer
d344687f52 Add change note. 2020-04-09 09:41:09 +01:00
Max Schaefer
c9ef6f77a2 Merge pull request #91 from max-schaefer/disabled-certificate-check 
Add new query DisabledCertificateCheck.
 2020-04-08 07:11:15 +01:00
Max Schaefer
8fba9a98d4 Add new query DisabledCertificateCheck. 2020-04-07 09:01:41 +01:00
Max Schaefer
76f2748cbc Teach SsaWithFields to properly handle implicit dereferences. 2020-04-06 09:23:07 +01:00
Sauyon Lee
dcd6aaf69a Alphabetize change notes 2020-04-03 00:01:19 -07:00