hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-22 07:15:15 +02:00
Code Issues Packages Projects Releases Wiki Activity
8,721 Commits 1,738 Branches 165 Tags
12ea81af9c19cdd6adf425929bd0ecde07537ffc
Commit Graph

8721 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Max Schaefer
12ea81af9c JavaScript: Move getAMatchedConstant(RegExpTerm) into the library. 2019-11-22 09:24:34 +00:00
Max Schaefer
a5a5debdc7 JavaScript: Move getStringValue(RegExpLiteral) into the library. 2019-11-22 09:24:34 +00:00
Max Schaefer
0edb70f373 JavaScript: Deal with escape-unescape-escape (and similar) chains. 2019-11-22 09:24:34 +00:00
Max Schaefer
cb54618a5d JavaScript: Deal with (un-)escaping on captured variables. 2019-11-22 09:24:34 +00:00
Max Schaefer
61aa075e8d JavaScript: Fix regexes for escaping schemes. 2019-11-22 09:24:34 +00:00
Max Schaefer
4f899a9b0d JavaScript: Recognize string escaping using .replace with a callback. 2019-11-22 09:24:34 +00:00
Max Schaefer
5dcf55e113 JavaScript: Refactor DoubleEscaping.ql. 2019-11-22 09:24:34 +00:00
semmle-qlci
62859d140d Merge pull request #2394 from esbena/js/support-getDerivedFromError 
Approved by max-schaefer
 2019-11-22 07:45:45 +00:00
semmle-qlci
2c623372b6 Merge pull request #2405 from esbena/js/another-bind-model 
Approved by asgerf
 2019-11-22 07:35:58 +00:00
Robert Marsh
dbe885fd38 Merge pull request #1926 from jbj/ir-dataflow-toString 
C++: DataFlow::Node.toString consistency
 2019-11-21 10:20:35 -08:00
Geoffrey White
676e8a2c2e Merge pull request #2399 from jbj/ExprHasNoEffect-templates 
C++: Suppress ExprHasNoEffect on template code
 2019-11-21 18:01:41 +00:00
semmle-qlci
8cca9b05ea Merge pull request #2393 from max-schaefer/js/improve-incomplete-sanitization-docs 
Approved by mchammer01
 2019-11-21 16:04:19 +00:00
Esben Sparre Andreasen
edb94db6ef JS: add change notes 2019-11-21 13:20:08 +01:00
Esben Sparre Andreasen
03c83c9c9d JS: model React's getDerivedStateFromError 2019-11-21 13:18:43 +01:00
Esben Sparre Andreasen
23d29a80db JS: improve comment syntax 2019-11-21 13:16:40 +01:00
Esben Sparre Andreasen
6328a0a8b9 JS: improve FP filter for js/unbound-event-handler-receiver 2019-11-21 13:13:40 +01:00
Rasmus Wriedt Larsen
53576a4781 Merge pull request #2397 from tausbn/python-make-tostrings-visible 
Python: Add `toString` information for all classes without such.
 2019-11-21 11:46:22 +01:00
Geoffrey White
403899ecbc Merge pull request #2391 from jbj/CompareWhereAssignMeant-decltype 
C++: Fix FP for expression SFINAE with decltype
 2019-11-20 17:34:09 +00:00
Jonas Jensen
ff96e3a8ea C++: Also suppress ExprHasNoEffect in declspec etc 2019-11-20 15:44:39 +01:00
Jonas Jensen
b325427d29 C++: Suppress ExprHasNoEffect on template code 2019-11-20 15:12:25 +01:00
Taus Brock-Nannestad
c525ab325f Python: Add toString information for all classes without such. 
Having `toString()` defined to be `none()` is a major headache when debugging,
as `toString`-less results are silently elided. This PR puts dummy `toString`s
in place of the `none()`s.

(I am mostly creating this to see if it impacts our tests and/or the
performance. If not, we may as well merge it.)
 2019-11-20 14:47:20 +01:00
semmle-qlci
77c869f528 Merge pull request #2220 from erik-krogh/processEnvTaint 
Approved by esbena, max-schaefer
 2019-11-20 13:16:43 +00:00
Max Schaefer
cb20de8070 JavaScript: Add a warning to IncompleteSanitization help. 
Sanitizing away multi-character strings using regular expressions is tricky business, and we should probably warn about it.
 2019-11-20 11:57:50 +00:00
Jonas Jensen
4dafa16572 C++: Fix FP on unevaluated code 
This fixes false positives on tenzir/vast.
 2019-11-20 10:42:36 +01:00
Geoffrey White
9cf819929d Merge pull request #2383 from jbj/field-isStatic 
C++: Don't check if a Field is static
 2019-11-20 09:05:03 +00:00
semmle-qlci
51a51d7e0c Merge pull request #2387 from max-schaefer/js/incomplete-dotdot-sanitization 
Approved by asger-semmle
 2019-11-19 16:39:35 +00:00
Jonas Jensen
a1af96e521 C++: Reproduce a reported FP 2019-11-19 16:17:49 +01:00
Max Schaefer
5565be14fc JavaScript: Teach IncompleteSanitization to flag incomplete path sanitizers. 2019-11-19 15:06:16 +00:00
Jonas Jensen
c41114334f Merge remote-tracking branch 'upstream/master' into ir-dataflow-toString 
Solved conflicts in `*.expected` by re-running the tests.
 2019-11-19 14:27:27 +01:00
Rasmus Wriedt Larsen
b39bcde31c Merge pull request #2375 from tausbn/python-fix-mutable-value-type-coercion-fp 
Python: Don't report mutable parameters that are in fact immutable.
 2019-11-19 13:26:23 +01:00
Jonas Jensen
fbf2ef8625 C++: Don't check if a Field is static 
A `Field` in the C++ QL libraries can't be static, but I'd for some
reason written two checks for `Field`s being static in the data-flow
library.
 2019-11-19 13:20:21 +01:00
Rasmus Wriedt Larsen
231414ceaf Merge pull request #2374 from tausbn/python-fix-mappingproxytype-fp 
Python: Fix non-container FP relating to `MappingProxyType`.
 2019-11-19 13:13:26 +01:00
Jonas Jensen
b43cbeb17f Merge pull request #2372 from geoffw0/qhelpms 
CPP: Improve TlsSettingsMisconfiguration qhelp
 2019-11-19 13:05:52 +01:00
Erik Krogh Kristensen
0a428a8f44 typo 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2019-11-19 13:05:13 +01:00
Erik Krogh Kristensen
d4f42d872a change change-note to target 1.24 instead of 1.23 2019-11-19 11:10:34 +01:00
Taus
4c700882b6 Merge pull request #2190 from RasmusWL/python-modernise-tornado-library 
Python: modernise tornado library
 2019-11-19 09:36:30 +01:00
Taus Brock-Nannestad
3491d90b1e Python: Apply auto-format. 2019-11-18 16:50:32 +01:00
Taus Brock-Nannestad
1385f3c018 Python: Fix non-container FP relating to MappingProxyType. 
Fixes #2307.

Also modernises the query to use the `Value` API.
 2019-11-18 16:50:32 +01:00
Taus Brock-Nannestad
3c47394b7a Python: Apply auto-format. 2019-11-18 16:28:54 +01:00
Taus Brock-Nannestad
cac261858c Python: Don't report mutable parameters that are in fact immutable. 
Fixes #1832.

In the taint sink, we add an additional check that the given control-flow node
can indeed point to a value that is mutable. This takes care of the guard on the
type.

If and when we get around to adding configurations for all of the taint
analyses, we may want to implement this as a barrier instead, pruning any steps
that go through a type test where the type is not mutable.
 2019-11-18 16:18:44 +01:00
Calum Grant
b9d1c38753 Merge pull request #2371 from max-schaefer/rc/1.23 
Merge rc/1.23 into master
 2019-11-18 14:15:31 +00:00
semmle-qlci
ed4657c201 Merge pull request #2340 from hvitved/csharp/nunit-assertions 
Approved by calumgrant
 2019-11-18 13:02:49 +00:00
Nick Rolfe
9828315b6e Merge pull request #2033 from ian-semmle/edg 
C++: Changes following EDG upgrade
 2019-11-18 12:46:11 +00:00
Geoffrey White
ff15c01ab9 CPP: Comma. 2019-11-18 11:51:54 +00:00
semmle-qlci
34f4b11416 Merge pull request #2368 from asger-semmle/regexp-max-length 
Approved by max-schaefer
 2019-11-18 11:49:46 +00:00
Geoffrey White
9a53706e87 CPP: Reword TlsSettingsMisconfiguration.qhelp. 2019-11-18 11:49:28 +00:00
Geoffrey White
2789c2dbac CPP: Fix typos. 2019-11-18 11:48:13 +00:00
James Fletcher
21832a8550 Merge pull request #2350 from shati-patel/docs/vscode 
Docs: Update links to new products
 2019-11-18 11:14:53 +00:00
Tom Hvitved
3d1ce55642 C#: Address review comments 2019-11-18 10:53:02 +01:00
Shati Patel
d6a673c91a Docs: Update links to new products 2019-11-18 09:34:00 +00:00