hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-16 00:38:15 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,964 Commits 1,807 Branches 170 Tags
148c79a0e66c2d3bd5b0adb6894d5cbcedc8f42e
Commit Graph

1964 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jonas Jensen
148c79a0e6 C++: Deprecate RecursionPrevention 2018-11-30 15:41:43 +01:00
Jonas Jensen
9532ee5177 C++: Add more detail to change notes for libraries 2018-11-30 14:29:08 +01:00
Jonas Jensen
b793807af5 C++: Complete change notes for Dave's PRs 2018-11-30 13:44:40 +01:00
Jonas Jensen
9daefa3613 C++: Complete change notes for my own PRs 2018-11-30 13:09:27 +01:00
Geoffrey White
453529e3bf Merge pull request #575 from jbj/UnsafeCreateProcessCall-nullValue 
C++: Avoid using nullValue predicate (rc/1.19)
 2018-11-30 09:54:17 +00:00
Jonas Jensen
dd3791490a Merge pull request #580 from geoffw0/av-79-perf 
CPP: Fix performance issue with AV Rule 79.ql.
 2018-11-30 08:39:38 +01:00
Jonas Jensen
b98452ddb1 Merge pull request #474 from rdmarsh2/rdmarsh/cpp/call-side-effect 
C++: Initital aliased SSA with Chi nodes and function side effects
 2018-11-29 18:31:29 +01:00
Geoffrey White
4744cece7b Merge pull request #576 from jbj/bbEntryReachesLocally-perf 
C++: Fix performance of bbEntryReachesLocally (1.19)
 2018-11-29 17:12:47 +00:00
Asger F
f85e30aa6c Merge pull request #571 from xiemaisi/js/numeric-constant-interpreted-as-code 
JavaScript: Add new query `HardcodedDataInterpretedAsCode`.
 2018-11-29 17:07:48 +00:00
Taus
1956cd802f Merge pull request #577 from markshannon/python-fix-performance-regression-dependencies 
Python: Fix performance regression in dependency analysis
 2018-11-29 16:41:58 +01:00
Geoffrey White
e09ce77678 CPP: Fix performance issue with AV Rule 79.ql. 2018-11-29 15:16:01 +00:00
Mark Shannon
8414d46a87 Python: Fix accidentally introduced cartesian product. 2018-11-29 14:19:47 +00:00
Jonas Jensen
62d478eab3 C++: Fix performance of bbEntryReachesLocally 
This predicate was fast with the queries and engine from 1.18. With the
queries from `master` it got a bad join order in the
`UninitializedLocal.ql` query, which made it take 2m34s on Wireshark.
This commit decomposes `bbEntryReachesLocally` into two predicates that
together take only 4s.
 2018-11-29 15:11:32 +01:00
Jonas Jensen
8654ebcbbd C++: Avoid using nullValue predicate 
The `nullValue` predicate performs a slow custom data-flow analysis to
find possible null values. It's so slow that it timed out after 1200s on
Wireshark.

In `UnsafeCreateProcessCall.ql`, the values found with `nullValue` were
used as sources in another data-flow analysis. By using the `NullValue`
class as sink instead of `nullValue`, we avoid the slow-down of doing
data flow twice. The `NullValue` class is essentially the base case of
`nullValue`. Confusing names, yes.
 2018-11-29 13:33:45 +01:00
Max Schaefer
73ce0f17d6 JavaScript: Americanise change note spelling. 2018-11-29 11:23:47 +00:00
Max Schaefer
8637eaf100 JavaScript: Address review comments. 2018-11-29 10:48:44 +00:00
mc
83d4fb6711 Merge pull request #559 from xiemaisi/js/invalid-dynamic-method-call 
JavaScript: Documentation review for new query `UnvalidatedDynamicMethodCall`.
 2018-11-29 09:59:53 +00:00
Max Schaefer
5f16406ad7 JavaScript: Add new query HardcodedDataInterpretedAsCode. 2018-11-29 09:52:31 +00:00
Max Schaefer
94a5722c2a JavaScript: Model taint propagation through new Buffer and Buffer.from. 2018-11-29 09:52:31 +00:00
Max Schaefer
4091cf410d JavaScript: Improve detection of require calls. 2018-11-29 09:52:31 +00:00
Max Schaefer
506236994f JavaScript: Address doc review comments. 2018-11-29 09:49:13 +00:00
Dave Bartolomeo
40864f9ebb C++: Fix GVN test expectation 2018-11-28 14:07:23 -08:00
Dave Bartolomeo
d7938362dd C++: Rename Chi IPA types to match classes 2018-11-28 10:33:04 -08:00
Taus
595e6fcbf8 Merge pull request #550 from markshannon/python-weak-crypto 
Python: Query for use of weak crypto keys.
 2018-11-28 18:21:27 +01:00
Mark Shannon
a345727f71 Python fix up tags in qhelp. 2018-11-28 17:14:07 +00:00
Mark Shannon
b3eaa46f14 Python: Use consistent abbreviations in weak-crypto query message. 2018-11-28 16:58:22 +00:00
Mark Shannon
4f0a666a43 Python: Tweak name of new query and add change note. 2018-11-28 16:58:22 +00:00
Mark Shannon
3c4c8cf7d3 Python: Add qhelp for new query. 2018-11-28 16:57:34 +00:00
Mark Shannon
1065ad0ce7 Python: Weak crypto query. 2018-11-28 16:57:34 +00:00
Taus
c75fa28510 Merge pull request #538 from markshannon/python-jinja2-autoescape 
Python: New query to check for use of jinja2 templates without auto-escaping
 2018-11-28 17:32:17 +01:00
Mark Shannon
21246dcbf2 Python: clean up change notes and query help. 2018-11-28 15:02:47 +00:00
Max Schaefer
45574d4eaa JavaScript: Minor change to documentation to facilitate opening another PR. 2018-11-28 13:53:28 +00:00
semmle-qlci
57a976d668 Merge pull request #555 from xiemaisi/js/invalid-dynamic-method-call 
Approved by esben-semmle
 2018-11-28 13:52:51 +00:00
Mark Shannon
eefb45c94b Python: jinja2-without-escaping query: Clean up query and account for Template class in tests. 2018-11-28 10:46:44 +00:00
Mark Shannon
dff36e22ff Fix typo. 2018-11-28 10:46:44 +00:00
Mark Shannon
1080525d7d Python: Add missing test stub. 2018-11-28 10:45:48 +00:00
Mark Shannon
2518ac561e Python: Add change note for jinja2-autoescape query. 2018-11-28 10:45:48 +00:00
Mark Shannon
243280dc00 Python: New query to check for use of jinja2 templates without auto-escaping. 2018-11-28 10:45:19 +00:00
Max Schaefer
39f1c7904b JavaScript: Address review comments. 2018-11-28 09:44:58 +00:00
semmle-qlci
e66691a90c Merge pull request #551 from asger-semmle/js-extractor-shebang 
Approved by xiemaisi
 2018-11-28 08:49:44 +00:00
Max Schaefer
31d23b6295 JavaScript: Sort change notes alphabetically. 2018-11-28 08:16:31 +00:00
Max Schaefer
f9de1d44ca JavaScript: Add change notes. 2018-11-28 08:16:31 +00:00
Max Schaefer
f1c538a97b JavaScript: Restrict RemotePropertyInjection query to avoid double-reporting. 
This query now only flags user-controlled property and header writes, method calls are handled by the new unsafe/unvalidated method call queries.
 2018-11-28 08:16:31 +00:00
Max Schaefer
2889e07eb8 JavaScript: Add new query UnvalidatedDynamicMethodCall. 2018-11-28 08:16:31 +00:00
Dave Bartolomeo
5d997c7135 C++: Big QLDoc comment for ChiInstruction 2018-11-27 17:09:26 -08:00
Dave Bartolomeo
53cd5e9994 C++: Fix bug introduced by earlier commit 2018-11-27 14:57:58 -08:00
Dave Bartolomeo
7e6e6f00c1 C++: Fix IR for designated array initializers 2018-11-27 14:57:23 -08:00
Dave Bartolomeo
0a20f9ffbf C++: Print field names and element indices for aggregate literals in PrintAST 2018-11-27 13:26:18 -08:00
Dave Bartolomeo
90b79eb5f3 C++: Accept GVN test expectations with Chi nodes 2018-11-27 12:56:23 -08:00
Mark Shannon
31ac33e723 Merge pull request #528 from taus-semmle/python-flask-debug 
Python: Implement check for flask debug mode.
 2018-11-27 19:42:26 +00:00