hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 14:04:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
64,352 Commits 1,740 Branches 165 Tags
19ac9e089ad516a5edd0835577ba6d672dfd004b
Commit Graph

64352 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Owen Mansel-Chan
19ac9e089a Add test 2024-03-03 21:03:41 +00:00
Owen Mansel-Chan
c7efde3b7a Remove variables with "null" in their name as sources 2024-03-03 20:55:04 +00:00
Owen Mansel-Chan
bf22c6dae0 Merge pull request #15766 from owen-mc/java/add-neutral-models 
Java: add neutral models
 2024-03-02 06:00:33 +00:00
Owen Mansel-Chan
0a8dfbafe4 Accept suggestion to put models under the right heading 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-03-01 16:05:28 +00:00
Ian Lynagh
fd82a06b93 Merge pull request #15777 from igfoo/igfoo/label-kot 
CI: Kotlin: Label Kotlin test changes as "Kotlin"
 2024-03-01 15:38:01 +00:00
Owen Mansel-Chan
0e1c45e84b Accept test change: some more APIs have manual models now 2024-03-01 14:08:42 +00:00
Owen Mansel-Chan
df64e0bc5f Add neutral summary models for java.security.MessageDigest#digest 2024-03-01 14:08:31 +00:00
Owen Mansel-Chan
f89fedcbaf Add some neutral models for java.util 2024-03-01 14:07:45 +00:00
Michael Nebel
a97510a2fc Merge pull request #15419 from github/egregius313/csharp/dataflow/threat-modeling/refactor-to-threatmodelflowsource 
C#: Refactor C# queries to use `ThreatModelFlowSource` instead of `RemoteFlowSource`
 2024-03-01 14:40:40 +01:00
Tom Hvitved
15d1105d8d Merge pull request #15779 from hvitved/csharp/build-mode-none 
C#: Add `build_modes: none` to `codeql-extractor.yml`
 2024-03-01 14:34:08 +01:00
Mathias Vorreiter Pedersen
9133a13fc7 Merge pull request #15628 from microsoft/cpp-non-constant-format-as-path-query 
Cpp non constant format as path query
 2024-03-01 13:05:44 +00:00
Tom Hvitved
6d9f3d4a3e C#: Add build_modes: none to codeql-extractor.yml 2024-03-01 13:54:57 +01:00
Owen Mansel-Chan
10f6329b3e Add manual neutral models for java.util.stream 
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll

   * Note: the following top JDK APIs are not modeled with MaD:
   * `java.util.stream.Collectors#joining(CharSequence)`: cannot be modeled completely without a model for `java.util.stream.Stream#collect(Collector)` as well
   * `java.util.stream.Collectors#toMap(Function,Function)`: specialized collectors flow
   * `java.util.stream.Stream#collect(Collector)`: handled separately on a case-by-case basis as it is too complex for MaD
 2024-03-01 12:32:04 +00:00
Owen Mansel-Chan
f907fd21ad Add manual neutral models for java.text.Format and java.text.MessageFormat 
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll

   * Note: the following top JDK APIs are not modeled with MaD:
   * `java.text.Format#format(Object)`: similar issue as `Object.toString`; depends on the object being passed as the argument
   * `java.text.MessageFormat#format(String,Object[])`: similar issue as `Object.toString`; depends on the object being passed as the argument
 2024-03-01 12:31:59 +00:00
Owen Mansel-Chan
0e95f41900 Add manual neutral models for java.lang 
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll

   * Note: the following top JDK APIs are not modeled with MaD:
   * `java.lang.System#getProperty(String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
   * `java.lang.System#setProperty(String,String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
 2024-03-01 12:31:49 +00:00
Tom Hvitved
cb128da5aa Merge pull request #15762 from hvitved/csharp/fetch-dotnet-dependency-fetching 
C#: Fetch .NET in dependency manager instead of autobuilder
 2024-03-01 13:19:20 +01:00
Tom Hvitved
20ff7def73 Address review comment 2024-03-01 12:54:47 +01:00
Ian Lynagh
86b4f27d12 CI: Kotlin: Label Kotlin test changes as "Kotlin" 2024-03-01 11:26:56 +00:00
Mathias Vorreiter Pedersen
a7547d516a Merge branch 'main' into cpp-non-constant-format-as-path-query 2024-03-01 11:08:58 +00:00
Florin Coada
1719fd8acb Merge pull request #15769 from github/coadaflorin/changelog-2.16.3-updates 
Match changelog updates with public unified changelog
 2024-03-01 10:57:02 +00:00
Joe Farebrother
0f1106b2f6 Merge pull request #15753 from joefarebrother/ruby-i18n-translation 
Ruby: Model Rails translation methods
 2024-03-01 10:35:12 +00:00
Joe Farebrother
abdae2c437 Apply reveiw suggestion - update change note 
Co-authored-by: Harry Maclean <hmac@github.com>
 2024-03-01 09:57:28 +00:00
Joe Farebrother
bf2174ffce Add change note 2024-03-01 09:57:28 +00:00
Joe Farebrother
0b7b7ea1b8 Add test cases and improve controller model 2024-03-01 09:57:24 +00:00
Joe Farebrother
ef0a1d2873 Implement models for translation methods 2024-03-01 09:52:53 +00:00
Tony Torralba
e0515269c5 Merge pull request #15774 from atorralba/atorralba/java/mapentry-copyof-provenance 
Java: Fix provenance of Map.Entry.copyOf models
 2024-03-01 10:26:22 +01:00
Mathias Vorreiter Pedersen
4e913592fa Merge branch 'main' into cpp-non-constant-format-as-path-query 2024-03-01 09:26:00 +00:00
Mathias Vorreiter Pedersen
2eb8d13439 C++: Accept test changes. 2024-03-01 09:25:25 +00:00
Florin Coada
a8816a6d1c Update java/ql/src/change-notes/released/0.8.9.md 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-03-01 09:18:22 +00:00
Florin Coada
d54e3d73ab Update java/ql/src/CHANGELOG.md 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-03-01 09:18:14 +00:00
Tony Torralba
664dac6b28 Merge pull request #15773 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2024-03-01 09:22:47 +01:00
Tony Torralba
dd1dbdf4ec Java: Fix provenance of Map.Entry.copyOf models 2024-03-01 09:00:13 +01:00
github-actions[bot]
148bc26b09 Add changed framework coverage reports 2024-03-01 00:17:57 +00:00
Owen Mansel-Chan
54031a8187 Merge pull request #15767 from owen-mc/java/add-summary-models 
Java: add a few summary models
 2024-02-29 21:21:23 +00:00
Tom Hvitved
a8468a6178 C#: Better handle multiple global.json files 2024-02-29 20:27:52 +01:00
Mathias Vorreiter Pedersen
1466f11a92 C++: Add change note. 2024-02-29 18:39:59 +00:00
Paolo Tranquilli
6d90877c52 Merge pull request #15536 from github/redsun82/bazel-cmake 
Bazel/CMake: auto detect all `cc_binary`/`cc_test` targets
 2024-02-29 18:13:40 +01:00
Ed Minnix
f488f23a48 Add LocalFlowSource back to UncontrolledFormatString 2024-02-29 12:06:59 -05:00
Edward Minnix III
89bdb7f437 Remove discussion of local flow in change note 
Co-authored-by: Michael Nebel <michaelnebel@github.com>
 2024-02-29 12:03:19 -05:00
Ed Minnix
86ceeebd89 Change handling of LocalSource in queries 
1. Change `LocalSource` to extend `DataFlow::Node`, thus removed from
   the definiton of `Source`
2. Add a private class `AddLocalSource` which extends `Source`. This
   allows us to currently preserve the inclusion of local sources, while
   making it easier to remove it in the future.
 2024-02-29 12:03:17 -05:00
Ed Minnix
3563c7ef03 Modify deprecated RemoteSource classes to extend DataFlow::Node directly. 
Since `ThreatModelFlowSource` contains `RemoteFlowSource` by default, we
can safely remove the `RemoteSource` from the default of the queries.
 2024-02-29 12:03:16 -05:00
Ed Minnix
e64826db1b Add threat-model configuration for UncontrolledFormatString test 2024-02-29 12:03:14 -05:00
Ed Minnix
af749e221b Remove commented out code 2024-02-29 12:03:13 -05:00
Ed Minnix
f237d2aeda Refactor to use ThreatModelFlowSource 2024-02-29 12:03:12 -05:00
Ed Minnix
5198f52351 Add references to changed queries in change note 2024-02-29 12:03:11 -05:00
Ed Minnix
22e8da2928 Update change note date 2024-02-29 12:03:09 -05:00
Ed Minnix
eb81946adc Change note changes to mention local sources as well 2024-02-29 12:03:08 -05:00
Ed Minnix
b4dabee770 Remove unnecessary flowsources.Remote imports 
Since `FlowSources` now re-exports `Remote`, these can be safely removed.
 2024-02-29 12:03:07 -05:00
Ed Minnix
434fa20646 Refactor to using ThreatModelFlowSource 2024-02-29 12:03:05 -05:00
Ed Minnix
1086abca63 Refactor to using ThreatModelFlowSource 2024-02-29 12:03:04 -05:00