hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity
22,808 Commits 1,672 Branches 157 Tags
1b51dd47ec2717f0da468af752134042cbf9abc3
Commit Graph

991 Commits

Author SHA1 Message Date
CodeQL CI
23e8092452 Merge pull request #5864 from RasmusWL/some-framework-modeling 
Approved by tausbn
 2021-05-19 02:31:06 -07:00
Ethan Palm
610e041e28 Add reviewer feedback 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
 2021-05-18 11:42:08 -04:00
Ethan P
58c746e42b fix formatting 2021-05-14 14:09:07 -04:00
Ethan P
0e99d5e379 Add examples of both tracing mechanisms 2021-05-14 14:05:55 -04:00
Ethan Palm
6dd30ee5e2 clarify options for tracing 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-05-14 14:00:33 -04:00
Ethan Palm
4cf695b5ab specify `--command` option 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2021-05-14 10:00:17 -04:00
Ethan P
406fb1e383 Update with Go custom build options 2021-05-13 17:29:34 -04:00
CodeQL CI
beb66fc4db Merge pull request #5719 from asgerf/js/nestjs 
Approved by esbena
 2021-05-11 02:08:27 -07:00
Rasmus Wriedt Larsen
c2a6b811fc Python: Add modeling of ujson PyPI package 
The problem with `tainted_filelike` not having taint, is that in the call

`ujson.dump(tainted_obj, tainted_filelike)`

there is no PostUpdateNote for `tainted_filelike` :( The reason is that
points-to is not able to resolve the call, so none of the clauses in
`argumentPreUpdateNode` matches

See 08731fc6cf/python/ql/src/semmle/python/dataflow/new/internal/DataFlowPrivate.qll (L101-L111)

Let's deal with that issue in an other PR though
 2021-05-10 15:10:31 +02:00
Rasmus Wriedt Larsen
3fe9a3d933 Python: Add modeling of simplejson PyPI package 
I noticed that we don't handle PostUpdateNote very well in the concept tests,
for exmaple for `json.dump(...)` there _should_ have been an `encodeOutput` as
part of the inline expectations.

I'll work on fixing that up in a separate PR, to keep things clean.
 2021-05-10 15:10:27 +02:00
Rasmus Wriedt Larsen
8afdf26540 Python: Add modeling of idna PyPI package 2021-05-10 11:47:11 +02:00
CodeQL CI
b1f28afcbd Merge pull request #5741 from asgerf/js/more-cheat-sheet 
Approved by erik-krogh
 2021-05-10 01:34:56 -07:00
Felicity Chapman
10e76ff28f Merge pull request #5831 from github/3893-code-scanning 
Update CodeQL CLI article to use different query suite example
 2021-05-07 12:37:47 +01:00
Shati Patel
cf80773453 Merge pull request #5830 from Marcono1234/marcono1234/guides-link-updates 
Docs: Use GitHub links for guides, improve formatting
 2021-05-06 16:44:11 +01:00
Felicity Chapman
616a57d6d4 Update article with code scanning example 2021-05-04 12:11:18 +01:00
Marcono1234
ab90fe18fd Docs: Use GitHub links for guides, improve formatting 2021-05-04 12:35:23 +02:00
Mario Campos
ae857db657 Add React Native to JavaScript frameworks 
According to @asgerf, React Native is already supported 🎉
 2021-04-30 10:47:08 -05:00
Chuan-kai Lin
c27363cea5 Fix inconsistencies in information about the thief 
The find-the-thief exercise is inconsistent.  The first part lists 10 answered questions about the thief, but later discussion silently adds a new question as question 8, so there are a total of 11 answered questions.

This commit updates the first list of answered questions so that it matches later discussions and the sample solution.
 2021-04-27 13:57:16 -07:00
Erik Krogh Kristensen
0b322a3143 update JS/TS versions to reflect supported versions 2021-04-27 08:53:15 +02:00
Shati Patel
a09c12acfe Merge pull request #5537 from alexet/ambig-super 
Docs: Update the language specification for changes to super.
 2021-04-26 13:34:50 +01:00
Shati Patel
6f2103f312 Merge pull request #5722 from github/tamasvajk-patch-1 
C#: Add Dapper to supported frameworks
 2021-04-23 14:32:22 +01:00
Asger Feldthaus
0da0670a79 JS: Add Nest.js to list of supported framworks 2021-04-23 13:15:35 +01:00
Tamás Vajk
819be43ce7 Fix alphabetical order of supported frameworks 2021-04-23 13:41:59 +02:00
Shati Patel
96a4d91a6c Merge pull request #5731 from shati-patel/docs/unbind-pragmas 
Docs: New "directional binding" pragmas
 2021-04-23 08:37:02 +01:00
Asger Feldthaus
d2646ea4ad JS: More consistent section capitalization 2021-04-22 09:06:44 +01:00
Asger Feldthaus
0dceabe704 JS: Reference specific section of cheat sheet 2021-04-22 09:06:09 +01:00
asgerf
226792c73a JS: Expand RemoteFlowSource and move into own section 2021-04-21 12:04:09 +01:00
asgerf
5df8583056 JS: Mention isUserControlledObject 2021-04-21 11:40:27 +01:00
asgerf
ff73c0b247 JS: Add section with access paths to cheat sheet 2021-04-21 11:40:27 +01:00
asgerf
f611d06ed0 JS: Add getALocalUse to cheat sheet 2021-04-21 10:53:10 +01:00
Shati Patel
98a0959784 Docs: New "directional binding" pragmas 2021-04-20 18:12:35 +01:00
Tamás Vajk
408954e4d8 C#: Add Dapper to supported frameworks 2021-04-20 09:30:47 +02:00
Tamas Vajk
b0975bb3ea Update supported C#/.NET versions 2021-04-16 09:15:43 +02:00
Tom Hvitved
7d2a60e910 Merge pull request #5640 from hvitved/dataflow/path-step-perf 
Data flow: Prevent bad join-order in `pathStep`
 2021-04-12 14:40:46 +02:00
Tom Hvitved
cf5f838b13 Data flow: Remove recommendation to use unique in Node::getEnclosingCallable() 2021-04-12 12:04:23 +02:00
Shati Patel
2d618d6b92 Merge pull request #5625 from shati-patel/docs/cli-manual 
Docs: Link to CodeQL CLI manual from the sidebar
 2021-04-09 15:30:24 +01:00
Shati Patel
f372274857 Docs: Fix broken links 2021-04-07 18:02:29 +01:00
Shati Patel
2373bf2dfb Docs: Link to CodeQL CLI manual from the sidebar 2021-04-07 17:55:05 +01:00
Shati Patel
461d4e45af Merge pull request #5608 from shati-patel/docs/telemetry-settings 
Docs: Mention telemetry in "customizing settings"
 2021-04-07 13:44:32 +01:00
Shati Patel
9a41c80626 Merge pull request #5574 from github/smowton/admin/update-supported-go-version 
Update supported Go version to 1.16
 2021-04-06 14:54:36 +01:00
Shati Patel
695b02a94c Docs: Mention telemetry in "customizing settings" 2021-04-06 14:30:17 +01:00
Shati Patel
36bdee0e8b Merge pull request #5571 from github/docs/bug-fix 
Docs: Typo fix
 2021-03-31 21:59:43 +01:00
Chris Smowton
4f9b6d1192 Update supported Go version to 1.16 2021-03-31 08:56:27 +01:00
Shati Patel
b9788eb53c Merge pull request #5568 from shati-patel/docs-binding-sets 
Docs: Mention that binding sets are available for classes
 2021-03-30 18:08:23 +01:00
Sarita Iyer
649286995a Merge pull request #5562 from saritai/saritai/cli-remove-1.23-references 
Remove Enterprise 1.23 special instructions and replace references
 2021-03-30 13:07:42 -04:00
Shati Patel
fb004bacc3 Describe predicates first 2021-03-30 17:31:20 +01:00
Shati Patel
67835ee273 Address review comments 2021-03-30 17:29:43 +01:00
Shati Patel
23df459c16 remove accidental punctuation 2021-03-30 17:23:33 +01:00
Sarah Edwards
e0a73ce797 Merge pull request #5560 from skedwards88/patch-1 
download LGTM database from a project slug
 2021-03-30 06:58:28 -07:00
Shati Patel
62de15cd22 Docs: Mention that binding sets are available for classes 2021-03-30 14:46:59 +01:00