hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-29 08:37:04 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,208 Commits 1,785 Branches 169 Tags
1bcdbd2d348f1d72ac724b178dbe7c19ebc0cd32
Commit Graph

785 Commits

Author SHA1 Message Date
Chad Bentz
c08c0e9ae5 Merge branch 'main' into felickz/razor-page-handler-sources 2026-06-15 11:35:54 -04:00
Chad Bentz
4f1d6f472d Fix test comments: replace GOOD/BAD markers with flow source descriptions 
Per review feedback, GOOD/BAD markers don't apply to flow source
enumeration tests. Use descriptive comments instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-15 11:34:43 -04:00
Michael Nebel
175c4f1b0d C#: Add models as data tests for compound assignment operators. 2026-06-15 13:26:39 +02:00
Chad Bentz
ce9e61dbfd C#: Add Razor Page handler method parameters as remote flow sources 
ASP.NET Core Razor Page handler method parameters (OnGet, OnPost, etc.)
were not modeled as remote flow sources, causing security queries like
SQL injection to miss vulnerabilities in PageModel subclasses.

This adds AspNetCorePageHandlerMethodParameter, analogous to the existing
AspNetCoreActionMethodParameter for MVC controllers, using the existing
PageModelClass.getAHandlerMethod() from Razor.qll.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:50:12 -04:00
Michael Nebel
4bd9005f9a C#: Add data flow testcases for mutation operators. 2026-05-13 09:24:54 +02:00
Anders Schack-Mulligen
02f5fe9a42 C#: Address some review comments. 2026-05-04 11:49:24 +02:00
Anders Schack-Mulligen
e012981e5b C#: Accept test changes for out/ref SSA location changes. 2026-05-01 10:32:18 +02:00
Anders Schack-Mulligen
351e9cc914 C#: Accept test changes. 2026-05-01 10:28:15 +02:00
Anders Schack-Mulligen
9a7eb8dfb9 C#: Replace Ssa::PhiNode with SsaPhiDefinition. 2026-04-30 13:49:23 +02:00
Anders Schack-Mulligen
6ecdf3fe32 C#: Replace Ssa::ImplicitParameterDefinition with SsaParameterInit. 2026-04-30 13:49:19 +02:00
Anders Schack-Mulligen
dc34b10cb6 C#: Replace Ssa::ExplicitDefinition with SsaExplicitWrite. 2026-04-30 12:52:51 +02:00
Anders Schack-Mulligen
ed6cdfc227 C#: Move isLiveOutRefParameterDefinition to top-level. 2026-04-30 12:46:27 +02:00
Anders Schack-Mulligen
9345c44e0f C#: Delete test for Definition.getElement. 2026-04-30 12:46:23 +02:00
Anders Schack-Mulligen
c88a22ccf8 C#: Replace most uses of Ssa::Definition with SsaDefinition. 2026-04-30 12:45:25 +02:00
Anders Schack-Mulligen
83c7a33e53 C#: Deprecate member predicates Definition.getAFirstRead and getAFirstReadAtNode. 2026-04-30 12:42:21 +02:00
Tom Hvitved
6c42418faf C#: Use parameter CFG nodes in SSA 2026-04-29 14:01:11 +02:00
Tom Hvitved
cbe207ab65 C#: Include parameters and their defaults in the CFG 2026-04-29 14:01:09 +02:00
Tom Hvitved
d792e11b7f C#: Add tests for methods with default parameters 2026-04-29 14:01:08 +02:00
Michael Nebel
01baa6e3ae C#: Add tests and update expected test output. 2026-04-24 08:57:11 +02:00
Anders Schack-Mulligen
4b8e4b40af C#: Fix test. 2026-04-22 14:00:13 +02:00
Anders Schack-Mulligen
bbd60031b1 C#: Replace references to old BaseSSA classes. 2026-04-22 11:53:40 +02:00
Michael Nebel
bca51a986c Merge pull request #21612 from michaelnebel/csharp/legacyasptaintedmember 
C#: Taint members of types in ASP.NET user context.
 2026-04-22 09:28:27 +02:00
Michael Nebel
8b93ce2747 C#: Add ASP.NET test case for a collection type. 2026-04-21 14:27:06 +02:00
Michael Nebel
8060d2ff24 C#: Streamline the implementation for ASP.NET Core tainted members. 2026-04-21 13:40:02 +02:00
Michael Nebel
921d93e427 C#: Add an ASP.NET flow source example when using the WebMethod attribute. 2026-04-21 13:39:59 +02:00
Michael Nebel
0062eb1209 C#: Update remote flow sources test to also report tainted members. 2026-04-21 13:39:51 +02:00
Anders Schack-Mulligen
a2a4e8288e C#: Deprecate ControlFlowElement.getAControlFlowNode and remove some splitting quantification. 2026-04-21 11:14:05 +02:00
Anders Schack-Mulligen
aaf9bb2e9e C#: Accept fewer CallContextSpecificCall due to no splitting. 2026-04-10 15:47:24 +02:00
Anders Schack-Mulligen
2d5a1840f4 C#: Accept new CFG in tests. 2026-04-10 15:47:24 +02:00
Anders Schack-Mulligen
a7d4b00d06 C#: Accept changed location for phi nodes. 2026-04-10 15:47:21 +02:00
Anders Schack-Mulligen
e90243c348 C#: Accept irrelevant changes. 
The additions are unintentional, but the fault lies with the shared
SignAnalysis code. The removals are due to compile-time constant
initializers no longer having CFG nodes.
 2026-04-10 15:47:19 +02:00
Anders Schack-Mulligen
49cc931f92 C#: Compile-time constants no longer have CFG nodes. 2026-04-10 15:47:18 +02:00
Anders Schack-Mulligen
1a6670a6bb C#: Phi nodes are not expected to have associated Elements. 2026-04-10 15:47:16 +02:00
Anders Schack-Mulligen
43fe411585 C#: Accept SSA location changes. 2026-04-10 15:47:16 +02:00
Anders Schack-Mulligen
b1790335c0 C#: Fix test. 2026-04-10 15:47:14 +02:00
Anders Schack-Mulligen
9cf9a36d0d C#: Rename ControlFlow::BasicBlock to BasicBlock. 2026-04-10 15:47:12 +02:00
Anders Schack-Mulligen
13a4141cc6 C#: Rename remaining references to ControlFlow::Nodes. 2026-04-10 15:47:12 +02:00
Anders Schack-Mulligen
61976e3ef0 C#: Rename ControlFlow::Node to ControlFlowNode. 2026-04-10 15:47:10 +02:00
Michael Nebel
55516342b2 C#: Add/update tests and expected output. 2026-03-24 15:32:11 +01:00
Mathias Vorreiter Pedersen
f8f8991d36 C#: Accept more test changes. 2026-03-04 13:06:59 +00:00
Mathias Vorreiter Pedersen
088913d925 C#: Accept test changes. 2026-03-04 12:26:07 +00:00
Mathias Vorreiter Pedersen
b7992ed8cd C#: Add test. 2026-03-04 12:25:08 +00:00
Michael Nebel
cfd4be6b4e C#: Update test expected output. 2026-03-03 14:39:57 +01:00
Michael Nebel
8807217e49 C#: Add implicit conversion operator taint example. 2026-03-03 14:26:46 +01:00
Michael Nebel
a3d15dbaa3 C#: Update test expected output for new tests. 2026-03-02 15:25:31 +01:00
Michael Nebel
4e63b83fd3 C#: Add struct source model example. 2026-03-02 14:50:04 +01:00
Michael Nebel
ea1fc43732 C#: Add data flow test for struct. 2026-03-02 14:50:01 +01:00
Michael Nebel
113565ba76 C#: Update test expected output. 2026-02-24 14:38:59 +01:00
Michael Nebel
884c61604e C#: Add dataflow test for partial constructors. 2026-02-24 14:32:22 +01:00
Michael Nebel
03a54bfbf9 C#: Update test expected output. 2026-02-24 07:55:57 +01:00