hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-06 15:49:08 +01:00
Code Issues Packages Projects Releases Wiki Activity
12,710 Commits 1,703 Branches 162 Tags
26dfca80f6b487f30c258e5964a7ba38af17c00d
Commit Graph

12710 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
semmle-qlci
26dfca80f6 Merge pull request #3510 from max-schaefer/cull-boring-queries 
Approved by asgerf, esbena
 2020-05-19 15:41:53 +01:00
Mathias Vorreiter Pedersen
f0f7e531d7 Merge pull request #3511 from jbj/simplify-field-conflation-test 
C++: Simplify field conflation test
 2020-05-19 16:04:45 +02:00
yo-h
bfeaeccf60 Merge pull request #3507 from aschackmull/java/cleanup-deprecated-overrides 
Java: Clean up deprecated overrides.
 2020-05-19 09:47:57 -04:00
Max Schaefer
a803120414 Lower precision for a number of queries. 
These queries are currently run by default, but don't have their results displayed.

Looking through results on LGTM.com, they are either false positives (e.g., `BitwiseSignCheck` which flags many perfectly harmless operations and `CompareIdenticalValues` which mostly flags NaN checks) or harmless results that developers are unlikely to care about (e.g., `EmptyArrayInit` or `MisspelledIdentifier`).

With this PR, the only queries that are still run but not displayed are security queries, where different considerations may apply.
 2020-05-19 13:43:17 +01:00
Jonas Jensen
486f06ab18 C++: Simplify field conflation test 
It turned out the `memcpy` step was not even necessary.
 2020-05-19 14:12:11 +02:00
Anders Schack-Mulligen
6f03a0bc39 Merge pull request #3487 from luchua-bc/java-sensitive-jboss-logging 
Add JBoss logging
 2020-05-19 11:04:18 +02:00
Anders Schack-Mulligen
c36e6213f1 Merge pull request #3288 from ggolawski/jndi-injection 
CodeQL query to detect JNDI injections
 2020-05-19 11:03:29 +02:00
Anders Schack-Mulligen
9d7329de30 Java: Clean up deprecated overrides. 2020-05-19 10:41:41 +02:00
semmle-qlci
0c081a8e87 Merge pull request #3497 from esbena/js/yield-and-local-objects 
Approved by asgerf, erik-krogh
 2020-05-19 09:02:22 +01:00
semmle-qlci
0d762066f5 Merge pull request #3504 from erik-krogh/unique 
Approved by esbena
 2020-05-19 08:35:08 +01:00
Grzegorz Golawski
73e736b47a Enhanced comments according to the review comment 2020-05-18 23:37:48 +02:00
Grzegorz Goławski
0075d35346 Update java/ql/src/experimental/Security/CWE/CWE-074/JndiInjectionLib.qll 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2020-05-18 23:18:16 +02:00
semmle-qlci
192bf918c3 Merge pull request #3488 from asger-semmle/js/sql-type-tracking 
Approved by erik-krogh
 2020-05-18 19:57:32 +01:00
Erik Krogh Kristensen
202b8a56b7 apply the unique aggregate where trivially applicable 2020-05-18 20:37:38 +02:00
Asger F
96d6115452 Merge branch 'master' into js/sql-type-tracking 2020-05-18 15:58:42 +01:00
Bt2018
69f2525e62 Remove the ending blank lines for auto-format check 2020-05-18 10:02:37 -04:00
semmle-qlci
0da1e68462 Merge pull request #3498 from max-schaefer/js/remote-exec 
Approved by esbena
 2020-05-18 14:17:20 +01:00
Asger F
a9983fdb49 Update javascript/ql/src/semmle/javascript/frameworks/SQL.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-18 13:23:22 +01:00
Max Schaefer
bdd778f989 JavaScript: Add change note. 2020-05-18 12:08:36 +01:00
Max Schaefer
6797fec1a3 JavaScript: Add more models of packages that execute commands over SSH. 2020-05-18 12:08:14 +01:00
Esben Sparre Andreasen
a9ba6ac659 JS: make LocalObjects::isEscape aware of yield 2020-05-18 12:43:46 +02:00
semmle-qlci
14664be467 Merge pull request #3468 from p0/imp/nodejs-vm-sinks 
Approved by esbena
 2020-05-18 11:10:13 +01:00
Asger Feldthaus
a18e0b37cf JS: simplify sequelize model 2020-05-18 09:34:17 +01:00
Asger F
f52c827966 Apply suggestions from code review 
Base type of EscapingSanitizer

Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-18 09:31:09 +01:00
Asger F
ffb22c061a Apply suggestions from code review 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-18 09:28:22 +01:00
semmle-qlci
6041d52936 Merge pull request #3424 from asger-semmle/js/express-param-handler 
Approved by esbena
 2020-05-18 08:48:24 +01:00
semmle-qlci
135eae9895 Merge pull request #3483 from esbena/js/fix-qhelp-FNs 
Approved by asgerf
 2020-05-18 08:47:05 +01:00
semmle-qlci
0230b79efc Merge pull request #3391 from erik-krogh/SplitFPs 
Approved by esbena
 2020-05-18 08:46:26 +01:00
semmle-qlci
8d41ce1630 Merge pull request #3480 from erik-krogh/moreSlip 
Approved by esbena
 2020-05-16 21:17:27 +01:00
Mathias Vorreiter Pedersen
a42d80aa14 Merge pull request #3481 from dbartol/github/codeql-c-analysis-team/69 
C++/C#: Allow memory operands to lack a definition
 2020-05-16 11:53:00 +02:00
Asger Feldthaus
897a3e39c9 JS: Autoformat 2020-05-16 09:37:16 +01:00
Asger Feldthaus
0171c9e10c JS: Autoformat 2020-05-16 09:25:18 +01:00
Asger Feldthaus
d279845a43 JS: Minor fixes 2020-05-16 09:24:53 +01:00
yo-h
4f00e40257 Merge pull request #3474 from aschackmull/java/string-formatted 
Java: Add taint steps for String.formatted.
 2020-05-15 22:04:36 -04:00
yo-h
69ab158910 Merge pull request #3473 from aschackmull/java/switchexpr 
Java: Extend library support for switch expressions.
 2020-05-15 20:46:37 -04:00
Dave Bartolomeo
96c87b309b C++/C#: Use unique to get a better join order 
The previous changes made the optimizer choose a bad join order for the RHS of the antijoin in `addressOperandAllocationAndOffset`. Once again, `unique` to the rescue.
 2020-05-15 17:36:43 -04:00
Asger Feldthaus
435f9ea09f JS: Change note 2020-05-15 17:27:30 +01:00
Asger Feldthaus
5249e84359 JS: Type track spanner model 2020-05-15 17:27:30 +01:00
Asger Feldthaus
d225715828 JS: Type track mssql model 2020-05-15 17:27:30 +01:00
Asger Feldthaus
6dcee5a0ef JS: Type track sqlite model 2020-05-15 17:27:30 +01:00
Asger Feldthaus
84cd02cf01 JS: Type track pg model 2020-05-15 17:27:27 +01:00
Asger Feldthaus
f7771f17d1 JS: Type track mysql model 2020-05-15 17:27:27 +01:00
Asger Feldthaus
3e9849b7c4 JS: Type track sequelize model 2020-05-15 17:27:24 +01:00
luchua-bc
4117cd73a7 Add JBoss logging 2020-05-15 16:14:41 +00:00
Jonas Jensen
b08de6c051 Merge pull request #3482 from MathiasVP/getlim-taint-source 
C++: Add GetDelim as taint step
 2020-05-15 15:54:29 +02:00
Calum Grant
5787871734 Merge pull request #3351 from hvitved/csharp/unification-nested-types 
C#: Teach unification library about nested types
 2020-05-15 14:11:00 +01:00
Calum Grant
cc844648ff Merge pull request #3365 from hvitved/csharp/format-queries-path-problem 
C#: Convert `string.format()` queries to path queries
 2020-05-15 14:08:54 +01:00
Rasmus Wriedt Larsen
061f318576 Merge pull request #3460 from yoff/boolDefault 
Python: __bool__ does not raise TypeError by default
 2020-05-15 15:07:45 +02:00
Dave Bartolomeo
89ec60c948 C++/C#: Add missing QLDoc 2020-05-15 09:01:16 -04:00
Dave Bartolomeo
bcddaf4c29 C++/C#: Fix formatting 2020-05-15 08:56:32 -04:00