hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-11 05:30:24 +01:00
Code Issues Packages Projects Releases Wiki Activity
13,462 Commits 1,679 Branches 158 Tags
4853b8a281e18c0e7ae3585b18df7ff1eb284c19
Commit Graph

13462 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
toufik-airane
4853b8a281 Try to finish the PR 
- Add help documentation
- Empty qll file
- rename examples
 2020-06-22 13:26:13 +02:00
toufik-airane
7166d5422e add test file for CWE-347 
Add a test file for CWE-347.
The HS256 algorithm is safe, but the none algorithm is unsafe.
 2020-06-20 17:10:35 +02:00
toufik-airane
8a2a33459a Merge branch 'master' of github.com:toufik-airane/codeql 2020-06-20 16:56:27 +02:00
toufik-airane
b0aaca0e1c JWT Missing Secret Or Public Key Verification 
Add an experimental CodeQL query.
 2020-06-20 16:54:41 +02:00
Jonas Jensen
ac89559b20 Merge pull request #3744 from github/p0-patch-1 
Fix typo in cpp-security-extended.qls
 2020-06-19 21:19:20 +02:00
Pavel Avgustinov
00f1e57d0c Update cpp-security-extended.qls 2020-06-19 20:16:24 +01:00
Jonas Jensen
81d8dc15cd Merge pull request #3693 from geoffw0/stringtest 
C++: Add tests of char* -> std::string -> char* conversions.
 2020-06-19 21:12:33 +02:00
Tom Hvitved
573d55a160 Merge pull request #3740 from github/codeql-analysis-yml 
Enable code scanning
 2020-06-19 17:57:52 +02:00
Taus
2081d0cecc Merge pull request #3575 from RasmusWL/python-add-qldoc-FunctionValue.getQualifiedName 
Python: Add QLDoc for FunctionValue.getQualifiedName
 2020-06-19 16:32:23 +02:00
Tom Hvitved
56670f3a5f Disable analysis for JS and Python 2020-06-19 16:25:23 +02:00
Jonas Jensen
09d7ed092b Merge pull request #3612 from dbartol/github/codeql-c-analysis-team/69_union 
C++: Share `TInstruction` across IR stages
 2020-06-19 16:03:11 +02:00
Tom Hvitved
4b47483263 Add codeql-config.yml 2020-06-19 12:28:52 +00:00
Tom Hvitved
ffe3f500d7 Restrict languages in codeql-analysis.yml 2020-06-19 13:01:28 +02:00
Anders Schack-Mulligen
8107fbadc2 Merge pull request #3456 from hvitved/dataflow/precise-field-types 
Data flow: Track precise types during field flow
 2020-06-19 11:50:10 +02:00
Esben Sparre Andreasen
4126d5b59e Merge pull request #3646 from dellalibera/master 
[javascript] CodeQL query to detect missing origin validation in cross-origin communication via postMessage
 2020-06-19 11:43:57 +02:00
Tom Hvitved
a285f6460c Create codeql-analysis.yml 2020-06-19 11:34:31 +02:00
Esben Sparre Andreasen
baaa31665a Update javascript/ql/src/experimental/Security/CWE-020/PostMessageNoOriginCheck.qhelp 2020-06-19 09:05:13 +02:00
Alessio Della Libera
eba64dba7c Update javascript/ql/src/experimental/Security/CWE-020/PostMessageNoOriginCheck.ql 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-06-18 19:44:46 +02:00
Alessio Della Libera
c0271b1627 Update javascript/ql/src/experimental/Security/CWE-020/PostMessageNoOriginCheck.qhelp 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-06-18 19:44:38 +02:00
Alessio Della Libera
ffc9a449ab Update javascript/ql/src/experimental/Security/CWE-020/PostMessageNoOriginCheck.qhelp 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-06-18 19:43:45 +02:00
Alessio Della Libera
e84339d5bf Update javascript/ql/src/experimental/Security/CWE-020/PostMessageNoOriginCheck.qhelp 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-06-18 19:43:36 +02:00
ubuntu
71a7ec593c Use StringOps to identify functions used for verifing the origin 2020-06-18 19:41:07 +02:00
Taus
44637e29ee Merge pull request #3716 from RasmusWL/python-fix-re-escape-fp 
Python: Fix FP in treating re.escape as regex
 2020-06-18 16:05:50 +02:00
Geoffrey White
35487ff109 Merge branch 'master' into stringtest 2020-06-17 19:00:26 +01:00
ubuntu
c490cfdfa5 Create another branch 2020-06-17 19:51:14 +02:00
ubuntu
4ccfdef71d Add CodeQL query to detect Log Injection in JS code 2020-06-17 19:44:58 +02:00
Geoffrey White
174fdadbf5 Merge branch 'master' into stringtest 2020-06-17 18:24:30 +01:00
Geoffrey White
03c6d7a7e5 Merge pull request #3654 from jbj/controlsBlock-perf 
C++: Speed up IRGuardCondition::controlsBlock
 2020-06-17 17:53:10 +01:00
Tom Hvitved
ad56f17246 Merge pull request #2 from aschackmull/dataflow/content-type-tracking 
Dataflow: Record content types
 2020-06-17 17:26:04 +02:00
Anders Schack-Mulligen
74eab3cbc0 Dataflow: Fix qltest. 2020-06-17 17:23:35 +02:00
Anders Schack-Mulligen
cedfaf6aaf Dataflow: autoformat 2020-06-17 17:09:55 +02:00
Anders Schack-Mulligen
543ab71dfe Dataflow: minor review fixes. 2020-06-17 17:03:22 +02:00
Dave Bartolomeo
687d6d2643 C++: Replace TRawInstruction() calls 
Replace most direct calls to `TRawInstruction()` with calls to `getInstructionTranslatedElement()` and `getInstructionTag()`, matching existing practice. One tiny RA diff in an inconsequential join order in `getInstructionVariable`.
 2020-06-17 10:52:32 -04:00
Dave Bartolomeo
c1016743a5 C++: Remove instructionOrigin() 
This noopt predicate is no longer necessary. It's equivalent to `instruction = TRawInstruction(element, tag)`, which is already materialized and has a more favorable column order anyway.
 2020-06-17 10:25:59 -04:00
Dave Bartolomeo
e85cc0b0c6 C++: Stop caching raw IR construction predicates 
These predicates are only used within the new single IR stage, so there's no need to cache them beyond that. RA diffs are trivial. Where previously many of the predicate on `Instruction` were inline wrappers around cached predicates from `IRConstruction`, now the predicates from `IRConstruction` get inlined into the `Instruction` predicates, and the `Instruction` predicates get materialized. The net amount of work is the same, but now it's not getting cached unnecessarily.
 2020-06-17 09:47:48 -04:00
Anders Schack-Mulligen
d28b5ace63 Dataflow: Sync. 2020-06-17 15:40:48 +02:00
Anders Schack-Mulligen
10b64fc47a Dataflow: Record content type for stores. 2020-06-17 15:40:42 +02:00
Mathias Vorreiter Pedersen
01abaf373a Merge pull request #3728 from geoffw0/memberfunctions 
C++: Split MemberFunction.qll from Function.qll.
 2020-06-17 14:54:33 +02:00
Jonas Jensen
a87ff80ac0 Merge pull request #3587 from rdmarsh2/ir-this-parameter-2 
C++: IR return indirections for `this`
 2020-06-17 13:27:35 +02:00
Geoffrey White
7edaade175 C++: Improve QLDoc. 2020-06-17 12:11:42 +01:00
Erik Krogh Kristensen
cd111fe350 Merge pull request #3721 from asger-semmle/js/non-linear-pattern-msg 
JS: Improve alert message in js/non-linear-pattern
 2020-06-17 13:10:56 +02:00
Geoffrey White
0a9ec70c31 C++: Autoformat. 2020-06-17 11:54:50 +01:00
Geoffrey White
f3e24963cb C++: Update QLDoc. 2020-06-17 10:27:34 +01:00
ubuntu
22cb45beab Merge remote-tracking branch 'upstream/master' 2020-06-17 11:13:13 +02:00
Dave Bartolomeo
8e977dc6bf C++/C#: Move overrides of IRType::getByteSize() into leaf classes 
See https://github.com/github/codeql/pull/2272. I've added code comments in all of the places that future me will be tempted to hoist these overrides.
 2020-06-16 16:48:42 -04:00
Dave Bartolomeo
24c3110989 Merge from master 2020-06-16 16:37:38 -04:00
Robert Marsh
ef940e815f C++: Add comment for false positives in swap tests 2020-06-16 11:46:14 -07:00
Robert Marsh
0c99b3644c C++: remove false negative comments in swap tests 2020-06-16 11:33:26 -07:00
Robert Marsh
1c9b6f0a48 Merge branch 'master' into ir-this-parameter-2 
Accept test changes - dataflow changes are all positive
 2020-06-16 11:28:49 -07:00
Geoffrey White
3d75d287a9 C++: Split MemberFunction.qll from Function.qll. 2020-06-16 17:40:46 +01:00