Jami Cogswell
48d1fe062b
Java: remove exists variable
2025-01-30 10:13:59 -05:00
Jami Cogswell
c9ad15cc83
Java: update .expected file contents
2025-01-30 10:13:57 -05:00
Jami Cogswell
39ccde0c9d
Java: add name-based heuristic
2025-01-30 10:13:54 -05:00
Jami Cogswell
286c655264
Java: add class for Stapler web methods that are not default-protected from CSRF
2025-01-30 10:13:52 -05:00
Jami Cogswell
0f39011122
Java: add taint-tracking config for execute to exclude FPs from non-update queries like select
2025-01-30 10:13:50 -05:00
Jami Cogswell
97aaf4c011
Java: handle MyBatis annotations for insert/update/delete
2025-01-30 10:13:48 -05:00
Jami Cogswell
df77d4914f
Java: initial tests
2025-01-30 10:13:45 -05:00
Jami Cogswell
178b032453
Java: add query
2025-01-30 10:13:43 -05:00
Jami Cogswell
c553e3132e
Java: add CallGraph module for displaying call graph paths
2025-01-30 10:13:41 -05:00
Jami Cogswell
87a8746b22
Java: add a class for methods that update a sql database (found using sql-injection nodes)
2025-01-30 10:13:39 -05:00
Jami Cogswell
43a288070c
Java: add a class for PreparedStatement methods that update a database
2025-01-30 10:13:37 -05:00
Jami Cogswell
b88731df80
Java: move contents of MyBatisMapperXML.qll in src to MyBatis.qll in lib so importable, and fix experimental files broken by the move
2025-01-30 10:13:27 -05:00
Jami Cogswell
8e9f21dc52
Java: add a class for MyBatis Mapper methods that update a database
2025-01-30 10:01:43 -05:00
Jami Cogswell
506d668289
Java: add class for Spring request mapping methods that are not default-protected from CSRF
2025-01-30 10:01:41 -05:00
Jami Cogswell
0c6925399d
Java: add qhelp
2025-01-30 10:01:39 -05:00
Chuan-kai Lin
b3b7817a2b
Merge pull request #18603 from github/cklin/restrict-alerts-to-exact
...
AlertFiltering: add restrictAlertsToExactLocation
2025-01-30 06:40:39 -08:00
Anders Schack-Mulligen
8edcad0509
Merge pull request #18634 from aschackmull/cpp/unnest-getkind
...
C++: Un-nest the if-then-else sequence.
2025-01-30 14:07:07 +01:00
Jeroen Ketema
8f25dbf98d
Merge pull request #18606 from jketema/typeref
...
C++: Support mixed `typedef`s and `using`s
2025-01-30 14:04:48 +01:00
Jonas Jensen
e27e3ae5a1
Merge pull request #18610 from jbj/bigint-language-reference
...
QL reference: more BigInt updates
2025-01-30 13:47:30 +01:00
Anders Schack-Mulligen
15171eb1a5
C++: Un-nest the if-then-else sequence.
2025-01-30 13:28:44 +01:00
Jonas Jensen
455eb5bf9b
QL spec: fix typo
2025-01-30 13:09:15 +01:00
Chuan-kai Lin
d6f9eb2953
Merge pull request #18617 from github/cklin/merge-back-2.20.3
...
Mergeback from codeql-cli-2.20.3
2025-01-29 08:15:51 -08:00
Chuan-kai Lin
96caa686fc
AlertFiltering: add restrictAlertsToExactLocation
...
This commit introduces a new extensible predicate
restrictAlertsToExactLocation, which is similar to the existing
restrictAlertsTo predicate but matches alert locations exactly.
2025-01-29 07:50:45 -08:00
Owen Mansel-Chan
04e17ec987
Merge pull request #18565 from owen-mc/go/mad/parameter
...
Go: Fix "Parameter" in models-as-data
2025-01-29 14:13:17 +00:00
Owen Mansel-Chan
168fe4ae20
Merge pull request #18543 from owen-mc/go/misc-improvements-rs-cors
...
Go: miscellaneous improvements rs cors models
2025-01-29 14:12:20 +00:00
Arthur Baars
54efb0a4a6
Merge pull request #18611 from github/aibaars/use-tree-star
...
Rust: add UseTree::is_star
2025-01-29 14:42:03 +01:00
Mathias Vorreiter Pedersen
4b2c7ef03f
Merge pull request #18615 from MathiasVP/fix-fp-buffer-overflow
...
C++: Fix FPs in `cpp/overflow-buffer`
2025-01-29 12:12:47 +00:00
Mathias Vorreiter Pedersen
6e312140ce
Merge pull request #18618 from MathiasVP/18592-follow-follow-up-up
...
C++: Don't infer lambda calls when there is a static dispatch
2025-01-29 12:04:46 +00:00
Simon Friis Vindum
e141b4ee95
Merge pull request #18612 from paldepind/shared-model-generation-row
...
Shared: Generalize the number of columns in a generated MaD row
2025-01-29 12:56:07 +01:00
Mathias Vorreiter Pedersen
48cae7e7ed
C++: Accept test changes after previous commit.
2025-01-29 11:04:55 +00:00
Mathias Vorreiter Pedersen
373b38e881
Update cpp/ql/test/query-tests/Security/CWE/CWE-119/semmle/tests/tests.cpp
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2025-01-29 11:03:52 +00:00
Simon Friis Vindum
9d87f26145
Shared: Use strictconcat in model generator printing
2025-01-29 11:56:39 +01:00
Michael Nebel
ee5416f0b1
Merge pull request #18299 from michaelnebel/java/deprecateexperimental
...
Java: Deprecate experimental queries.
2025-01-29 10:41:25 +01:00
Simon Friis Vindum
70550950d8
Java, C#: Ensure variable is used in all disjuncts
2025-01-29 10:30:26 +01:00
Geoffrey White
a42c0f6b5b
Merge pull request #18605 from geoffw0/expect
...
Rust: Improve models for environment sources, expect and unwrap
2025-01-29 09:11:30 +00:00
Asger F
f8694a34e5
Merge pull request #18397 from aegilops/angular-sources-sinks
...
JavaScript CodeQL library updates: new Angular sink(s)
2025-01-29 09:09:23 +01:00
Mathias Vorreiter Pedersen
bc50634472
Merge pull request #18616 from MathiasVP/18592-follow-up
...
C++: #18592 follow-up
2025-01-28 20:00:16 +00:00
Andrew Eisenberg
a4d9956c94
Merge pull request #18614 from github/aeisenberg/remove-pr-template
...
Delete .github/pull_request_template.md
2025-01-28 10:54:08 -08:00
Mathias Vorreiter Pedersen
be2777bc31
C++: Don't infer lambda calls when there is a static dispatch to a source or summary callable.
2025-01-28 18:51:31 +00:00
Chuan-kai Lin
225ce81d26
Merge branch 'main' into cklin/merge-back-2.20.3
2025-01-28 10:11:30 -08:00
Chuan-kai Lin
36d1c5602e
Merge pull request #18589 from github/cklin/merge-back-2.20.2
...
Mergeback from codeql-cli-2.20.2
2025-01-28 10:04:43 -08:00
Mathias Vorreiter Pedersen
a35ed57848
Revert "C++: Don't generate parameter nodes for bodyless parameters when there is a summary of the enclosing function."
...
This reverts commit ad80b36074
2025-01-28 17:09:45 +00:00
Mathias Vorreiter Pedersen
ff9a4d02f0
Merge pull request #18592 from MathiasVP/fix-enclosing-callable-cpp
...
C++: Don't generate dataflow nodes for functions with summaries
2025-01-28 16:57:44 +00:00
Geoffrey White
919e7978cd
Rust: Add PrettyPrintModels.ql to the test. I gather this stabilized the output MaD IDs.
2025-01-28 16:23:20 +00:00
Geoffrey White
df8a92cb62
Merge pull request #6 from hvitved/expect
...
Rust: Fix data flow through callbacks passed to library functions
2025-01-28 16:12:17 +00:00
Mathias Vorreiter Pedersen
202a5e86da
C++: Add change note.
2025-01-28 16:07:09 +00:00
Chuan-kai Lin
b9b9394259
AlertFiltering: allow multiple filtering predicates
...
This commit rephrases the documentation for the restrictAlertsTo
predicate and renames the predicate columns for clarity. The new
documentation should be equivalent to the old documentation, except
allowing for the possibility that there may be multiple alert filtering
predicates.
2025-01-28 07:51:45 -08:00
Mathias Vorreiter Pedersen
c9a3cf4bd0
C++: Accept test changes.
2025-01-28 15:48:11 +00:00
Mathias Vorreiter Pedersen
d6054c9a51
C++: Infer larger buffer sizes for non-static member variables.
2025-01-28 15:48:04 +00:00
Mathias Vorreiter Pedersen
1643a66183
C++: Add 'cpp/overflow-buffer' FP tests.
2025-01-28 15:44:53 +00:00
