Rasmus Wriedt Larsen
7bd7bedb1b
Ruby: Simplify isLocalSourceNode implementation
...
The need for `SynthReturnNode` goes away if we don't restrict the nodes
that can't be reached from another entry definition or expression to be
`ExprNode`s
2022-05-04 16:12:20 +02:00
Tom Hvitved
9cb63c0a5e
Data flow: Sync files
2022-05-04 14:49:26 +02:00
Nick Rolfe
276f8d40f9
Ruby: add comments to address review feedback
2022-05-04 12:07:46 +01:00
Tom Hvitved
74e99302d6
Address review comments
2022-05-04 09:57:59 +02:00
Tom Hvitved
da72ba46d4
Data flow: Add stub expectsContent for all languages
2022-05-04 09:57:59 +02:00
Tom Hvitved
6e2e8440eb
Data flow: Sync files
2022-05-04 09:57:59 +02:00
Tom Hvitved
a50f18ab50
Data flow: Introduce expectsContent
2022-05-04 09:57:58 +02:00
Rasmus Wriedt Larsen
6cacf7b9a6
Ruby: isLocalSourceNode needs SynthReturnNode
2022-05-03 14:43:57 +02:00
Rasmus Wriedt Larsen
89c4b6c235
Ruby: Fix isLocalSourceNode implementation
...
The old code was equivalent with the code below, which seems wrong
```
not n instanceof ExprNode
or
n instanceof ExprNode and
localFlowStepTypeTracker+(..., n)
```
From running on real DB I found that this meant that the following node
types were also included as local source nodes:
- `TReturningNode`
- `TSynthReturnNode`
- `TSummaryNode`
- `TSsaDefinitionNode`
My understanding is that the first 3 should not be included.
I would guess that SsaDefinitionNode should indeed be included as a
LocalSourceNode, but I'm not 100% sure, so I'll see what the test
results say before making further changes.
2022-05-03 14:16:19 +02:00
Tom Hvitved
e9c8f979f9
Data flow: Sync files
2022-05-03 11:46:51 +02:00
Nick Rolfe
00bf352b50
Ruby: fix some flow summary join orders
...
The flow summaries that are implemented with an abstract base class
restricting the method name, and child classes using that method name,
had unfortunate join orders:
r1 = JOIN Call::MethodCall::getMethodName#dispred#f0820431#ff WITH Call::MethodCall::getMethodName#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.0, (Lhs.1 ++ "_arg"), Rhs.1
2022-05-03 09:58:40 +01:00
Arthur Baars
19e4d34581
Update ruby/ql/lib/change-notes/2022-04-30-update-grammar.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-05-03 10:08:29 +02:00
Erik Krogh Kristensen
f87312d4ba
have ApiGraphModelsSpecific.qll mention all the required predicates/types
2022-04-30 20:29:44 +02:00
Arthur Baars
cf4325c86f
Add change note
2022-04-29 16:19:11 +02:00
Tom Hvitved
8d2bf2228b
Merge pull request #7914 from hvitved/ruby/generalize-element-content
...
Ruby: Generalize `ArrayElementContent` to `ElementContent`
2022-04-28 14:23:08 +02:00
Jeroen Ketema
4a648f3c89
Fix change note items
2022-04-28 14:14:19 +02:00
github-actions[bot]
8e4cf190e9
Release preparation for version 2.9.1
2022-04-28 11:59:05 +00:00
Tom Hvitved
f7669815ce
Address review comments
2022-04-28 13:50:26 +02:00
Arthur Baars
ccc18640db
Ruby: add upgrade and downgrade scripts
2022-04-28 13:47:14 +02:00
Arthur Baars
20a3e3a8ae
Update library
2022-04-28 13:00:02 +02:00
Arthur Baars
65989ae564
Update dbscheme stats
2022-04-28 13:00:02 +02:00
Arthur Baars
a848929069
Regenerate QLL library
2022-04-28 13:00:02 +02:00
Harry Maclean
ba1d43dd42
Merge pull request #8658 from hmac/hmac/insecure-download
...
Ruby: Add InsecureDownload query
2022-04-28 11:07:35 +12:00
Harry Maclean
f4453f4da2
Merge pull request #8573 from hmac/hmac/missing-regexp-anchor
...
Ruby: Add MissingRegExpAnchor query
2022-04-28 11:06:33 +12:00
Erik Krogh Kristensen
e1c7d369be
Merge pull request #8796 from erik-krogh/redundantImport
...
Remove redundant imports
2022-04-27 12:39:51 +02:00
Tom Hvitved
790d97714f
Ruby: Replace Element with Element[any]
...
To make it look more like `Argument` tokens.
2022-04-27 11:53:25 +02:00
Tom Hvitved
d1c9d68e14
Ruby: Generalize ArrayElementContent to ElementContent
2022-04-27 11:53:21 +02:00
Tom Hvitved
3b7fe06858
Ruby: Simplify flow summary for fetch
2022-04-27 08:26:24 +02:00
Harry Maclean
992cc517a8
Ruby: Minor changes to InsecureDownload
2022-04-27 18:04:21 +12:00
Harry Maclean
a85811ad69
Remove unused field
2022-04-27 12:47:09 +12:00
Harry Maclean
bb3fb0325b
Ruby: Add InsecureDownload query
...
This query finds cases where a potentially unsafe file is downloaded
over an unsecured connection.
2022-04-27 12:47:09 +12:00
Harry Maclean
ce7675ef43
Ruby: Identify domain in Net::HTTP requests
2022-04-27 12:47:09 +12:00
Harry Maclean
3f8b27c0cd
Ruby: Add RegExpNonWordBoundary to RegExpTreeView
2022-04-27 10:12:33 +12:00
Harry Maclean
debc57b417
Ruby: Add RegExpAnchor to RegExpTreeView
2022-04-27 10:12:33 +12:00
Harry Maclean
d95f533d19
Ruby: Add getLastChild to RegExpParent
2022-04-27 10:12:33 +12:00
Nick Rolfe
649d7dd022
Merge pull request #8607 from github/nickrolfe/incomplete_sanitization
...
Ruby: port of `js/incomplete-sanitization`
2022-04-26 17:10:24 +01:00
Erik Krogh Kristensen
d389012b75
Merge branch 'main' into redundantImport
2022-04-26 14:24:51 +02:00
Anders Schack-Mulligen
59aedc2872
Merge pull request #8853 from aschackmull/dataflow/fix-join
...
Dataflow: Fix join-on-config producing a CP.
2022-04-26 09:52:50 +02:00
Mathias Vorreiter Pedersen
aca4c8727f
Merge pull request #8802 from github/post-release-prep/codeql-cli-2.9.0
...
Post-release preparation for codeql-cli-2.9.0
2022-04-25 22:52:55 +01:00
Anders Schack-Mulligen
c06efa1f42
Dataflow: Sync.
2022-04-25 13:11:04 +02:00
Anders Schack-Mulligen
40a16325a9
Minor clean-up in AccessPathSyntax.
2022-04-25 12:27:48 +02:00
Tom Hvitved
bffa8fa7cb
Merge pull request #8641 from hvitved/dataflow/interpret-read-store
...
Data flow: Introduce `ContentSet`
2022-04-25 12:17:34 +02:00
Tom Hvitved
2466288656
Data flow: Simplify revFlowStore
2022-04-25 10:11:54 +02:00
Tom Hvitved
cf0a1e748a
Add change notes
2022-04-25 09:17:40 +02:00
Jeroen Ketema
79164056d1
Replace help.semmle.com links by codeql.github.com links
2022-04-22 20:42:11 +02:00
Tom Hvitved
bc6ee10583
Data flow: Sync files
2022-04-22 15:10:00 +02:00
Tom Hvitved
488a4ede94
Data flow: Inline getAStoreContent up-front
2022-04-22 15:09:59 +02:00
Tom Hvitved
b033f107df
Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store
2022-04-22 14:35:02 +02:00
Erik Krogh Kristensen
ff73dbc35c
delete redundant imports
2022-04-22 12:55:28 +02:00
Erik Krogh Kristensen
a96489b23d
delete duplicate imports
2022-04-22 12:41:30 +02:00
