hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,036 Commits 1,673 Branches 157 Tags
58c93bfdca240d4757c52d458e32c4e98a05f48c
Commit Graph

1036 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Alex Ford
a4a8f17a54 Update ql/src/codeql_ruby/dataflow/BarrierGuards.qll 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 18:12:26 +01:00
Alex Ford
9883a9b606 update SqlInjection tests 2021-06-24 18:12:26 +01:00
Alex Ford
d62f4f5bd4 Address review comments 2021-06-24 18:12:26 +01:00
Alex Ford
bc5a1b86ff Fix handling of arrays passed to ActiveRecord SQL methods 2021-06-24 18:12:26 +01:00
Alex Ford
fc8db88b66 Apply suggestions from code review 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 18:12:25 +01:00
Alex Ford
7415503772 update ActiveRecord test output 2021-06-24 18:12:25 +01:00
Alex Ford
12e4c9ee90 update SqlInjection tests 2021-06-24 18:12:25 +01:00
Alex Ford
734fe01867 Support named :conditions parameter to some SQL executing ActiveRecord calls 2021-06-24 18:12:25 +01:00
Alex Ford
91bde8d85d Support ActiveRecord SQL executing calls where there is a self receiver (implicit or explicit) 2021-06-24 18:12:25 +01:00
Alex Ford
5386c776b3 Implement rb/sql-injection 2021-06-24 18:12:25 +01:00
Alex Ford
957b29b5af Add more defaultAdditionalTaintSteps 2021-06-24 18:12:25 +01:00
Alex Ford
6e5665da8c Make ActiveRecord model flag more potentially dangerous SQL executions 2021-06-24 18:12:25 +01:00
Alex Ford
8761873cd1 Implement two common barrier guards 2021-06-24 18:12:25 +01:00
Alex Ford
98313d0a56 Convenience classes for wrapping some Exprs as ExprCfgNodes 2021-06-24 18:12:25 +01:00
Alex Ford
ad1d8420f3 Make BarrierGuard abstract 2021-06-24 18:12:25 +01:00
Alex Ford
adf32e973a Create Frameworks.qll to act as a container for all framework models 2021-06-24 18:12:25 +01:00
Nick Rolfe
17a59ef824 Add basic test for regex parsing 2021-06-24 18:06:08 +01:00
Arthur Baars
f69c5dc19b Merge pull request #221 from github/package-depend-on-compile-queries 
make the package job depend on compile-queries
 2021-06-24 19:03:44 +02:00
Arthur Baars
22990a938d Add support for LGTM_INDEX_FILTERS environment variable 
* re-implement autobuilder script in Rust
* add additional --include/--exclude flags based on LGTM_INDEX_FILTERS
  environment variable
 2021-06-24 18:45:31 +02:00
Nick Rolfe
51b0ffdaf8 Fix printAst to support adding edges in AstDesugar test 2021-06-24 17:14:23 +01:00
Nick Rolfe
f7e89f47fd Comment out temporarily-unused predicates 2021-06-24 17:06:41 +01:00
Alex Ford
58e9b69ea4 make the package job depend on compile-queries 2021-06-24 16:52:22 +01:00
Nick Rolfe
a6dd2fa0a1 Split ReDoS query into .ql and .qll, and add .qhelp 2021-06-24 16:32:45 +01:00
Arthur Baars
7574d1cad7 Merge pull request #220 from github/aibaars/update-build-yml 
Update build.yml
 2021-06-24 16:38:26 +02:00
Arthur Baars
be1d4c3d2c Address comment 2021-06-24 16:31:24 +02:00
Arthur Baars
ade36691b6 Remove unnecessary qualifier 2021-06-24 16:13:29 +02:00
Arthur Baars
dfc96de4cc Update build.yml 2021-06-24 16:09:45 +02:00
Arthur Baars
95399b2d0a Refactor ApiGraphs.qll 2021-06-24 15:58:02 +02:00
Arthur Baars
4f96834711 Add ConstantAccessCfgNode 2021-06-24 15:57:48 +02:00
Arthur Baars
6bed50a86b Rename predicate with snake cased name 2021-06-24 11:59:13 +02:00
Arthur Baars
b2be1c3b3d Update ql/src/codeql_ruby/ApiGraphs.qll 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-23 20:40:22 +02:00
Tom Hvitved
9438885776 Merge pull request #216 from github/hvitved/synthesis-location 
AST synthesis: Move location information into a separate predicate
 2021-06-23 16:50:17 +02:00
Nick Rolfe
c784e37089 Add regexp parser and exponential ReDoS query 2021-06-23 15:29:49 +01:00
Alex Ford
e5f0206c6d Merge pull request #208 from github/action-controller-1 
Model accesses to `ActionController` parameters via `params` method
 2021-06-23 14:21:55 +01:00
Alex Ford
0238c19085 remove TODO 2021-06-23 14:11:38 +01:00
Alex Ford
5941eb2be4 model some ActionController user input sources (params) 2021-06-23 14:11:38 +01:00
Alex Ford
9227f3a0c3 Add RemoteFlowSources.qll 2021-06-23 14:11:38 +01:00
Alex Ford
5163514d43 Merge pull request #218 from github/build-yml-debug 
Fix `compile-queries` job
 2021-06-23 14:04:33 +01:00
Alex Ford
8e1f2e6237 try fixing build.yml 2021-06-23 13:41:51 +01:00
Tom Hvitved
1dde5b8ef9 AST synthesis: Move location information into a separate predicate 2021-06-23 08:46:07 +02:00
Arthur Baars
f18e5030e0 Address comments by @tausbn 2021-06-22 17:25:34 +02:00
Alex Ford
dbf1805c8b Merge pull request #196 from github/active-record-1 
Start modelling some potential SQL fragment sinks in ActiveRecord
 2021-06-22 16:05:26 +01:00
Arthur Baars
bedd790d33 Merge pull request #217 from github/aibaars-patch-2 
Remove ad-hoc entries from query suite
 2021-06-22 15:48:22 +02:00
Arthur Baars
f7eee915da Remove ad-hoc queries 2021-06-22 15:35:30 +02:00
Arthur Baars
cdfe74959f Remove methodName field 2021-06-22 10:32:44 +02:00
Arthur Baars
7c3c1db462 Use ApiGraphs in WeakFilePermissions query 2021-06-22 10:25:56 +02:00
Arthur Baars
65d9327951 Add CallNode class 2021-06-22 10:25:56 +02:00
Arthur Baars
57d8ba649f Use flowsTo 2021-06-21 19:37:41 +02:00
Arthur Baars
d2e2901128 First version of ApiGraphs 2021-06-21 19:37:41 +02:00
Arthur Baars
f0c83288a7 Add test case for ApiGraph 2021-06-21 19:37:41 +02:00