hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,036 Commits 1,673 Branches 157 Tags
58c93bfdca240d4757c52d458e32c4e98a05f48c
Commit Graph

1036 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Arthur Baars
4fa093048c Add inline expectations test framework 2021-06-21 19:37:41 +02:00
Arthur Baars
33c5312842 Merge pull request #215 from github/bump-codeql 
Bump `codeql` submodule
 2021-06-21 16:18:04 +02:00
Tom Hvitved
992d8faa06 Bump codeql submodule 2021-06-21 16:06:45 +02:00
Tom Hvitved
abe5e3d953 Merge pull request #210 from github/hvitved/dataflow/consistency 
Data flow: Add consistency queries
 2021-06-21 14:42:55 +02:00
Nick Rolfe
35eb4a3af4 Merge pull request #214 from github/regexp_naming 
Use RegExp prefix instead of Regex, for consistency with other languages.
 2021-06-21 11:06:19 +01:00
Tom Hvitved
b820f3f20d Merge pull request #212 from github/hvitved/ssa/assigns-pred 
Add `Ssa::WriteDefinition::assigns/1` predicate
 2021-06-21 10:46:48 +02:00
Nick Rolfe
65aa97c07c Use RegExp prefix instead of Regex, for consistency with other languages. 2021-06-18 15:56:19 +01:00
Tom Hvitved
7cc02e6d00 Add Ssa::WriteDefinition::assigns/1 predicate 2021-06-18 10:42:32 +02:00
Nick Rolfe
78db1bf045 Merge pull request #211 from github/smaller_trap 
Tweaks to reduce size of TRAP output
 2021-06-17 17:09:14 +01:00
Nick Rolfe
ab72b4e9e7 Use hexadecimal encoding for TRAP labels 2021-06-17 16:16:32 +01:00
Nick Rolfe
ed93233917 Remove unnecessary spaces in TRAP output 2021-06-17 16:16:06 +01:00
Alex Ford
7439ab5635 remove recvCls field from ActiveRecordModelClassMethodCall 2021-06-17 14:42:42 +01:00
Alex Ford
214532516b try to avoid a future merge conflict 2021-06-17 14:41:51 +01:00
Alex Ford
762656ee60 Add QLDoc to ActiveRecord.qll 2021-06-17 14:41:51 +01:00
Alex Ford
12a0af1d28 Tidy up PotentiallyUnsafeSqlExecutingMethodCall characteristic predicate 
Co-authored-by: Nick Rolfe <nickrolfe@github.com>
 2021-06-17 14:39:40 +01:00
Tom Hvitved
41ed9f3e1b Data flow: Fix inconsistencies 2021-06-17 10:48:32 +02:00
Tom Hvitved
00e544189e Data flow: Add consistency queries 2021-06-17 10:26:56 +02:00
Tom Hvitved
ad54f2e1f4 Bump codeql submodule 2021-06-17 10:24:19 +02:00
Tom Hvitved
872c7edfc8 Merge pull request #207 from github/bump-codeql 
Bump `codeql` submodule
 2021-06-16 12:33:40 +02:00
Tom Hvitved
84d79ccae9 Bump codeql submodule 2021-06-16 11:55:38 +02:00
Alex Ford
bf43a77df5 Include some more types of expressions as possible active record SQL sink arguments 2021-06-15 12:41:42 +01:00
Alex Ford
ea21c591af remove accidentally unbound variable 2021-06-15 11:39:48 +01:00
Alex Ford
c1b9952517 account for chained method calls when constructing ActiveRecord SQL queries 2021-06-15 11:39:48 +01:00
Alex Ford
f8a77b9854 format QL 2021-06-15 11:39:48 +01:00
Alex Ford
57c04266e3 rename SqlExecutingMethodCall as PotentiallyUnsafeSqlExecutingMethodCall 2021-06-15 11:39:48 +01:00
Alex Ford
2d4bb61789 limit SqlExecutingMethodCall to those that are called with a StringlikeLiteral argument 2021-06-15 11:39:48 +01:00
Alex Ford
2c15b60998 add ActiveRecord find_by_sql as an SQL executing method call 2021-06-15 11:39:48 +01:00
Alex Ford
c641d12259 add shell ActiveRecord library tests 2021-06-15 11:39:48 +01:00
Alex Ford
5b7df8578a cleanup ActiveRecord.qll 2021-06-15 11:39:48 +01:00
Alex Ford
7488d072d8 Model some SQL fragment sinks in ActiveRecord model classes 2021-06-15 11:39:48 +01:00
Alex Ford
743deee9ce add a class to represent ActiveRecord models 2021-06-15 11:39:48 +01:00
Alex Ford
7d3eaf40ff add base SqlExecution concepts 2021-06-15 11:39:48 +01:00
Tom Hvitved
3a37e321d5 Merge pull request #205 from github/hvitved/taint-tracking 
Initial taint-tracking library
 2021-06-15 09:30:59 +02:00
Tom Hvitved
5a9521372b Merge pull request #206 from github/tausbn/fix-identical-files 2021-06-15 07:31:07 +02:00
Taus
2bbcbb2200 Bump submodule pointer 2021-06-14 19:04:22 +00:00
Tom Hvitved
302b485f4c Merge pull request #204 from github/hvitved/cfg-nodes-perf 
Improve performance of `ExprChildMapping::reachesBasicBlock()`
 2021-06-14 20:14:17 +02:00
Taus
068b980517 Update identical-files.json 
As of https://github.com/github/codeql/pull/6063 we have now started using the shared type tracking library in Python as well. 🎉
 2021-06-14 19:01:24 +02:00
Tom Hvitved
8aa337ab01 Initial taint-tracking library 2021-06-14 14:19:34 +02:00
Tom Hvitved
b154c936c3 Improve performance of ExprChildMapping::reachesBasicBlock() 
Since all expressions are now post-order, the logic of `reachesBasicBlock` can
be simplified, and performance can be improved as well.
 2021-06-14 11:58:24 +02:00
Arthur Baars
88fb3c7097 Merge pull request #203 from github/aibaars/pack-qhelp-samples 
Query pack: include .rb and .erb sample files from queries directory
 2021-06-11 13:50:17 +02:00
Arthur Baars
909e6d5a62 Query pack: include .rb and .erb sample files from queries directory 
These are required by the qhelp files.
 2021-06-11 13:42:43 +02:00
Arthur Baars
78a6ed43c3 Merge pull request #202 from github/aibaars-patch-2 
HardCodedCredentials: fix query metadata comment
 2021-06-11 12:05:44 +02:00
Arthur Baars
661d6e8e38 HardCodedCredentials: fix query metadata comment 2021-06-11 11:59:46 +02:00
Tom Hvitved
8860b8adf0 Merge pull request #198 from github/hvitved/desugar-compound-assignment 2021-06-10 19:39:54 +02:00
Alex Ford
f74dff560b Merge pull request #187 from github/hardcoded-credentials 
Add rb/hardcoded-credentials query
 2021-06-10 16:12:32 +01:00
Alex Ford
8839d4c584 limit additional flow steps in rb/hardcoded-credentials to string concatenation 2021-06-10 14:59:28 +01:00
Alex Ford
fe45dadd55 set precision to high for rb/hardcoded-credentials 2021-06-10 14:52:26 +01:00
Alex Ford
e26afe91b5 move rb/hardcoded-credential alert location to the source 2021-06-07 14:53:04 +01:00
Alex Ford
5d79a8cec0 account for keyword args in rb/hardcoded-credentials and simplify query 2021-06-07 14:49:49 +01:00
Tom Hvitved
962768e7c0 Disambiguate toStrings for nested synthetic local variables 2021-06-04 19:20:11 +02:00