hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 01:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity
50,022 Commits 1,741 Branches 165 Tags
5c23b47ef4935668ebe5a3583fd82289e710de5f
Commit Graph

6664 Commits

Author SHA1 Message Date
Rasmus Wriedt Larsen
5c23b47ef4 Python: Fix typo in QLDoc 
Co-authored-by: Taus <tausbn@github.com>
 2023-02-08 16:27:06 +01:00
Rasmus Wriedt Larsen
8bb1d8631a Python: Add call-graph hotfix for sympy 2023-02-08 16:19:29 +01:00
Rasmus Wriedt Larsen
23144f584a Merge branch 'main' into call-graph-code 2023-02-08 16:17:34 +01:00
Erik Krogh Kristensen
9360ae9638 Merge pull request #12076 from erik-krogh/poly-sink-track 
PY: add tracking of strings to compile-sites for poly-redos
 2023-02-06 14:21:04 +01:00
Mathias Vorreiter Pedersen
00fe448e3a Merge pull request #12072 from aschackmull/dataflow/stage3-perf 
Dataflow: Fix join in `fwdFlowRead` (take 2)
 2023-02-06 10:43:11 +00:00
github-actions[bot]
faf21f3edb Post-release preparation for codeql-cli-2.12.2 2023-02-02 23:01:04 +00:00
erik-krogh
6e712b293a add tracking of strings to compile-sites for poly-redos, in the style of Ruby 2023-02-02 22:56:20 +01:00
erik-krogh
52959d7c0a add failing test for not tracking strings to re.compile 2023-02-02 19:10:32 +01:00
Anders Schack-Mulligen
67d4ed53b9 Dataflow: Sync. 2023-02-02 16:33:00 +01:00
github-actions[bot]
a4fa984792 Release preparation for version 2.12.2 2023-02-02 14:34:55 +00:00
Rasmus Wriedt Larsen
db114bb104 Merge branch 'main' into call-graph-code 2023-02-02 11:56:55 +01:00
Rasmus Wriedt Larsen
fdb33ff48e Python: Fix grammar in change-note 
Co-authored-by: Taus <tausbn@github.com>
 2023-02-01 14:01:20 +01:00
erik-krogh
77e014c5a4 sync added dataflow config 2023-02-01 11:46:57 +01:00
Erik Krogh Kristensen
01f6862965 Merge pull request #11833 from erik-krogh/trackPyReg 
PY: track string-constants to regular expression uses
 2023-02-01 11:40:42 +01:00
Rasmus Wriedt Larsen
c7e552b343 Python: Fix grammar in qldoc 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2023-01-30 09:45:45 +01:00
Rasmus Wriedt Larsen
a1c2f4c138 Python: Small rewrite of **kwargs getParameter logic 2023-01-30 09:42:43 +01:00
Mathias Vorreiter Pedersen
95b15825f9 DataFlow: Sync identical files. 2023-01-27 16:24:31 +00:00
Rasmus Wriedt Larsen
cef933f813 Python: Add comment explaining SINK3_F(kwargs["c"]) test 
Co-authored-by: yoff <yoff@github.com>
 2023-01-27 15:48:59 +01:00
Rasmus Wriedt Larsen
c099dbd04c Python: Expand notes around bound methods self argument passing 2023-01-27 15:27:45 +01:00
Rasmus Wriedt Larsen
02b3a1b515 Python: At most one **kwargs ParameterNode per callable 
Similar to the Ruby changes from
https://github.com/github/codeql/pull/11461

I feel the change to `DataFlowFunciton.getParameter` where we use
`not exists(func.getArgByName(_))` is not very great, but I was not allowed
to use `not exists(this.getParameter(any(ParameterPosition _).isKeyword(_)))`
because of negative recursion.
 2023-01-27 11:14:42 +01:00
Rasmus Wriedt Larsen
f262dc68f8 Python: Reword note about debugging getNextClassInMro 2023-01-25 10:08:43 +01:00
Rasmus Wriedt Larsen
63b2bd0871 Python: Fixup test_only_starargs addition 
validTest.py did not pass, since we use `SINK3_F`.

I initially tried swapping the order

```
args = (arg1, arg2) # $ arg1 arg2 func=starargs_only
more_args = (arg4, arg3)
starargs_only(*args, *more_args)
```

But then asked myself, what is it _actually_ we're testing here? and it
seems to be the way we handle multiple *args arguments in the same call,
so I converted the test to be that instead! (and it matches what we do
in test_stararg_mixed)
 2023-01-25 09:37:07 +01:00
Rasmus Wriedt Larsen
0879c8f8e1 Python: Expand comments on C3 MRO 2023-01-23 17:40:24 +01:00
Rasmus Wriedt Larsen
80324735bb Python: Fixup annotation for CWE-022-PathInjection/pathlib_use.py 2023-01-23 17:40:24 +01:00
Rasmus Wriedt Larsen
753192bb4d Merge branch 'main' into call-graph-code 2023-01-23 11:25:02 +01:00
Alex Ford
55550e7980 Merge pull request #11941 from alexrford/summary-component-tostring-syntheticglobal 
Add missing toString case for synthetic globals
 2023-01-23 10:00:00 +00:00
Michael Nebel
69a42d8b1f Merge pull request #11931 from michaelnebel/csharp/refactor 
Remove the Csv postfix of some predicate names.
 2023-01-23 09:09:48 +01:00
github-actions[bot]
b62cb6ba84 Post-release preparation for codeql-cli-2.12.1 2023-01-20 19:49:56 +00:00
Rasmus Wriedt Larsen
25a68c4d71 Python: Include @yoff's suggestion on synthetic *args handling 2023-01-20 16:49:33 +01:00
Rasmus Wriedt Larsen
41ebb4fb55 Python: Add p2 in QLDoc example code for synthetic **kwargs 2023-01-20 16:40:39 +01:00
Rasmus Wriedt Larsen
d9fbe58ad5 Python: Expand starargs_only test 2023-01-20 16:34:59 +01:00
Rasmus Wriedt Larsen
0df3dd68d6 Python: Remove (now) redundant cast 2023-01-20 15:13:02 +01:00
Rasmus Wriedt Larsen
1bd969c219 Merge branch 'main' into call-graph-code 2023-01-20 15:11:49 +01:00
Alex Ford
e4df1f5a6f Ruby: add missing toString case for synthetic globals 2023-01-20 13:31:43 +00:00
github-actions[bot]
005b3e4a47 Release preparation for version 2.12.1 2023-01-20 12:03:19 +00:00
Michael Nebel
dc223cb82e Sync files and make corresponding changes for other languages. 2023-01-19 15:14:06 +01:00
Rasmus Wriedt Larsen
4df946b161 Python: call-graph: Don't design for special method calls yet 
The `call` arguments were not `CallNode`s before, to allow for easier
support of special method calls, such as `a + b` going to `__add__`.

However, this is not implemented yet, so for now we can keep things
simple.

Co-authored-by: Taus <tausbn@github.com>
 2023-01-18 12:30:53 +01:00
Rasmus Wriedt Larsen
e0ccb9306a Merge pull request #11908 from RasmusWL/dataflow-consistency-more-excludes 
DataFlow: Add `uniqueParameterNodePositionExclude`
 2023-01-18 10:44:51 +01:00
yoff
5a82012d03 Merge pull request #11854 from yoff/python/fix-tarslip-improv-bug 
Python: fix bug  in `py/tarslip-extended`
 2023-01-17 20:44:06 +01:00
Rasmus Wriedt Larsen
b83fc3b6eb Python: Update QLDoc for clsArgumentTracker 2023-01-17 14:38:56 +01:00
Rasmus Wriedt Larsen
24892801ec Python: clsTracker => clsArgumentTracker 
Co-authored-by: Taus <tausbn@github.com>
 2023-01-17 14:16:56 +01:00
Rasmus Wriedt Larsen
1c8cc6a32a Python: Add QLDoc for TFunction 2023-01-17 14:14:05 +01:00
Rasmus Wriedt Larsen
a0b1c2ea79 DataFlow: Add uniqueParameterNodePositionExclude 2023-01-17 14:05:22 +01:00
Rasmus Wriedt Larsen
2b0a5fd5d1 DataFlow: Add uniqueParameterNodeAtPositionExclude 2023-01-17 14:05:17 +01:00
Rasmus Wriedt Larsen
dad6221b61 Python: Accept dataflow-consistency.expected changes for now 
As highlighted in the configuration file, there are some things to catch
up on, and we also need to apply the same fix as Ruby for **kwargs
handling.
 2023-01-17 13:58:40 +01:00
Rasmus Wriedt Larsen
749e81367d Python: Allow multiple **kwargs parameters outside our test code 2023-01-17 13:58:40 +01:00
Rasmus Wriedt Larsen
b6272b383d Python: Allow non-unique parameter positions for normal parameters 2023-01-17 13:58:40 +01:00
Rasmus Wriedt Larsen
a6fd5b6e59 DataFlow: Add uniqueParameterNodePositionExclude 2023-01-17 13:58:37 +01:00
Rasmus Wriedt Larsen
7a423622f8 DataFlow: Add uniqueParameterNodeAtPositionExclude 2023-01-17 13:57:31 +01:00
Rasmus Wriedt Larsen
e3fcfd0a66 Python: Use configuration for dataflow consistency checks in dataflow/exceptions 2023-01-17 13:55:22 +01:00