hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-21 06:57:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,989 Commits 1,712 Branches 163 Tags
78334af3540dfd776ba4fdb561692161c515ca66
Commit Graph

1989 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Asger F
78334af354 JS: remove cookie source; rely on persistent flow steps instead 2018-12-19 11:23:51 +00:00
semmle-qlci
c37d655fe8 Merge pull request #697 from esben-semmle/js/fix-heuristics-compilation-time 
Approved by asger-semmle
 2018-12-18 09:07:36 +00:00
semmle-qlci
7fd1d64d97 Merge pull request #699 from esben-semmle/js/add-lastIndexOf 
Approved by asger-semmle
 2018-12-18 09:07:17 +00:00
Tom Hvitved
e14259126e Merge pull request #658 from calumgrant/cs/extractor/for-is 
C#: Fix extraction bug for variable declarations in for condition
 2018-12-17 16:16:00 +01:00
calumgrant
6648c8414f Merge pull request #680 from hvitved/csharp/data-flow-performance-tweaks 
C#: Minor data flow performance tweaks
 2018-12-17 14:25:51 +00:00
calumgrant
dbd0c7e80a Merge pull request #674 from hvitved/csharp/cache-get-label 
C#: Cache `NamedElement::getLabel()`
 2018-12-17 14:24:01 +00:00
calumgrant
f50d0e373a Merge pull request #642 from hvitved/csharp/extractor/nullness-refactorings 
C#: nullness related extractor refactorings
 2018-12-17 14:16:51 +00:00
Esben Sparre Andreasen
4a631b42d4 JS: use .lastIndexOf in js/incomplete-url-substring-sanitization 2018-12-17 13:22:31 +01:00
Asger F
7adf1d9958 Merge pull request #631 from esben-semmle/js/bad-url-regexing 
JS: add query: js/incomplete-url-regexp
 2018-12-17 11:53:22 +00:00
Tom Hvitved
5f269b2d87 Merge branch 'master' into cs/extractor/for-is 2018-12-17 11:14:50 +01:00
Esben Sparre Andreasen
50cba92f5f JS: remove slow test Security/heuristics/AdditionalCommandInjections 2018-12-17 10:58:46 +01:00
Geoffrey White
b8877f1d5f Merge pull request #690 from jbj/prepareQueries-fix-warnings-2 
C++: Delete dead code with warnings in it
 2018-12-14 14:23:19 +00:00
Esben Sparre Andreasen
487b8c52c6 JS: fix <p></p> issue 2018-12-14 13:04:10 +01:00
Jonas Jensen
23a2bf1756 C++: Delete dead code with warnings in it 2018-12-14 10:59:41 +00:00
Tom Hvitved
654f2ae290 C#: Address review comment 2018-12-14 10:38:34 +00:00
Esben Sparre Andreasen
bb3e3a541d JS: address doc review comments 2018-12-14 10:24:30 +01:00
semmle-qlci
936094d0b6 Merge pull request #671 from xiemaisi/js/more-unhelpful-magic 
Approved by asger-semmle
 2018-12-14 08:44:45 +00:00
Max Schaefer
f9106b3bfe Merge pull request #685 from asger-semmle/useless-conditional-as-value 
JS: fix FPs in UselessConditional
 2018-12-14 08:44:10 +00:00
semmle-qlci
7f21f145e2 Merge pull request #678 from asger-semmle/function-receiver 
Approved by xiemaisi
 2018-12-14 08:39:04 +00:00
Tom Hvitved
b11d5c5075 Merge pull request #679 from calumgrant/cs/omitted-array-size 
C#: Extract stackalloc initializers
 2018-12-14 07:48:46 +01:00
Asger F
f737830f18 JS: fix typo 2018-12-13 15:56:00 +00:00
Asger F
ae4b55de9a JS: fix FPs in UselessConditional 2018-12-13 15:41:41 +00:00
Geoffrey White
b21e832ee2 Merge pull request #683 from jbj/prepareQueries-fix-warnings 
C++: Fix all prepareQueries errors and warnings
 2018-12-13 15:30:44 +00:00
calum
9fba643fb0 C#: Address review comments. 2018-12-13 13:53:58 +00:00
calumgrant
16c065274d Merge pull request #666 from hvitved/csharp/useless-upcast-performance 
C#: Improve performance of `cs/useless-upcast`
 2018-12-13 12:04:12 +00:00
Jonas Jensen
bee2ddaf26 C++: Fix all prepareQueries errors and warnings 
With these changes we can run `odasa prepareQueries --check-only
--fail-on-warnings` on the C++ query directory. Two changes were needed:

1. The `Metrics/queries.xml` file had to be deleted. It existed because
   the built distribution has a different file layout, where `Metrics`
   is moved to the top-level query dir `odasa-cpp-metrics`. Since
   internal PR 28230 this file is created as needed as part of the dist
   build process, so it doesn't need to be checked in with the sources.
2. All uses of the `deprecated` and stubbed-out Objective C classes were
   removed.
 2018-12-13 11:13:50 +00:00
Asger F
cb349348e7 JS: rename getThisParameter to getReceiver 2018-12-13 10:19:44 +00:00
Max Schaefer
e194021c3b Merge pull request #629 from esben-semmle/js/persistent-read-taint 
JS: add persistent storage taint steps
 2018-12-13 08:24:42 +00:00
Max Schaefer
969fe6e4f1 Merge pull request #657 from esben-semmle/js/classify-more-files 
JS: classify additional files
 2018-12-13 08:20:33 +00:00
Max Schaefer
e8c8360ad1 Merge pull request #659 from esben-semmle/js/more-constant-string-usage 
JS: replace StringLiteral with ConstantString in two queries
 2018-12-13 08:19:22 +00:00
Max Schaefer
54bb9d185f Merge pull request #632 from asger-semmle/pseudo-random-bytes 
JS: add crypto.pseudoRandomBytes as source in InsecureRandomness.ql
 2018-12-13 08:14:40 +00:00
Max Schaefer
df42707050 Merge pull request #675 from asger-semmle/window.name 
JS: Add window.name as remote flow source
 2018-12-13 08:13:15 +00:00
Tom Hvitved
b155a0f5fb C#: Avoid computing CIL strings and non-PDB locations in data flow library 
Computing strings and locations for CIL instructions can be quite time consuming.
The CIL `toString()`s are not very helpful in path explanations, and their locations
are only useful when a PDB source file exists. Therefore, produce a simple constant
`toString()`, and restrict locations to those in PDB files.
 2018-12-12 21:58:16 +01:00
Tom Hvitved
344466a8c1 C#: Cache DataFlow::Node::getEnclosingCallable() 2018-12-12 21:49:21 +01:00
Aditya Sharad
41a48078f7 Merge pull request #673 from calumgrant/cs/sync-files 
C#: Sync samples and qltest cases
 2018-12-12 17:10:00 +00:00
calumgrant
8e546a30b0 Merge pull request #637 from hvitved/csharp/cfg/throwing-callable 
C#: Fix a bug in `ThrowingCallable`
 2018-12-12 16:58:28 +00:00
calum
2bbd55519b C#: Add tests for C# 7.3 features. 2018-12-12 16:44:55 +00:00
Asger F
635a3cb1ec JS: add FunctionNode.getThisParameter 2018-12-12 16:26:02 +00:00
calum
5596bc8827 C#: Add change note. 2018-12-12 16:16:07 +00:00
Anders Schack-Mulligen
12bc1fc656 Merge pull request #581 from jf205/metadata-guide 
Query metadata style guide: add to ql/docs
 2018-12-12 12:55:20 +00:00
Asger F
a96c53f9b8 JS: restrict when a variable reference is considered a source 2018-12-12 12:28:26 +00:00
Asger F
14621760bb JS: add window.name as DOM-based remote flow source 2018-12-12 12:22:39 +00:00
Tom Hvitved
74167e478a C#: Cache NamedElement::getLabel() 2018-12-12 13:16:28 +01:00
Tom Hvitved
6918dad1db C#: Refactor localFlowStep() 
Using the `forceCachingInSameStage()` trick, we can get rid of the non-cached version
of local flow, while still computing it in the same stage.
 2018-12-12 13:14:22 +01:00
Tom Hvitved
1366638f06 C#: Fix whitespaces 2018-12-12 13:13:13 +01:00
calum
3037b2b197 C#: Sync the -Good and -Bad files in the qltest to match the sample. 2018-12-12 11:36:00 +00:00
calum
1df1b0c28e C#: Refactor ArrayCreations to allow stackalloc arrays to have initializers (C# 7.3). 2018-12-12 11:05:34 +00:00
Max Schaefer
faaca21996 JavaScript: Avoid more unhelpful magic. 2018-12-12 08:40:21 +00:00
Max Schaefer
4fc27aaa51 Merge branch 'master' into pseudo-random-bytes 2018-12-12 08:19:57 +00:00
semmle-qlci
06dd5f3616 Merge pull request #656 from xiemaisi/js/unused-local-underscore 
Approved by esben-semmle
 2018-12-12 08:11:37 +00:00