hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-06 20:15:37 +02:00
Code Issues Packages Projects Releases Wiki Activity
29,395 Commits 1,797 Branches 169 Tags
78c4690eee4480d3cefd1492745692da95ae7b6b
Commit Graph

29395 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Esben Sparre Andreasen
78c4690eee Remove additional SQL sinks 2021-11-22 21:08:49 +00:00
Esben Sparre Andreasen
fddc2cc6de Remove additional path-injection sinks 2021-11-22 21:08:49 +00:00
Esben Sparre Andreasen
700c1f5a35 Add benjamin-button.md 2021-11-22 21:08:49 +00:00
Esben Sparre Andreasen
426e635437 Remove pseudo-properties 2021-11-22 21:08:49 +00:00
Esben Sparre Andreasen
a769c96aa2 Remove 2020 sinks from SqlInjection.ql 2021-11-22 21:08:49 +00:00
Esben Sparre Andreasen
5b1bfe2799 Remove 2020 sinks from Xss.ql 2021-11-22 21:08:49 +00:00
Esben Sparre Andreasen
6e2897b0f8 Remove 2020 sinks from TaintedPath.ql 2021-11-22 21:08:49 +00:00
Tiferet Gazit
f28b85c059 Create many features with different scopes. 
This will allow us to experiment with feature selection on the modeling side to pick out the best subset of scoped features.
 2021-11-22 20:56:41 +00:00
Tiferet Gazit
b493702a5a Bug fix: 
When getting the wrapper for the root node, we must give the container of the root node, not the endpoint, because they won't necessarily be the same for functions contained within functions.
 2021-11-22 20:15:48 +00:00
Tiferet Gazit
e2ffba2e47 TODO Interim fix: 
For now don't allow the neighborhood to go all the way out to the outermostEnclosingFunction, because that causes bugs.

After this change, `enclosingFunctionBodyEndpointNeighborhood` doesn't match `enclosingFunctionBody` even when the function is small, which is undesired behavior. `enclosingFunctionBody` includes the arguments to the function whereas `enclosingFunctionBodyEndpointNeighborhood` does not. We should find a way to fix this.
 2021-11-22 20:10:24 +00:00
Tiferet Gazit
a507d6dc1d Formatting fixes 2021-11-22 20:02:28 +00:00
Tiferet Gazit
da5f664265 Create three features with different scopes: 
Create three versions of `enclosingFunctionBodyEndpointNeighborhood`, each with a different threshold on the number of descendants.
 2021-11-20 02:39:01 +00:00
Tiferet Gazit
d52af5599a Allow the neighborhood to be the entire enclosing function 2021-11-20 02:28:53 +00:00
Anna Railton
05460f6444 Add check for neighborhood node being top-level enclosing function 2021-11-18 16:34:06 +00:00
Anna Railton
c7f96928dc Reformat docstrings 2021-11-18 16:34:03 +00:00
Anna Railton
4351d9e861 Add predicates for the magic numbers in the predicates 2021-11-18 16:26:59 +00:00
Anna Railton
c3766477dc Apply suggestions from code review 
Co-authored-by: Tiferet Gazit <tiferet@github.com>
 2021-11-18 16:26:59 +00:00
annarailton
b6922813a8 Add neighborhoodBody feature to token features 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-11-18 16:26:59 +00:00
annarailton
5de0edc773 Add NeighborhoodBodies module 
This provides functionality for getting the token features associated with a
neighborhood around an AST node. It is strongly related to `FunctionBodies`.

Co-authored-by: Chris Smowton <smowton@github.com>
 2021-11-18 16:26:59 +00:00
annarailton
a8c1febf88 Add helper types for changes to EndpointFeatures 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-11-18 16:26:59 +00:00
annarailton
2b334055db Clean up to astNodes predicate to make more explicit 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-11-18 16:26:59 +00:00
Henry Mercer
46958e5bff Merge pull request #7168 from erik-krogh/useMinInsteadofRank1 
ATM: use min() instead of rank[1]
 2021-11-18 14:56:49 +00:00
Anders Schack-Mulligen
6815a13a00 Merge pull request #6931 from hvitved/dataflow/restrict-derived-summaries 
Data flow: Restrict derived flow summaries
 2021-11-18 15:31:55 +01:00
Erik Krogh Kristensen
2af7817691 use min() instead of rank[1] 2021-11-18 14:26:55 +01:00
Geoffrey White
6c2713dd8b Merge pull request #7159 from MathiasVP/pointers-are-always-iterators 
C++: Always recognize pointers as iterators
 2021-11-18 11:14:44 +00:00
Tony Torralba
9d22ec88fd Merge pull request #7165 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2021-11-18 10:37:34 +01:00
Erik Krogh Kristensen
1cca377e7d Merge pull request #6561 from erik-krogh/htmlReg 
JS/Py/Ruby: add a bad-tag-filter query
 2021-11-18 09:39:13 +01:00
github-actions[bot]
ecdaeb0c10 Add changed framework coverage reports 2021-11-18 00:09:24 +00:00
Mathias Vorreiter Pedersen
c998370c84 C++: Accept more test changes. 2021-11-17 15:22:17 +00:00
Mathias Vorreiter Pedersen
36585a7469 C++: Accept test changes. 2021-11-17 14:41:30 +00:00
Mathias Vorreiter Pedersen
6dc6a78293 C++: Add a 'IteratorByPointer' class so pointers are always iterators. 2021-11-17 14:41:19 +00:00
Alex Ford
08b6a17097 Merge pull request #7151 from github/ruby/methodcallnode 
Ruby: add `getMethodName` predicate to `DataFlow::CallNode` class
 2021-11-17 14:40:07 +00:00
Anders Schack-Mulligen
22ebe68b1b Merge pull request #7132 from aschackmull/java/overrides 
Java: Fix overrides to not be transitive.
 2021-11-17 15:38:11 +01:00
Anders Schack-Mulligen
1645fcf79c Merge pull request #7088 from aschackmull/java/parameterized-subtyping 
Java: Improve algorithm for subtyping of parameterized types.
 2021-11-17 15:28:28 +01:00
Arthur Baars
5ddfb37f29 Merge pull request #7155 from aibaars/ruby-qualified-import 
Ruby: QL generator: use qualified imports
 2021-11-17 12:40:14 +01:00
Arthur Baars
6f24947ec6 Merge pull request #7156 from aibaars/ruby-prepare-db-upgrade-fix 
Ruby: Fix scripts/prepare-db-upgrade.sh
 2021-11-17 12:39:55 +01:00
Benjamin Muskalla
3c3a65243f Merge pull request #6664 from bmuskalla/bmuskalla/modelGenerator 
Java: Initial CSV model generator
 2021-11-17 12:30:45 +01:00
Arthur Baars
fbb3e8d780 Fix scripts/prepare-db-upgrade.sh 2021-11-17 12:11:20 +01:00
Geoffrey White
d232283647 Merge pull request #7149 from geoffw0/non-https-url2 
C++: Minor improvements to 'Failure to use HTTPS URLs' query
 2021-11-17 10:05:30 +00:00
Tom Hvitved
4eacbd1cbe Ruby: Sync files 2021-11-17 10:49:51 +01:00
Tom Hvitved
6d58dd2823 Java: Update expected test output 2021-11-17 10:49:51 +01:00
Tom Hvitved
3da73b9001 C#: Update expected test output 2021-11-17 10:49:49 +01:00
Tom Hvitved
58dd75881c C#: Update flow summary to avoid negative recursion 2021-11-17 10:39:13 +01:00
Tom Hvitved
ac41451798 Data flow: Sync files 2021-11-17 10:39:12 +01:00
Tom Hvitved
0c1285f5d9 Data flow: Restrict derived flow summaries 2021-11-17 10:39:12 +01:00
Arthur Baars
7c2841f058 Ruby: QL generator: use qualified imports 2021-11-17 10:37:44 +01:00
Erik Krogh Kristensen
474c808373 Merge pull request #7137 from erik-krogh/functionExport 
JS: recognize library inputs when the library exports "through" a function
 2021-11-17 09:49:02 +01:00
Anders Schack-Mulligen
69671ce90d Java: cache overrides 2021-11-17 09:16:58 +01:00
Tom Hvitved
7cfc696d62 Merge pull request #7141 from hvitved/ruby/synthesis-realnode-recursion 
Ruby: Eliminate unnecessary recursion through `RealNode`
 2021-11-17 09:03:30 +01:00
Pierre
f846915b58 Merge pull request #7069 from github/turbo-apple-silicon-requirements-1 
Add requirements for Apple Silicon
 2021-11-17 00:04:06 +01:00