hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-24 11:52:56 +01:00
Code Issues Packages Projects Releases Wiki Activity
7,984 Commits 1,686 Branches 158 Tags
7dfd4e06875d690be8e3e5a78409773c3a7efd2e
Commit Graph

7984 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Asger F
7dfd4e0687 TS: Stop using the deprecated TypeReference.typeArguments 2019-11-04 07:54:38 +00:00
Asger F
341c11523c TS: Add recursive type alias tests (already works) 2019-11-04 07:54:38 +00:00
Asger F
b81931e402 TS: Support assertion types 2019-11-04 07:54:38 +00:00
Asger F
4e7b987fa3 TS: Rename IsTypeExpr -> PredicateTypeExpr 2019-11-04 07:54:38 +00:00
Asger F
f50f3b48c4 TS: Add test for ?? operator (already works) 2019-11-04 07:54:38 +00:00
Asger F
869fe4558f TS: Support optional chaining 2019-11-04 07:54:38 +00:00
Asger F
f76006e490 JS: Delete duplicate test case (typo) 2019-11-04 07:54:38 +00:00
Asger F
36b6c32f4f TS: Update expected output 2019-11-04 07:54:37 +00:00
Asger F
637394fb62 TS: Add TypeScript-3.7.1-rc 2019-11-04 07:54:37 +00:00
Max Schaefer
ef1778a8a7 Merge pull request #2212 from yh-semmle/java13-ql 
Java: support JDK 13
 2019-11-04 06:32:57 +00:00
yh-semmle
e232f538e9 Java 13: update test options 2019-11-02 16:09:32 -04:00
yh-semmle
e8a65101bc Java 13: add db stats for @yieldstmt 2019-11-02 16:09:32 -04:00
yh-semmle
de0869c216 Java 13: remove superfluous disjunct in JumpStmt.getAPotentialTarget() 2019-11-02 16:09:31 -04:00
yh-semmle
8fb4dbe092 Java 13: account for changes to switch expressions 2019-11-02 16:09:31 -04:00
yh-semmle
9f37237b4a Java 13: add stmt kind @yieldstmt to dbscheme 2019-11-02 16:09:31 -04:00
Jonas Jensen
426565ae68 Merge pull request #2239 from DX-MON/master 
Query cpp/unused-static-variable was producing incorrect results for constexpr variables
 2019-11-01 18:59:52 +01:00
semmle-qlci
e8e2f7bb20 Merge pull request #2240 from max-schaefer/js/indirect-command-argument-data-flow 
Approved by esbena
 2019-11-01 11:00:22 +00:00
Dave Bartolomeo
ea23c2daac Merge pull request #2188 from jbj/printast-override 
C++: Add a sample class in PrintAST.ql
 2019-10-31 17:02:20 -07:00
Dave Bartolomeo
e6f632b44e Merge pull request #2228 from jbj/DefaultTaintTracking-getASTVariable 
C++: Use getASTVariable in DefaultTaintTracking
 2019-10-31 17:00:49 -07:00
Dave Bartolomeo
2f63ab0250 Merge pull request #2150 from rdmarsh2/rdmarsh/cpp/ir-buffer-read-call-se 
C++: buffer read side effects on unmodeled funcs
 2019-10-31 16:59:51 -07:00
Rachel Mant
413f49bba5 Query cpp/unused-static-variable was producing incorrect results for constexpr variables 2019-10-31 22:50:44 +00:00
Robert Marsh
9477bd5698 Merge branch 'master' of github.com:Semmle/ql into rdmarsh/cpp/ir-buffer-read-call-se 2019-10-31 11:00:01 -07:00
semmle-qlci
d03aecaa98 Merge pull request #2235 from max-schaefer/js/issue-2233 
Approved by esbena
 2019-10-31 14:17:58 +00:00
Max Schaefer
8aae1f443f JavaScript: Use type tracking instead of auxiliary data-flow configuration to track indirect command arguments. 2019-10-31 12:13:55 +00:00
Max Schaefer
311cbd824c JavaScript: Recognize ":" pseudo-directive. 2019-10-31 11:39:09 +00:00
semmle-qlci
2a3980222b Merge pull request #2201 from max-schaefer/js/avoid-duplicate-source-and-sink-nodes 
Approved by asger-semmle
 2019-10-31 10:47:30 +00:00
Robert Marsh
24c9b8b9b1 C++: fix unbound variables 2019-10-30 14:06:19 -07:00
Geoffrey White
ee3b49af3a Merge pull request #2219 from jbj/rangeanalysis-best-bound 
C++: Restrict the output of IR Range Analysis to the best bounds
 2019-10-30 17:18:59 +00:00
Jonas Jensen
1e6c983d62 C++: Use getASTVariable in DefaultTaintTracking 
This library is not yet used in a query or test, so it broke silently
when `VariableAddressInstruction.getVariable` was removed.
 2019-10-30 13:42:17 +01:00
semmle-qlci
a778efe71e Merge pull request #2216 from asger-semmle/xss-encodeURIComponent 
Approved by max-schaefer
 2019-10-30 11:49:31 +00:00
Aditya Sharad
ecd4c08cb4 Merge pull request #2225 from hvitved/csharp/autobuilder-tests 
C#: Update autobuilder tests
 2019-10-29 12:21:04 -07:00
Luke Cartey
d9d4aa30a9 Merge pull request #2214 from hmakholm/pr/upgrade-packs 
Make each upgrade directory a QL pack
 2019-10-29 16:45:02 +00:00
semmle-qlci
fde56cf290 Merge pull request #2223 from hvitved/csharp/autobuilder-curl-redirect 
Approved by jbj
 2019-10-29 15:38:02 +00:00
Rasmus Wriedt Larsen
87ec58aff1 Merge pull request #2221 from tausbn/python-unreachable-catch-all-assert 
Python: Do not report unreachable "catch-all" cases in `elif`-chains.
 2019-10-29 16:36:51 +01:00
Max Schaefer
b42026a90a JavaScript: Update expected output. 2019-10-29 15:36:24 +00:00
Max Schaefer
530fa2c11c JavaScript: Collapse edges instead of hiding nodes. 
Instead of skipping over initial and final nodes, we now introduce edges from source and to sink nodes that circumvent these nodes entirely.
 2019-10-29 15:30:24 +00:00
Max Schaefer
dc1d1c2f22 JavaScript: Update expected output. 2019-10-29 15:30:06 +00:00
Max Schaefer
278ea90049 JavaScript: Collapse flow labels at start/end nodes to avoid duplication. 2019-10-29 15:24:40 +00:00
Max Schaefer
316962233c JavaScript: Factor out MidPathNode into its own class. 2019-10-29 15:24:40 +00:00
Max Schaefer
7c56c9f999 JavaScript: Move suppression of hidden nodes into edges predicate. 
They should really only be hidden for display purposes.
 2019-10-29 15:19:26 +00:00
Max Schaefer
3373742077 JavaScript: Turn PathNode::getASuccessorInternal and PathNode::getAHiddenSuccessor into top-level predicates. 2019-10-29 15:19:26 +00:00
Max Schaefer
b6f4785645 JavaScript: Rename MkPathNode to MkMidNode. 2019-10-29 15:19:26 +00:00
Max Schaefer
d71faaa5f9 JavaScript: Introduce PathNode::wraps. 2019-10-29 15:19:26 +00:00
Max Schaefer
98e0932de5 JavaScript: Make Configuration::isLive nullary. 
This makes it more obvious to the evaluator that it is a good predicate to pick as a sentinel, and in practice we mostly just have one configuration in scope anyway.
 2019-10-29 15:19:26 +00:00
Tom Hvitved
edbdfdfa27 C#: Update autobuilder tests 2019-10-29 16:14:58 +01:00
Max Schaefer
6964945c74 JavaScript: Restrict edges to only contain nodes. 2019-10-29 15:03:52 +00:00
Taus Brock-Nannestad
5e62da7690 Python: Do not report unreachable "catch-all" cases in elif-chains. 
This was brought up on the LGTM.com forums here:
https://discuss.lgtm.com/t/warn-when-always-failing-assert-is-reachable-rather-than-unreachable/2436

Essentially, in a complex chain of `elif` statements, like

```python
if x < 0:
    ...
elif x >= 0:
    ...
else:
    ...
```

the `else` clause is redundant, since the preceding conditions completely
exhaust the possible values for `x` (assuming `x` is an integer). Rather than
promoting the final `elif` clause to an `else` clause, it is common to instead
raise an explicit exception in the `else` clause. During execution, this
exception will never actually be raised, but its presence indicates that the
preceding conditions are intended to cover all possible cases.

I think it's a fair point. This is a clear instance where the alert, even if it
is technically correct, is not useful for the end user.

Also, I decided to make the exclusion fairly restrictive: it only applies if
the unreachable statement is an `assert False, ...` or `raise ...`, and only
if said statement is the first in the `else` block. Any other statements will
still be reported.
 2019-10-29 15:30:32 +01:00
Tom Hvitved
6a77751713 C#: Add -L flag to autobuilder curl invocation 
Turns out that `https://dot.net/v1/dotnet-install.sh` has moved to
`https://dotnet.microsoft.com/download/dotnet-core/scripts/v1/dotnet-install.sh`.
Instead of updating the URL in the code, I prefer to keep the old URL (which is
still referenced in the documentation), and let `curl` handle the redirect.
 2019-10-29 14:15:17 +01:00
Jonas Jensen
b6038f3caa C++: Remove best-bound logic from test 
This logic, in an improved form, is now part of the library itself.
 2019-10-29 11:54:32 +01:00
Jonas Jensen
311963906b C++: Only give the best delta in range analysis 
This mirrors Java's 6b85fe087a.
 2019-10-29 11:49:49 +01:00