hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-24 20:02:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
51,896 Commits 1,686 Branches 158 Tags
84fd5f7ee0a6ba2cea3772621f7be4aac46726ec
Commit Graph

51896 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Ed Minnix
84fd5f7ee0 Fix naming of ZipSlip configuration 2023-03-20 07:55:23 -04:00
Ed Minnix
60a4a79537 Make the Config module of public Flow modules public 
This is to make things easier for the CodeML/ATM team once these
configurations are moved from `src/` to `lib/`.
 2023-03-20 07:47:55 -04:00
Ed Minnix
7eb3fd2ff7 Conform queries to Config naming convention 2023-03-17 15:17:18 -04:00
Ed Minnix
d317de14c9 XXE Configuration Deprecation messages 2023-03-17 15:17:18 -04:00
Ed Minnix
310af99843 Refactor Security.CWE.CWE-807.TaintedPermissionsCheck 2023-03-17 15:17:18 -04:00
Ed Minnix
a9561a97c3 Refactor Security.CWE.CWE-643.XPathInjection 2023-03-17 15:17:18 -04:00
Ed Minnix
271d50ba99 Refactor Security.CWE.CWE-611 Xxe queries 2023-03-17 15:17:18 -04:00
Ed Minnix
80012b190d Refactor Security.CWE.CWE-601.UrlRedirect 2023-03-17 15:17:18 -04:00
Ed Minnix
481d1f9b15 Refactor Security.CWE.CWE-297.UnsafeHostnameVerification 2023-03-17 15:17:18 -04:00
Ed Minnix
7bd7ecd9e6 Refactor Security.CWE.CWE-190 Arithmetic queries 2023-03-17 15:17:18 -04:00
Ed Minnix
4a202b430f Security.CWE.CWE-200.AndroidWebViewSettingsAllowsContentAccess 2023-03-17 15:17:18 -04:00
Ed Minnix
d34dbbc96f Refactor Security.CWE.CWE-134.ExternallyControlledFormatString 2023-03-17 15:17:18 -04:00
Ed Minnix
ac223ea57f Refactor Security.CWE.CWE-094.InsecureBeanValidation 2023-03-17 15:17:18 -04:00
Ed Minnix
7aecefc4aa Refactor Security.CWE.CWE-090.LdapInjectionLib 2023-03-17 15:17:18 -04:00
Ed Minnix
07fdcf2d04 Refactor Security.CWE.CWE-022.ZipSlip 2023-03-17 15:17:18 -04:00
Ed Minnix
e60e1a2ba9 Refactor Security.CWE.CWE-022.TaintedPathLocal 2023-03-17 15:17:18 -04:00
Stephan Brandauer
dce81cf0ae Merge pull request #12463 from github/java/update-mad-decls-after-triage-2023-03-09T10-41-58 
Java: Add MaD declarations after triage
 2023-03-17 17:02:42 +01:00
AlexDenisov
208ae192e4 Merge pull request #12567 from github/alexdenisov/swift-extracted-files 
Swift: add a query showing successfully extracted files
 2023-03-17 13:50:42 +01:00
Paolo Tranquilli
86b61d712c Merge pull request #12565 from github/redsun82/swift-remove-labels-from-function-type 
Swift: remove parameter labels from function types
 2023-03-17 13:49:37 +01:00
Asger F
d537f86324 Merge pull request #12555 from asgerf/js/block-modes 
JS: Include weak block modes as sink in weak crypto algorithm
 2023-03-17 13:23:23 +01:00
Henry Mercer
9d05d94f49 Merge pull request #12568 from github/rc/3.9 
Merge `rc/3.9` back to `main`
 2023-03-17 12:14:31 +00:00
Erik Krogh Kristensen
ac85b6e74f Merge pull request #12011 from erik-krogh/ts50 
JS: Add support for TypeScript 5.0
 2023-03-17 13:03:47 +01:00
Chris Smowton
0cadf4d94a Merge pull request #12558 from smowton/smowton/fix/flow-to-external-api-write-only-methods 
Go: exclude `net/http.Header.Set` and `.Del` from `go/untrusted-data-to-external-api`
 2023-03-17 11:52:48 +00:00
Ian Lynagh
b8fb4b9b0f Merge pull request #12521 from igfoo/igfoo/printast_sig 
Java: PrintAst: Improve the ranking of callables
 2023-03-17 11:43:40 +00:00
Henry Mercer
d824695da2 Merge pull request #12561 from github/henrymercer/cli-prepare-diagnostics-rename 
JS: Update for renamed `com.semmle.util.diagnostics` package
 2023-03-17 10:31:27 +00:00
Alex Denisov
7c15527300 Swift: add a query showing successfully extracted files 2023-03-17 11:27:03 +01:00
Michael Nebel
282b5d4836 Merge pull request #12538 from michaelnebel/emptypredworkaround 
DataFlow: Workaround empty predicate usage in IPA branch.
 2023-03-17 10:29:19 +01:00
Paolo Tranquilli
f2dff092dc Swift: remove parameter labels from function types 
As discussed [in this accepted proposal][1], parameter labels do not
take part any more in making up a function type, so we need to not
extract them any more to avoid DB inconsistencies.

These were unused in the library, which makes the upgrade and downgrade
scripts have full compatibility.

[1]: 9c53790a13/proposals/0111-remove-arg-label-type-significance.md
 2023-03-17 10:22:02 +01:00
Tom Hvitved
d2647850d2 Merge pull request #12564 from hvitved/ruby/remove-redundant-super-prefixes 
Ruby: Remove some redundant `super` type qualifiers
 2023-03-17 10:13:45 +01:00
Tom Hvitved
d146d816a9 Ruby: Fix semantic merge conflict 2023-03-17 09:59:44 +01:00
Tom Hvitved
e69e90db4a Ruby: Remove some redundant super type qualifiers 2023-03-17 09:32:13 +01:00
Tom Hvitved
75746cbacc Merge pull request #12549 from hvitved/ruby/ssa-write-access 
Ruby: `Ssa::WriteDefinition::getWriteAccess` should return a CFG node
 2023-03-17 09:31:14 +01:00
Tom Hvitved
ee01e9ab35 Merge pull request #12554 from hvitved/ruby/clear-text-logging-hashes 
Ruby: Rely on built-in hash-flow in clear text storage query
 2023-03-17 09:21:11 +01:00
Harry Maclean
2c63dbad67 Merge pull request #11954 from hmac/sinatra 
Ruby: Model Sinatra
 2023-03-17 10:46:52 +13:00
erik-krogh
f1094cd3d6 bump to stable release 2023-03-16 22:38:54 +01:00
erik-krogh
f3c7aed1f9 bump to RC 2023-03-16 22:37:58 +01:00
erik-krogh
e00c41c6e2 add change-note and bump version 2023-03-16 22:37:56 +01:00
erik-krogh
a63739915d add test confirming support for const type parameters 2023-03-16 22:37:35 +01:00
erik-krogh
2c1c41d8a3 add test confirming end-to-end support for well-typed decorators with the new TS 5.0 type ClassMethodDecoratorContext 2023-03-16 22:37:35 +01:00
erik-krogh
d47659b48e upgrade to TypeScript 5.0 beta, and unbreak things that broke 2023-03-16 22:37:35 +01:00
Mathias Vorreiter Pedersen
ebab6ecc30 Merge pull request #12559 from MathiasVP/test9-range-check 2023-03-16 19:18:38 +00:00
Henry Mercer
74cc1a42d0 JS: Update for renamed com.semmle.util.diagnostics package 2023-03-16 18:19:10 +00:00
Geoffrey White
880f948763 Merge pull request #12560 from geoffw0/testcustominterp 
Swift: Add taint test for custom string interpolation.
 2023-03-16 17:44:37 +00:00
Mathias Vorreiter Pedersen
406d02253d C++: Add 'range(x)' call demonstrating missing bounds. 2023-03-16 17:08:53 +00:00
Geoffrey White
3a04e42ae0 Swift: Add taint test for string interpolation. 2023-03-16 17:04:46 +00:00
Chris Smowton
3e9924fcd2 Add change note 2023-03-16 15:35:00 +00:00
Chris Smowton
647bd44666 Go: exclude net/http.Header.Set and .Del from go/untrusted-data-to-external-api 
These functions (and doubtless many others) are write-only with respect to their receiver argument, so it doesn't really make sense to flag externally-controlled data flowing there.
 2023-03-16 15:31:35 +00:00
Ian Lynagh
f9bb0df6a2 Kotlin: Update expected PrintAst output 2023-03-16 15:20:07 +00:00
Ian Lynagh
13c2ef8c20 Java: PrintAst: Improve the ranking or callables 
We now look not only at how many parameters each callable has, but what
its full signature is. This allows us to give a consistent order to
    Test(Throwable) { ... }
    Test(String) { ... }
 2023-03-16 15:20:07 +00:00
Tom Hvitved
f35fb13723 Add change note 2023-03-16 15:18:47 +01:00