hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-12 15:05:33 +02:00
Code Issues Packages Projects Releases Wiki Activity
23,046 Commits 1,801 Branches 170 Tags
919a0b6b84489488c1dcb1de41e0097f01ccddca
Commit Graph

23046 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Wriedt Larsen
919a0b6b84 Python: aiohttp route setup is more complicated than expected 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
c69b857662 Python: Add self.request as RemoteFlowSource for aiohttp View 
Just like we do for Django in
7393443f8c/python/ql/src/semmle/python/frameworks/Django.qll (L1786-L1804)
 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
c4b618dcf5 Python: Model view-classes in aiohttp.web 
No taint modeling of them yet though
 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
8c039d5688 Python: Add more aiohttp view routing tests 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
1aa222d7cc Python: Add taint-test for class-based view 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
fb21bc04fa Python: Add taint-steps for yarl.URL 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
72e6a1489c Python: Add taint-steps for MultiDictProxy 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
e76f02b016 Python: Minor refactor to use LocalSourceNode 
This just more correctly reflects the reality, since the type-tracking
predicate just below only holds for LocalSourceNode anyway.
 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
dd131e6bf7 Python: Add taint-step for methods on aiohttp.web.Request 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
63c7fa0c2c Python: aiohttp match_info should be tainted 
Whoops
 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
597a9dfc80 Python: Don't consider has_body tainted 
Although it technically is, I think it belong in the section of things
that are unlikely to be exploitable
 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
d953ea47d4 Python: Basic handling of tainted attributes in aiohttp 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
88158e7414 Python: Add basic model setup for aiohttp.web.Request 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
2b992a635a Python: Add aiohttp taint tests 2021-06-03 10:55:34 +02:00
Rasmus Wriedt Larsen
3cbb909a3a Python: Add modeling of coroutine routes in aiohttp.web 2021-06-03 10:55:33 +02:00
Rasmus Wriedt Larsen
fa1d4e6de7 Python: Extract poor mans function resolution (from django) 
Since I also want to use this for aiohttp.web modeling
 2021-06-03 10:55:33 +02:00
Rasmus Wriedt Larsen
85d9483c7b Python: Add basic aiohttp tests 2021-06-03 10:55:33 +02:00
CodeQL CI
ffad65be40 Merge pull request #5993 from erik-krogh/lib-debug 
Approved by esbena
 2021-06-03 01:38:57 -07:00
CodeQL CI
60fb1a3b59 Merge pull request #5995 from erik-krogh/webpack-merge 
Approved by esbena
 2021-06-03 01:38:08 -07:00
CodeQL CI
7663095b57 Merge pull request #5948 from erik-krogh/fixRandom 
Approved by esbena
 2021-06-03 01:37:23 -07:00
CodeQL CI
40b6c85341 Merge pull request #5972 from erik-krogh/ts43 
Approved by esbena
 2021-06-03 01:35:58 -07:00
CodeQL CI
87268d57b8 Merge pull request #5994 from erik-krogh/abstractMongooseFunction 
Approved by esbena
 2021-06-03 01:34:44 -07:00
Anders Schack-Mulligen
c86d433e2d Merge pull request #5996 from tamasvajk/feature/csv-coverage-2 
Temporarily disable CSV coverage PR file comparison step
 2021-06-03 08:51:44 +02:00
Anders Schack-Mulligen
acca26f1d6 Merge pull request #5992 from hvitved/java/is-unreachable-perf 
Java: Improve performance of `isUnreachableInCall()`
 2021-06-03 08:49:51 +02:00
Tamas Vajk
374adc8819 Temporarily disable CSV coverage PR file comparison step 2021-06-03 08:17:28 +02:00
Erik Krogh Kristensen
3bda1f2e26 update expected test output 2021-06-03 00:43:54 +02:00
Erik Krogh Kristensen
143bf9de14 add change note 2021-06-02 23:48:29 +02:00
Erik Krogh Kristensen
48ab630559 model webpack-merge as an extend call 2021-06-02 23:43:53 +02:00
Erik Krogh Kristensen
185811ee22 make MongooseFunction abstract 2021-06-02 23:23:30 +02:00
Erik Krogh Kristensen
431c995131 add support for the debug library 2021-06-02 23:11:15 +02:00
Erik Krogh Kristensen
69d6c74e7e fix typescript version 2021-06-02 21:56:47 +02:00
Tom Hvitved
daf2cc3d53 Java: Improve performance of isUnreachableInCall() 2021-06-02 20:39:05 +02:00
Anders Schack-Mulligen
8e6dd51f50 Merge pull request #5868 from Marcono1234/marcono1234/ignore-not-closing-char-array-closeable 
Java: Ignore char array based closeables for CloseReader.ql and CloseWriter.ql
 2021-06-02 15:00:59 +02:00
Chris Smowton
7382b349c2 Merge pull request #5987 from aschackmull/java/query-metadata 
Java: Add missing metadata.
 2021-06-02 12:40:34 +01:00
Anders Schack-Mulligen
8a20395857 Merge pull request #5940 from pwntester/main 
Remove XSS sink for Java
 2021-06-02 12:30:20 +02:00
Anders Schack-Mulligen
c0e562de21 Merge pull request #5979 from hvitved/java/shared-external-summaries 
Java: Move some CSV flow summary code into shared library
 2021-06-02 12:28:45 +02:00
Alvaro Muñoz
a3a215afea HTTP -> Http 2021-06-02 11:12:39 +02:00
Anders Schack-Mulligen
5e96e28792 Java: Add missing metadata. 2021-06-02 10:24:46 +02:00
Tamás Vajk
348fab82fd Merge pull request #5970 from tamasvajk/feature/csv-coverage-impr 
Improve error reporting in CI check for CSV coverage report comparison
 2021-06-02 09:03:35 +02:00
Alvaro Muñoz
9aba92397d lift XssSink check to InformationLeakSink 2021-06-01 17:16:41 +02:00
Jonas Jensen
7282ad90d0 Merge pull request #5854 from dbartol/dbartol/smart-pointers/side-effects 
C++: Generate side effect instructions for smart pointer indirections
 2021-06-01 16:57:05 +02:00
Dave Bartolomeo
da14647e5a Merge pull request #5522 from github/rdmarsh2/cpp/ssa-reuse 
C++: reuse unaliased SSA results when computing aliased SSA
 2021-06-01 10:17:54 -04:00
Alvaro Muñoz
970b4e7d6a update java library coverage documentation 2021-06-01 14:54:31 +02:00
Alvaro Muñoz
0fb692400c fix failing test 2021-06-01 13:57:13 +02:00
Tom Hvitved
ecf7f24cde C#: Sync latest FlowSummaryImpl.qll changes 2021-06-01 13:22:14 +02:00
Tom Hvitved
14f9a5c280 Java: Move some CSV flow summary code into shared library 2021-06-01 13:22:14 +02:00
Henning Makholm
534e771309 Merge pull request #5934 from github/hmakholm/pr/monotonic-agg 
QL language reference: add monotonic aggregate example
 2021-06-01 13:10:50 +02:00
Tamás Vajk
e7a349be2d Merge pull request #5978 from tamasvajk/fix/change-note-workflow 
Fix change note workflow to handle paginated results
 2021-06-01 12:50:32 +02:00
Anders Schack-Mulligen
ce509eb7e1 Merge pull request #5927 from aschackmull/dataflow/flowthrough-dispatch-perf 
Dataflow: Improve performance in flow-through pruning
 2021-06-01 11:46:22 +02:00
Anders Schack-Mulligen
a4661e1aca Merge pull request #5704 from edvraa/regexj 
Java: Regex injection
 2021-06-01 11:45:59 +02:00