hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 06:12:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
667 Commits 1,684 Branches 159 Tags
97b3ec5cfc35d6076bc355a847a04cc5cea09329
Commit Graph

667 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sauyon Lee
97b3ec5cfc Update dependency stubs 2020-05-13 10:07:14 -07:00
Sauyon Lee
ac55287210 Merge pull request #138 from max-schaefer/fix-tests 
Fix frontend errors in two tests and a code example
 2020-05-13 08:50:35 -07:00
Sauyon Lee
b8b9ff13f3 Merge pull request #139 from max-schaefer/cleanup-131 
Cleanup of `io` model
 2020-05-13 08:29:45 -07:00
Max Schaefer
d5fcf28e03 Add change note. 
While we didn't see any new results in the evaluation, this is a fairly substantial amount of changes, so adding a change note is probably justified.
 2020-05-13 15:55:52 +01:00
Max Schaefer
e852caea07 Cleanup of Io module. 
- Undid rename from `Io` to `IO`
  - Ensured function signatures in comments have leading `func`
  - Removed superfluous `extends Function` clauses
  - Renamed a few classes to be more consistent.
 2020-05-13 15:55:52 +01:00
Max Schaefer
41b5fc17ab Inline two single-use predicates. 
This fixes a TODO.
 2020-05-13 15:40:36 +01:00
Max Schaefer
6e58524b78 Fix a typo. 2020-05-13 15:40:31 +01:00
Max Schaefer
ec2314310e Fix code example in query. 2020-05-13 15:38:48 +01:00
Max Schaefer
ac9e39120b Fix unused variable in test. 2020-05-13 15:28:49 +01:00
Max Schaefer
e034458574 Fix MongoDB tests. 2020-05-13 15:25:54 +01:00
Sauyon Lee
2089cb4543 Merge pull request #133 from max-schaefer/cleanup-conditional-bypass 
Cleanup conditional-bypass query
 2020-05-13 02:31:13 -07:00
Max Schaefer
005e49fe94 Merge pull request #130 from porcupineyhairs/MongoInjection 
Golang : Add MongoDB injection support
 2020-05-13 09:43:49 +01:00
Sauyon Lee
24e939730a Merge pull request #134 from max-schaefer/fix-test-errors 
Fix frontend errors in tests
 2020-05-13 01:38:30 -07:00
Max Schaefer
89d633ac3f Merge pull request #120 from porcupineyhairs/SensitiveActionBypass 
User-controlled bypass of sensitive action
 2020-05-12 19:48:24 +01:00
Max Schaefer
d438b5ec03 Merge pull request #131 from porcupineyhairs/IO 
Model stdlib's IO package.
 2020-05-12 19:41:40 +01:00
Slavomir
84e2a5ddd2 Add experimental library: gin web framework (#117) 2020-05-12 14:27:11 +01:00
Max Schaefer
6f21b4030e Merge pull request #135 from sauyon/tempfile-test 
Add support for ioutil TempFile and TempDir
 2020-05-12 14:25:38 +01:00
Sauyon Lee
21bfaec0d3 TaintedPath: Add change note for tempfiles 2020-05-12 05:44:19 -07:00
Porcupiney Hairs
e51bc42bfb fix metadata 2020-05-12 17:31:24 +05:30
Max Schaefer
5dac94d24c Merge pull request #116 from gagliardetto/CWE-681 
CWE 681
 2020-05-12 11:59:08 +01:00
Slavomir
556f527193 Exclude results in test files 2020-05-12 13:12:47 +03:00
Slavomir
e5e74f34d7 Add note on why the zero is commented out in Lt32BitFlowConfig 2020-05-12 13:06:11 +03:00
Slavomir
623d5b3a97 Add comments 2020-05-12 13:00:50 +03:00
Slavomir
ea7c38c99c Remove references section from qhelp file 2020-05-12 13:00:27 +03:00
Slavomir
67a7294d10 Simplify and remove deprecated; add severity 2020-05-12 12:51:13 +03:00
Max Schaefer
a55c828fe4 Update ql/src/experimental/CWE-840/ConditionalBypass.ql 
Co-authored-by: porcupineyhairs <61983466+porcupineyhairs@users.noreply.github.com>
 2020-05-11 15:26:30 +01:00
Porcupiney Hairs
d0061bfd4b Golang : Add MongoDB injection support 
This PR adds support for MongoDB injection to the existing SQL injection query.
This models the official Golang MongoDB driver.

A  brief summary of changes made in this query are :

1. A `NoSQL.qll` files has been created to model a `NoSQLQueryString`.

2. An entry is added in `go.qll` by default as I find these changes may be generally useful.

3. Library tests along with there expected outputs are added.

4. Query tests are added. However, I am unable to add the expected output as qltest
can't find depstubber. However, these can be easily added. I have created a separate
codeql-go database with the same files and ran the query against the same. I can see
there should be 14 correct results added from this PR.
 2020-05-11 19:55:48 +05:30
Porcupiney Hairs
9b53ad3b3c model IO package 2020-05-11 19:39:01 +05:30
Porcupiney Hairs
c1856ba260 fix tests 2020-05-11 19:32:28 +05:30
Max Schaefer
4a7171d91e Fix frontend errors in BadRedirectCheck tests. 2020-05-11 11:45:21 +01:00
Max Schaefer
17dd99d326 Fix frontend errors in Mux tests. 2020-05-11 11:45:08 +01:00
Max Schaefer
df9902512f More cleanup in help and tests. 
In particular, I have copied over the examples referenced in the qhelp into the test folder and made sure they compile.
 2020-05-11 11:07:38 +01:00
Max Schaefer
287dda0ab5 Minor cleanup in query and tests. 2020-05-11 11:05:40 +01:00
Max Schaefer
78201a2c5f Rename ConditionBypass* to ConditionalBypass* for consistency with other languages. 2020-05-11 10:47:00 +01:00
Max Schaefer
3e830b69b5 Merge pull request #121 from porcupineyhairs/conditionBypass 
User-controlled bypass of a comparision
 2020-05-11 10:41:33 +01:00
Slavomir
5df81d3210 Apply suggestions from code review 
Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
 2020-05-11 12:37:14 +03:00
Sauyon Lee
181c03ebf3 Add support for ioutil TempFile and TempDir 2020-05-10 18:25:55 -07:00
Porcupiney Hairs
b32ac2a47f fix tests 2020-05-11 04:51:17 +05:30
Porcupiney Hairs
4aba80b0bd include changes from review 2020-05-11 04:05:41 +05:30
Porcupiney Hairs
3d10ec7e51 remove some obvious false positives and include changes from review 2020-05-11 03:13:01 +05:30
Max Schaefer
0e779d0b64 Merge pull request #62 from max-schaefer/update-data-flow 
Port recent data-flow improvements
 2020-05-07 16:07:33 +01:00
Max Schaefer
994536e93b Add change note. 2020-05-07 11:46:31 +01:00
Max Schaefer
70f87b59d2 Data flow: Support stores into nodes that are not PostUpdateNodes. 
cf https://github.com/github/codeql/pull/3312
 2020-05-06 19:43:27 +01:00
Max Schaefer
fd2e618be2 Data flow: No more summaries 
cf https://github.com/github/codeql/pull/3110
 2020-05-06 19:43:27 +01:00
Max Schaefer
968d4d9cdd Revert the join order fix from https://github.com/github/codeql/pull/2872. 
cf https://github.com/github/codeql/pull/3202
 2020-05-06 19:43:27 +01:00
Max Schaefer
f2b43f65f9 Data flow: Exclude param-param flow through identical params. 
cf https://github.com/Semmle/ql/pull/3060
 2020-05-06 19:43:27 +01:00
Max Schaefer
aabe2f2f82 Data flow: No magic in returnFlowCallableCand. 
cf https://github.com/Semmle/ql/pull/3142
 2020-05-06 19:43:27 +01:00
Max Schaefer
c9ba6dd672 Fix up hasLocationInfo predicate. 2020-05-06 19:43:27 +01:00
Max Schaefer
5cd9168e4d Data flow: Refactoring + performance improvements 
cf https://github.com/Semmle/ql/pull/2903
 2020-05-06 19:43:27 +01:00
Max Schaefer
96120e1e35 Update expected output. 2020-05-06 19:43:27 +01:00