hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-17 13:06:48 +01:00
Code Issues Packages Projects Releases Wiki Activity
26,733 Commits 1,714 Branches 162 Tags
9d63efe495353ed31283260c3c8e666a6bdb24ec
Commit Graph

26733 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Geoffrey White
9d63efe495 Python: Set literals. 2021-10-14 14:22:44 +01:00
Geoffrey White
b9cce57db4 JS: Fix mistake. 2021-10-14 14:22:43 +01:00
Geoffrey White
882adc8e50 JS: Set literals. 2021-10-14 14:22:42 +01:00
Geoffrey White
a82c76d2f9 Java: Set literals. 2021-10-14 14:22:40 +01:00
Geoffrey White
3983587682 C#: Set literals. 2021-10-14 14:22:39 +01:00
Geoffrey White
2e61ae244a C++: Set literals. 2021-10-13 16:12:36 +01:00
Anders Schack-Mulligen
169cc75c88 Merge pull request #6840 from aschackmull/java/misc-perf 
Java: Fix some performance issues.
 2021-10-13 15:53:49 +02:00
Philip Ginsbach
a204b7f3e7 Merge pull request #6866 from github/ginsbach/MoreInstanceofExtensions 
more instanceof extensions
 2021-10-13 14:21:50 +01:00
Jonas Jensen
c215838531 Merge pull request #6867 from nickrolfe/mergeback 
Merge rc/3.3 into main
 2021-10-13 15:19:18 +02:00
Mathias Vorreiter Pedersen
6ece3c2b46 Merge pull request #6870 from jbj/cp-fixes 
C++: Fix potential Cartesian products
 2021-10-13 14:15:33 +01:00
Jonas Jensen
e80c1ad91f C++: Fix resource-not-released-in-destructor CP 
By moving a disjunct outside the scope of an `exists(Function f`
variable it doens't use, the code becomes clearer and can be optimized
better.

The CP in the QL code did not lead to a CP at evaluation time since the
optimizer was smart enough to compensate for it:

    376161  ~37597630%     {0} r1 = SCAN functions OUTPUT {}
    1       ~0%            {0} r2 = STREAM DEDUP r1

Before this change, the largest tuple count in `leakedInSameMethod` on
bitcoin/bitcoin was 2M. Now it's 400k.
 2021-10-13 14:24:26 +02:00
Jonas Jensen
955344e175 C++: Inline a predicate that contains CPs 
The `overflows` predicate had quite severe Cartesian products. We didn't
see them in practice because magic saved us, but we can't rely on magic
in the future, so it seems better to inline this predicate.

Tuple counts and speed look good both before and after.
 2021-10-13 14:11:47 +02:00
Philip Ginsbach
c9c0c7f24f fix formatting 2021-10-13 13:10:37 +01:00
Philip Ginsbach
6b9ddf1f65 Guard non-extending subtype of G::Guard 2021-10-13 11:44:22 +01:00
Philip Ginsbach
e3e741251f ParameterNode non-extending subtype of ParameterNodeImpl 2021-10-13 11:42:41 +01:00
Philip Ginsbach
aa656f7542 ArgumentNode non-extending subtype of ArgumentNodeImpl 2021-10-13 11:41:40 +01:00
Philip Ginsbach
4a0aac8505 SuppressionScope non-extending subtype of SuppressionComment 2021-10-13 11:40:32 +01:00
Philip Ginsbach
d0ecabad19 DataFlowCall non-extending subtype of Call 2021-10-13 11:39:25 +01:00
Anders Schack-Mulligen
d4fd8780e9 Merge pull request #6863 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2021-10-13 08:58:18 +02:00
Anders Schack-Mulligen
306388a6bc Update java/ql/src/Likely Bugs/Comparison/StringComparison.ql 2021-10-13 08:57:31 +02:00
github-actions[bot]
2f27a0c9f9 Add changed framework coverage reports 2021-10-13 00:09:35 +00:00
Andrew Eisenberg
8285878504 Merge pull request #6861 from github/aeisenberg/qlpack-defaultSuite 
QlPacks: Add the defaultSuite to query packs that are missing it
 2021-10-12 14:27:09 -07:00
Andrew Eisenberg
bbb2637bcc QlPacks: Add the defaultSuite to query packs that are missing it 
Also, change some examples pack names from `codeql-lang-examples` to
`codeql/lang-examples`. This doesn't affect behaviour since internally,
the legacy name is converted to the modern name.
 2021-10-12 11:54:50 -07:00
Aditya Sharad
a517a05ca8 Merge pull request #6830 from github/henrymercer/report-extraction-errors-as-warnings 
C++: Improve SARIF severity level reporting of extractor diagnostics
 2021-10-12 09:59:27 -07:00
Anders Schack-Mulligen
0e5f89a03c Merge pull request #6463 from smowton/smowton/admin/gson-unsafe-deserialization 
Java: add Gson support to unsafe-deserialization query
 2021-10-12 16:15:27 +02:00
Mathias Vorreiter Pedersen
6853f491f4 Merge pull request #6794 from geoffw0/impropnullfp 
C++: Improvements to cpp/improper-null-termination
 2021-10-12 14:47:02 +01:00
Tom Hvitved
10739b11ee Merge pull request #6841 from hvitved/dataflow/incorrect-summary-chaining 
Data flow: Add tests for missing summary flow
 2021-10-12 15:44:21 +02:00
Chris Smowton
83c6406167 Update javadoc 2021-10-12 13:51:02 +01:00
Tom Hvitved
cc305ed766 Data flow: Sync 2021-10-12 14:37:33 +02:00
Tom Hvitved
296e268339 Apply suggestions from code review 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2021-10-12 14:28:32 +02:00
Chris Smowton
3c96e62be7 Remove duplicate declaration 2021-10-12 12:35:05 +01:00
Chris Smowton
8816aa1431 Improve Android stub fidelity to the point that all relevant tests work 
Note these still aren't entirely mechanically generated stubs matching the real Android 9.
 2021-10-12 12:35:05 +01:00
Chris Smowton
205b6fe6d7 Fix bad merge on Uri.java 2021-10-12 12:35:05 +01:00
Chris Smowton
5da392ebfe Introduce TaintInheritingContent 2021-10-12 12:35:05 +01:00
Chris Smowton
1afc03b9b5 Remove redundant import 2021-10-12 12:35:05 +01:00
Chris Smowton
9e0b112f05 Remove now-unnecessary models and tests 2021-10-12 12:35:05 +01:00
Chris Smowton
490168fb05 Fix comments 2021-10-12 12:35:05 +01:00
Chris Smowton
1dffbcd0bd Fix tests disrupted by re-modelling and stubbing Android 9: 
* Account for changed dataflow graph shape using external flow
* Account for BaseBundle only existing as of Android 5
* Properly implement Parcelable, which we previously got away with due to a partial stub
* Restore an Android 11 function that had been added to the Android 9 Context class (I won't get into enforcing the difference in this PR)
 2021-10-12 12:35:05 +01:00
Chris Smowton
81c0e66b1d Add change note and update qhelp 2021-10-12 12:35:05 +01:00
Chris Smowton
fc0b18cf61 Add tests for Android flow steps 2021-10-12 12:35:05 +01:00
Chris Smowton
cd2c9e9ca3 Add Gson support to unsafe deserialization query 2021-10-12 12:35:04 +01:00
Anders Schack-Mulligen
6b4ca31783 Merge pull request #6849 from Marcono1234/marcono1234/improvements 
Java: Serialization query improvements
 2021-10-12 13:30:45 +02:00
Shati Patel
1c3239972c Merge pull request #6854 from shati-patel/packaging-beta-note 
Docs: Update beta note for packaging
 2021-10-12 10:33:59 +01:00
Taus
75c4d6a8a0 Merge pull request #6650 from yoff/python-dataflow/init-time 
Python: Import time dataflow
 2021-10-12 11:31:03 +02:00
yoff
43f7eede0b Merge pull request #6182 from haby0/python/LogInjection 
Python: CWE-117 Log injection
 2021-10-12 10:54:45 +02:00
yoff
c007c9460c Merge pull request #6843 from RasmusWL/dataflow-bool-expr 
Python: Add data-flow for `x or y` and `x and y`
 2021-10-12 10:40:54 +02:00
Rasmus Lerchedahl Petersen
f34d1ee997 Python: Update test expectation following rename 2021-10-12 10:36:18 +02:00
Tom Hvitved
97bbb12e06 Merge pull request #6838 from hvitved/csharp/enumerate-files-dir-not-found 
C#: Make `GetCSharpArgsLogs` robust against log directory not existing
 2021-10-12 10:00:27 +02:00
haby0
d52f95d24d Auto Formatting 2021-10-12 09:36:44 +08:00
Mathias Vorreiter Pedersen
df8c399efb Merge pull request #6710 from ihsinme/ihsinme-patch-70 
CPP: Add query for CWE-1041 Use of Redundant Code
 2021-10-11 17:17:01 +01:00