hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-06-15 18:01:10 +02:00
Code Issues Packages Projects Releases Wiki Activity
6,446 Commits 1,785 Branches 169 Tags
9df205b288fb7208c58a0e07ea6e83b39b60698c
Commit Graph

6446 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mark Shannon
9df205b288 Python tests: Fix up CWE-327 tests to use new sensitive-data library. 2019-08-22 15:27:48 +01:00
Mark Shannon
6cd0087d9d Python: Use Value API for sensitive data analysis. 2019-08-22 15:27:48 +01:00
Mark Shannon
81c65cd37c Add missing html tag 2019-08-22 15:27:48 +01:00
Mark Shannon
816938369e Python: Add tests for clear-text storage and logging. 2019-08-22 15:27:48 +01:00
Mark Shannon
15bb8b5f70 Python add new queries for clear-text logging and storage. 2019-08-22 15:27:48 +01:00
Mark Shannon
79ebd5652a Python: Add library support for cookies. Update and extend sensitive data library. 2019-08-22 15:27:48 +01:00
Taus
ae2a68b988 Merge pull request #1791 from markshannon/python-revert-tests 
Python: Revert and update tests removed in #1767
 2019-08-22 11:20:24 +02:00
Robert Marsh
1b6339528c Merge pull request #1783 from jbj/taint-fields-structs 
C++: Don't propagate taint between field and struct [CPP-410]
 2019-08-21 11:20:26 -07:00
yh-semmle
9012c3240f Merge pull request #1789 from aschackmull/java/autoformat 
Java: Autoformat.
 2019-08-21 12:36:55 -04:00
Taus
c595d0f27b Merge pull request #1784 from markshannon/python-move-essa-together 
Python: Move all ESSA related code into one folder.
 2019-08-21 17:51:45 +02:00
Tom Hvitved
a2ffddec5f Merge pull request #1785 from jbj/dataflow-recursion-prevention-shared 
C++/C#/Java: Pyrameterize ConfigurationRecursionPrevention
 2019-08-21 15:56:50 +02:00
Mark Shannon
e77ae09a86 Python tests: Update test results to account for better handling of branches in finally blocks. 2019-08-21 14:47:57 +01:00
Mark Shannon
714fecbf5e Python: Revert tests removed in #1767. 2019-08-21 14:39:53 +01:00
semmle-qlci
ddc716d2d3 Merge pull request #1768 from asger-semmle/ts-debugging 
Approved by esben-semmle, xiemaisi
 2019-08-21 14:21:45 +01:00
Felicity Chapman
4e355ce497 Merge pull request #1786 from jf205/gtm-sphinx 
Sphinx docs: update references on `layout.html`
 2019-08-21 14:17:21 +01:00
jf205
79477a45cf Merge pull request #1748 from asger-semmle/type-tracking-tutorial 
JS: Type tracking tutorial
 2019-08-21 13:47:53 +01:00
james
419d07e1e5 docs: remove HS, GA, add GTM ref 2019-08-21 13:45:54 +01:00
Anders Schack-Mulligen
629c19e719 Java: Autoformat. 2019-08-21 14:38:17 +02:00
Jonas Jensen
863bf523d6 C++/C#/Java: Autoformat 2019-08-21 13:24:01 +02:00
Asger F
d5f43fb7cb Update docs/language/learn-ql/javascript/type-tracking.rst 
Co-Authored-By: jf205 <42464962+jf205@users.noreply.github.com>
 2019-08-21 12:23:09 +01:00
Anders Schack-Mulligen
b4856e928b Merge pull request #1780 from jbj/simpleLocalFlowStep 
C++/C#/Java: Split localFlowStep predicate in two
 2019-08-21 13:16:58 +02:00
Jonas Jensen
846e3734ce C++: Change note for recursion prevention 2019-08-21 13:12:48 +02:00
Jonas Jensen
fdd3b901f7 C/C#/Java: Share ConfigurationRecursionPrevention 
This class was copy-pasted in all `DataFlowN.qll` files without using
the identical-files system to keep the copies in sync. The class is now
moved to the `DataFlowImplN.qll` files.

This also has the effect of preventing recursion through first data flow
library copy for C/C++. Such recursion has been deprecated for over a
year, and some forms of recursions are already ruled out by the library
implementation.
 2019-08-21 13:04:10 +02:00
Mark Shannon
857cd9196b Merge pull request #1782 from taus-semmle/python-pruning-nomagic 
Python: Prevent bad magic during pruning.
 2019-08-21 11:55:59 +01:00
Asger F
0785c1b17b JS: Address comments 2019-08-21 11:48:05 +01:00
Asger F
17573afa0c JS: Hyphenate type-tracking when used as adjective 2019-08-21 11:47:58 +01:00
Jonas Jensen
2f4ed45dac C++: No taint between field and struct 
To compensate for the lack of field flow, the taint tracking library has
previously considered taint to flow from fields to their containing
structs and back again from the structs to any of their fields. This
leads to false flow between unrelated fields and is not needed now that
we have proper flow through fields.
 2019-08-21 11:57:12 +02:00
Jonas Jensen
6fc3a62edb C++/C#/Java: Change another caller of localFlow 
There was also a use of `localFlowStep` in `DataFlowImplCommon` that
should now be `simpleLocalFlowStep`.
 2019-08-21 10:20:15 +02:00
Jonas Jensen
ec2cc5a80e C#: Refactor how simpleLocalFlowStep is called 
`localFlowStep` is no longer an alias because it should not have the
same QLDoc as `simpleLocalFlowStep`.
 2019-08-21 10:05:54 +02:00
Jonas Jensen
c9ea5ad9a3 C#/Java: Remove cached from wrapper predicate 2019-08-21 09:43:13 +02:00
Jonas Jensen
4b7813b98e C++/C#/Java: Split localFlowStep predicate in two 
There's now a `localFlowStep` predicate for use directly in queries and
other libraries and a `simpleLocalFlowStep` for use only by the global
data flow library. The former predicate is intended to include field
flow, but the latter may not.

This will let Java and C# (and possibly C++ IR) avoid getting two kinds
of field flow at the same time, both from SSA and from the global data
flow library. It should let C++ AST add some form of field flow to
`localFlowStep` without making it an input to the global data flow
library.
 2019-08-21 09:27:01 +02:00
zlaski-semmle
c2d1a52b39 Merge pull request #1732 from geoffw0/qldoceg6 
CPP: Add syntax examples to QLDoc in Block.qll, Stmt.qll
 2019-08-20 16:34:35 -07:00
Anders Schack-Mulligen
9150682ada Merge pull request #1757 from jbj/pyrameterized-taint 
C++: Use pyrameterized modules for TaintTracking
 2019-08-20 16:33:22 +02:00
Taus Brock-Nannestad
a58c16f91c Python: Prevent bad magic during pruning. 
Fixes the performance regression seen on `uncompyle2` and similar projects.
 2019-08-20 16:18:42 +02:00
Calum Grant
35017786cf Merge pull request #1739 from hvitved/csharp/ssa/delegate-call-source 
C#: Search from delegate creation in `delegateCallSource()`
 2019-08-20 15:16:20 +01:00
Jonas Jensen
7c4938c035 C#: Get rid of TaintTrackingUtil.qll 2019-08-20 13:56:13 +02:00
Jonas Jensen
bc702debf9 C++/Java: Change notes for Configuration2 rename 2019-08-20 13:46:04 +02:00
Jonas Jensen
11583b69e0 C#: Use pyrameterized modules for TaintTracking 
To keep the code changes minimal, and to keep the implementation similar
to C++ and Java, the `TaintTracking{Public,Private}` files are now
imported together through `TaintTrackingUtil`. This has the side effect
of exposing `localAdditionalTaintStep`. The corresponding predicate for
Java was already exposed.
 2019-08-20 13:45:38 +02:00
Jonas Jensen
f1e6e36ce6 Java: Remove wrong definition of taint tracking 
This explanation, taken from C/C++, was not correct for Java.
 2019-08-20 13:45:38 +02:00
Jonas Jensen
9ac0cdd2a2 Java: Don't use the deprecated Configuration2 2019-08-20 13:45:37 +02:00
Jonas Jensen
aeb2323128 Java: Use pyrameterized modules for TaintTracking 2019-08-20 13:45:37 +02:00
Jonas Jensen
d65b09d94a C++: Proper fix for TaintTracking2 parameter 2019-08-20 13:45:37 +02:00
Jonas Jensen
b1cd64bbf4 C++: Fix mismatch between taint and dataflow copy 2019-08-20 13:45:37 +02:00
Jonas Jensen
d388be7d3b C++: Use pyrameterized modules for TaintTracking 2019-08-20 13:45:37 +02:00
Mark Shannon
d8531c46e7 Python ESSA: Move variable definitions into new file and unify 'generic' and 'python specific' parts. 2019-08-20 11:55:41 +01:00
Mark Shannon
523c5b1e1e Python ESSA: Remove unnecessary intermediate class. 2019-08-20 11:41:53 +01:00
Mark Shannon
2ab3bf46cf Python ESSA: Move definition sub-classes from points-to folder to essa folder. 2019-08-20 11:41:53 +01:00
Mark Shannon
e34ccae1fc Python ESSA: Move all Essa code to semmle.python.essa folder. 2019-08-20 11:41:46 +01:00
Asger F
f18f54fd0d TS: Allow changing the port 2019-08-20 10:41:25 +01:00
semmle-qlci
7698240484 Merge pull request #1769 from asger-semmle/ts-rest-pattern-default 
Approved by esben-semmle
 2019-08-20 10:02:43 +01:00