hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 12:46:34 +01:00
Code Issues Packages Projects Releases Wiki Activity
64,930 Commits 1,673 Branches 157 Tags
a13391bda16dfb3ee2d04fdef0aeb61645cfbfbe
Commit Graph

64930 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tom Hvitved
a13391bda1 Merge pull request #15802 from hvitved/dataflow/variable-capture-overlapping-paths 
Variable capture: Avoid overlapping and false-positive data flow paths
 2024-03-18 10:45:55 +01:00
Max Schaefer
daee22d38c Merge pull request #15933 from github/max-schaefer/go-incomplete-hostname-regex 
Go: Mention raw string iterals in QHelp for `go/incomplete-hostname-regexp`.
 2024-03-15 15:07:10 +00:00
Edward Minnix III
8ae64e992c Merge pull request #15929 from egregius313/egregius313/csharp/mad/source-node-clases-for-models 
C#: Add classes extending `SourceNode` for local and stored source models
 2024-03-15 11:06:14 -04:00
Max Schaefer
d3e0a90ae5 Go: Mention raw string iterals in QHelp for go/incomplete-hostname-regexp. 2024-03-15 11:22:40 +00:00
Tom Hvitved
693c28a821 Merge pull request #15931 from hvitved/ql/remove-missing-override-query 
QL4QL: Remove `MissingOverride` query
 2024-03-15 11:28:41 +01:00
Tom Hvitved
80649786c3 QL4QL: Remove MissingOverride query 2024-03-15 11:06:15 +01:00
Tony Torralba
171ff4d161 Merge pull request #15928 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2024-03-15 09:24:57 +01:00
Ed Minnix
71cf948650 Classes extending SourceNode for local and stored source models 
Queries such as `cs/sql-injection` cast their source to a `SourceNode`
in order to describe them. For example:

```ql
import semmle.code.csharp.security.dataflow.flowsources.FlowSources

string getSourceType(DataFlow::Node source) {
   result = source.(SourceNode).getSourceType()
}
```

Models as data source models are not included in `SourceNode` by
default, they must be wrapped with a class extending `SourceNode`.

This adds such classes, which wrap the
`sourceNode(DataFlow::Node,string)` predicate and assigns a
`getSourceType`.
 2024-03-14 22:23:54 -04:00
github-actions[bot]
7f05743212 Add changed framework coverage reports 2024-03-15 00:16:16 +00:00
Mathias Vorreiter Pedersen
6dddae0154 Merge pull request #15925 from MathiasVP/rename-dataflowutil-class 
C++: Follow-up to #15918
 2024-03-14 18:15:14 +00:00
Tony Torralba
ee3efbadae Merge pull request #15924 from atorralba/atorralba/go/hardcoded-credentials-fix 
Go: Consider more strings as hardcoded credentials
 2024-03-14 16:52:34 +01:00
Tamás Vajk
945121de1b Merge pull request #15922 from tamasvajk/buildless/namespace-extraction 
C#: Handle namespace resolution error more gracefully
 2024-03-14 16:19:48 +01:00
Michael Nebel
2280469564 Merge pull request #15902 from michaelnebel/csharp/uncontrolledformatstring 
C#: Remove hard-coded local sources from the uncontrolled-format-string query.
 2024-03-14 15:21:31 +01:00
Mathias Vorreiter Pedersen
7fdea27d33 C++: Rename 'IndirectTemporaryExpr' to 'IndirectOperandExprNode'. 2024-03-14 11:46:15 +00:00
Tony Torralba
20691e409c Add change note 2024-03-14 11:56:43 +01:00
Mathias Vorreiter Pedersen
9aefdca7a7 Merge pull request #15875 from MathiasVP/bring-back-type-barriers-in-non-constant-format 
C++: Clean up `cpp/non-constant-format`
 2024-03-14 10:51:23 +00:00
Tony Torralba
30d906d42a Merge pull request #15906 from atorralba/atorralba/java/jdk-neutrals 
Java: Add more neutral JDK models
 2024-03-14 11:07:06 +01:00
Mathias Vorreiter Pedersen
dacf7d73d9 Merge pull request #15918 from MathiasVP/fix-as-expr-for-temps 
C++: Fix dataflow node <> expression problem on prvalues
 2024-03-14 09:38:46 +00:00
Tony Torralba
87b2dcc892 Adjust test expectations 2024-03-14 10:25:04 +01:00
Mathias Vorreiter Pedersen
a24432bacc Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll 2024-03-14 09:23:33 +00:00
Mathias Vorreiter Pedersen
c375497fa5 Update cpp/ql/lib/semmle/code/cpp/ir/dataflow/internal/DataFlowUtil.qll 2024-03-14 09:16:04 +00:00
Tony Torralba
d8c0ab8e1f Go: Consider more strings as hardcoded credentials 2024-03-14 10:11:39 +01:00
Tony Torralba
9d44045e6f Adjust test expectations 2024-03-14 09:41:34 +01:00
Tony Torralba
eecab9122a Recognize the model generator involvement in the models' provenances 2024-03-14 08:56:23 +01:00
Tony Torralba
5b88b8a3ed A few more neutrals 2024-03-14 08:53:58 +01:00
Tony Torralba
36f6a6fb10 Model more EnumSet methods as neutrals 2024-03-14 08:46:43 +01:00
Tamas Vajk
b5f349bd2c C#: Handle namespace resolution error more gracefully 2024-03-14 08:37:22 +01:00
Jeroen Ketema
b2e0485c94 Merge pull request #15908 from jketema/destructors12 
C++: suppress destructors with reuse expressions until proper support is added
 2024-03-14 07:41:59 +01:00
Mathias Vorreiter Pedersen
a839c92979 C++: Fix mapping issue between dataflow nodes and expressions when the expression is a prvalue. 2024-03-13 22:59:09 +00:00
Mathias Vorreiter Pedersen
2fc0922b29 Merge branch 'main' into bring-back-type-barriers-in-non-constant-format 2024-03-13 22:46:35 +00:00
Mathias Vorreiter Pedersen
d1c253b519 C++: Accept test changes. 2024-03-13 22:41:32 +00:00
Mathias Vorreiter Pedersen
61597f5ac7 C++: This commit does two things: 
1. It fixes a logic error in the cannotContainString predicate.
2. It reverts the changes to the `isSource` predicate that required the external
function to be within the source root.

The change to `isSource` was meant to fix the a performance problem that occurred
because of the logic error in the cannotContainString predicate. However, now that
the logic error is fixed this is no longer necessary 🎉
 2024-03-13 22:40:06 +00:00
Jeroen Ketema
866a3934d4 C++: suppress destructors with reuse expressions until proper support is added 2024-03-13 20:17:00 +01:00
Jeroen Ketema
67b3670d06 Merge pull request #15901 from jketema/destructors11 
C++: Introduce re-use expressions in the database scheme
 2024-03-13 18:27:28 +01:00
Tony Torralba
039bea1625 Java: Add more neutral JDK models 
This is similar to https://github.com/github/codeql/pull/15766, in the sense that it adds neutral models to prevent the model generator from generating summaries for them. These models were spotted while evaluating https://github.com/github/codeql/pull/14919.
 2024-03-13 16:59:38 +01:00
Mathias Vorreiter Pedersen
b638d4d0ba Merge pull request #15900 from MathiasVP/glib-alloc-and-dealloc 
C++: Add models for `GLib` allocation and deallocation
 2024-03-13 15:29:46 +00:00
Erik Krogh Kristensen
bd121b98ae Merge pull request #15893 from erik-krogh/more-filter-taint 
JS: allow more flow through .filter()
 2024-03-13 16:19:28 +01:00
Michael Nebel
560b355e0c C#: Remove hard-coded local sources from the uncontrolled-format-string query. 2024-03-13 14:26:30 +01:00
Erik Krogh Kristensen
53502a8662 Merge pull request #15510 from yoff/ts-54 
JS: Add support for TS 5.4
 2024-03-13 14:22:24 +01:00
Jeroen Ketema
8d5eab401d C++: Introduce re-use expressions in the database scheme 2024-03-13 13:28:27 +01:00
Mathias Vorreiter Pedersen
8d504d8b32 Merge pull request #15899 from jketema/destructors10 
C++: Add IR tests for the destruction of temporaries
 2024-03-13 11:56:04 +00:00
Mathias Vorreiter Pedersen
465c3c18e3 C++: Add change note. 2024-03-13 11:49:26 +00:00
Asger F
c5a02dae2b Merge pull request #15768 from asgerf/js/amd-pseudo-deps 
JS: Do not treat AMD pseudo-dependencies as imports
 2024-03-13 12:49:17 +01:00
Mathias Vorreiter Pedersen
3ea39a2553 C++: Add some query tests. 2024-03-13 11:39:34 +00:00
Mathias Vorreiter Pedersen
bcd36b1994 C++: Recognize glib allocations and deallocations. 2024-03-13 11:39:15 +00:00
Ian Lynagh
adefdfd59f Merge pull request #15889 from igfoo/igfoo/k2exprs 
Kotlin 2: Accept more changes in the exprs test
 2024-03-13 11:34:10 +00:00
erik-krogh
129286aa1c allow more flow through .filter() 2024-03-13 12:03:00 +01:00
Jeroen Ketema
3ef1ab49ea C++: Add IR tests for the destruction of temporaries 2024-03-13 12:00:02 +01:00
yoff
b5c0fbb827 Merge pull request #15776 from RasmusWL/tt-consistency 
Python: Add type-tracking consistency query
 2024-03-13 11:11:07 +01:00
Tom Hvitved
4085c8ec8f Merge pull request #15866 from hvitved/ruby/orm-tracking-ap-limit 
Ruby: Lower access path limit to 1 for `OrmTracking`
 2024-03-13 10:57:09 +01:00