hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-21 01:13:43 +01:00
Code Issues Packages Projects Releases Wiki Activity
62,498 Commits 1,693 Branches 161 Tags
a8863e44db70f7491874e2d75a10a5fff9648689
Commit Graph

110 Commits

Author SHA1 Message Date
Geoffrey White
a8863e44db C++: Port implementation to CPP. 2024-01-18 13:24:57 +00:00
Mathias Vorreiter Pedersen
3897befbe2 C++: Fix joins in 'cpp/wrong-type-format-argument'. 2023-12-18 09:49:34 +01:00
Mathias Vorreiter Pedersen
2b36ba33f0 C++: Add support for 'data' in the query. 2023-11-28 12:57:59 +00:00
Mathias Vorreiter Pedersen
22a91d18b8 C++: Make the sequence container classes public. 2023-11-27 21:32:49 +00:00
Jeroen Ketema
ee35bfb290 C++: Do not use isReturnValue in getenv, gets, and fgets models 2023-11-24 16:38:15 +01:00
Jeroen Ketema
3a62628938 Merge pull request #14735 from jketema/strl 
C++: Add models for `strlcpy` and `strlcat`
 2023-11-10 17:51:59 +01:00
Jeroen Ketema
c71bdce2d0 Merge pull request #14744 from jketema/fgets 
C++: Fix `hasRemoteFlowSource` for `fgets`
 2023-11-10 14:03:40 +01:00
Jeroen Ketema
617d950a25 Apply suggestions from code review 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2023-11-10 13:55:39 +01:00
Jeroen Ketema
1c87875049 C++: Drop the size return value of strlcat from hasTaintFlow 2023-11-10 13:15:57 +01:00
Jeroen Ketema
5e21a5d284 C++: Fix flow for return values of strlcat and strlcpy 2023-11-10 12:28:48 +01:00
Jeroen Ketema
ba51b65d84 C++: Fix hasRemoteFlowSource for fgets 
Also add the test that exposed this. Note that the test would only have started
failing after `cpp/uncontrolled-process-operation` with the rewrite of the
query away from default taint tracking, which has not happened yet.
 2023-11-10 11:56:23 +01:00
Jeroen Ketema
e4c8406365 C++: Split strlcat off in a separate model 2023-11-10 10:11:57 +01:00
Benjamin Rodes
5e140021fb Removed non-ascii characters. 2023-11-09 15:24:58 -05:00
Jeroen Ketema
a051a57e00 Update cpp/ql/lib/semmle/code/cpp/models/implementations/Strcat.qll 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2023-11-09 17:48:45 +01:00
Jeroen Ketema
0b91310357 C++: Add models for strlcpy and strlcat 2023-11-09 17:21:37 +01:00
Benjamin Rodes
bdae2af0e2 Adding missing strsafe sprintf variants. 2023-11-08 12:20:53 -05:00
Mathias Vorreiter Pedersen
a17cd9bc1c Merge pull request #14667 from MathiasVP/more-function-input-and-output-ipa-numbers 
C++: Allocate more `FunctionInput` and `FunctionOutput`s
 2023-11-07 08:57:31 +00:00
Mathias Vorreiter Pedersen
31c2a3be98 C++: Don't redefine the meaning of the single-parameter 'isParameterDeref' and accept test changes. 2023-11-06 15:52:58 +00:00
Mathias Vorreiter Pedersen
ff30308a2b C++: Only the first indirection of the argument should be the remote flow sink. 2023-11-06 13:57:14 +00:00
Mathias Vorreiter Pedersen
cd2eec0aa0 C++: Also override the single-parameter 'isParameterDeref' in 'InParameterDeref'. 2023-11-06 13:23:31 +00:00
Mathias Vorreiter Pedersen
679d64f0e8 Merge pull request #14647 from microsoft/24-odbc-model-instantiation-upstream2 
C++: Adding a model implementation for ODBC.
 2023-11-02 19:42:27 +00:00
Benjamin Rodes
30a512c96b Formatting 2023-11-02 15:01:15 -04:00
Benjamin Rodes
f404d7a5f8 Changes to address pr comments. 2023-11-02 13:11:23 -04:00
Mathias Vorreiter Pedersen
392b2af923 C++: Only the second indirection of the argument should be the remote flow source. 2023-11-02 16:51:24 +00:00
Mathias Vorreiter Pedersen
b82dfa9a21 C++: Fix failing test by allocating 'TFunctionInput's and 'TFunctionOutput's for more indirections. Note that we now mark two output nodes coming out of 'getaddrinfo' as a remote flow source (the first indirection and the second indirection). We'll fix that in the next commit. 2023-11-02 16:45:50 +00:00
Benjamin Rodes
18c8d90a1a Adding a model implementation for ODBC. 
(cherry picked from commit 04147f8d91cdf018ec03cbfdb953253e23687944)
 2023-10-31 08:52:05 -07:00
Mathias Vorreiter Pedersen
4a1bf95a87 C++: Expose a public memset model and use it in the exposure queries. 2023-10-31 11:17:51 +00:00
Mathias Vorreiter Pedersen
08b528b5c4 C++: Add a taint-model for 'realloc' and accept test changes. 2023-10-30 17:08:01 +00:00
Mathias Vorreiter Pedersen
33494fe9e1 C++: Extend the taint model and accept test changes. 2023-10-27 16:26:37 +01:00
Mathias Vorreiter Pedersen
8bf8888c24 C++: Simplify 'parameterNeverEscapes' and add a comment. 2023-10-27 16:26:37 +01:00
Mathias Vorreiter Pedersen
43e8b900bf C++: Fix 'strtol' model. 2023-10-27 14:59:11 +01:00
Mathias Vorreiter Pedersen
032572b924 C++: Fix 'strtok' model. 2023-10-25 09:39:36 +01:00
Mathias Vorreiter Pedersen
fe97572f70 C++: Fix strncpy model. 2023-06-22 10:59:12 +01:00
Mathias Vorreiter Pedersen
f7924bda0d Merge pull request #13099 from MathiasVP/heuristic-allocation-for-overrun-write 
C++: Use heuristic allocation functions in `cpp/overrun-write`
 2023-05-12 10:15:28 +01:00
Mathias Vorreiter Pedersen
6aa40050bd C++: Use member predicates on parameterized module parameters now that it's available in the language. 2023-05-10 09:24:38 +01:00
Mathias Vorreiter Pedersen
363514e4ca C++: Expand heuristic to catch more sources. 2023-05-10 08:27:29 +01:00
Kasper Svendsen
c46898cb75 C++: Make implicit this receivers explicit 2023-05-09 15:35:54 +02:00
Mathias Vorreiter Pedersen
00450d10bb Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow 2023-03-13 14:50:17 +01:00
erik-krogh
6c1ebd999e Merge branch 'main' into delOldDeps 2023-03-13 11:00:29 +01:00
Anders Schack-Mulligen
ef97e539ec C/C++: Autoformat 2023-03-10 09:39:41 +01:00
erik-krogh
f96d6accbb delete old deprecations 2023-03-03 09:23:02 +01:00
Mathias Vorreiter Pedersen
3906a1923b Merge branch 'mathiasvp/replace-ast-with-ir-use-usedataflow' into no-taint-indirect-direct-conflation 2023-02-27 18:40:04 +00:00
Mathias Vorreiter Pedersen
a4c075f03b C++: The data pointed to by 'gets' is also a source of user input. 2023-02-27 16:25:32 +00:00
Mathias Vorreiter Pedersen
5a8b900394 C++: Properly track smart pointer wrappers. 2023-02-27 14:57:35 +00:00
Mathias Vorreiter Pedersen
fcc4c91739 C++: More responding to comments. 2023-01-31 13:01:00 +00:00
Mathias Vorreiter Pedersen
daf7d1b7e7 C++: Add more QLDoc. 2023-01-31 10:37:51 +00:00
Mathias Vorreiter Pedersen
7583fe2ad8 C++: Respond to PR reviews. 2023-01-31 10:31:02 +00:00
Mathias Vorreiter Pedersen
f90007ae71 C++: Make our iterator models public. 2023-01-30 17:23:52 +00:00
Mathias Vorreiter Pedersen
470abfd0aa C++: Conflate iterator value and indirection for taint-flow to fix AST dataflow. 2023-01-23 10:40:25 +00:00
Mathias Vorreiter Pedersen
962b651c44 C++: Fix models. 2023-01-23 10:10:02 +00:00