Tom Hvitved
987870bb62
Merge pull request #10315 from hvitved/ruby/parameter-match-join
...
Ruby: Fix bad join in `parameterMatch`
2022-09-07 08:43:15 +02:00
Tom Hvitved
b2c38b37de
Merge pull request #10296 from hvitved/ruby/call-graph-missing-singletons
...
Ruby: Add missing edges to the call graph for singleton methods
2022-09-06 13:23:24 +02:00
Tom Hvitved
8b8a662c76
Ruby: Fix bad join in parameterMatch
...
Before
```
Evaluated relational algebra for predicate DataFlowDispatch#36b84300::parameterMatch#2#ff@281bdfu5 with tuple counts:
23338949 ~0% {2} r1 = JOIN DataFlowDispatch#36b84300::Cached::TParameterPosition#f WITH DataFlowDispatch#36b84300::Cached::TArgumentPosition#f CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.0
65011 ~0% {2} r2 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TAnyParameterPosition#f ON FIRST 1 OUTPUT Lhs.0, Lhs.1
65010 ~0% {2} r3 = r2 AND NOT DataFlowDispatch#36b84300::Cached::TSelfArgumentPosition#f(Lhs.1)
23338949 ~0% {2} r4 = JOIN DataFlowDispatch#36b84300::Cached::TParameterPosition#f WITH DataFlowDispatch#36b84300::Cached::TArgumentPosition#f CARTESIAN PRODUCT OUTPUT Rhs.0, Lhs.0
359 ~3% {2} r5 = JOIN r4 WITH DataFlowDispatch#36b84300::Cached::TAnyArgumentPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
358 ~3% {2} r6 = r5 AND NOT DataFlowDispatch#36b84300::Cached::TSelfParameterPosition#f(Lhs.0)
65368 ~0% {2} r7 = r3 UNION r6
65011 ~0% {2} r8 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TSelfParameterPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
1 ~0% {2} r9 = JOIN r8 WITH DataFlowDispatch#36b84300::Cached::TSelfArgumentPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
65011 ~0% {2} r10 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TBlockParameterPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
1 ~0% {2} r11 = JOIN r10 WITH DataFlowDispatch#36b84300::Cached::TBlockArgumentPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
65011 ~3% {2} r12 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::THashSplatParameterPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
1 ~0% {2} r13 = JOIN r12 WITH DataFlowDispatch#36b84300::Cached::THashSplatArgumentPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
2 ~0% {2} r14 = r11 UNION r13
3 ~0% {2} r15 = r9 UNION r14
65371 ~0% {2} r16 = r7 UNION r15
65011 ~0% {2} r17 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TAnyKeywordParameterPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
1645 ~1% {2} r18 = JOIN r17 WITH DataFlowDispatch#36b84300::Cached::TKeywordArgumentPosition#ff_1#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0
359 ~0% {2} r19 = JOIN r4 WITH DataFlowDispatch#36b84300::Cached::TAnyKeywordArgumentPosition#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0
320 ~0% {2} r20 = JOIN r19 WITH DataFlowDispatch#36b84300::Cached::TKeywordParameterPosition#ff_1#join_rhs ON FIRST 1 OUTPUT Lhs.0, Lhs.1
1965 ~1% {2} r21 = r18 UNION r20
20803520 ~1% {3} r22 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TKeywordParameterPosition#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
320 ~0% {2} r23 = JOIN r22 WITH DataFlowDispatch#36b84300::Cached::TKeywordArgumentPosition#ff ON FIRST 2 OUTPUT Lhs.2, Lhs.1
2145363 ~0% {3} r24 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TPositionalParameterPosition#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
33 ~0% {2} r25 = JOIN r24 WITH DataFlowDispatch#36b84300::Cached::TPositionalArgumentPosition#ff ON FIRST 2 OUTPUT Lhs.2, Lhs.1
65011 ~0% {3} r26 = JOIN r1 WITH DataFlowDispatch#36b84300::Cached::TPositionalParameterLowerBoundPosition#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Rhs.1
63361 ~0% {4} r27 = JOIN r26 WITH DataFlowDispatch#36b84300::Cached::TPositionalArgumentPosition#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Lhs.2, Rhs.1
63360 ~0% {4} r28 = SELECT r27 ON In.3 >= In.2
63360 ~0% {2} r29 = SCAN r28 OUTPUT In.0, In.1
63393 ~0% {2} r30 = r25 UNION r29
63713 ~0% {2} r31 = r23 UNION r30
65678 ~0% {2} r32 = r21 UNION r31
131049 ~0% {2} r33 = r16 UNION r32
return r33
```
After
```
Evaluated relational algebra for predicate DataFlowDispatch#36b84300::parameterMatch#2#ff@698b99ci with tuple counts:
1 ~0% {2} r1 = JOIN DataFlowDispatch#36b84300::Cached::TSelfParameterPosition#f WITH DataFlowDispatch#36b84300::Cached::TSelfArgumentPosition#f CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.0
1 ~0% {2} r2 = JOIN DataFlowDispatch#36b84300::Cached::TBlockParameterPosition#f WITH DataFlowDispatch#36b84300::Cached::TBlockArgumentPosition#f CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.0
2 ~0% {2} r3 = r1 UNION r2
1 ~0% {2} r4 = JOIN DataFlowDispatch#36b84300::Cached::THashSplatParameterPosition#f WITH DataFlowDispatch#36b84300::Cached::THashSplatArgumentPosition#f CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.0
65010 ~0% {2} r5 = JOIN DataFlowDispatch#36b84300::Cached::TAnyParameterPosition#f WITH DataFlowDispatch#36b84300::argumentPositionIsNotSelf#1#f CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.0
358 ~3% {2} r6 = JOIN DataFlowDispatch#36b84300::Cached::TAnyArgumentPosition#f WITH DataFlowDispatch#36b84300::parameterPositionIsNotSelf#1#f CARTESIAN PRODUCT OUTPUT Rhs.0, Lhs.0
65368 ~0% {2} r7 = r5 UNION r6
65369 ~0% {2} r8 = r4 UNION r7
65371 ~0% {2} r9 = r3 UNION r8
1645 ~1% {2} r10 = JOIN DataFlowDispatch#36b84300::Cached::TAnyKeywordParameterPosition#f WITH DataFlowDispatch#36b84300::Cached::TKeywordArgumentPosition#ff CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.1
320 ~0% {2} r11 = JOIN DataFlowDispatch#36b84300::Cached::TAnyKeywordArgumentPosition#f WITH DataFlowDispatch#36b84300::Cached::TKeywordParameterPosition#ff CARTESIAN PRODUCT OUTPUT Rhs.1, Lhs.0
1965 ~1% {2} r12 = r10 UNION r11
33 ~0% {2} r13 = JOIN DataFlowDispatch#36b84300::Cached::TPositionalParameterPosition#ff WITH DataFlowDispatch#36b84300::Cached::TPositionalArgumentPosition#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
320 ~0% {2} r14 = JOIN DataFlowDispatch#36b84300::Cached::TKeywordParameterPosition#ff WITH DataFlowDispatch#36b84300::Cached::TKeywordArgumentPosition#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
63361 ~1% {4} r15 = JOIN DataFlowDispatch#36b84300::Cached::TPositionalParameterLowerBoundPosition#ff WITH DataFlowDispatch#36b84300::Cached::TPositionalArgumentPosition#ff CARTESIAN PRODUCT OUTPUT Lhs.0, Lhs.1, Rhs.0, Rhs.1
63360 ~1% {4} r16 = SELECT r15 ON In.2 >= In.0
63360 ~0% {2} r17 = SCAN r16 OUTPUT In.1, In.3
63680 ~0% {2} r18 = r14 UNION r17
63713 ~0% {2} r19 = r13 UNION r18
65678 ~0% {2} r20 = r12 UNION r19
131049 ~0% {2} r21 = r9 UNION r20
return r21
```
2022-09-06 13:02:36 +02:00
Arthur Baars
604af4f7b3
Merge pull request #10302 from github/rc/3.7
...
Merge 3.7 into main
2022-09-06 08:42:44 +02:00
Arthur Baars
b2431d0b50
Ruby: exclude 'require' and 'require_relative' definitions from call graph
...
The syntax_suggest library redefines Kernel.require/require_relative.
Somehow this causes performance issues on ruby/ruby. As a workaround
we exclude 'require' and 'require_relative'.
2022-09-05 16:52:52 +02:00
Tom Hvitved
b197eff23e
Ruby: Add missing edges to the call graph for singleton methods
2022-09-05 14:11:04 +02:00
Tom Hvitved
ab22f932a5
Ruby: Add more tests for singleton methods
2022-09-05 14:09:59 +02:00
Tom Hvitved
3c3390728a
Merge pull request #10245 from hvitved/ruby/simplify-track-instance
...
Ruby: Exclude top-level `self` accesses from `trackModule`
2022-09-01 16:50:14 +02:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
Tom Hvitved
4d485163a6
Ruby: Exclude top-level self accesses from trackModule
2022-09-01 11:05:53 +02:00
Ian Lynagh
7dc5bdafe3
Merge pull request #10186 from github/post-release-prep/codeql-cli-2.10.4
...
Post-release preparation for codeql-cli-2.10.4
2022-08-31 17:29:57 +01:00
Tom Hvitved
61b67640f4
Ruby: Adapt to parameterized SSA implementation
2022-08-31 11:45:15 +02:00
Tom Hvitved
760c7beb94
SSA: Sync files
2022-08-31 11:45:15 +02:00
Asger F
5ad6c05a9c
Merge pull request #10205 from asgerf/mad-generics
...
Support type variables in MaD typings
2022-08-30 18:07:39 +02:00
Asger F
dd44187aed
Sync files again
2022-08-30 14:08:33 +02:00
Asger F
d5d1365104
Synchronize ApiGraphModels.qll
2022-08-30 14:07:37 +02:00
erik-krogh
7fd426e748
print a correct range for ranges that doesn't contain any alpha-numeric chars
2022-08-30 13:57:11 +02:00
Erik Krogh Kristensen
8f0b999c31
Merge pull request #10207 from erik-krogh/fixRank
...
fix performance issue in the ReDoS query
2022-08-30 10:17:11 +02:00
erik-krogh
e2caf3e8c0
put a limit on the length of the equivalent range
2022-08-30 09:29:22 +02:00
erik-krogh
f47b097d7c
put a limit on the length of the equivalent range
2022-08-29 21:03:52 +02:00
erik-krogh
77949cbeb3
add context to the rankState predicate in ExponentialBackTracking.qll
2022-08-29 13:42:05 +02:00
Nick Rolfe
898689f550
Merge pull request #9896 from github/nickrolfe/hardcoded_code
...
Ruby: port js/hardcoded-data-interpreted-as-code
2022-08-26 13:49:25 +01:00
github-actions[bot]
3b4ad3c4f1
Post-release preparation for codeql-cli-2.10.4
2022-08-26 09:32:11 +00:00
Nick Rolfe
52d46552af
Ruby: fix 'inefficient string comparison' alert
2022-08-26 09:58:22 +01:00
Nick Rolfe
95bf18fdc9
Ruby: make hex-escaped strings ("\xCD\xEF" etc.) sources of hardcoded data
2022-08-26 09:33:03 +01:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
Ian Lynagh
a904438828
Update ruby/ql/lib/CHANGELOG.md
...
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com >
2022-08-25 14:24:44 +01:00
Ian Lynagh
5cd4e0d3b1
Update ruby/ql/lib/change-notes/released/0.3.4.md
...
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com >
2022-08-25 14:24:38 +01:00
Erik Krogh Kristensen
06afe9c0f4
Merge pull request #9816 from erik-krogh/msgConsis
...
Make alert messages consistent across languages
2022-08-25 15:20:01 +02:00
github-actions[bot]
0f63bc077f
Release preparation for version 2.10.4
2022-08-25 12:52:26 +00:00
Erik Krogh Kristensen
ba1ad00d2a
Merge pull request #10062 from erik-krogh/redosPrefix
...
JS: use the shared regular expression libraries in `js/case-sensitive-middleware-path`
2022-08-25 12:57:16 +02:00
Nick Rolfe
acf5b11139
Merge remote-tracking branch 'origin/main' into nickrolfe/hardcoded_code
2022-08-25 11:44:55 +01:00
Ian Lynagh
bf6d9f8c23
Merge pull request #10161 from igfoo/igfoo/exec
...
Make a load of files non-executable
2022-08-25 10:05:39 +01:00
Anders Schack-Mulligen
c6f89aac0a
Merge pull request #10141 from aschackmull/ruby/perf-apigraph
...
Ruby: Perf fix for trackUseNode.
2022-08-25 10:22:07 +02:00
Ian Lynagh
501a9b3c6b
Make *.qll non-executable
2022-08-24 16:36:15 +01:00
erik-krogh
1c0f2251e2
Merge branch 'main' into msgConsis
2022-08-24 14:38:57 +02:00
Michael Nebel
761ed283b6
C#/Java/Ruby/Swift: Address review comments.
2022-08-24 09:58:54 +02:00
Michael Nebel
30d554503a
C#/Java: Fix some QL doc spelling typos.
2022-08-24 09:58:53 +02:00
Michael Nebel
160ae934af
C#/Java/Ruby/Swift: Fix typo in QL doc.
2022-08-24 09:58:53 +02:00
Michael Nebel
581824a9b4
C#/Java/Ruby/Swift: Fix various typos.
2022-08-24 09:58:53 +02:00
Michael Nebel
fbc0e6a1ec
Ruby: Sync files and make dummy negative summary implementation.
2022-08-24 09:58:52 +02:00
Anders Schack-Mulligen
b83e851ac6
Ruby: one more pragma
2022-08-23 16:04:29 +02:00
Anders Schack-Mulligen
0ea55a9581
Ruby: autoformat
2022-08-23 15:58:29 +02:00
Anders Schack-Mulligen
844e0129b6
Ruby: Perf fix for trackUseNode.
2022-08-23 15:50:54 +02:00
erik-krogh
5e3cb08ed2
rename stateInPumpableRegexp to stateInRelevantRegexp
2022-08-23 12:40:45 +02:00
erik-krogh
f7846a598e
add change-notes
2022-08-23 07:54:01 +02:00
erik-krogh
94ec0b8a52
update expected output of tests
2022-08-23 07:19:37 +02:00
erik-krogh
7e0bd5bde4
update expected output of tests
2022-08-22 21:41:47 +02:00
erik-krogh
df9a9f4a56
update rb/stored-css to match javascript
2022-08-22 21:41:47 +02:00
erik-krogh
9b257bfa9e
update rb/reflected-xss to match javascript
2022-08-22 21:41:47 +02:00
