hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity
107 Commits 1,684 Branches 159 Tags
aa9489ea286d363388a98c43f0255bf1bb86dc80
Commit Graph

107 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Sauyon Lee
aa9489ea28 Merge pull request #218 from max/field-refs 
Fix handling of references to fields and methods
 2020-01-16 14:26:55 -08:00
Sauyon Lee
7040b76cf6 Merge pull request #219 from max/new-env-vars 
Teach extractor about CodeQL environment variables.
 2020-01-15 11:37:26 -08:00
Max Schaefer
1ad90b6739 Teach extractor about CodeQL environment variables. 2020-01-15 14:01:30 +00:00
Max Schaefer
b7a830593d Correctly create extract nodes for returns where we cannot infer the type of the returned expression, but know from context that it must be a tuple type. 2020-01-15 10:22:29 +00:00
Max Schaefer
86708f7867 Merge pull request #212 from sauyon/dependency-update 
Dependency update
 2020-01-15 09:18:14 +00:00
Sauyon Lee
f32a785127 Merge pull request #217 from max/issue-24 
Switch RedundantExpr query back to using AST instead of global value numbering.
 2020-01-14 13:05:44 -08:00
Max Schaefer
3d508d44e7 Fix global value numbering. 2020-01-14 20:44:13 +00:00
Max Schaefer
2fdd45255c Add two new tests. 2020-01-14 17:06:42 +00:00
Max Schaefer
61976d8dea Fix code that does not account for the fact that Field is a subtype of ValueEntity. 2020-01-14 15:52:48 +00:00
Max Schaefer
0c254f8cd1 Fix a typo. 2020-01-14 15:35:18 +00:00
Max Schaefer
c96cebb022 Make reads(ValueEntity) and writes(ValueEntity) work for fields. 2020-01-14 15:35:18 +00:00
Sauyon Lee
1125c1ac41 Merge pull request #216 from Semmle/add-sql-tx-support 
Add tests for https://github.com/github/codeql-go/pull/15
 2020-01-14 01:55:29 -08:00
Max Schaefer
efc72fa01a Remove Entity.getAUse() and replace uses with getAReference(). 
The former had result type `Ident`, so it wouldn't pick up references to methods and fields. Apart from that, it is subsumed by the latter anyway.
 2020-01-14 07:15:43 +00:00
Max Schaefer
d339d55faa Merge pull request #15 from RicterZ/add-sql-tx-support 
Add sql.Tx.Exec/Query... support
 2020-01-13 08:38:32 +00:00
Max Schaefer
d55ebd731d Autoformat. 2020-01-13 08:37:32 +00:00
Max Schaefer
36c620d1dd Add tests and change note. 2020-01-13 08:37:01 +00:00
Ricter Zheng
a6e0dcaefc Add sql.Tx.Exec/Query... support 
Ref: https://golang.org/pkg/database/sql/#Tx.ExecContext
 2020-01-13 15:17:55 +08:00
Sauyon Lee
00dd464697 Update stats 2020-01-10 19:27:47 -08:00
Sauyon Lee
f01ef40af3 Update golang.org/x/tools dependency 2020-01-10 19:27:46 -08:00
Sauyon Lee
5985559161 Merge pull request #214 from max/issue-26 
Model `Header.Get` as a source of untrusted input.
 2020-01-10 19:26:43 -08:00
Max Schaefer
384d21b0e9 Switch RedundantExpr query back to using AST instead of global value numbers. 
Most current alerts (https://lgtm.com/rules/1510380685982/alerts/), while technically correct, are likely intentional and harmless. This change keeps only the interesting ones: https://lgtm.com/query/2999122885894714237
 2020-01-10 14:46:54 +00:00
Max Schaefer
c60ddb0f7c Model Header.Get as a source of untrusted input. 2020-01-10 12:29:18 +00:00
Sauyon Lee
3ab68cb624 Merge pull request #208 from max/incomplete-url-scheme-check 
Add `IncompleteUrlSchemeCheck` query
 2020-01-08 00:50:58 -08:00
Max Schaefer
3d7046e38c Apply suggestions from code review 
Co-Authored-By: Shati Patel <shati@semmle.com>
 2020-01-07 20:07:44 +00:00
Max Schaefer
0d2fe473d7 Add IncompleteUrlSchemeCheck query. 2020-01-07 14:46:49 +00:00
Max Schaefer
9cff56b975 Rename StringConcatenation.qll to StringOps.qll and add HasPrefix class. 2020-01-07 14:46:49 +00:00
Max Schaefer
aeb9840144 Add SliceNode class. 2020-01-06 15:36:54 +00:00
Sauyon Lee
db40535b70 Merge pull request #207 from max/uber-fixes 
Various library improvements
 2020-01-03 17:18:49 -08:00
Max Schaefer
638fe07da0 Move getReceiver from MethodCallNode to CallNode. 2020-01-03 14:14:18 +00:00
Max Schaefer
bb4052a574 Generalise result type of getACallee. 2020-01-03 14:14:18 +00:00
Max Schaefer
59498f53f0 Move FuncDec.getACall into FuncDecl. 
Also changes the result from a `CallExpr` to a `CallNode` for consistency with `Function.getACall`.
 2020-01-03 14:13:38 +00:00
Sauyon Lee
0a39124223 Merge pull request #206 from max/generalise-alert-suppression 
Alert suppression through single-line /* */ style comments.
 2020-01-02 11:47:44 -08:00
Max Schaefer
6f82310a9e Alert suppression through single-line /* */ style comments. 2020-01-02 14:34:11 +00:00
Sauyon Lee
9fd7db7e43 Merge pull request #205 from max/trap-writer-long-strings 
Teach TRAP writer to truncate strings longer than 1MiB.
 2019-12-27 11:35:34 -08:00
Max Schaefer
121c940ace Teach TRAP writer to truncate strings longer than 1MiB. 
The evaluator cannot in general handle strings that are longer than 1MiB when UTF8-encoded. Similar to other extractors, we now truncate such strings to fit within the size limit.
 2019-12-18 14:18:56 +00:00
Max Schaefer
1df3585c92 Merge pull request #204 from Semmle/rc/1.23 
Merge rc/1.23 into master
 2019-12-11 10:28:00 +00:00
Sauyon Lee
d3bf87d0f5 Merge pull request #203 from max/quieten-hard-coded-cred 
Make HardcodedCredentials query less noisy.
 2019-12-10 16:43:15 -08:00
Max Schaefer
75d78b3f62 Reduce precision of HardcodedCredentials to "medium". 2019-12-10 16:12:48 +00:00
Max Schaefer
46c4670796 Make HardcodedCredentials query less noisy. 
Considering "cert" and "account" to be sensitive leads to a massive number of false positives, especially on cockroach and kubernetes.
 2019-12-10 14:14:36 +00:00
Max Schaefer
7894eb3a60 Merge pull request #202 from sauyon/incomplete-hostname-fix 
IncompleteHostname: disallow unescaped dot before TLD
 2019-12-10 08:17:32 +00:00
Sauyon Lee
10907c8b04 IncompleteHostnameRegexp: disallow unescaped dot before TLD 2019-12-09 08:47:17 -08:00
Max Schaefer
7876c37998 Merge pull request #14 from henrymercer/fix-contributing-link 
Fix Code of Conduct link in CONTRIBUTING.md
 2019-12-09 12:55:33 +00:00
Henry Mercer
3c08314782 Fix Code of Conduct link in CONTRIBUTING.md 2019-12-09 12:42:46 +00:00
Sauyon Lee
bc8974d32d Merge pull request #201 from max/update-data-flow 
Update data flow and taint-tracking libraries
 2019-12-06 18:26:27 -08:00
Sauyon Lee
34d619038b Merge pull request #200 from Semmle/codeql-test 
Adapt Go tests to `codeql test`
 2019-12-06 10:34:59 -08:00
Henning Makholm
7bc68c4302 Adapt Go tests to codeql test 
These changes make the tests work with the coming `codeql test` support.

The `queries.xml` file defines which extractor the `codeql test`
runner will use to extract databases for the tests. In the future one
will be able to write this information in `qlpack.yml`, but we can't
do that immediately because the _existing_ CodeQL tooling would refuse
to parse a `qlpack.yml` that has the new field in it.
 2019-12-06 18:27:47 +01:00
Max Schaefer
62a50bac2a Update taint-tracking libraries. 
This brings `TaintTrackingImpl.qll` up-to-date with the other languages as of https://github.com/Semmle/ql/pull/2480.
 2019-12-06 14:07:35 +00:00
Max Schaefer
53f5e13af1 Update data-flow libraries. 
This brings `DataFlowImpl.qll` and `DataFlowImplCommon.qll` up-to-date with the other languages as of https://github.com/Semmle/ql/pull/2480.
 2019-12-06 12:14:53 +00:00
Sauyon Lee
2fc9e37655 Merge pull request #199 from max/notype-test 
Add test for handling of expressions without extracted type.
 2019-12-06 01:59:32 -08:00
Max Schaefer
594824f19c Add test for handling of expressions without extracted type. 2019-12-06 09:21:55 +00:00