hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity
56,115 Commits 1,671 Branches 157 Tags
ab797065abc78e48bc2b4dfad1ea50fe3ce449d0
Commit Graph

856 Commits

Author SHA1 Message Date
Alex Eyers-Taylor
c6a482819a Bump all qlpacks major versions 2023-04-13 19:15:27 +01:00
Michael Nebel
52bc43b22b Merge pull request #12595 from michaelnebel/enhanceprovenance 
Java/C# : Enhance provenance.
 2023-04-13 14:27:53 +02:00
Alex Ford
8c46bfd051 Merge pull request #12816 from github/rc/3.9 
Merge `rc/3.9` into `main`
 2023-04-13 12:35:41 +01:00
Tom Hvitved
3cc9dec9c8 Remove all queries.xml files 2023-04-13 11:18:58 +02:00
Michael Nebel
917cf7bfee Go: Update provenance validation. 2023-04-13 09:21:05 +02:00
Michael Nebel
1d82b09ec1 Sync files. 2023-04-13 09:21:05 +02:00
Chris Smowton
d648b34037 Accept test changes 
These are caused by nodes being hidden by https://github.com/github/codeql/pull/12783
 2023-04-12 15:05:04 +01:00
Chris Smowton
7eefa43f5a Rename and document viableArgParamSpecific to make clear it is a temporary hook. 2023-04-12 14:33:46 +01:00
Chris Smowton
1706367b34 Document DataFlowCallable 2023-04-12 14:24:21 +01:00
Chris Smowton
9f4b77e851 Accept test changes 2023-04-12 14:19:06 +01:00
Chris Smowton
4d8ca3d759 Add dataflow callback to filter out receiver argument flow to Golang interface dispatch candidates. 
Other langauges stub the callback.
 2023-04-12 14:19:06 +01:00
Chris Smowton
7ffe863ba6 Remove addressed FIXME 
This was addressed by adding `getAPackageWithSummarizedCallables`
 2023-04-12 14:19:06 +01:00
Chris Smowton
985e07d902 pragma[nomagic] hasQualifiedName 
These are cheap and frequently-used, and magicking them with respect to `interpretPackage` was yielding expensive, unnecessary regex operations.
 2023-04-12 14:19:06 +01:00
Chris Smowton
0129167cc4 Convert Beego's MapGet method to MaD 2023-04-12 14:19:06 +01:00
Chris Smowton
b86f0cf268 Sort models 2023-04-12 14:19:06 +01:00
Chris Smowton
12527e406b Remove unnecessary model 
This referred to a private type
 2023-04-12 14:19:05 +01:00
Chris Smowton
2abffccded Accept test changes 2023-04-12 14:19:05 +01:00
Chris Smowton
3cea01b6c8 Fix functions with multiple models 
In some cases multiple return value outputs can be coalesced, and in others we had accidentally conflated two independent flows (e.g. Arg1 -> Arg2 | Arg3 -> Arg4 led to accidentally introducing Arg1 -> Arg4 and Arg3 -> Arg2)
 2023-04-12 14:19:05 +01:00
Chris Smowton
4a89dbc498 Revert "Remove unnecessary models" 
This reverts commit 12eaedc188487275e8cd6bed4a4318fed4d4b752.

We can't do this now, because there is nothing to guarantee an interface has actually been extracted, and therefore whether a model will get applied. Therefore explicitly modelling methods that may be interface implementations where the interface is in a different package may still make a difference to behaviour.
 2023-04-12 14:19:05 +01:00
Chris Smowton
3f6ceccbe8 US spelling 2023-04-12 14:19:05 +01:00
Chris Smowton
8c553ec0fc Autoformat go 2023-04-12 14:19:05 +01:00
Chris Smowton
ac4dcc6c4b Add ioutil usage to TaintSteps test 
It appears at present the Go standard library imports the deprecated io/ioutil package internally on some platforms but not others. Therefore I add a test explicitly using it to make the test behave more uniformly.
 2023-04-12 14:19:05 +01:00
Chris Smowton
3c48609635 Accept test changes 2023-04-12 14:19:05 +01:00
Chris Smowton
ed56461ed7 Remove unnecessary models 
These are inherited from Stringer, Reader, Writer and BinaryMarshaler
 2023-04-12 14:19:05 +01:00
Chris Smowton
19e8974766 Fix comment 2023-04-12 14:19:05 +01:00
Chris Smowton
140505222f Update test expectations 2023-04-12 14:19:04 +01:00
Chris Smowton
1a7927d3a1 Fix x/net/html.EscapeString modelling 
This had never worked due to accidentally extending non-abstract class HtmlEscapeFunction; consequently it was neither a taint propagator in general, nor an HTML escape function. Added tests to ensure it is now behaving as intended.
 2023-04-12 14:19:04 +01:00
Chris Smowton
fa4145b5e4 Remove dead code 2023-04-12 14:19:04 +01:00
Chris Smowton
141d6b8d7b Accept paths test changes 2023-04-12 14:19:04 +01:00
Chris Smowton
8a06ca5a43 Allow $ANYVERSION token in Go package names 2023-04-12 14:19:04 +01:00
Chris Smowton
477341dd3b Remove unnecessary variable 2023-04-12 14:19:04 +01:00
Chris Smowton
952bc8458f Use explicit this 2023-04-12 14:19:04 +01:00
Chris Smowton
affe42b079 Use US spelling 2023-04-12 14:19:04 +01:00
Chris Smowton
aaa7f34386 Fix mixing of source and summary models 2023-04-12 14:19:04 +01:00
Chris Smowton
18d00c1116 Autoformat QL 2023-04-12 14:19:03 +01:00
Chris Smowton
54d08e11ca Autoformat Go 2023-04-12 14:19:03 +01:00
Chris Smowton
6b9b4c8da0 Remove binary file 2023-04-12 14:19:03 +01:00
Chris Smowton
8fb75f412a Consider MaD models ref whether a package should be considered an unknown external. 2023-04-12 14:19:03 +01:00
Chris Smowton
9447dfd636 Combine net/http models 2023-04-12 14:19:03 +01:00
Chris Smowton
0d306e6189 Restore versioning to one more protobuf model 2023-04-12 14:19:03 +01:00
Chris Smowton
2658a47f21 Remove another protobuf instance now handled in Protobuf.qll 2023-04-12 14:19:03 +01:00
Chris Smowton
a16d56258f Clean up protobuf models 2023-04-12 14:19:03 +01:00
Chris Smowton
95a9fcae47 Remove spurious model 
This referenced a test-specific package; these protobuf models are more than MaD can specify, so they have already moved back into Protobuf.qll.
 2023-04-12 14:19:03 +01:00
Chris Smowton
0d66b68a56 Restore more package / subpackage boundaries and alternate package names 
Note none of these alternate names are apparently tested, either before or afterwards.
 2023-04-12 14:19:03 +01:00
Chris Smowton
5e121fb4fd Restore Couchbase alternate package names 2023-04-12 14:19:03 +01:00
Chris Smowton
fd16c03fcf Add Beego v2 models 2023-04-12 14:19:02 +01:00
Chris Smowton
172ff082d3 Default to tolerating multiple package versions 
Subpackages still need to use the $ANYVERSION trick
 2023-04-12 14:19:02 +01:00
Chris Smowton
12f35bc6ac Add missing tests for RevelHeader mutators 2023-04-12 14:19:02 +01:00
Chris Smowton
2024747827 Add missing tests for html.Node taint propagators 
The TaintTracking::FunctionModels for these appeared broken, so I suspect they had never worked.
 2023-04-12 14:19:02 +01:00
Chris Smowton
8f4567349d Add missing NewTokenizerFragment model and test 2023-04-12 14:19:02 +01:00