hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-09 13:35:38 +02:00
Code Issues Packages Projects Releases Wiki Activity
88,459 Commits 1,800 Branches 170 Tags
aba008dcd721471052027d42ecdc7cf1fcdbb36a
Commit Graph

8109 Commits

Author SHA1 Message Date
Owen Mansel-Chan
aba008dcd7 Remove comments "// BAD: but flagged by cs/constant-condition" 2026-07-08 14:00:57 +01:00
Owen Mansel-Chan
7b96f66d34 Also run cs/constant-condition on test for cs/comparison-of-identical-expressions 2026-07-08 14:00:55 +01:00
Owen Mansel-Chan
85d800f317 Apply suggestions from code review 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2026-07-08 13:02:20 +01:00
Owen Mansel-Chan
b6d588c1a8 Revert inline expectations for blazor integration tests with BMN 2026-07-08 00:56:43 +01:00
Owen Mansel-Chan
5ba1fe315d Accept updated .expected output 2026-07-08 00:56:16 +01:00
Owen Mansel-Chan
f67b7299f9 Update query example (synced file) 2026-07-07 14:09:50 +01:00
Owen Mansel-Chan
366d70bfee Convert qlref tests to inline expectations 2026-07-07 14:09:48 +01:00
Owen Mansel-Chan
8f026b1dc2 Allow inline expectation comments in more file formats 2026-07-06 13:43:31 +01:00
Nora Dimitrijević
0a02b16c43 Merge pull request #22095 from d10c/d10c/drop-bracket-style-links 
Remove [[ link syntax from C# XSS sink
 2026-07-02 15:45:30 +02:00
Mathias Vorreiter Pedersen
4f4cdf434b Merge pull request #22061 from MathiasVP/mad-write-through-model 
Shared: Support flow summaries from `ReturnValue`s
 2026-07-02 12:38:44 +01:00
Jeroen Ketema
daf97f7139 Add Windows integration tests showing that subst is handled inconsistently 2026-07-01 12:51:05 +02:00
Nora Dimitrijević
43cfa2f8bd C#: Remove [[ style links from XSS sink explanation 
Remove the makeUrl predicate and the [[""|""]]] link syntax from
AspxCodeSink.explanation(), replacing with plain text.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-30 16:14:12 +02:00
Mathias Vorreiter Pedersen
b7b731bab7 Merge branch 'main' into mad-write-through-model 2026-06-30 15:12:02 +01:00
Michael Nebel
a93501a1eb Merge pull request #22033 from michaelnebel/csharp/usefeedmanager 
C#: Use the feed manager in the `NugetExeWrapper`.
 2026-06-30 15:03:25 +02:00
github-actions[bot]
456e33773b Post-release preparation for codeql-cli-2.26.0 2026-06-25 16:24:06 +00:00
github-actions[bot]
237c5639e2 Release preparation for version 2.26.0 2026-06-25 15:27:00 +00:00
Michael Nebel
18913ce4b8 C#: Add change-note. 2026-06-25 11:50:49 +02:00
Tom Hvitved
929fa1e977 C#: Remove redundant code from DeadStoreOfLocal.ql 2026-06-25 08:50:40 +02:00
Mathias Vorreiter Pedersen
bf50e377c5 C#: Fixes after changes to the flow summary API. 2026-06-23 20:33:10 +01:00
Anders Schack-Mulligen
e1d4fe8605 C#: Accept test changes. 2026-06-23 14:42:20 +02:00
Anders Schack-Mulligen
41297c588c Cfg: Change AST/CFG for CatchClauses to use a pattern. 2026-06-23 14:28:44 +02:00
copilot-swe-agent[bot]
b254aa7e0b C#: Extract catch(Ex) type as TypeAccess instead of TypeMention 2026-06-23 13:55:39 +02:00
Anders Schack-Mulligen
ac7ed0612d C#: Accept test change. 2026-06-22 13:00:55 +02:00
copilot-swe-agent[bot]
bd84fb31e1 Add regression for catch type mention extraction 2026-06-22 09:41:55 +00:00
copilot-swe-agent[bot]
4c9fa4dddc Emit catch type mentions without variables 2026-06-22 09:37:24 +00:00
Anders Schack-Mulligen
f844cd3754 Java/C#: Adapt to signature change. 2026-06-18 11:00:30 +02:00
Michael Nebel
e94d279234 Merge pull request #21984 from forks-felickz/felickz/razor-page-handler-sources 
C#: Add Razor Page handler method parameters as remote flow sources
 2026-06-16 13:15:51 +02:00
Michael Nebel
01454d76c2 Merge pull request #21881 from michaelnebel/csharp/propertycalls 
C#: Property- and Indexer call targets for partial overrides.
 2026-06-16 08:46:33 +02:00
Michael Nebel
859ad1d8d0 Merge pull request #21877 from michaelnebel/csharp/spanaccessrange 
C#: Extract `.Slice` method call when using a span in conjunction with a range.
 2026-06-16 08:42:57 +02:00
Chad Bentz
c08c0e9ae5 Merge branch 'main' into felickz/razor-page-handler-sources 2026-06-15 11:35:54 -04:00
Chad Bentz
4f1d6f472d Fix test comments: replace GOOD/BAD markers with flow source descriptions 
Per review feedback, GOOD/BAD markers don't apply to flow source
enumeration tests. Use descriptive comments instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-15 11:34:43 -04:00
Michael Nebel
c31b594bbc C#: Address review comments. 2026-06-15 16:17:46 +02:00
Michael Nebel
175c4f1b0d C#: Add models as data tests for compound assignment operators. 2026-06-15 13:26:39 +02:00
Michael Nebel
ab4f170780 Merge pull request #21909 from michaelnebel/csharp/refactoroperations 
C#: Refactor- and rename operation expressions.
 2026-06-15 12:35:39 +02:00
Michael Nebel
d0841d2283 C#: Address review comments. 2026-06-15 11:04:59 +02:00
Chad Bentz
23567eba3d C#: Add change note for Razor Page handler flow sources 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:53:00 -04:00
Chad Bentz
ce9e61dbfd C#: Add Razor Page handler method parameters as remote flow sources 
ASP.NET Core Razor Page handler method parameters (OnGet, OnPost, etc.)
were not modeled as remote flow sources, causing security queries like
SQL injection to miss vulnerabilities in PageModel subclasses.

This adds AspNetCorePageHandlerMethodParameter, analogous to the existing
AspNetCoreActionMethodParameter for MVC controllers, using the existing
PageModelClass.getAHandlerMethod() from Razor.qll.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-06-12 19:50:12 -04:00
Michael Nebel
346d140c87 C#: Add change-note. 2026-06-12 15:33:49 +02:00
Michael Nebel
9f0feb467a C#: Add upgrade/downgrade scripts. 2026-06-12 15:26:16 +02:00
Anders Schack-Mulligen
ff61344afa Cfg: Add support for until-statements. 2026-06-12 13:55:05 +02:00
Michael Nebel
8d46bfcbd4 C#: Update some of the QL docs. 2026-06-12 12:41:27 +02:00
Michael Nebel
f0640d78d2 C#: Deprecate the operation module. 2026-06-12 12:41:24 +02:00
Michael Nebel
fb9e4a8c40 C#: Move logical operation class from Operation.qll to LogicalOperation.qll. 2026-06-12 12:41:22 +02:00
Michael Nebel
3c407f77a9 C#: Update the QL library implementation for logical operations. 2026-06-12 12:41:19 +02:00
Michael Nebel
9465a1d063 C#: Update DB scheme for logical assignments and expressions (and some other minor changes). 2026-06-12 12:41:16 +02:00
Michael Nebel
072c4837d2 C#: Move bitwise operation classes from Operation.qll to BitwiseOperation.qll. 2026-06-12 12:41:14 +02:00
Michael Nebel
ee040da575 C#: Update test expected output. 2026-06-12 12:41:11 +02:00
Michael Nebel
524330c188 C#: Update the QL library implementation for Bitwise operations. 2026-06-12 12:41:09 +02:00
Michael Nebel
7d54669696 C#: Update DB scheme for bitwise assignments and expressions (and some other minor changes). 2026-06-12 12:41:06 +02:00
Michael Nebel
951a26a01a C#: Move arithmetic like classes from Operation.qll to ArithmeticOperation.qll. 2026-06-12 12:41:03 +02:00