hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-04 22:56:47 +01:00
Code Issues Packages Projects Releases Wiki Activity
74,382 Commits 1,699 Branches 161 Tags
baec4adbb1fd8c0550091517f9eb59cb3d94de0a
Commit Graph

1006 Commits

Author SHA1 Message Date
Jami Cogswell
1da1e896cb Java: convert SpringModelAndViewSink to MaD 2024-03-13 16:28:41 -04:00
Edward Minnix III
c190dd21db Merge pull request #15877 from egregius313/egregius313/csharp/mad/sources/windows-registry 
C#: Add source models for values from the Windows registry
 2024-03-12 16:41:42 -04:00
Tom Hvitved
d7790faece Address review comments 2024-03-12 13:34:55 +01:00
Tom Hvitved
0e0b73a5e6 Address review comment 2024-03-12 11:22:04 +01:00
Tom Hvitved
e82e3180f0 Data flow: Replace hasLocationInfo with getLocation 2024-03-11 20:56:38 +01:00
Ed Minnix
bc745dfd5e Windows registry sources 2024-03-11 13:55:34 -04:00
Tom Hvitved
7a39f077d9 Data flow: Add ConfigSig::accessPathLimit 2024-03-11 13:01:58 +01:00
Edward Minnix III
e7852f520f Merge pull request #15605 from egregius313/egregius313/csharp/dataflow/sources/commandargs-and-environment 
C#: Add more `environment` and `commandargs` sources for the C# Standard Library
 2024-03-08 14:10:09 -05:00
Tom Hvitved
63bb772ef9 Variable capture: Avoid overlapping and false-positive data flow paths 2024-03-08 10:00:42 +01:00
Tom Hvitved
2896bfbd9f Merge pull request #15821 from hvitved/dataflow/clears-content-store 
Data flow: Allow for direct stores into nodes with `clearsContent`
 2024-03-08 09:59:29 +01:00
Ed Minnix
b0eb0e1f1e Move common source kinds to "shared" 2024-03-07 12:20:45 -05:00
Tom Hvitved
76564edc93 Address review comment 2024-03-07 16:50:28 +01:00
Geoffrey White
b71b43a2fb Merge pull request #15705 from geoffw0/qldoc3 
Shared: Fill some QLDoc holes
 2024-03-07 14:12:51 +00:00
Tom Hvitved
22b168beee Data flow: Allow for direct stores into nodes with clearsContent 2024-03-07 12:47:12 +01:00
github-actions[bot]
dc9092c9ec Post-release preparation for codeql-cli-2.16.4 2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d Release preparation for version 2.16.4 2024-03-06 20:56:51 +00:00
Angela P Wen
ce31f8641a Revert "Release preparation for version 2.16.4" 2024-03-06 12:07:33 -08:00
Geoffrey White
0edfafeb06 Shared: Correct and clarify doc for SemBound.getExpr. 2024-03-06 16:00:36 +00:00
Anders Schack-Mulligen
caa45058ae Dataflow: Improve join-order. 
Join with the functional getApprox before filtering with revFlow as this
is always better.
 2024-03-06 11:29:08 +01:00
Anders Schack-Mulligen
55e6255e05 Dataflow: Extend the first join to also include argApa. 
Improves from
2024-03-04 13:29:20] Evaluated non-recursive predicate DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::flowThroughIntoCall/6#b44155c7@6dd478n9 in 126ms (size: 398332).
Evaluated relational algebra for predicate DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::flowThroughIntoCall/6#b44155c7@6dd478n9 with tuple counts:
              1  ~0%    {2} r1 = SCAN `DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::TAccessPathApproxNone#dom#04382804` OUTPUT _, _
              1  ~0%    {0}    | REWRITE WITH Tmp.0 := true, Tmp.1 := false, TEST Tmp.0 != Tmp.1 KEEPING 0
          83798  ~0%    {4}    | JOIN WITH `project#DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::returnFlowsThrough/8#ffafcf14` CARTESIAN PRODUCT OUTPUT Rhs.0, Rhs.3, Rhs.1, Rhs.2
        4044102  ~3%    {7}    | JOIN WITH `project#DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::flowIntoCallApaTaken/6#d989a8d1#cpe#12346_2013#join_rhs` ON FIRST 1 OUTPUT Rhs.2, Lhs.2, Lhs.3, Rhs.3, Lhs.1, Lhs.0, Rhs.1
         398332  ~3%    {6}    | JOIN WITH `project#DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::fwdFlow/9#00ae2fc8#2` ON FIRST 4 OUTPUT Lhs.6, Lhs.0, Lhs.5, _, Lhs.2, Lhs.4
         398332  ~1%    {6}    | REWRITE WITH Out.3 := true
                        return r1
to
[2024-03-04 15:20:26] Evaluated non-recursive predicate DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::flowThroughIntoCall/6#b44155c7@97bd358u in 35ms (size: 398332).
Evaluated relational algebra for predicate DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::flowThroughIntoCall/6#b44155c7@97bd358u with tuple counts:
         83798   ~0%    {7} r1 = SCAN `project#DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::returnFlowsThrough/9#53894c55` OUTPUT In.0, In.1, In.2, In.3, In.4, _, _
                        {5}    | REWRITE WITH Tmp.5 := true, Tmp.6 := false, TEST Tmp.5 != Tmp.6 KEEPING 5
         83798   ~3%    {5}    | SCAN OUTPUT In.0, In.3, In.4, In.1, In.2
        416847   ~2%    {7}    | JOIN WITH `project#DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::flowIntoCallApaTaken/6#d989a8d1#cpe#12346_2301#join_rhs` ON FIRST 2 OUTPUT Rhs.3, Lhs.3, Lhs.4, Lhs.1, Lhs.2, Lhs.0, Rhs.2
        398332   ~3%    {6}    | JOIN WITH `project#DataFlowImpl::Impl<TaintedPath::TaintedPath::C>::Stage5::fwdFlow/9#00ae2fc8#2` ON FIRST 4 OUTPUT Lhs.6, Lhs.0, Lhs.5, _, Lhs.2, Lhs.4
        398332   ~1%    {6}    | REWRITE WITH Out.3 := true
                        return r1
 2024-03-06 11:29:08 +01:00
github-actions[bot]
661e68dab5 Release preparation for version 2.16.4 2024-03-05 18:13:58 +00:00
Angela P Wen
967963a653 Revert "Release preparation for version 2.16.4" 2024-03-05 08:53:33 -08:00
Tom Hvitved
d5c34264ad Data flow: Prune call-context sensitivity relations 2024-03-05 10:44:12 +01:00
github-actions[bot]
a67218a027 Release preparation for version 2.16.4 2024-03-04 17:42:08 +00:00
Geoffrey White
50ad45944c Update shared/dataflow/codeql/dataflow/DataFlow.qll 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2024-03-04 12:02:01 +00:00
Geoffrey White
5def2887e7 Shared: Add an example for SemBound.getExpr. 2024-03-04 11:59:52 +00:00
Geoffrey White
cb1c68260e Shared: QLDoc for ContentApprox and getContentApprox. 2024-03-01 17:36:53 +00:00
Geoffrey White
c663809cc7 Update shared/rangeanalysis/codeql/rangeanalysis/RangeAnalysis.qll 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2024-03-01 17:06:48 +00:00
Geoffrey White
0e24ed14da Apply suggestions from code review 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2024-03-01 17:04:34 +00:00
Geoffrey White
1fece75f15 Apply suggestions from code review 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2024-03-01 11:10:26 +00:00
Geoffrey White
a499919239 Shared: More helpful QLDoc for simpleLocalFlowStep. 2024-02-29 17:13:40 +00:00
Geoffrey White
f834768720 Shared: Improve QLDoc for forceHighPrecision. 2024-02-29 17:09:31 +00:00
Geoffrey White
9d2dc7a3cc Shared: Format. 2024-02-29 17:09:16 +00:00
Geoffrey White
88e3bc6865 Update shared/dataflow/codeql/dataflow/DataFlow.qll 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2024-02-29 17:03:30 +00:00
Geoffrey White
445b82b4e1 Shared: Explain 'guard'. 2024-02-29 16:07:20 +00:00
Geoffrey White
70465b22c7 Shared: Remove @ annotations. 2024-02-29 16:00:43 +00:00
Geoffrey White
98289b52d6 Shared: Explain SsaPhiNode a bit more. 2024-02-29 15:45:43 +00:00
Geoffrey White
8151f3024d Shared: Pinch better doc for isEquality from a related Guards class in csharp. 2024-02-29 15:41:51 +00:00
Mathias Vorreiter Pedersen
2fd57f6ee7 Shared: Remove cached annotation. 2024-02-28 16:24:21 +00:00
Anders Schack-Mulligen
699dddcfbe Merge pull request #15725 from aschackmull/dataflow/summary-join-fix 
Dataflow: Prevent bad join in FlowSummaryImpl::Private::Steps::summaryLocalStep.
 2024-02-27 10:32:38 +01:00
Tom Hvitved
bbeee8f38d Merge pull request #15717 from hvitved/csharp/view-cfg 
Shared `View CFG` implementation
 2024-02-27 09:13:18 +01:00
Mathias Vorreiter Pedersen
690fdc076d Shared: Add change note. 2024-02-26 17:13:32 +00:00
Mathias Vorreiter Pedersen
9ec17e6338 Shared: Pull out the shared parts of Java's type flow library into a shared module. 2024-02-26 17:13:27 +00:00
Anders Schack-Mulligen
20bb631456 Dataflow: Prevent bad join. 2024-02-26 13:45:19 +01:00
Tom Hvitved
5b6e76c030 Move View CFG implementation from Ruby/Swift into shared library 2024-02-26 11:23:49 +01:00
Rasmus Wriedt Larsen
07223031e8 Merge branch 'main' into lgtm_index_filter_handling 2024-02-26 09:56:02 +01:00
Tom Hvitved
2683e40038 Merge pull request #15708 from hvitved/share-ide-contextual 
Share `getFileBySourceArchiveName` implementation
 2024-02-23 19:56:33 +01:00
Erik Krogh Kristensen
a0f91fbc15 Merge pull request #15706 from erik-krogh/pol-reg 
ReDoS: Restrict some edges related to upper/lower-case when constructing possible attack strings for polynomial-redos.
 2024-02-23 12:06:17 +01:00
Tom Hvitved
62b16c0fa3 Share getFileBySourceArchiveName implementation 2024-02-23 11:25:49 +01:00
Geoffrey White
573763a4b3 Shared: More revisions, manual and aided by further discussion with Copilot. 2024-02-22 18:59:35 +00:00