Mathias Vorreiter Pedersen
2fc0922b29
Merge branch 'main' into bring-back-type-barriers-in-non-constant-format
2024-03-13 22:46:35 +00:00
Mathias Vorreiter Pedersen
d1c253b519
C++: Accept test changes.
2024-03-13 22:41:32 +00:00
Mathias Vorreiter Pedersen
61597f5ac7
C++: This commit does two things:
...
1. It fixes a logic error in the cannotContainString predicate.
2. It reverts the changes to the `isSource` predicate that required the external
function to be within the source root.
The change to `isSource` was meant to fix the a performance problem that occurred
because of the logic error in the cannotContainString predicate. However, now that
the logic error is fixed this is no longer necessary 🎉
2024-03-13 22:40:06 +00:00
erik-krogh
ef8368cfc4
fix typo
2024-03-13 22:37:13 +01:00
Jeroen Ketema
866a3934d4
C++: suppress destructors with reuse expressions until proper support is added
2024-03-13 20:17:00 +01:00
Tom Hvitved
54fa8181da
Address review comment
2024-03-13 20:03:01 +01:00
Jeroen Ketema
67b3670d06
Merge pull request #15901 from jketema/destructors11
...
C++: Introduce re-use expressions in the database scheme
2024-03-13 18:27:28 +01:00
Tony Torralba
039bea1625
Java: Add more neutral JDK models
...
This is similar to https://github.com/github/codeql/pull/15766 , in the sense that it adds neutral models to prevent the model generator from generating summaries for them. These models were spotted while evaluating https://github.com/github/codeql/pull/14919 .
2024-03-13 16:59:38 +01:00
Mathias Vorreiter Pedersen
b638d4d0ba
Merge pull request #15900 from MathiasVP/glib-alloc-and-dealloc
...
C++: Add models for `GLib` allocation and deallocation
2024-03-13 15:29:46 +00:00
Erik Krogh Kristensen
bd121b98ae
Merge pull request #15893 from erik-krogh/more-filter-taint
...
JS: allow more flow through .filter()
2024-03-13 16:19:28 +01:00
Tom Hvitved
6c0ed28e6b
Python: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Tom Hvitved
02ae2d1520
Java: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Tom Hvitved
e4a4c18166
Go: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Michael Nebel
560b355e0c
C#: Remove hard-coded local sources from the uncontrolled-format-string query.
2024-03-13 14:26:30 +01:00
Erik Krogh Kristensen
53502a8662
Merge pull request #15510 from yoff/ts-54
...
JS: Add support for TS 5.4
2024-03-13 14:22:24 +01:00
Jeroen Ketema
8d5eab401d
C++: Introduce re-use expressions in the database scheme
2024-03-13 13:28:27 +01:00
Tom Hvitved
16cef92106
JS: Add DataFlow::Node.getLocation
2024-03-13 13:06:16 +01:00
Mathias Vorreiter Pedersen
8d504d8b32
Merge pull request #15899 from jketema/destructors10
...
C++: Add IR tests for the destruction of temporaries
2024-03-13 11:56:04 +00:00
Mathias Vorreiter Pedersen
465c3c18e3
C++: Add change note.
2024-03-13 11:49:26 +00:00
Asger F
c5a02dae2b
Merge pull request #15768 from asgerf/js/amd-pseudo-deps
...
JS: Do not treat AMD pseudo-dependencies as imports
2024-03-13 12:49:17 +01:00
Mathias Vorreiter Pedersen
3ea39a2553
C++: Add some query tests.
2024-03-13 11:39:34 +00:00
Mathias Vorreiter Pedersen
bcd36b1994
C++: Recognize glib allocations and deallocations.
2024-03-13 11:39:15 +00:00
Ian Lynagh
adefdfd59f
Merge pull request #15889 from igfoo/igfoo/k2exprs
...
Kotlin 2: Accept more changes in the exprs test
2024-03-13 11:34:10 +00:00
erik-krogh
129286aa1c
allow more flow through .filter()
2024-03-13 12:03:00 +01:00
Jeroen Ketema
3ef1ab49ea
C++: Add IR tests for the destruction of temporaries
2024-03-13 12:00:02 +01:00
erik-krogh
013ed7adb3
Java: update the url-redirection in the same style as the C# qhelp
2024-03-13 11:58:16 +01:00
yoff
b5c0fbb827
Merge pull request #15776 from RasmusWL/tt-consistency
...
Python: Add type-tracking consistency query
2024-03-13 11:11:07 +01:00
Tom Hvitved
4085c8ec8f
Merge pull request #15866 from hvitved/ruby/orm-tracking-ap-limit
...
Ruby: Lower access path limit to 1 for `OrmTracking`
2024-03-13 10:57:09 +01:00
Harry Maclean
dd5eb982ec
Merge pull request #15524 from hmac/hmac-process-spawn
...
Ruby: Add some more command injection sinks
2024-03-13 09:53:10 +00:00
Tony Torralba
2fd2b4c874
Merge pull request #15891 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2024-03-13 09:51:22 +01:00
github-actions[bot]
cff2cdb9e4
Add changed framework coverage reports
2024-03-13 00:15:53 +00:00
Edward Minnix III
c190dd21db
Merge pull request #15877 from egregius313/egregius313/csharp/mad/sources/windows-registry
...
C#: Add source models for values from the Windows registry
2024-03-12 16:41:42 -04:00
Edward Minnix III
d54489931c
Merge pull request #15869 from egregius313/egregius313/java/fix/parcelfiledescriptor-open-sink
...
Java: Add path-injection sink for `ParcelFileDescriptor::open`
2024-03-12 16:39:20 -04:00
Erik Krogh Kristensen
863e3f79e5
Merge pull request #15731 from erik-krogh/java-url
...
Java: More sanitizers for request-forgery
2024-03-12 19:31:52 +01:00
Ian Lynagh
0e94aa0eb5
Kotlin 2: Accept more changes in the exprs test
2024-03-12 16:42:37 +00:00
Ian Lynagh
8d1ee10981
Merge pull request #15876 from igfoo/igfoo/buildless-java-complete
...
Java: Accept test changes
2024-03-12 16:12:58 +00:00
Tamás Vajk
be2ce17376
Merge pull request #15881 from tamasvajk/buildless/fix-fallback
...
C#: Deduplicate not yet restored package names
2024-03-12 16:08:16 +01:00
Mathias Vorreiter Pedersen
ab6e2f9364
C++: Accept test regression.
2024-03-12 15:04:49 +00:00
erik-krogh
f613823047
add explicit QLDoc that any method named "contains" is matched
2024-03-12 15:25:27 +01:00
erik-krogh
35aae0a981
move changenote to src/
2024-03-12 15:22:57 +01:00
Erik Krogh Kristensen
b53ae77c56
expand change-note
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-03-12 15:22:17 +01:00
Mathias Vorreiter Pedersen
51f5740707
C++: Exclude functions that aren't declared inside the source root. This fixes performance on ImageMagick.
2024-03-12 14:20:16 +00:00
Mathias Vorreiter Pedersen
6a563c161e
C++: Simplify the definition of 'isNonConst'. On ImageMagick I get the same exact sources before and after.
2024-03-12 14:20:09 +00:00
Mathias Vorreiter Pedersen
179a7d500e
C++: Handle 'wchar_t' types that may be defined as unsigned short in C. This brings back SAMATE results.
2024-03-12 14:19:48 +00:00
Tamas Vajk
b07b0762f2
Adjust based on code review feedback
2024-03-12 15:07:58 +01:00
erik-krogh
74876ff49b
add change-note
2024-03-12 15:07:36 +01:00
erik-krogh
52f71e4553
small fixes based on review
2024-03-12 15:07:29 +01:00
Ian Lynagh
c2aa334465
Java: Accept test changes
2024-03-12 14:03:02 +00:00
Tom Hvitved
695e728ed5
Ruby: Lower access path limit to 1 for OrmTracking
2024-03-12 14:58:29 +01:00
Tom Hvitved
dddba3228b
Merge pull request #15867 from hvitved/dataflow/ap-limit
...
Data flow: Add `ConfigSig::accessPathLimit`
2024-03-12 14:57:51 +01:00
