hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 19:26:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
20,964 Commits 1,740 Branches 165 Tags
c0bb169342f7561ce7d50ee1ed07b030aad252fa
Commit Graph

20964 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anders Schack-Mulligen
53c360479a Merge pull request #5329 from tamasvajk/feature/csv-taint-step 
Java: migrate taint steps to CSV
 2021-03-16 14:09:21 +01:00
Anders Schack-Mulligen
46bae88181 Merge pull request #5375 from aschackmull/dataflow/unbind 
Dataflow: Switch from unbind to pragma[only_bind_into].
 2021-03-16 14:03:54 +01:00
Tom Hvitved
88b7ad001f C#: Take phi nodes into account in Steps::getARead() 2021-03-16 13:55:30 +01:00
CodeQL CI
ae62fbc2c7 Merge pull request #5382 from erik-krogh/moreCache 
Approved by asgerf
 2021-03-16 05:53:03 -07:00
Tom Hvitved
cb8e2d451d C#: Add test for DeadStoreOfLocal.ql 2021-03-16 13:52:41 +01:00
CodeQL CI
b37da7cc22 Merge pull request #5386 from erik-krogh/cachePrepend 
Approved by asgerf
 2021-03-16 05:49:24 -07:00
CodeQL CI
40acb95105 Merge pull request #5397 from erik-krogh/globalSanitizer 
Approved by asgerf
 2021-03-16 05:37:32 -07:00
Erik Krogh Kristensen
3640bbd466 add test for IncompleteHtmlAttributeSanitization 2021-03-16 13:25:27 +01:00
Erik Krogh Kristensen
1bf259beef support another String.prototype.replace pattern 2021-03-16 13:25:13 +01:00
Tamas Vajk
d02fba8c37 Java: adjust wrapped constructor calls 2021-03-16 12:42:41 +01:00
Rasmus Lerchedahl Petersen
cf791e8164 Python: Describe Concepts and Attributes 2021-03-16 12:31:47 +01:00
Tamas Vajk
e3534d1635 Java: cover wrapped constructor taint flow 2021-03-16 12:10:28 +01:00
Tamas Vajk
af0dff8c6f Java: migrate constructor flow taint steps to CSV 2021-03-16 12:10:28 +01:00
Tamas Vajk
f9a207dd9f Java: migrate 'arg to arg' taint steps to CSV 2021-03-16 12:10:28 +01:00
Tamas Vajk
7e1534a6cd Java: migrate 'arg to return' taint steps to CSV 2021-03-16 12:10:28 +01:00
Tamas Vajk
5cdbde2686 Java: migrate 'qualifier to return' taint steps to CSV 2021-03-16 12:10:28 +01:00
Tamas Vajk
40126563ef Java: migrate 'qualifier to arg' taint steps to CSV 2021-03-16 12:10:28 +01:00
CodeQL CI
c08230ce1e Merge pull request #5378 from asgerf/js/meta-problem-queries 
Approved by esbena
 2021-03-16 03:58:12 -07:00
Tamás Vajk
24140195d6 Merge pull request #5242 from tamasvajk/feature/tuple-df 
C#: Add tuple dataflow
 2021-03-16 11:45:11 +01:00
Tamás Vajk
8d6b8359eb Merge pull request #5316 from tamasvajk/feature/roslyn3.9 
C#: Upgrade Roslyn dependencies to 3.9
 2021-03-16 11:44:42 +01:00
Anders Schack-Mulligen
2d8d967060 Dataflow: Address review comment. 2021-03-16 11:07:33 +01:00
Chris Smowton
6d108c0fa7 Improve docstring for composedValueAndTaintModelStep 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2021-03-16 09:00:35 +00:00
Chris Smowton
915a19fb9d Improve naming; eliminate some harmless extra results 
Adding `src != valueSource` should have no effect as the introduced edge would already exist, but could reduce workload downstream.
 2021-03-16 08:57:14 +00:00
Chris Smowton
516122aa74 Add taint-preserving edges where a call also has a value-preserving edge 
For example, for a fluent method that returns `this`, we take a tainting edge from argX to either `this` or the return value to also taint the other.
 2021-03-16 08:45:24 +00:00
CodeQL CI
86b933a0e0 Merge pull request #5354 from yoff/doc-fix-typo-csharp-dataflow 
Approved by hvitved
 2021-03-15 23:52:38 -07:00
yoff
14dd708abc Apply suggestions from code review 
Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com>
 2021-03-15 17:56:50 +01:00
Anders Schack-Mulligen
45c9428668 Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources 
Java: Add support for Commons-Lang's RandomUtils
 2021-03-15 16:21:01 +01:00
CodeQL CI
9268050eb8 Merge pull request #5369 from erik-krogh/tempObjInj 
Approved by asgerf
 2021-03-15 05:23:55 -07:00
CodeQL CI
a9c292e265 Merge pull request #5391 from erik-krogh/additionalXss 
Approved by asgerf
 2021-03-15 04:50:54 -07:00
Erik Krogh Kristensen
b039267b76 Apply suggestions from code review 
Co-authored-by: Asger F <asgerf@github.com>
 2021-03-15 12:39:56 +01:00
Anders Schack-Mulligen
e37ba75599 Merge pull request #5401 from Marcono1234/patch-2 
Add missing quote in documentation
 2021-03-15 09:17:29 +01:00
Rasmus Lerchedahl Petersen
0d8f8d2cc5 Python, doc: subsection on local sources 
also remove references to `parameterNode` which is not available yet.
 2021-03-13 08:15:42 +01:00
Marcono1234
a457f5cc4a Add missing quote in documentation 2021-03-13 05:01:56 +01:00
yoff
a760ed8c55 Merge pull request #5388 from tausbn/python-api-graph-builtins 
Python: Support built-ins in API graphs
 2021-03-12 17:45:59 +01:00
Tamas Vajk
27048191c8 C#: Add dataflow test for tuple-positional pattern 2021-03-12 17:14:24 +01:00
Erik Krogh Kristensen
1dcfc3840d add test 2021-03-12 16:25:33 +01:00
Erik Krogh Kristensen
f357b73f94 require that the MetacharEscapeSanitizer is a global replace call 2021-03-12 16:18:47 +01:00
Tamas Vajk
9ff304ca6b Fix missing variable binding 2021-03-12 16:14:32 +01:00
Taus
dfc0e9b906 Merge pull request #5243 from RasmusWL/port-bind-to-all-interfaces 
Python: Port py/bind-socket-all-network-interfaces query
 2021-03-12 16:04:19 +01:00
Rasmus Lerchedahl Petersen
748749c32a Python, doc: Describe smoother syntax 2021-03-12 16:02:20 +01:00
Anders Schack-Mulligen
5aa9c2bd19 Dataflow: One more pragma. 2021-03-12 15:59:19 +01:00
CodeQL CI
cb6ee547ca Merge pull request #5379 from asgerf/js/d3 
Approved by erik-krogh
 2021-03-12 06:49:48 -08:00
Taus
c6d6d07720 Apply suggestions from code review 2021-03-12 14:28:59 +01:00
Taus
ffe5d30c2b Apply suggestions from code review 
Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com>
 2021-03-12 14:27:07 +01:00
Chris Smowton
92d61354d4 Remove abstract class RandomNumberGenerator 2021-03-12 13:04:31 +00:00
Asger Feldthaus
a2d1e88bb3 JS: Update more test expectations 2021-03-12 12:57:21 +00:00
Anders Schack-Mulligen
a8b84e430f Merge pull request #5390 from Marcono1234/patch-2 
Java: Fix documentation mistake in Modules.qll
 2021-03-12 12:51:24 +01:00
Anders Schack-Mulligen
c9786df760 Merge pull request #5344 from smowton/smowton/feature/commons-object-utils 
Java: Add models for flow- and taint-preserving functions in Commons ObjectUtils
 2021-03-12 12:46:31 +01:00
Anders Schack-Mulligen
195ed0173c Merge pull request #5393 from aschackmull/java/taint-not-value-step 
Java: Remove value steps from taint steps.
 2021-03-12 12:44:48 +01:00
Taus Brock-Nannestad
978200e2ad Python: Distinguish between Python 2 and 3 
Also moves the filtering on `name` to before the big disjunction in
`MkModuleImport`.
 2021-03-12 12:35:23 +01:00