hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-11 20:51:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
25,842 Commits 1,689 Branches 160 Tags
c2d203772628a86c23e516aff02e6000eab8fa2a
Commit Graph

25842 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anders Schack-Mulligen
f30dad7705 Dataflow: Update test expected outputs. 2021-09-07 13:02:20 +02:00
Rasmus Wriedt Larsen
8f52089475 C#: Fix CWE tag for cs/insufficient-key-size 
Since this targets

CWE-326 Inadequate Encryption Strength

> The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
> \- https://cwe.mitre.org/data/definitions/326.html

and not

CWE-327: Use of a Broken or Risky Cryptographic Algorithm

> The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
> \- https://cwe.mitre.org/data/definitions/327.html

This matches what we do for similar query in Python: https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-326/WeakCryptoKey.ql
 2021-09-07 12:59:10 +02:00
Anders Schack-Mulligen
7ec1fa2ebe Dataflow: Sync. 2021-09-07 12:51:42 +02:00
Anders Schack-Mulligen
2d7d45a8ac Dataflow: Account for hidden nodes. 2021-09-07 12:51:42 +02:00
Anders Schack-Mulligen
3c3d71d4a0 Dataflow: Sync 2021-09-07 12:51:42 +02:00
Anders Schack-Mulligen
81ed3e7176 Dataflow: Add subpaths query predicate. 2021-09-07 12:51:42 +02:00
Tamás Vajk
1dc712f54d Merge pull request #6629 from tamasvajk/feature/dispatch-fix 
C#: Fix dispatch library to handle summarized callables with no runti…
 2021-09-07 12:35:45 +02:00
Tamas Vajk
203ca3f91b C#: improve stubbing to escape more member names (not just fields) 2021-09-07 12:34:23 +02:00
Tamás Vajk
7befdc9c5c Merge pull request #6627 from tamasvajk/feature/stub-readme 
C#: Add readme to stub folder
 2021-09-07 12:09:52 +02:00
Tamás Vajk
c63fd4a254 Merge pull request #6260 from tamasvajk/feature/method-name 
C#: Change generic method names to include <> and type args/params
 2021-09-07 12:09:27 +02:00
Tom Hvitved
bcaf0658e4 C#: Use explicit Code Analysis build command 2021-09-07 10:58:06 +02:00
Mathias Vorreiter Pedersen
5cecea42e4 Merge pull request #6603 from geoffw0/impropnulltests 
C++: Add test cases for cpp/improper-null-termination.
 2021-09-07 09:55:36 +01:00
Mathias Vorreiter Pedersen
b7206c1218 Merge pull request #6581 from geoffw0/uncontrolledarith2 
CPP: Improvements for cpp/uncontrolled-arithmetic
 2021-09-07 09:48:59 +01:00
Anders Fugmann
ebdda885f9 C++: Update test annotation for OverflowStatic 2021-09-07 10:38:16 +02:00
Chris Smowton
79ff7baaf6 Claim Java 16 support 
As of https://github.com/github/codeql/pull/6604 we support all new Java 16 features
 2021-09-06 17:17:17 +01:00
yoff
138a7ae67f Merge pull request #6349 from RasmusWL/more-modeling 
Python: Improve various library modeling
 2021-09-06 17:01:45 +02:00
yoff
c7146ac10c Update python/ql/src/meta/alerts/RemoteFlowSourcesReach.ql 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com>
 2021-09-06 16:00:58 +02:00
Anders Fugmann
9af4d560dd Merge branch 'main' into andersfugmann/improve_upper_bound 2021-09-06 14:26:58 +02:00
Tamas Vajk
648197db35 C#: Fix dispatch library to handle summarized callables with no runtime target 2021-09-06 13:45:43 +02:00
Tamas Vajk
0d88d18781 C#: Add readme to stub folder 2021-09-06 13:42:36 +02:00
Andrew Eisenberg
bb9911e06f Merge pull request #6605 from aeisenberg/aeisenberg/pack/consistency 2021-09-06 04:40:58 -07:00
Rasmus Wriedt Larsen
b28bddd22c Merge pull request #6598 from RasmusWL/fail-on-missing-query-pack 
Misc: Make `generate-code-scanning-query-list.py` fail on missing query pack
 2021-09-06 13:22:13 +02:00
Tamas Vajk
b7f13a7e1f C#: Change generic method names to include <> and type args/params 2021-09-06 11:48:22 +02:00
Erik Krogh Kristensen
85e1c87d14 use the new non-extending-subtypes syntax 2021-09-06 11:19:50 +02:00
Erik Krogh Kristensen
8d4af3ad81 convert field based range pattern to casting based range pattern 2021-09-06 11:05:23 +02:00
Anders Fugmann
ddbaf585ec Merge branch 'main' into andersfugmann/improve_upper_bound 2021-09-06 10:32:44 +02:00
Anders Fugmann
e4d22ea628 C++: Add comment on why getGuardedUpperBound must have exactly one predecessor 2021-09-06 10:31:32 +02:00
Anders Schack-Mulligen
5a47ddbf77 Merge pull request #6604 from smowton/smowton/admin/marcono-record-tests 
Java: Add tests for static and final modifiers relating to record classes
 2021-09-06 09:32:32 +02:00
Tamás Vajk
b9ef6c7e55 Merge pull request #6596 from tamasvajk/fix/stub-ordering 
C#: Fix ordering of stubbed type members, implemented interfaces, and…
 2021-09-06 09:27:19 +02:00
Andrew Eisenberg
286c102358 Update the docs about qlpacks 
This is a first pass to fix obvious holes and outdated information, but
we should rethink these docs completely.
 2021-09-03 12:50:25 -07:00
Andrew Eisenberg
6a47fcaf1f Packaging: Normalize all qlpack.yml files for all languages 
This commit ensures consistency among all of our qlpacks. Here are the
changes:

1. Ensure only modern references are used (codeql-{lang} is converted to
   codeql/{lang}-all or codeql/{lang}-queries where appropriate).
2. Use consistent version numbers. All languages are at 0.0.2 except
   javascript, which is 0.0.3.
3. Convert all `libraryPathDependencies` to `dependencies` with version
   constraints
4. Dependencies from query packs to other packs are always `"*"` since
   these dependencies are always from source and we should get the
   latest.
5. Dependencies from codeql/{lang}-lib to codeql/{lang}-upgrades must
   be strict since there is a tight connection between the libary
   and its relevant upgrades.
 2021-09-03 11:53:28 -07:00
Chris Smowton
23d7633cd5 Add tests for static and final modifiers relating to record classes 2021-09-03 18:20:16 +01:00
Philip Ginsbach
863eede75b easier second example for instanceof extensions 2021-09-03 16:12:52 +01:00
Geoffrey White
4e60fd5fc7 C++:Add the ImproperNullTerminationTainted.ql query to the test. 2021-09-03 15:53:24 +01:00
Tamas Vajk
c02a743835 Revert redundant order by 2021-09-03 16:51:32 +02:00
Geoffrey White
ccf1a44a2b C++: Extend tests for cpp/improper-null-termination. 2021-09-03 15:48:36 +01:00
Benjamin Muskalla
ec0066d5a4 Merge pull request #6597 from bmuskalla/hideStubsInDiff 
Java: Hide diff for generated files by default
 2021-09-03 15:11:15 +02:00
Benjamin Muskalla
51475d2fb0 Merge branch 'main' into thirdpartyapitelemtry 2021-09-03 14:23:31 +02:00
Benjamin Muskalla
f59a5b6574 Hide changes for experimenal stubs 2021-09-03 14:16:04 +02:00
Benjamin Muskalla
ab5c1d6bdd Rework filter to exclude simple constructors 2021-09-03 13:38:01 +02:00
Asger Feldthaus
7149ad8ac4 JS: Also mark uses of the exports object as an export in PackageExports 2021-09-03 13:35:30 +02:00
Chris Smowton
0dd463dd2b Merge pull request #6520 from smowton/smowton/feature/allow-local-interfaces 
Java: Allow local interfaces
 2021-09-03 12:01:36 +01:00
Philip Ginsbach
cd646c819d explain instanceof extensions via charpred instanceof 2021-09-03 10:55:03 +01:00
Benjamin Muskalla
9ed14b438e Use readble format for APIs 2021-09-03 11:53:18 +02:00
Philip Ginsbach
35b0e83370 simpler first instanceof extension example 2021-09-03 10:52:05 +01:00
Chris Smowton
c20cf23c98 Update stats file dependencies 2021-09-03 10:40:51 +01:00
Benjamin Muskalla
4b02e266fd Fix test as we support explicit collection types 2021-09-03 11:37:39 +02:00
Benjamin Muskalla
7d3131ca49 Move usage count into where clause 2021-09-03 11:32:14 +02:00
Benjamin Muskalla
89ce04dcb9 Pull usage count into where clause 2021-09-03 11:26:22 +02:00
Philip Ginsbach
6e025186ab make clear that instanceof supertypes are not base types 2021-09-03 10:23:58 +01:00