Sauyon Lee
92ebb63b1f
Model Spring AntPath utils
2021-06-28 08:26:38 -07:00
Sauyon Lee
c4e9b1fd8e
Model Spring util
2021-06-28 08:26:37 -07:00
Tamas Vajk
006303420b
Fix CSV framework coverage commenter workflow
2021-06-28 15:07:13 +02:00
Chris Smowton
ca4c519a2a
Merge pull request #6170 from smowton/smowton/admin/cleanup-exec-tainted-query
...
Change ID and description of cloned query
2021-06-28 13:22:34 +01:00
Felicity Chapman
c4047afc05
Add extra reference to docs.github.com
...
Clarify the existing reference and add one for CodeQL code scanning using GitHub Actions.
2021-06-28 12:30:49 +01:00
Felicity Chapman
b52b158c97
Apply suggestions from code review
...
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com >
2021-06-28 12:20:20 +01:00
Chris Smowton
3d69868297
Change ID and description of cloned query
...
This should be cleaned up more effectively soon, but this suffices to fix the clashing-id problem.
2021-06-28 12:18:59 +01:00
Tamas Vajk
3b5856907f
Add updated C# framework coverage report
2021-06-28 11:29:46 +02:00
Tamas Vajk
3170781d57
Rework timeseries report to iterate git history only once
2021-06-28 11:29:45 +02:00
Tamas Vajk
1ec1e1cfc8
Adjust framework coverage report generator to include all sources not just remote ones
2021-06-28 11:20:32 +02:00
Tamas Vajk
4524563923
Fix timeseries coverage report to handle multiple languages
2021-06-28 11:20:32 +02:00
Tamas Vajk
a90a86bcbf
Fix flow from Element of Argument[0] for Int32.TryParse(ReadOnlySpan<Char>,...
2021-06-28 11:20:32 +02:00
Tamas Vajk
1d8b19e153
Adjust coverage report generator to allow multiple sink identifiers per CWE
2021-06-28 11:20:32 +02:00
Tamas Vajk
2a75989881
Migrate StringContent sink to CSV format
2021-06-28 11:20:32 +02:00
Tamas Vajk
5aba7142e8
C#: Add framework coverage report
2021-06-28 11:20:32 +02:00
Tamas Vajk
016e8fb2cf
Adjust framework coverage jobs to cover C#
2021-06-28 11:20:32 +02:00
Tamas Vajk
b7a43dccd3
C#: Migrate System.Int32 flow summaries to CSV
2021-06-28 11:20:32 +02:00
Tamas Vajk
a9ccd65fa9
C#: Migrate System.Web.HttpResponse sinks to CSV
2021-06-28 11:20:32 +02:00
Tamas Vajk
45568d5b10
C#: Convert System.Console.Read* local flow source to CSV
2021-06-28 11:20:32 +02:00
Tamas Vajk
9606816c39
Fix missing summarizedCallable case
2021-06-28 11:20:32 +02:00
Cornelius Riemenschneider
a1c38b78a9
Merge pull request #6163 from adityasharad/lines-of-code-make-unique
...
Ensure only one query per language is tagged `lines-of-code`
2021-06-28 10:57:29 +02:00
Tom Hvitved
4f8a103df2
C#: Add active preprocessor conditions as suffix in all TRAP .push instructions
2021-06-28 10:34:42 +02:00
Aditya Sharad
61e6dcb56d
Ensure only one query per language is tagged lines-of-code
...
Some languages have multiple `summary` queries for lines of code,
representing different forms of counting (user written, total, etc).
When Code Scanning sees results from multiple such summary queries in a single run,
it will need to choose one as the primary LoC count to display in the UI.
By ensuring only one query per language has the `lines-of-code` tag,
in future we can teach Code Scanning to look for this particular tag
to identify the primary LoC count.
If a "lines of user code" query is available, use that.
Otherwise use the total "lines of code".
(It is completely fine for multiple queries to be tagged with `summary`.)
2021-06-25 16:45:37 -07:00
Chris Smowton
8aa9cd52b5
Merge pull request #5811 from mogwailabs/insecureJmxRmiServerEnvironment
...
Java: Add query - insecure environment configuration during JMX/RMI server init
2021-06-25 22:09:20 +01:00
Timo Mueller
e5fa5325b5
Auto formatting .ql file
2021-06-25 22:31:29 +02:00
Timo Mueller
eb0a13f60f
Merge branch 'insecureJmxRmiServerEnvironment' of github.com:mogwailabs/codeql into insecureJmxRmiServerEnvironment
2021-06-25 22:29:43 +02:00
Chris Smowton
def4a23af2
Merge pull request #4879 from intrigus-lgtm/java/improve-trustmanager
...
Java: Add/improve insecure trustmanager query
2021-06-25 18:15:55 +01:00
Tom Hvitved
e624fb46f9
Merge pull request #6152 from hvitved/csharp/dataflow/csv-out-ref
2021-06-25 18:02:59 +02:00
intrigus
5aa711a956
Accept test changes.
2021-06-25 17:04:36 +02:00
Owen Mansel-Chan
44f0411b7c
Merge pull request #6138 from owen-mc/java/model/apache-commons-collections
...
Model Apache commons collections MapUtils class and keyvalue package
2021-06-25 15:53:03 +01:00
Anders Schack-Mulligen
a79356e316
Apply suggestions from code review
2021-06-25 16:47:26 +02:00
intrigus
be57aeccf2
Remove change-note.
2021-06-25 16:47:26 +02:00
intrigus
5106aec319
Fix test location.
2021-06-25 16:47:25 +02:00
intrigus
36575bb26f
Move back to experimental.........
2021-06-25 16:47:25 +02:00
intrigus
fe923facc8
Java: Move comments to separate lines.
...
Move comments to separate lines to improve
the rendering in the finished query help.
2021-06-25 16:47:25 +02:00
intrigus-lgtm
f527df73d5
Apply suggestions from code review.
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-06-25 16:47:25 +02:00
intrigus
f0d4b1d2b0
Java: Add change-note.
2021-06-25 16:47:25 +02:00
intrigus
6bfdf8d148
Java: Fix qhelp errors.
2021-06-25 16:47:24 +02:00
intrigus
dc0b06a735
Java: Factor out SecurityFlag library.
2021-06-25 16:47:24 +02:00
intrigus-lgtm
51fdcf86c8
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-06-25 16:47:24 +02:00
intrigus
6f217d37da
Java: Apply suggestions from review.
2021-06-25 16:47:24 +02:00
intrigus
4a00670b68
Java: Reduce long comment.
2021-06-25 16:47:24 +02:00
intrigus
45cec3df1c
Java: Use this consistently in QL classes.
2021-06-25 16:47:24 +02:00
intrigus
0c1ce74135
Java: Switch from tabs to spaces.
2021-06-25 16:47:24 +02:00
intrigus
281e0859d1
Java: Accept test changes.
2021-06-25 16:47:23 +02:00
intrigus
6413af4fbe
Java: Expand tests.
2021-06-25 16:47:23 +02:00
intrigus
484533c659
Java: Flag "intentionally" unsafe methods in tests.
...
Previously intentionally unsafe methods such as `disableCertificate`
would be ignored by this query. But now they will also be flagged
as it is hard to guess intentions...
Adjust the tests to account for this change.
2021-06-25 16:47:23 +02:00
intrigus
7023793af4
Java: Fix compilation errors in test.
2021-06-25 16:47:23 +02:00
intrigus
6d09db6fd6
Java: Explicitly list custom flow steps.
2021-06-25 16:47:23 +02:00
intrigus
e4775e0fae
Java: Remove "intention-guessing" sanitizer & simplify.
...
This removes the sanitizer part that classified some results as FP
if the results were in methods with certain names, like
`disableVerification()`. I now think that it's a bad idea to filter
based on the method name.
The custom flow steps in `flagFlowStep` are now listed explicitly.
Simplified check whether a method throws an exception.
2021-06-25 16:47:23 +02:00
