hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-19 14:04:09 +02:00
Code Issues Packages Projects Releases Wiki Activity
995 Commits 1,740 Branches 165 Tags
c3cff3e113e05cf38d2ce786196785106d83d2e7
Commit Graph

667 Commits

Author SHA1 Message Date
Tom Hvitved
c3cff3e113 Expose call graph through Call::getATarget() 2021-07-01 16:40:45 +02:00
Nick Rolfe
d99b5510e5 Merge pull request #219 from github/regex 
Add regexp parser and exponential ReDoS query
 2021-06-30 17:23:29 +01:00
Alex Ford
3f76075fe6 improve some rails framework tests 2021-06-29 13:56:28 +01:00
Alex Ford
31cbf818ab fix rb/sql-injection FPs due to not accounting for overridden ActiveRecord methods 2021-06-29 13:54:15 +01:00
Nick Rolfe
97ae9ed181 Add more qldoc comments from Python version 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
 2021-06-29 11:22:47 +01:00
Tom Hvitved
20f239fd0a Improve performance of seqChild/4 
Gets rid of the following bad join-order
```
[2021-06-29 09:40:44] (5s) Starting to evaluate predicate RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3/5@i2#fe59dz (iteration 2)
[2021-06-29 09:46:34] (354s) Tuple counts for RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3/5@i2#fe59dz:
                      222277     ~0%     {5} r1 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.1 're', In.2 'start', In.3, 0, In.0 'result'
                      207749     ~3%     {4} r2 = JOIN r1 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.1 'start', 0, Lhs.4 'result'
                      11636      ~2%     {5} r3 = JOIN r2 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 2 OUTPUT 0, Lhs.3 'result', Lhs.0 're', Lhs.1 'start', Rhs.2 'end'

                      222277     ~0%     {4} r4 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.1 're', In.2 'start', In.3, In.0 'result'
                      207749     ~0%     {3} r5 = JOIN r4 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.1, Lhs.3 'result', Lhs.0 're'
                      902017671  ~2%     {3} r6 = JOIN r5 WITH RegExpTreeView::RegExpTerm#ffff#reorder_3_0_1_2#prev ON FIRST 1 OUTPUT Lhs.2 're', Lhs.1 'result', Rhs.1
                      1193975963 ~2%     {5} r7 = JOIN r6 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 1 OUTPUT Lhs.0 're', Rhs.1, Rhs.2 'end', Lhs.2, Lhs.1 'result'
                      0          ~0%     {6} r8 = JOIN r7 WITH RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev ON FIRST 4 OUTPUT Lhs.4 'result', Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Rhs.4 're', (1 + Rhs.4 're')
                      0          ~0%     {6} r9 = SELECT r8 ON In.5 'i' > 0
                      0          ~0%     {5} r10 = SCAN r9 OUTPUT In.5 'i', In.0 'result', In.1 're', In.2 'start', In.3 'end'

                      11636      ~2%     {5} r11 = r3 UNION r10

                      222277     ~3%     {2} r12 = SCAN RegExpTreeView::RegExpTerm#ffff#prev_delta OUTPUT In.3, In.0 'result'
                      961948702  ~4%     {5} r13 = JOIN r12 WITH RegExpTreeView::RegExpTerm#ffff#reorder_2_1_0_3#prev ON FIRST 1 OUTPUT Rhs.1 're', Lhs.0, Rhs.3, Lhs.1, Rhs.2 'result'
                      902017671  ~0%     {3} r14 = JOIN r13 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.3, Lhs.4 'result'
                      1193975963 ~2%     {5} r15 = JOIN r14 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 1 OUTPUT Lhs.0 're', Rhs.1, Rhs.2 'end', Lhs.1, Lhs.2 'result'
                      0          ~0%     {6} r16 = JOIN r15 WITH RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev ON FIRST 4 OUTPUT Lhs.4 'result', Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Rhs.4 're', (1 + Rhs.4 're')
                      0          ~0%     {6} r17 = SELECT r16 ON In.5 'i' > 0
                      0          ~0%     {5} r18 = SCAN r17 OUTPUT In.5 'i', In.0 'result', In.1 're', In.2 'start', In.3 'end'

                      0          ~0%     {5} r19 = SCAN RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev_delta OUTPUT In.0 're', In.1 'start', In.2 'end', In.4, In.3
                      0          ~0%     {6} r20 = JOIN r19 WITH ParseRegExp::RegExp::sequence_dispred#fff ON FIRST 3 OUTPUT Lhs.0 're', Lhs.1 'start', Lhs.2 'end', Lhs.3, Lhs.4, (1 + Lhs.3)
                      0          ~0%     {6} r21 = SELECT r20 ON In.5 'i' > 0
                      0          ~0%     {5} r22 = SCAN r21 OUTPUT In.4, In.0 're', In.1 'start', In.2 'end', In.5 'i'
                      0          ~0%     {5} r23 = JOIN r22 WITH RegExpTreeView::RegExpTerm#ffff#prev ON FIRST 1 OUTPUT Rhs.3, Lhs.1 're', Lhs.2 'start', Lhs.3 'end', Lhs.4 'i'
                      0          ~0%     {7} r24 = JOIN r23 WITH RegExpTreeView::RegExpTerm#ffff#reorder_2_1_0_3#prev ON FIRST 2 OUTPUT Lhs.1 're', Lhs.0, Rhs.3, Lhs.2 'start', Lhs.3 'end', Lhs.4 'i', Rhs.2 'result'
                      0          ~0%     {5} r25 = JOIN r24 WITH ParseRegExp::RegExp::item_dispred#fff ON FIRST 3 OUTPUT Lhs.5 'i', Lhs.6 'result', Lhs.0 're', Lhs.3 'start', Lhs.4 'end'

                      0          ~0%     {5} r26 = r18 UNION r25
                      11636      ~2%     {5} r27 = r11 UNION r26
                      11636      ~2%     {5} r28 = r27 AND NOT RegExpTreeView::seqChild#fffff#reorder_0_1_2_4_3#prev(Lhs.2 're', Lhs.3 'start', Lhs.4 'end', Lhs.1 'result', Lhs.0 'i')
                      11636      ~0%     {5} r29 = SCAN r28 OUTPUT In.2 're', In.3 'start', In.4 'end', In.1 'result', In.0 'i'
                                         return r29
```
 2021-06-29 09:57:23 +02:00
Nick Rolfe
ba7021086b Merge remote-tracking branch 'origin/main' into regex 2021-06-25 15:00:26 +01:00
Nick Rolfe
bee94757dd Add query test for ReDoS.ql, ported from JS 2021-06-25 12:51:35 +01:00
Nick Rolfe
6142029fdc Recognise \t as not escaping t 2021-06-25 12:46:25 +01:00
Nick Rolfe
a77e7761fd Make \h and \H character class escapes 2021-06-25 12:27:39 +01:00
Nick Rolfe
a5dff79e51 Fix locations of regexp nodes in AST viewer 2021-06-25 12:00:38 +01:00
Alex Ford
2a7d8bbc0a Apply suggestions from code review 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 19:43:35 +01:00
Nick Rolfe
9ec503a3a5 Merge remote-tracking branch 'origin/main' into regex 2021-06-24 18:16:13 +01:00
Alex Ford
a45366e426 remove unnecessary ExprNodes prefix 2021-06-24 18:12:26 +01:00
Alex Ford
b27891b14e update ActiveRecord test output 2021-06-24 18:12:26 +01:00
Alex Ford
1f5a5181b9 StringInterpolationComponentCfgNode extends ExprNodes::StmtSequenceCfgNode 2021-06-24 18:12:26 +01:00
Alex Ford
a4a8f17a54 Update ql/src/codeql_ruby/dataflow/BarrierGuards.qll 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 18:12:26 +01:00
Alex Ford
9883a9b606 update SqlInjection tests 2021-06-24 18:12:26 +01:00
Alex Ford
d62f4f5bd4 Address review comments 2021-06-24 18:12:26 +01:00
Alex Ford
bc5a1b86ff Fix handling of arrays passed to ActiveRecord SQL methods 2021-06-24 18:12:26 +01:00
Alex Ford
fc8db88b66 Apply suggestions from code review 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-24 18:12:25 +01:00
Alex Ford
7415503772 update ActiveRecord test output 2021-06-24 18:12:25 +01:00
Alex Ford
12e4c9ee90 update SqlInjection tests 2021-06-24 18:12:25 +01:00
Alex Ford
734fe01867 Support named :conditions parameter to some SQL executing ActiveRecord calls 2021-06-24 18:12:25 +01:00
Alex Ford
91bde8d85d Support ActiveRecord SQL executing calls where there is a self receiver (implicit or explicit) 2021-06-24 18:12:25 +01:00
Alex Ford
5386c776b3 Implement rb/sql-injection 2021-06-24 18:12:25 +01:00
Alex Ford
957b29b5af Add more defaultAdditionalTaintSteps 2021-06-24 18:12:25 +01:00
Alex Ford
6e5665da8c Make ActiveRecord model flag more potentially dangerous SQL executions 2021-06-24 18:12:25 +01:00
Alex Ford
8761873cd1 Implement two common barrier guards 2021-06-24 18:12:25 +01:00
Alex Ford
98313d0a56 Convenience classes for wrapping some Exprs as ExprCfgNodes 2021-06-24 18:12:25 +01:00
Alex Ford
ad1d8420f3 Make BarrierGuard abstract 2021-06-24 18:12:25 +01:00
Alex Ford
adf32e973a Create Frameworks.qll to act as a container for all framework models 2021-06-24 18:12:25 +01:00
Nick Rolfe
17a59ef824 Add basic test for regex parsing 2021-06-24 18:06:08 +01:00
Nick Rolfe
51b0ffdaf8 Fix printAst to support adding edges in AstDesugar test 2021-06-24 17:14:23 +01:00
Nick Rolfe
f7e89f47fd Comment out temporarily-unused predicates 2021-06-24 17:06:41 +01:00
Nick Rolfe
a6dd2fa0a1 Split ReDoS query into .ql and .qll, and add .qhelp 2021-06-24 16:32:45 +01:00
Tom Hvitved
9438885776 Merge pull request #216 from github/hvitved/synthesis-location 
AST synthesis: Move location information into a separate predicate
 2021-06-23 16:50:17 +02:00
Nick Rolfe
c784e37089 Add regexp parser and exponential ReDoS query 2021-06-23 15:29:49 +01:00
Alex Ford
0238c19085 remove TODO 2021-06-23 14:11:38 +01:00
Alex Ford
5941eb2be4 model some ActionController user input sources (params) 2021-06-23 14:11:38 +01:00
Alex Ford
9227f3a0c3 Add RemoteFlowSources.qll 2021-06-23 14:11:38 +01:00
Tom Hvitved
1dde5b8ef9 AST synthesis: Move location information into a separate predicate 2021-06-23 08:46:07 +02:00
Alex Ford
dbf1805c8b Merge pull request #196 from github/active-record-1 
Start modelling some potential SQL fragment sinks in ActiveRecord
 2021-06-22 16:05:26 +01:00
Arthur Baars
f7eee915da Remove ad-hoc queries 2021-06-22 15:35:30 +02:00
Tom Hvitved
992d8faa06 Bump codeql submodule 2021-06-21 16:06:45 +02:00
Tom Hvitved
abe5e3d953 Merge pull request #210 from github/hvitved/dataflow/consistency 
Data flow: Add consistency queries
 2021-06-21 14:42:55 +02:00
Nick Rolfe
35eb4a3af4 Merge pull request #214 from github/regexp_naming 
Use RegExp prefix instead of Regex, for consistency with other languages.
 2021-06-21 11:06:19 +01:00
Nick Rolfe
65aa97c07c Use RegExp prefix instead of Regex, for consistency with other languages. 2021-06-18 15:56:19 +01:00
Tom Hvitved
7cc02e6d00 Add Ssa::WriteDefinition::assigns/1 predicate 2021-06-18 10:42:32 +02:00
Alex Ford
7439ab5635 remove recvCls field from ActiveRecordModelClassMethodCall 2021-06-17 14:42:42 +01:00