hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-08 08:34:02 +02:00
Code Issues Packages Projects Releases Wiki Activity
78,733 Commits 1,731 Branches 164 Tags
c6db32ed73b790aaf5cd094c03473386d4e7920e
Commit Graph

78733 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Napalys Klicius
c6db32ed73 Add exceptions for arktype, execa, and highland to prevent them from being flagged by unhandled pipe error query 2025-05-23 12:34:11 +02:00
Napalys Klicius
15ff7cb41a Added more test cases which common js libraries uses .pipe() 2025-05-23 12:30:49 +02:00
Napalys Klicius
b10a9481f3 Fixed false positives from strapi and rxjs/testing as well as when one passes function as second arg to pipe 2025-05-22 18:50:02 +02:00
Napalys Klicius
e6ae8bbde4 Added test cases where second parameter passed to pipe is a function and some popular library ones 2025-05-22 18:50:01 +02:00
Napalys Klicius
ac24fdd348 Add predicate to detect non-stream-like usage in sources of pipe calls 2025-05-22 18:49:59 +02:00
Napalys Klicius
5b1af0c0bd Added detection of custom gulp-plumber sanitizer, thus one would not flag such instances. 2025-05-22 18:49:53 +02:00
Napalys Klicius
b1048719aa Added UnhandledStreamPipe to javascript-security-and-quality.qls and javascript-code-quality.qls 2025-05-22 12:42:56 +02:00
Napalys Klicius
09220fce84 Fixed issue where pipe calls from rxjs package would been identified as pipe calls on streams 2025-05-22 12:33:36 +02:00
Napalys Klicius
d7f86db76c Enhance PipeCall to exclude non-function and non-object arguments in pipe method detection 2025-05-22 12:31:27 +02:00
Napalys Klicius
4332de464a Eliminate false positives by detecting non-stream objects returned from pipe() calls based on accessed properties 2025-05-22 12:31:26 +02:00
Napalys Klicius
5710f0cf51 Add test cases for non-stream field accesses and methods before and after pipe operations 2025-05-22 12:31:19 +02:00
Napalys Klicius
03d1f9a7d3 Restrict pipe detection to calls with 1-2 arguments 2025-05-21 11:41:22 +02:00
Napalys Klicius
30f2815503 Fixed issue where a custom pipe method which returns non stream would be flagged by the query 2025-05-21 11:41:19 +02:00
Napalys Klicius
ef1bde554a Fixed issue where streams would not be tracked via chainable methods 2025-05-21 11:40:35 +02:00
Napalys Klicius
f39bf62fc6 test: Add edge cases for stream pipe error handling 
Add tests for chained stream methods and non-stream pipe objects
 2025-05-21 11:39:03 +02:00
Napalys Klicius
c27157f021 Add UnhandledStreamPipee Quality query and tests to detect missing error handlers in Node.js streams 2025-05-21 11:38:57 +02:00
Napalys Klicius
d1e769ba54 Merge pull request #19422 from Napalys/js/shelljs 
JS: Modeling of `ShellJS` functions
 2025-05-02 14:18:44 +02:00
Napalys Klicius
871e93d9fe Update javascript/ql/lib/semmle/javascript/frameworks/ShellJS.qll 
Co-authored-by: Asger F <asgerf@github.com>
 2025-05-02 13:39:46 +02:00
Michael Nebel
74669cb0cb Merge pull request #19382 from michaelnebel/shared/modelgenrefactor 
Shared: Re-factor summary, source and sink model generators into separate modules.
 2025-05-02 09:38:24 +02:00
Tamás Vajk
cb1c3736fe Merge pull request #19413 from tamasvajk/quality/query-suite-selector 
Add code quality suite selector and use that in the code quality suites
 2025-05-02 08:18:48 +02:00
Napalys Klicius
f652686607 Merge pull request #19444 from Napalys/python/hdbcli 
Python: modeling of `hdbcli`
 2025-05-01 17:58:31 +02:00
Tom Hvitved
40f80ff4e7 Merge pull request #19442 from hvitved/rust/clone-modeling 
Rust: Strengthen modeling of the `Clone` trait
 2025-05-01 17:11:42 +02:00
Jeroen Ketema
8ad6938a82 Merge pull request #19434 from jketema/array-barrier 
C++: Limit flow through sinks and sources in `cpp/upcast-array-pointer-arithmetic`
 2025-05-01 16:42:53 +02:00
yoff
d7e6e1dd66 Merge pull request #19432 from yoff/python/model-http-server-header-write 
python: model `send_header` from `http.server`
 2025-05-01 15:34:05 +02:00
Taus
481adcea0a Merge pull request #18449 from github/tausbn/misc-add-script-for-calculating-mrva-totals 
Misc: Add script for calculating totals for a MRVA run
 2025-05-01 15:17:19 +02:00
Owen Mansel-Chan
e0549483fd Merge pull request #19429 from owen-mc/fix-cwe-tags-missing-leading-zero 
Fix cwe tags to include leading zero
 2025-05-01 14:09:54 +01:00
Napalys Klicius
da7c0931b8 Added hdbcli to be part of supported-framework as well as change note 2025-05-01 14:18:08 +02:00
Napalys Klicius
e1fc0ca051 Added implementation hdbcli as part of PEP249::PEP249ModuleApiNode 2025-05-01 14:18:02 +02:00
Napalys Klicius
0325f368fe Added test case for hdbcli 2025-05-01 13:57:14 +02:00
Nick Rolfe
817237ce54 Merge pull request #19441 from github/nickrolfe/mergeback-2.21.2 
Merge back 2.21.2 release branch
 2025-05-01 11:55:29 +01:00
Napalys Klicius
6ba0dc20a3 Merge pull request #19439 from Napalys/js/fastify-all 
JS: Modeling of `fastify`
 2025-05-01 12:11:52 +02:00
Owen Mansel-Chan
0863c87572 Add change notes 2025-05-01 10:33:24 +01:00
Napalys Klicius
68a9dd9f9e Address comments 2025-05-01 11:19:41 +02:00
Napalys Klicius
d4b5ef6a66 Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource 2025-05-01 11:14:15 +02:00
Napalys Klicius
33d8ffa83e Added test cases for shelljs.env 2025-05-01 11:11:29 +02:00
Napalys Klicius
602500e280 Added change note 2025-05-01 11:09:56 +02:00
Napalys Klicius
40d176a770 Added model for shelljs.env 2025-05-01 11:09:47 +02:00
Tom Hvitved
423e2dac91 Rust: Strenghten the modeling of the Clone trait 2025-05-01 10:54:52 +02:00
Tom Hvitved
1770f568a2 Merge pull request #19367 from hvitved/rust/type-inference-try-expr 
Rust: Type inference for `?` expressions
 2025-05-01 10:27:49 +02:00
Nick Rolfe
20f7781d9f Merge pull request #19437 from adityasharad/docs/fix/2.21.0-escaping 
Docs: Fix escaping in 2.21.0 changelog
 2025-05-01 09:27:41 +01:00
Nick Rolfe
005a27bff9 Merge pull request #19436 from adityasharad/actions/ga-change-note 
Actions: Retroactively add GA changenote
codeql-cli/v2.21.2 		2025-05-01 09:21:15 +01:00
Simon Friis Vindum
bab84d03d1 Merge pull request #19419 from paldepind/rust-precise-implicit-deref-borrow 
Rust: Use type inference to insert implicit borrows and derefs
 2025-05-01 08:41:37 +02:00
Aditya Sharad
36199b3f06 Docs: Fix escaping in 2.21.0 changelog 
These break when the RST is processed.
Escape the backslashes and consistently add
inline code blocks.
 2025-04-30 16:40:36 -07:00
Aditya Sharad
6285c2e502 Actions: Retroactively add GA changenote 
This was manually added in the docs site at the time of 2.21.1 release and GA.
Include the change note in the relevant places so it remains
in future docs updates:
- codeql/actions-queries@0.5.4
- codeql/actions-all@0.4.7
- 2.21.1 changelog
 2025-04-30 16:24:22 -07:00
Jeroen Ketema
2ed48ae571 C++: Update expected test results after barrier introduction 2025-04-30 20:51:27 +02:00
Tom Hvitved
a3c26b4bfe Rust: Type inference for ? expressions 2025-04-30 20:35:11 +02:00
Tom Hvitved
88075c4c8c Rust: Make manual tweaks to Copilot generated code 2025-04-30 20:35:10 +02:00
Tom Hvitved
51e70d0c3b Rust: Add Copilot generated test for ? operator expressions 2025-04-30 20:35:09 +02:00
Jeroen Ketema
723778fa82 C++: Limit flow through sinks and sources in cpp/upcast-array-pointer-arithmetic 2025-04-30 20:31:12 +02:00
Jeroen Ketema
359aa02602 Merge pull request #19410 from jketema/header-variant 
C++: Turn header variant tests that use PCH files into integration tests
 2025-04-30 20:10:30 +02:00