hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-14 19:44:03 +02:00
Code Issues Packages Projects Releases Wiki Activity
49,456 Commits 1,736 Branches 164 Tags
ca5916f3dc7548d39b5fb036dc9f757ac17a44a5
Commit Graph

49456 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mathias Vorreiter Pedersen
ca5916f3dc Merge pull request #11946 from MathiasVP/fix-taint-models-2 2023-01-24 08:13:43 +00:00
Arthur Baars
c512eddb69 Merge pull request #11969 from hmac/simplify-ruby-dependabot-config 
Ruby: Simplify dependabot config
 2023-01-24 07:34:45 +01:00
Harry Maclean
8050639b16 Ruby: Simplify dependabot config 
Dependabot is able to understand cargo workspaces, so it's not necessary
to enumerate each workspace member. It should be enough to configure it
with the workspace root directory. This will hopefully ensure that the
Cargo.lock file gets updated correctly.
 2023-01-24 16:37:10 +13:00
Erik Krogh Kristensen
fc66c905ff Merge pull request #11859 from erik-krogh/moreShell 
JS: slightly broaden the regular expression that recognizes bad string-concats used as shell commands
 2023-01-23 22:26:17 +01:00
Henry Mercer
21e63a8a86 Merge pull request #11967 from github/codeql-ci/atm/release-0.4.6 
JS: Bump version numbers of ML-powered packs after 0.4.6 release
 2023-01-23 20:43:18 +00:00
Henry Mercer
241951f53e Merge branch 'main' into codeql-ci/atm/release-0.4.6 2023-01-23 18:24:36 +00:00
github-actions[bot]
be481d975c JS: Bump version of ML-powered library and query packs to 0.4.7 2023-01-23 18:22:18 +00:00
github-actions[bot]
40a67d61d2 JS: Bump patch version of ML-powered library and query packs 2023-01-23 18:15:56 +00:00
Geoffrey White
25bcaa3a54 Merge pull request #11966 from geoffw0/usenumerics 
Swift: Use numeric types in CleartextLogging.qll.
 2023-01-23 18:06:17 +00:00
Sid Shankar
e32823c3e0 Merge pull request #11964 from github/sidshank/update-supported-language-versions-Jan-2023 
Update supported language versions in documentation
 2023-01-23 12:12:43 -05:00
Geoffrey White
19527016a5 Swift: Use numeric types in CleartextLogging.qll. 2023-01-23 16:52:03 +00:00
Sid Shankar
f77d156e9a Update supported version of Java 2023-01-23 15:41:35 +00:00
Sid Shankar
444df6fccb Update supported version of Go 2023-01-23 15:41:02 +00:00
Erik Krogh Kristensen
240248b9cf Merge pull request #11453 from erik-krogh/unsafeHtmlConstruction 
RB: add unsafe-html-construction query
 2023-01-23 16:40:25 +01:00
erik-krogh
11894144aa remove regular expression that did nothing 2023-01-23 16:38:09 +01:00
Jeroen Ketema
0a0d6d0841 Merge pull request #11963 from MathiasVP/testcase-with-loop 
C++: Add testcase with looping behavior
 2023-01-23 16:33:36 +01:00
Erik Krogh Kristensen
5be97f3761 Merge pull request #11909 from erik-krogh/concatCode 
Rb: recognize string concatenations as sinks for unsafe-code-construction
 2023-01-23 16:22:46 +01:00
Mathias Vorreiter Pedersen
a217017859 C++: Add testcase with looping behavior in C/C++ use-use flow. 2023-01-23 14:29:39 +00:00
erik-krogh
ae00518ddf remove the isAdditionalTaintStep predicate from UnsafeHtmlConstructionQuery, as it was not needed 2023-01-23 15:27:19 +01:00
erik-krogh
7c6ee5f293 Merge branch 'main' into unsafeHtmlConstruction 2023-01-23 15:01:01 +01:00
Erik Krogh Kristensen
32c4cf5769 Apply suggestions from code review 
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com>
 2023-01-23 14:58:04 +01:00
Erik Krogh Kristensen
a10b45e0db Merge pull request #11927 from mvogelgesang/express-rate-limit 
JS: Updated express-rate-limit example to match implementation examples f…
 2023-01-23 14:37:50 +01:00
Jeroen Ketema
05ecd2e015 Merge pull request #11958 from jketema/argv-if-tests 
C++: Add some additional uncontrolled format string tests
 2023-01-23 14:05:07 +01:00
Erik Krogh Kristensen
45aaeb897a Merge pull request #11955 from erik-krogh/docFrameworks 
JS: add Fastify and restify to the list of supported frameworks
 2023-01-23 13:14:15 +01:00
Philip Ginsbach
78a2dfa7c4 Merge pull request #11939 from github/ginsbach/DocumentNewNamespaces 
document new namespaces
 2023-01-23 12:12:49 +00:00
Chris Smowton
fea97a22c6 Merge pull request #11827 from smowton/smowton/admin/test-gradle-script-parsing 
Java: Add integration tests for Android projects
 2023-01-23 11:39:24 +00:00
Philip Ginsbach
8a3972049b fix grammar 2023-01-23 11:15:22 +00:00
Jeroen Ketema
cfc0dabad9 C++: Add some additional uncontrolled format string tests 
These duplicate the `i9` and `i91` tests slightly earlier in the same file, but
use an explicit `if` instead of the ternary operator.
 2023-01-23 11:50:45 +01:00
Mathias Vorreiter Pedersen
470abfd0aa C++: Conflate iterator value and indirection for taint-flow to fix AST dataflow. 2023-01-23 10:40:25 +00:00
Mathias Vorreiter Pedersen
962b651c44 C++: Fix models. 2023-01-23 10:10:02 +00:00
Alex Ford
55550e7980 Merge pull request #11941 from alexrford/summary-component-tostring-syntheticglobal 
Add missing toString case for synthetic globals
 2023-01-23 10:00:00 +00:00
Erik Krogh Kristensen
1ee9957838 Merge pull request #9807 from erik-krogh/endFilter 
JS: recognize "-->" as a bad tag filter
 2023-01-23 10:06:50 +01:00
Arthur Baars
99148244a4 Merge pull request #11856 from aibaars/update-grammars 
Update grammars
 2023-01-23 09:46:50 +01:00
erik-krogh
dc1bfa3a04 add Fastify and restify to the list of supported frameworks 2023-01-23 09:36:49 +01:00
Michael Nebel
69a42d8b1f Merge pull request #11931 from michaelnebel/csharp/refactor 
Remove the Csv postfix of some predicate names.
 2023-01-23 09:09:48 +01:00
Chris Smowton
a2e7b83411 Add additional note to Android tests 2023-01-21 11:57:54 +00:00
Chris Smowton
81e59e9005 Force Gradle tests to run sequentially 
Otherwise starting multiple Gradle daemons in parallel can fail
 2023-01-21 11:57:53 +00:00
Chris Smowton
4197d7bd20 Android tests: use Java 11 under Actions 
Some runners still default to Java 8 (e.g. windows-2022 and macos-12), so we need to manually pull Java 11 in in such cases.
 2023-01-21 11:57:53 +00:00
Chris Smowton
b6df415fe8 Add Android and Kotlin build script tests 
This adds a single plain Gradle project that uses a modern Kotlin build script (i.e. settings.gradle.kts and no build.gradle.kts), plus basic Android samples exercising the possible permutations of: (old vs. new-style build script, Groovy vs. Kotlin build script, wrapper present vs. absent)

Old vs. new style tests our recognition of different cues that this is likely a Droid project and requires `gradle assemble` not `gradle testClasses` (the example given at https://developer.android.com/studio/build/#top-level changed style as of plugin version ~7.3.0).

Groovy vs. Kotlin build script language checks that the regexes recognising Android dependencies and versions work for both build script kinds.

Wrapper present vs. absent exercises the autobuilder logic that guesses an appropriate Gradle version and sets it up in the event the Gradle wrapper isn't provided.
 2023-01-21 11:57:53 +00:00
Mathias Vorreiter Pedersen
e664662df9 Merge pull request #11944 from github/post-release-prep/codeql-cli-2.12.1 
Post-release preparation for codeql-cli-2.12.1
 2023-01-20 21:52:55 +00:00
github-actions[bot]
b62cb6ba84 Post-release preparation for codeql-cli-2.12.1 2023-01-20 19:49:56 +00:00
Sarita Iyer
f5406570f7 Merge pull request #11817 from github/saritai/docs-contributing-info 
Add CONTRIBUTING.MD file for contributing to docs
 2023-01-20 12:41:20 -05:00
Jean Helie
9e6f9c2705 Merge pull request #11709 from github/jhelie/add-shell-command-injection 
ATM: add boosted version for `ShellCommandInjectionFromEnvironment` query
 2023-01-20 16:03:30 +01:00
Mathias Vorreiter Pedersen
3059ce3070 Merge pull request #11938 from github/release-prep/2.12.1 
Release preparation for version 2.12.1
codeql-cli/v2.12.1 		2023-01-20 14:30:42 +00:00
Alex Ford
e4df1f5a6f Ruby: add missing toString case for synthetic globals 2023-01-20 13:31:43 +00:00
Jeroen Ketema
cddaa0c8fa Apply suggestions from code review 2023-01-20 14:10:27 +01:00
Philip Ginsbach
3998c9a89a document the existence of a global QlBuiltins module 2023-01-20 12:16:24 +00:00
Philip Ginsbach
127b1ac114 update handbook and reference with signature namespaces 2023-01-20 12:16:22 +00:00
github-actions[bot]
005b3e4a47 Release preparation for version 2.12.1 2023-01-20 12:03:19 +00:00
Geoffrey White
976b0401be Merge pull request #11876 from geoffw0/coredata 
Swift: Improve Core Data sinks for swift/cleartext-storage-database
 2023-01-20 11:02:03 +00:00