hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-05 13:45:19 +02:00
Code Issues Packages Projects Releases Wiki Activity
45,430 Commits 1,746 Branches 166 Tags
cb33d5aeff42cd415ebb7c5454fe7523efee1b92
Commit Graph

45430 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
erik-krogh
cb33d5aeff add test for .send(..) in code-injection 2022-10-19 11:25:30 +02:00
Tony Torralba
fd8f8cb930 Merge pull request #10223 from atorralba/atorralba/unsafe-content-resolver 
Java: New Android query to detect unsafe content URI resolution
 2022-10-19 11:22:04 +02:00
Tamás Vajk
0f499dfb75 Merge pull request #10877 from tamasvajk/kotlin-safe-call-null-check 
Kotlin: Add test for useless null check on safe calls
 2022-10-19 11:19:58 +02:00
Tamás Vajk
086362d8ee Merge pull request #10859 from tamasvajk/kotlin-field-masking 
Kotlin: Exclude fields of live literals from `java/field-masks-super-field`
 2022-10-19 11:19:44 +02:00
Henry Mercer
3afb9c1b3b Merge pull request #10845 from github/henrymercer/remove-worsening-queries 
ATM: Remove worsening-based queries
 2022-10-19 10:05:53 +01:00
James Fletcher
e9e2e90a92 Merge pull request #10647 from jf205/lgtm-cli-vs-code 
Partially remove mentions of lgtm.com from the CodeQL documentation
 2022-10-19 09:32:01 +01:00
AlexDenisov
5c8fa84d30 Merge pull request #10786 from github/alexdenisov/xcode-autobuilder 
Swift: introduce Xcode autobuilder
 2022-10-19 10:19:49 +02:00
Tamas Vajk
bd9c7df25b Improve QL quality 2022-10-19 09:00:39 +02:00
Tamas Vajk
d65c52bfc5 Kotlin: Add test for useless null check on safe calls 2022-10-19 08:49:56 +02:00
Tom Hvitved
6208071575 Merge pull request #10874 from hvitved/ruby/fix-test-syntax-error 
Ruby: Fix syntax error in a test
 2022-10-18 19:28:17 +02:00
Tom Hvitved
61b9065135 Ruby: Fix syntax error in a test 2022-10-18 16:49:32 +02:00
Geoffrey White
73f977c98c Merge pull request #10510 from geoffw0/staticfn 
C++: Fix FPs for cpp/unused-static-function in files that were not extracted completely
 2022-10-18 14:53:49 +01:00
Tony Torralba
1d745a6365 Merge pull request #10774 from atorralba/atorralba/swift/url-field-summaries 
Swift: Add summaries for tainted URL fields
 2022-10-18 15:32:23 +02:00
Arthur Baars
14f150c1f3 Merge pull request #10872 from aibaars/set-output 
CI: update actions/cache to v3
 2022-10-18 15:09:29 +02:00
Jean Helie
e2462d8a2e Merge pull request #10871 from github/atm-model-pack-update/f3c3c9360a727959e428ecc6932257e6a546dc65d8a9baac525a49247123822d 
ATM: Update model pack to version 0.2.1-2022-09-06-08h55m54s.bubbly-basin-xpztl8fh.f3c3c9360a727959e428ecc6932257e6a546dc65d8a9baac525a49247123822d
 2022-10-18 14:55:21 +02:00
Paolo Tranquilli
fd46592dfb Merge pull request #10869 from github/redsun82/swift-no-base-suffix 
Swift: replace `Base` suffix with `Generated::` module
 2022-10-18 14:28:08 +02:00
AlexDenisov
5e17861066 Merge pull request #10870 from github/redsun82/swift-rm-schema.yml 
Swift: remove obsolete `schema.yml`
 2022-10-18 14:23:48 +02:00
Arthur Baars
f56e155080 CI: update actions/cache to v3 2022-10-18 14:07:52 +02:00
github-actions[bot]
fa274e4375 ATM: Update ML model to 0.2.1-2022-09-06-08h55m54s.bubbly-basin-xpztl8fh.f3c3c9360a727959e428ecc6932257e6a546dc65d8a9baac525a49247123822d 2022-10-18 11:53:42 +00:00
Paolo Tranquilli
8a839c8b96 Swift: remove obsolete schema.yml 2022-10-18 12:51:56 +02:00
Paolo Tranquilli
9c7eec5e44 Swift: remove debug print from qlgen.py 2022-10-18 12:48:18 +02:00
Tony Torralba
0eeaf71716 Simplify models by introducing TaintInheritingContent 2022-10-18 12:36:18 +02:00
Paolo Tranquilli
e29fe54b3c Swift: remove redudant import 2022-10-18 12:35:35 +02:00
Paolo Tranquilli
f4f5e3e382 Swift: remove redundant module namespace 2022-10-18 12:32:31 +02:00
Paolo Tranquilli
af3f782ad5 Swift: fix TypeDecl.qll 2022-10-18 12:21:06 +02:00
Paolo Tranquilli
581939d139 Swift: replace non-genereated Base suffixes 
This is the effect of running
```
find swift/ql/lib/codeql/swift/elements -type f | xargs sed -ri 's/\b([A-Z]\w+)Base\b/Generated::\1/g'
```
followed by reformatting.
 2022-10-18 12:21:06 +02:00
Paolo Tranquilli
307c885c1f Swift: use Generated:: instead of Base suffix 
This commit changes `codegen` and the generated classes.
 2022-10-18 12:21:06 +02:00
Calum Grant
643cfced6a Merge pull request #10837 from github/calumgrant/ruby-frameworks2 
Ruby: Add more frameworks to the list of supported frameworks
 2022-10-18 11:06:14 +01:00
Tamás Vajk
0069fd9681 Merge pull request #10860 from tamasvajk/kotlin-clinit-static 
Kotlin: Add `static` modifier to `clinit`
 2022-10-18 11:39:34 +02:00
Chris Smowton
67aa6c7737 Merge pull request #10822 from smowton/smowton/feature/kotlin-collection-literals 
Koltin: support collection literals
 2022-10-18 09:45:59 +01:00
Alex Denisov
0c3fd9fdcf Swift: %/\t/\s/ 2022-10-18 10:17:02 +02:00
Alex Denisov
ad9f5efcd7 Swift: stream directly instead of using intermediate string 2022-10-18 10:15:16 +02:00
Alex Denisov
eba7f1a744 Swift: simplify Bazel a bit 2022-10-18 10:04:50 +02:00
Tom Hvitved
19bcd287cb Merge pull request #10867 from hvitved/ruby/orm-tracking-redundant-additional-step 
Ruby: Remove redundant additional flow step from `OrmTracking::Configuration`
 2022-10-18 10:03:51 +02:00
Tom Hvitved
d362296f1c Merge pull request #10864 from hvitved/ruby/get-a-barrier-node-join-fix 
Ruby: Fix bad join-order in `BarrierGuard::getABarrierNode`
 2022-10-18 10:03:02 +02:00
Alex Denisov
a3b5f2239d Swift: do not use C casts 2022-10-18 10:01:02 +02:00
Alex Denisov
44c26be2c4 Swift: make dealing with CF types typesafe 2022-10-18 09:53:06 +02:00
Tom Hvitved
1266d248ed Ruby: Remove redundant additional flow step from OrmTracking::Configuration 2022-10-18 09:33:29 +02:00
Tamas Vajk
b67a8877a7 Kotlin: Add static modifier to clinit 2022-10-18 09:26:06 +02:00
Alex Denisov
d97669f9aa Swift: add CMake target for xcode-autobuilder 2022-10-18 09:22:40 +02:00
Alex Denisov
6d754c42d7 Swift: do not use relative include paths 2022-10-18 09:14:48 +02:00
Alex Denisov
023fea68d0 Merge branch 'main' into alexdenisov/xcode-autobuilder 2022-10-18 09:12:47 +02:00
Tamás Vajk
543e2f5aab Merge pull request #10678 from tamasvajk/kotlin-type-param-modifiers 
Kotlin: Extract type parameter modifiers (`reified`, `in`, `out`)
 2022-10-18 09:10:57 +02:00
Tom Hvitved
6c765a95ff Ruby: Fix bad join-order in BarrierGuard::getABarrierNode 
Before
```
Evaluated relational algebra for predicate XSS#e59174e9::Shared::Sanitizer#class#f@6c9d334e with tuple counts:
                 0   ~0%    {1} r1 = JOIN ActionView#3462bac2::RailsHtmlEscaping#f WITH project#DataFlowPublic#e1781e31::CallNode::getArgument#1#dispred#fff#3 ON FIRST 1 OUTPUT Lhs.0

            554860   ~0%    {2} r2 = JOIN SsaImpl#ff97b16a::Cached::getARead#1#ff_10#join_rhs WITH DataFlowPrivate#462ff392::Cached::TExprNode#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1

                 1   ~0%    {1} r3 = JOIN r2 WITH DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstArrayInclusionCall#::getAMaybeGuardedCapturedDef#0#f ON FIRST 1 OUTPUT Lhs.1

                 1   ~0%    {1} r4 = r1 UNION r3

                 7   ~0%    {1} r5 = JOIN r2 WITH DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstCompare#::getAMaybeGuardedCapturedDef#0#f ON FIRST 1 OUTPUT Lhs.1

           3045081   ~1%    {3} r6 = JOIN DataFlowPrivate#462ff392::Cached::TExprNode#ff_10#join_rhs WITH DataFlowPrivate#462ff392::Cached::TExprNode#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Rhs.1
           3045081   ~1%    {3} r7 = JOIN r6 WITH ControlFlowGraph#46cebcbd::CfgNode::getBasicBlock#0#dispred#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
            554860   ~1%    {3} r8 = JOIN r7 WITH SsaImpl#ff97b16a::Cached::getARead#1#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2
        1462917146   ~0%    {3} r9 = JOIN r8 WITH SsaImpl#ff97b16a::Cached::getARead#1#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
           5082692   ~1%    {4} r10 = JOIN r9 WITH DataFlowPublic#e1781e31::guardControlsBlock#3#fff_102#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.2, Rhs.2, Lhs.1

                33   ~0%    {1} r11 = JOIN r10 WITH BarrierGuards#2462899b::stringConstArrayInclusionCall#3#fff ON FIRST 3 OUTPUT Lhs.3

                57   ~0%    {1} r12 = JOIN r10 WITH BarrierGuards#2462899b::stringConstCompare#3#fff ON FIRST 3 OUTPUT Lhs.3

                90   ~0%    {1} r13 = r11 UNION r12
                97   ~0%    {1} r14 = r5 UNION r13
                98   ~0%    {1} r15 = r4 UNION r14
                            return r15
```

After
```
[2022-10-17 20:35:01] Evaluated non-recursive predicate XSS#e59174e9::Shared::Sanitizer#class#f@487a64ar in 65ms (size: 98).
Evaluated relational algebra for predicate XSS#e59174e9::Shared::Sanitizer#class#f@487a64ar with tuple counts:
             0   ~0%    {1} r1 = JOIN ActionView#3462bac2::RailsHtmlEscaping#f WITH project#DataFlowPublic#e1781e31::CallNode::getArgument#1#dispred#fff#3 ON FIRST 1 OUTPUT Lhs.0

            33   ~0%    {1} r2 = JOIN DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstArrayInclusionCall#::guardChecksSsaDef#3#fff WITH DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstArrayInclusionCall#::guardControlsSsaDef#4#ffff ON FIRST 3 OUTPUT Rhs.3

            33   ~0%    {1} r3 = r1 UNION r2

            57   ~1%    {1} r4 = JOIN DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstCompare#::guardChecksSsaDef#3#fff WITH DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstArrayInclusionCall#::guardControlsSsaDef#4#ffff ON FIRST 3 OUTPUT Rhs.3

        554860   ~0%    {2} r5 = JOIN SsaImpl#ff97b16a::Cached::getARead#1#ff_10#join_rhs WITH DataFlowPrivate#462ff392::Cached::TExprNode#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1

             1   ~0%    {1} r6 = JOIN r5 WITH DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstArrayInclusionCall#::getAMaybeGuardedCapturedDef#0#f ON FIRST 1 OUTPUT Lhs.1

             7   ~0%    {1} r7 = JOIN r5 WITH DataFlowPublic#e1781e31::BarrierGuard#BarrierGuards#2462899b::stringConstCompare#::getAMaybeGuardedCapturedDef#0#f ON FIRST 1 OUTPUT Lhs.1

             8   ~0%    {1} r8 = r6 UNION r7
            65   ~2%    {1} r9 = r4 UNION r8
            98   ~1%    {1} r10 = r3 UNION r9
                        return r10
```
 2022-10-17 20:39:30 +02:00
Chris Smowton
595a66a3a4 Fix extraction of primitive-typed arrays 2022-10-17 18:29:59 +01:00
Geoffrey White
040d72e7f1 Merge pull request #10857 from geoffw0/locationstring 
Swift: Give Location a useful toString
 2022-10-17 18:10:51 +01:00
james
d917416479 fix document anchor in codeql-library-for-ruby 2022-10-17 16:51:48 +01:00
James Fletcher
4d7195509c Merge branch 'main' into lgtm-cli-vs-code 2022-10-17 16:24:29 +01:00
james
51c0287905 address review comments 2022-10-17 16:19:15 +01:00
Paolo Tranquilli
3a99b9845e Merge pull request #10856 from github/redsun82/swift-show-ql-class-in-collapsed-hierarchy-tests 
Swift: show QL class in generated tests on collapsed hierarchies
 2022-10-17 16:38:24 +02:00