hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity
84,738 Commits 1,671 Branches 157 Tags
d2c7147480b297e8fec5ec735230c24d9b943a7a
Commit Graph

84738 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Taus
d2c7147480 Python: Add new test 2025-12-10 13:52:13 +00:00
Taus
6af9fd816f Python: Make space for new test 2025-12-10 13:51:20 +00:00
Taus
e6e05012c8 Python: Add change note 2025-12-09 22:55:40 +00:00
Taus
ad68a5e4e9 Python: Add modelling for zstd.compression 
See https://docs.python.org/3/library/compression.zstd.html for
information about this library.

As far as I can tell, the `zstd` library is not vulnerable to things
like ZipSlip, but it _could_ be vulnerable to a decompression bomb
attack, so I extended those models accordingly.
 2025-12-09 22:52:16 +00:00
Tom Hvitved
fe18e0e414 Merge pull request #20997 from paldepind/rust/fix-expected 
Rust: Accept changes to expected files
 2025-12-09 14:25:36 +01:00
Tom Hvitved
a5f513f178 Merge pull request #20954 from hvitved/rust/stats-more-calls 
Rust: Include more calls in DB quality metrics
 2025-12-09 14:14:07 +01:00
Simon Friis Vindum
53ad3282c3 Rust: Accept changes to expected files 2025-12-09 14:01:31 +01:00
Owen Mansel-Chan
cf19586516 Merge pull request #20993 from github/dependabot/go_modules/go/extractor/extractor-dependencies-955632e86c 
Bump the extractor-dependencies group in /go/extractor with 2 updates
 2025-12-09 09:36:16 +00:00
Anders Schack-Mulligen
139dc0acaf Merge pull request #20922 from aschackmull/csharp/object-initializer 
C#: Replace initializer splitting with an ObjectInitMethod.
 2025-12-09 10:35:02 +01:00
yoff
5c6d83ed65 Merge pull request #20877 from joefarebrother/python-tornado-websocket 
Python: Add models for websocket handlers for Tornado
 2025-12-09 10:08:59 +01:00
Michael Nebel
8ecae77887 Merge pull request #20991 from github/dependabot/nuget/csharp/ql/integration-tests/posix/standalone_dependencies_no_framework/nuget-335537b6a2 
Bump the nuget group with 1 update
 2025-12-09 10:01:15 +01:00
Tom Hvitved
e054741061 Update expected test output 2025-12-09 09:13:26 +01:00
Tom Hvitved
31b184a404 Rust: Exclude deref expressions on raw pointers from call resolution stats 2025-12-09 08:54:51 +01:00
dependabot[bot]
9eb1eb8f0d Bump the extractor-dependencies group in /go/extractor with 2 updates 
Bumps the extractor-dependencies group in /go/extractor with 2 updates: [golang.org/x/mod](https://github.com/golang/mod) and [golang.org/x/tools](https://github.com/golang/tools).


Updates `golang.org/x/mod` from 0.30.0 to 0.31.0
- [Commits](https://github.com/golang/mod/compare/v0.30.0...v0.31.0)

Updates `golang.org/x/tools` from 0.39.0 to 0.40.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.39.0...v0.40.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-version: 0.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.40.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: extractor-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-09 03:07:27 +00:00
Owen Mansel-Chan
e7147244e8 Merge pull request #20992 from myvyang/main 
Change MethodAccess to MethodCall in query example.
 2025-12-09 01:22:55 +00:00
Owen Mansel-Chan
d15342db1f Fix table padding 2025-12-09 01:12:53 +00:00
i
134312173f MethodAccess has been deprecated, Change MethodAccess to MethodCall in query example. 2025-12-09 08:41:01 +08:00
dependabot[bot]
c8992fc834 Bump the nuget group with 1 update 
Bumps Newtonsoft.Json from 6.0.4 to 13.0.1

---
updated-dependencies:
- dependency-name: Newtonsoft.Json
  dependency-version: 13.0.1
  dependency-type: direct:production
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-09 00:33:13 +00:00
Chris Smowton
359a28e409 Merge pull request #20984 from github/rc/3.20 
Java: Add change note for Maven compiler flags
 2025-12-08 14:24:58 +00:00
Tom Hvitved
0280771c51 Merge pull request #20953 from hvitved/rust/data-flow-call-models 
Rust: Model more data flow constructs as calls using MaD
 2025-12-08 15:22:02 +01:00
Tom Hvitved
57ce2ee749 Address review comments 2025-12-08 13:27:36 +01:00
Chris Smowton
ef991e5ba5 Merge pull request #20983 from smowton/smowton/feature/csharp-csrf-aspnetcore 
C# CSRF query: add support for ASP.NET Core
 2025-12-08 12:14:48 +00:00
Idriss Riouak
877669d1f0 Merge pull request #20981 from github/idrissrio/java/java-maven-sap 
Java: Add change note for Maven compiler flags
 2025-12-08 12:55:50 +01:00
Chris Smowton
79718b6dcb Change note 2025-12-08 11:54:02 +00:00
Chris Smowton
5bb31afc83 C# CSRF query: add support for ASP.NET Core 2025-12-08 11:51:01 +00:00
idrissrio
a0e7afde8e Java: Add change note for Maven compiler flags 2025-12-08 12:14:03 +01:00
Simon Friis Vindum
cd6429a39e Merge pull request #20969 from paldepind/rust/dispath-default-trait 
Rust: Do not dispatch to all implementations when trait target is accurate
 2025-12-08 10:45:55 +01:00
Tom Hvitved
bfa37b8488 Fix typo 2025-12-08 10:17:47 +01:00
Geoffrey White
24852c6664 Merge pull request #20966 from geoffw0/lifetimetest 
Rust: Fix FPs from rust/access-after-lifetime-ended
 2025-12-08 09:03:51 +00:00
Michael Nebel
10c01832b0 Merge pull request #20964 from michaelnebel/csharp/nugetversionsorting 
C#: Fix NuGet version bug and a .NET10 compatibility issue.
 2025-12-08 09:35:53 +01:00
Óscar San José
3230df02d9 Merge pull request #20975 from github/oscarsj/merge-back-rc-3.20 
Merge back rc/3.20
 2025-12-05 21:16:18 +01:00
Óscar San José
bc6133de5c Merge branch 'main' of https://github.com/github/codeql into oscarsj/merge-back-rc-3.20 2025-12-05 19:31:47 +01:00
Tom Hvitved
9a95acadb5 Merge pull request #20963 from hvitved/rust/call-refactor-follow-up 
Rust: Remove some predicates
 2025-12-05 14:38:47 +01:00
Paolo Tranquilli
2acb02bf67 Merge pull request #20971 from github/redsun82/ripunzip 
Ripunzip: update to 2.0.4
 2025-12-05 14:32:55 +01:00
Taus
1b519384d7 Merge pull request #20739 from github/tausbn/python-remove-top-level-points-to-imports 
Python: Hide points-to imports in `python.qll`
 2025-12-05 14:24:41 +01:00
Geoffrey White
108db75124 Update rust/ql/lib/codeql/rust/security/AccessAfterLifetimeExtensions.qll 
Co-authored-by: Simon Friis Vindum <paldepind@github.com>
 2025-12-05 13:19:38 +00:00
Simon Friis Vindum
f200dba7dd Rust: Add change note 2025-12-05 14:12:58 +01:00
Simon Friis Vindum
fa4b212020 Rust: Fix grammar 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-12-05 14:03:29 +01:00
Paolo Tranquilli
90aeccab07 Ripunzip: update to 2.0.4 2025-12-05 13:55:33 +01:00
Chris Smowton
86962c6055 Merge pull request #20970 from github/smowton/admin/document-missing-actions-permissions-shortcomings 
Actions: note imprecision of MissingActionsPermissions.ql
 2025-12-05 12:43:49 +00:00
Chris Smowton
02caa098bc Actions: note imprecision of MissingActionsPermissions.ql 
Added a note to the query's qhelp to note its imprecision, but also encourage usage of a permissions block regardless as a belt-and-braces measure.
 2025-12-05 12:36:07 +00:00
Simon Friis Vindum
5888ed30bd Rust: Do not dispatch to all implementations when trait target is accurate 2025-12-05 13:01:22 +01:00
Óscar San José
5addb53e0f Merge pull request #20946 from github/post-release-prep/codeql-cli-2.23.7 
Post-release preparation for codeql-cli-2.23.7
 2025-12-05 12:51:51 +01:00
Tom Hvitved
12a6dcc4ff Rust: Remove some predicates 2025-12-05 12:50:36 +01:00
Anders Schack-Mulligen
28e9420476 C#: Fix lambda flow. 2025-12-05 10:58:01 +01:00
Paolo Tranquilli
795bfdf02d Merge pull request #20962 from github/redsun82/dependabot 
Dependabot: add bazel
 2025-12-05 10:51:29 +01:00
Simon Friis Vindum
59ce721f7d Rust: Add global data flow example 2025-12-05 09:38:22 +01:00
Tom Hvitved
5a5679bd51 Rust: Taint flow through operations using MaD 2025-12-05 09:19:03 +01:00
Tom Hvitved
41916640c3 Rust: Taint flow tests for operations 2025-12-05 09:19:02 +01:00
Tom Hvitved
294c489fd8 Rust: Handle x[y] expressions as *.index(y) calls in data flow 2025-12-05 09:18:59 +01:00