Mathias Vorreiter Pedersen
d55db836cb
C++: Remove implied conjunct.
2021-05-10 16:13:54 +02:00
Mathias Vorreiter Pedersen
51d04cb5b3
C++: Correct test annotation.
2021-05-10 15:30:35 +02:00
Mathias Vorreiter Pedersen
c0b65314be
C++: Fix false positive by restricting _both_ the old (unconverted) expression _and_ all of the conversions.
2021-05-10 15:18:42 +02:00
Mathias Vorreiter Pedersen
c7cd75437f
C++: Add testcase demonstrating false positive from conversions.
2021-05-10 14:58:33 +02:00
Mathias Vorreiter Pedersen
474b337eeb
C++: Add change-note.
2021-05-10 10:22:44 +02:00
Mathias Vorreiter Pedersen
c91ed80e6c
C++: Fix false positive by computing range of the converted expression.
2021-05-10 10:12:43 +02:00
Mathias Vorreiter Pedersen
7ac7830973
C++: Add testcase with false positive involving a conversion on the large-expression side of the comparison.
2021-05-10 10:11:31 +02:00
Shati Patel
059a5f35fa
Merge pull request #5812 from mario-campos/patch-1
...
Add React Native to JavaScript frameworks docs
2021-05-05 16:03:41 +01:00
CodeQL CI
69cd9dfb7d
Merge pull request #5826 from erik-krogh/moreLib
...
Approved by esbena
2021-05-05 04:40:49 -07:00
Erik Krogh Kristensen
e333267e69
require that the factory function is in a main module file
2021-05-05 12:00:38 +02:00
Erik Krogh Kristensen
fc3f5adbbb
more source code examples in PackageExports.qll
2021-05-05 11:48:41 +02:00
Erik Krogh Kristensen
28eef264e5
recognize the define(..) call in PackageExports.qll
2021-05-05 11:23:25 +02:00
Jonas Jensen
390ee3a6b8
Merge pull request #5829 from MathiasVP/reorder-get-instruction-opcode
...
C++: Reorder getInstructionOpcode
2021-05-05 11:13:15 +02:00
Erik Krogh Kristensen
3ca670146e
remove outdated comment
2021-05-05 11:10:45 +02:00
Mathias Vorreiter Pedersen
066cdb55d7
C++: Add qldoc explaining column order.
2021-05-05 09:30:12 +02:00
Mathias Vorreiter Pedersen
f03c99ab03
Merge pull request #5835 from hmakholm/hmakholm/pr/blowup-fix
...
CPP: fix semi-unused variables in WrongInDetectingAndHandlingMemoryAllocationErrors.q
2021-05-05 08:15:37 +02:00
Henning Makholm
4964ce347b
CPP: fix semi-unused variables in WrongInDetectingAndHandlingMemoryAllocationErrors.ql
...
The fact that `aex` and `it` was each used in just one disjunct of the
exists() body caused the optimizer to generate perfectly horrible
code, including a pointless cartesian product between them that caused
the evaluation to blow up.
Fix it such that each variable is logically scoped. That makes the
compiler much happier.
2021-05-05 02:31:11 +02:00
CodeQL CI
95f26aadd3
Merge pull request #5681 from yoff/python-support-pathlib
...
Approved by tausbn
2021-05-04 09:20:24 -07:00
Robert Marsh
5ee74d269a
Merge pull request #5822 from MathiasVP/more-cwe-tags-in-code-scanning
...
C++: Add more CWE tags to queries in the Code Scanning suite
2021-05-04 09:01:00 -07:00
Mathias Vorreiter Pedersen
d5793418f9
C++: Remove parent CWE tags.
2021-05-04 14:39:23 +02:00
CodeQL CI
b160badbf6
Merge pull request #5768 from erik-krogh/cacheMore
...
Approved by esbena
2021-05-04 04:16:15 -07:00
Tamás Vajk
05c045070e
Merge pull request #5810 from tamasvajk/feature/culture
...
C#: Use invariant culture in the extractor
2021-05-04 13:09:38 +02:00
Mathias Vorreiter Pedersen
568724bffd
C#: Fix getInstructionOpcode to make sure IRConstruction.qll compiles for C#.
2021-05-04 13:00:40 +02:00
Mathias Vorreiter Pedersen
ded377bcd2
C++: Reorder getInstructionOpcode to produce better RA.
2021-05-04 12:13:34 +02:00
Tamas Vajk
c547907784
C#: Use invariant culture in the extractor
2021-05-04 11:17:33 +02:00
Anders Schack-Mulligen
5bcf810a7c
Merge pull request #5821 from JarLob/patch-1
...
Update UncaughtServletException.qhelp
2021-05-04 10:39:02 +02:00
Anders Schack-Mulligen
9ee9186a1a
Merge pull request #5825 from github/yo-h/java-diagnostic-queries
...
Java: split extractor diagnostics query into two
2021-05-04 10:12:32 +02:00
Erik Krogh Kristensen
aaf754ebf5
recognize more library input
2021-05-04 10:06:14 +02:00
CodeQL CI
6931d9a6f7
Merge pull request #5785 from edvraa/httponlyjs
...
Approved by esbena
2021-05-03 23:14:26 -07:00
yo-h
edf1a90161
Java: split extractor diagnostics query into two
2021-05-03 20:27:07 -04:00
edvraa
6fa2f1e653
update test message
2021-05-04 00:32:01 +03:00
Taus
483199878d
Merge pull request #5793 from RasmusWL/fix-qldoc
...
Python: Minor fix to Django RawSQL QLDoc
2021-05-03 18:18:02 +02:00
Mathias Vorreiter Pedersen
2912c2e7f5
C++: Add more CWE tags to queries in the code scanning suite.
2021-05-03 16:58:47 +02:00
Edwin
27c680e28b
Apply suggestions from code review
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2021-05-03 16:41:09 +03:00
Jaroslav Lobačevski
38bce39baa
Update UncaughtServletException.qhelp
...
There is no single word in https://cwe.mitre.org/data/definitions/600.html about possible DoS or unexpected state.
2021-05-03 15:06:57 +03:00
edvraa
cef845ac47
Support string expressions
2021-05-03 13:46:56 +03:00
edvraa
ea38f0d3bd
a new test for simple flow
2021-05-03 12:19:05 +03:00
edvraa
000826af11
typo
2021-05-03 12:18:43 +03:00
Tom Hvitved
bb1cb73675
Merge pull request #5795 from hvitved/csharp/implicit-constructor-inits
...
C#: Extract implicit constructor initializer calls
2021-05-03 10:21:04 +02:00
Tom Hvitved
b77b3da8d6
C#: Add change note
2021-05-03 09:40:13 +02:00
Jonas Jensen
c05ef1225c
Merge pull request #5803 from MathiasVP/no-magic-in-getUnspecifiedType
...
C++: Add nomagic to getUnspecifiedType
2021-05-03 09:03:58 +02:00
edvraa
65183cde80
Move to experimental
2021-05-03 09:59:52 +03:00
edvraa
bd99114cd6
Comments added
2021-05-03 09:55:04 +03:00
edvraa
a24c1c8114
fix comment
2021-05-03 00:36:38 +03:00
edvraa
fa94fedfc3
simple dataflow for sensitive name
2021-05-03 00:36:26 +03:00
edvraa
97bc7e38d2
check for sensitive property name
2021-05-03 00:31:29 +03:00
edvraa
7ab91bb185
Inline getOptionsArgument
2021-05-03 00:09:15 +03:00
Mario Campos
ae857db657
Add React Native to JavaScript frameworks
...
According to @asgerf, React Native is already supported 🎉
2021-04-30 10:47:08 -05:00
Chris Smowton
b2c0259197
Merge pull request #5631 from haby0/UseOfLessTrustedSource
...
[Java] CWE-348: Using a client-supplied IP address in a security check
2021-04-30 15:20:53 +01:00
haby0
fdcc517b9f
UseOfLessTrustedSource -> ClientSuppliedIpUsedInSecurityCheck"
2021-04-30 17:43:34 +08:00
