hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-16 16:53:25 +01:00
Code Issues Packages Projects Releases Wiki Activity
12,008 Commits 1,671 Branches 157 Tags
d6f77c0f98fc89cbd04371601328a586ee858467
Commit Graph

12008 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jonas Jensen
d6f77c0f98 Merge pull request #3328 from MathiasVP/literal-comment 
C++: Remove unnecessary part of comment
 2020-04-23 11:10:16 +02:00
semmle-qlci
da3292606c Merge pull request #3191 from erik-krogh/XssDom 
Approved by esbena, mchammer01
 2020-04-23 09:17:07 +01:00
Jonas Jensen
f696594d35 Merge pull request #3295 from MathiasVP/field-flow-single-struct 
C++: Add PostUpdateNode for updates to structs with no chi instructions
 2020-04-23 10:02:10 +02:00
Jonas Jensen
cbed175931 Merge pull request #3273 from Semmle/rdmarsh/cpp/RemoteFlowSource-model 
C++: Add remote flow sources via models
 2020-04-23 09:54:40 +02:00
semmle-qlci
1312fcccae Merge pull request #3324 from erik-krogh/BoundSocketIO 
Approved by asgerf
 2020-04-23 08:42:45 +01:00
Mathias Vorreiter Pedersen
7b51d0c8a5 C++: Remove unnecessary part of comment 2020-04-23 08:35:44 +02:00
Robert Marsh
ac22e7950c C++: autoformat FlowSources.qll 2020-04-22 16:11:33 -07:00
Robert Marsh
471f536326 Merge pull request #3307 from dbartol/dbartol/BinaryConditional 
C++: IR translation for binary conditional operator
 2020-04-22 15:01:16 -07:00
Erik Krogh Kristensen
957e4073b0 use getABoundCallbackParameter in SocketIO 2020-04-22 21:56:34 +02:00
Erik Krogh Kristensen
40822e10b4 add SocketIO test case 2020-04-22 21:55:20 +02:00
Tom Hvitved
5a2dcc591c Merge pull request #3317 from Semmle/revert-2814-cs/unqualify-trap-ids 
Revert "C#: Improve db consistency by removing assembly id"
 2020-04-22 20:46:35 +02:00
Rebecca Valentine
d5c44d8513 Merge pull request #3315 from tausbn/python-finalise-1.24-change-notes 
Python: Finalise change notes for 1.24.
 2020-04-22 09:15:54 -07:00
Dave Bartolomeo
163ecd97de Merge pull request #3277 from geoffw0/rangeshift 
C++: Support for & and >> in SimpleRangeAnalysis
 2020-04-22 11:36:36 -04:00
Felicity Chapman
e29468135d Editorial suggestions 
We don't hyphenate "QL-library" and there were a few typos. Feel free to further revise this if I've changed the meaning too much.

As discussed separately, I was unable to raise this as a PR in GitHub.com and had to resort to a direct commit.
 2020-04-22 15:48:01 +01:00
Tom Hvitved
8c0c283811 Revert "C#: Improve db consistency by removing assembly id" 2020-04-22 16:32:13 +02:00
Taus
44b570f7b6 Apply suggestions from code review 
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
 2020-04-22 16:03:20 +02:00
Taus Brock-Nannestad
e97d88c158 Python: Finalise change notes for 1.24. 2020-04-22 14:31:04 +02:00
Erik Krogh Kristensen
ac26741816 reuse existing SanitizerGuard from UnsafeJQueryPlugin 2020-04-22 14:16:15 +02:00
Dave Bartolomeo
66381e89ef C++: Add comment from PR feedback 2020-04-22 08:11:43 -04:00
Erik Krogh Kristensen
0a29d132d0 reuse existing logic in DomBasedXss 2020-04-22 13:50:43 +02:00
Rasmus Wriedt Larsen
1ecfa2eb55 Merge pull request #3278 from tausbn/python-fix-warnings 
Python: Fix remaining deprecation warnings.
 2020-04-22 11:33:16 +02:00
Taus Brock-Nannestad
2fad5e8e32 Python: Remove deprecated TaintFlow and additionalFlowStepVar. 2020-04-22 10:34:00 +02:00
Erik Krogh Kristensen
a5bbfa30d1 add change note 2020-04-22 10:23:07 +02:00
Erik Krogh Kristensen
7bfea946fd update links in xss-through-dom qhelp 2020-04-22 10:23:03 +02:00
Erik Krogh Kristensen
8811455d49 Merge remote-tracking branch 'upstream/master' into XssDom 2020-04-22 10:20:40 +02:00
Calum Grant
1b88c97688 Merge pull request #3199 from hvitved/csharp/vsvars-unset-platform 
C#: Unset `Platform` env variable when invoking `vcvarsall.bat`
 2020-04-22 09:18:20 +01:00
Geoffrey White
2e392516c2 Apply suggestions from code review 
Co-Authored-By: Dave Bartolomeo <dbartol@github.com>
 2020-04-22 09:09:16 +01:00
Erik Krogh Kristensen
76503d3536 user controlled -> user-controlled 2020-04-22 10:08:01 +02:00
Erik Krogh Kristensen
947e9828da Update javascript/ql/src/Security/CWE-079/XssThroughDom.qhelp 
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
 2020-04-22 10:07:50 +02:00
Taus
5af351eacd Merge pull request #3275 from RasmusWL/python-fix-points-to-deprecations 
Python: Remove deprecated annotation for old PointsTo::points_to
 2020-04-21 18:18:07 +02:00
Dave Bartolomeo
4b44afef90 C++: Accept syntax-zoo test output 2020-04-21 09:42:24 -04:00
Dave Bartolomeo
fee557001e C++: Update SignAnalysis test results 2020-04-21 09:34:44 -04:00
Mathias Vorreiter Pedersen
a49d22e6e4 C++: Fix join ordering 2020-04-21 13:25:06 +02:00
semmle-qlci
2fb711e460 Merge pull request #3169 from erik-krogh/Maps 
Approved by asgerf, esbena
 2020-04-21 12:12:06 +01:00
Erik Krogh Kristensen
59b94b3d1b revert back to having 2 separate cases in JQuery::MethodCall 2020-04-21 13:08:06 +02:00
Rasmus Wriedt Larsen
32a97266cf Python: Fix deprecation warnings in test output 2020-04-21 11:39:44 +02:00
semmle-qlci
53abf83229 Merge pull request #3304 from asger-semmle/js/typescript-unary-type-expr 
Approved by erik-krogh
 2020-04-21 10:38:59 +01:00
semmle-qlci
2ecef33c9d Merge pull request #3299 from asger-semmle/js/flows-to-redundant-check 
Approved by esbena
 2020-04-21 10:00:34 +01:00
semmle-qlci
80c20cb66e Merge pull request #3297 from asger-semmle/js/isambient-refactor 
Approved by esbena
 2020-04-21 09:36:14 +01:00
semmle-qlci
d75d520f35 Merge pull request #3232 from RasmusWL/python-more-deprecated-annotations 
Approved by BekaValentine
 2020-04-21 09:30:27 +01:00
Tom Hvitved
29e690e159 Merge remote-tracking branch 'upstream/master' into csharp/vsvars-unset-platform 2020-04-21 09:00:26 +02:00
Tom Hvitved
7d86cce658 Merge pull request #2814 from calumgrant/cs/unqualify-trap-ids 
C#: Improve db consistency by removing assembly id
 2020-04-21 08:58:34 +02:00
Dave Bartolomeo
1428811f75 C++: IR translation for binary conditional operator 
IR generation was not handling the special two-operand flavor of the `?:` operator that GCC supports as an extension. The extractor doesn't quite give us enough information to do this correctly (see github/codeql-c-extractor-team#67), but we can get pretty close.

About half of the code could be shared between the two-operand and three-operand flavors. The main differences for the two-operand flavor are:
1. The "then" operand isn't a child of the `ConditionalExpr`. Instead, we just reuse the original value of the "condition" operand, skipping any implicit cast to `bool` (see comment for rationale).
2. For the three-operand flavor, we generate the condition as control flow rather than the computation of a `bool` value, to avoid creating unnecessarily complicated branching. For the two-operand version, we just compute the value, since we have to reuse that value in the "then" branch anyway.

I've added IR tests for these new cases. I've also updated the expectations for `SignAnalysis.ql` based on the fix. @rdmarsh2, can you please double-check that these diffs look correct? I believe they do, but you're the range/sign analysis expert.
 2020-04-21 02:05:21 -04:00
Robert Marsh
d0bb5ad4e2 C++: rename and add description to hasFlowSource 2020-04-20 13:25:31 -07:00
Robert Marsh
e6630a8fba Apply suggestions from code review 
Co-Authored-By: Jonas Jensen <jbj@github.com>
 2020-04-20 10:14:13 -07:00
Asger Feldthaus
883846dfb6 JS: Fix extraction of negative number literal types 2020-04-20 16:17:15 +01:00
Jonas Jensen
875daae84b Merge pull request #3151 from dbartol/dbartol/floats 
C++: Better support for complex numbers in IR and AST
 2020-04-20 16:27:20 +02:00
Calum Grant
41d8d32764 C#: Address review comment: Make dictionary type more specific. 2020-04-20 15:06:42 +01:00
Asger Feldthaus
ca60e8264e JS: Autoformat 2020-04-20 14:42:41 +01:00
Mathias Vorreiter Pedersen
8be1bfe8d0 C++: Add comments and accept expected dataflow sanity failures 2020-04-20 14:13:12 +02:00