hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 10:15:14 +02:00
Code Issues Packages Projects Releases Wiki Activity
12,351 Commits 1,741 Branches 165 Tags
dd0ca34038242393cd51d064f1364a69253971da
Commit Graph

12351 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mathias Vorreiter Pedersen
dd0ca34038 C++: Remove abstract keyword from a couple of AST classes 2020-05-07 12:01:07 +02:00
semmle-qlci
b2f1008a00 Merge pull request #3420 from max-schaefer/js/fix-missing-triple-backtick 
Approved by asgerf
 2020-05-06 13:52:18 +01:00
Asger F
5725814774 Merge pull request #3403 from asger-semmle/js/getcontainer 
JS: Move getContainer to single rootdef (+fixes)
 2020-05-06 12:06:44 +01:00
Max Schaefer
9335a6cb79 JavaScript: Fix missing triple backtick in qldoc comment. 2020-05-06 11:40:00 +01:00
Anders Schack-Mulligen
3b3ca6d41e Merge pull request #3214 from aibaars/base64 
Java: Add org.apache.commons.codec.(De|En)coder to TaintTrackingUtil
 2020-05-06 09:21:18 +02:00
Jonas Jensen
63f04afa8d Merge pull request #3312 from hvitved/dataflow/impl-no-postupdate 
Data flow: Support stores into nodes that are not `PostUpdateNode`s
 2020-05-06 09:09:31 +02:00
semmle-qlci
9210660ea0 Merge pull request #3401 from erik-krogh/jsonLike 
Approved by esbena
 2020-05-06 08:00:44 +01:00
Asger F
b2da4fe491 Update javascript/ql/src/semmle/javascript/internal/StmtContainers.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-05-06 07:59:04 +01:00
Asger Feldthaus
926e79d272 JS: Autoformat 2020-05-06 07:59:04 +01:00
Asger Feldthaus
f51e846439 JS: Fix ClosureModule implementation 2020-05-06 07:59:04 +01:00
Asger Feldthaus
0f870a4992 JS: Use TCapturedVariableNode as starting point of callInputStep 2020-05-06 07:59:04 +01:00
Asger Feldthaus
4d6da19173 JS: Improve performance of getExceptionTarget 2020-05-06 07:59:04 +01:00
Asger Feldthaus
639f04386c JS: Avoid bad join ordering in ClosureModule 2020-05-06 07:59:04 +01:00
Asger Feldthaus
e52e1b26c6 JS: Upgrade script 2020-05-06 07:59:04 +01:00
Asger Feldthaus
5f710bc881 JS: Move definition of getContainer() to a single rootdef 2020-05-06 07:59:04 +01:00
semmle-qlci
86c5b38d62 Merge pull request #3341 from hvitved/csharp/generics-nested-types 
Approved by calumgrant
 2020-05-06 07:16:37 +01:00
Robert Marsh
78d2ac1ff4 Merge pull request #3368 from Cornelius-Riemenschneider/local-ala 
C++: Add experimental Array Length Tracking library
 2020-05-05 13:05:52 -07:00
Felicity Chapman
0e0d0499bb Merge pull request #3413 from felicitymay/update-docs-reviews 
Update requirements for docs review
 2020-05-05 19:05:57 +01:00
Mathias Vorreiter Pedersen
114310700a Merge pull request #3414 from geoffw0/issue3356 
C++: Fix error in QLDoc.
 2020-05-05 18:07:49 +02:00
Anders Schack-Mulligen
11ffcc4378 Merge pull request #2912 from Mithrilwoodrat/master 
Add check for disabled HTTPOnly setting in Tomcat
 2020-05-05 14:39:32 +02:00
Geoffrey White
27490a35ae C++: Fix error in QLDoc. 2020-05-05 13:37:14 +01:00
Tom Hvitved
e8e27e0e00 C#: Address review comments 2020-05-05 14:28:13 +02:00
Tom Hvitved
3d37a49ccd C#: Add change note 2020-05-05 14:28:13 +02:00
Tom Hvitved
19c3e6a58d C#: Add DB upgrade script 2020-05-05 14:28:13 +02:00
Tom Hvitved
c324c388d0 C#: Refine UnboundGeneric and ConstructedGeneric 2020-05-05 14:28:13 +02:00
Tom Hvitved
8a01023dee C#: Add more generics tests 2020-05-05 14:28:13 +02:00
Tom Hvitved
4f7743058a C#: Restructure existing generics tests 2020-05-05 14:28:13 +02:00
Felicity Chapman
c0ebf12ab0 Update requirements for docs review 2020-05-05 13:25:19 +01:00
Tom Hvitved
e95cc24b3f Data flow: Support stores into nodes that are not PostUpdateNodes 2020-05-05 14:01:04 +02:00
Anders Schack-Mulligen
b7458091a9 Merge pull request #3110 from hvitved/dataflow/no-more-summaries 
Data flow: No more flow summaries
 2020-05-05 13:27:07 +02:00
Matthew Gretton-Dann
52d8acc1a1 Merge pull request #3404 from nickrolfe/field_attrs 
C++: add test for attributes on fields
 2020-05-05 12:12:28 +01:00
Cornelius Riemenschneider
264763080e Autoformat, address review. 2020-05-05 08:52:52 +02:00
Erik Krogh Kristensen
eb7e0d6a62 still flag single-expression files that contain a function 2020-05-04 18:37:26 +02:00
Nick Rolfe
ae913fbf56 C++: update expected output to include field attribute 2020-05-04 16:17:59 +01:00
Calum Grant
a01ef83312 Merge pull request #3270 from hvitved/csharp/dataflow/library-field-flow 
C#: Field-sensitive summaries for library code
 2020-05-04 16:11:18 +01:00
Mathias Vorreiter Pedersen
a98135093f Merge pull request #3400 from jbj/fieldFlow-join-order 
C++: Fix fieldFlow join order
 2020-05-04 17:07:55 +02:00
Nick Rolfe
124ea86d65 C++: add test for attributes on fields 2020-05-04 15:12:49 +01:00
Tom Hvitved
c7763e69e5 C#: Add comments to LibraryCodeNode::get{Predecessor|Successor}() 2020-05-04 13:46:52 +02:00
Jonas Jensen
50b0d426ee C++: Fix fieldFlow join order 
The `fieldFlow` predicate contained a fragile join that has become
ordered wrong recently, either as result of an unrelated change in the
data-flow library or as part of the stats change for the last dbscheme
change.

The minimal fix is to use `getEnclosingCallable` instead of
`getFunction` since the former uses `unique` to ensure good join
ordering in its callers. A longer-term fix should be applied to the AST
base libraries, but this will be invasive and require independent
testing.

Tuple counts on Wireshark before (cancelled after a few minutes):

    (747s) Starting to evaluate predicate DataFlowUtil::localFlowStep#ff/2@bdba82
    (848s) Tuple counts for DataFlowUtil::localFlowStep#ff:
    1766640980 ~1%        {2} r1 = JOIN DataFlowUtil::Node::getFunction_dispred#ff_10#join_rhs AS L WITH DataFlowUtil::Node::getFunction_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT L.<1>, R.<1>
    1327       ~0%        {2} r2 = JOIN r1 WITH project#DataFlowImplLocal::Configuration::hasFlow#fbb AS R ON FIRST 2 OUTPUT r1.<0>, r1.<1>
    9691232    ~0%        {2} r3 = DataFlowUtil::simpleLocalFlowStep#ff@staged_ext \/ r2
                          return r3

After:

    (0s) Starting to evaluate predicate DataFlowUtil::localFlowStep#ff/2@a852a0
    (0s) Tuple counts for DataFlowUtil::localFlowStep#ff:
    49017    ~4%     {3} r1 = JOIN project#DataFlowImplLocal::Configuration::hasFlow#fff AS L WITH DataFlowUtil::Node::getEnclosingCallable_dispred#ff AS R ON FIRST 1 OUTPUT L.<1>, R.<1>, R.<0>
    42359    ~0%     {2} r2 = JOIN r1 WITH DataFlowUtil::Node::getEnclosingCallable_dispred#ff AS R ON FIRST 2 OUTPUT r1.<2>, r1.<0>
    9732264  ~0%     {2} r3 = DataFlowUtil::simpleLocalFlowStep#ff@staged_ext \/ r2
                     return r3
 2020-05-04 12:14:07 +02:00
Mithrilwoodrat
a7960c3385 Update java/ql/src/experimental/Security/CWE/CWE-1004/InsecureTomcatConfig.qhelp 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2020-05-04 17:48:41 +08:00
Jonas Jensen
2b0ad2df6f Merge pull request #3185 from github/geoffw0-patch-1 
Add details about query tagging to supported-queries.md
 2020-05-04 11:41:35 +02:00
semmle-qlci
a805a63443 Merge pull request #3357 from erik-krogh/YetAnotherPerformancePatch 
Approved by asgerf, esbena
 2020-05-04 10:05:34 +01:00
semmle-qlci
a0800cecc4 Merge pull request #3386 from erik-krogh/lessJQueryChaining 
Approved by asgerf
 2020-05-04 09:16:17 +01:00
Erik Krogh Kristensen
ffdbe31a30 change-note 2020-05-04 09:08:46 +02:00
Erik Krogh Kristensen
cee986fa76 skip expressions that are alone in a file for js/useless-expression 2020-05-04 09:08:41 +02:00
Tom Hvitved
32b419229d C#: Address review comments 2020-05-04 09:01:49 +02:00
mithrilwoodrat
1053aa4c44 add query to found Tomcat config disables 'HttpOnly' flag 2020-05-04 12:26:03 +08:00
Dave Bartolomeo
8e9e3c8919 Merge pull request #3395 from jbj/IRBlock-unique 
C++: Use `unique` aggregate in IRBlock computation
 2020-05-03 07:54:51 -04:00
Jonas Jensen
0a59045dc3 C++: Use unique aggregate in IRBlock computation 
This gives a slight speedup, and I think it makes the code shorter and
clearer.

On Wireshark, the time from the beginning of the `IRBlock` stage until
just before evaluation of `getInstruction` drops from 44s to 34s.
 2020-05-03 10:07:09 +02:00
Dave Bartolomeo
d8f32e3db5 Merge pull request #3392 from rdmarsh2/rdmarsh/cpp/qldoc-get-ConvertedResultExpression 
C++/C#: improve qldoc on IR get*ResultExpression
 2020-05-02 15:59:08 -04:00