hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-28 06:36:33 +01:00
Code Issues Packages Projects Releases Wiki Activity
19,798 Commits 1,673 Branches 157 Tags
e9bfbb677d87f7a638d40bcf32fc44a912436f34
Commit Graph

19798 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anders Schack-Mulligen
e9bfbb677d Java: Connect the external sources and steps to the defaults. 2021-02-10 17:06:21 +01:00
Anders Schack-Mulligen
5a391ab6c0 Java: Add qldoc. 2021-02-10 16:54:48 +01:00
Anders Schack-Mulligen
3a6fa9d99b Java: Add support for framework modelling through csv data. 2021-02-10 13:25:03 +01:00
yoff
9930d59aca Merge pull request #5124 from RasmusWL/typetracking-with-decorator 
Python: Add test for type-tracking through decorators
 2021-02-10 09:34:54 +01:00
Alexander Eyers-Taylor
1c43505d30 Merge pull request #5121 from alexet/fix-js-jdoc 
Javascript Extractor: Update <tt> tages to <code>
 2021-02-09 13:07:19 +00:00
CodeQL CI
475d216f8e Merge pull request #5087 from erik-krogh/immutable 
Approved by asgerf
 2021-02-09 12:43:19 +00:00
Rasmus Wriedt Larsen
1d25184b32 Python: Add test for type-tracking through decorators 
In general, if there is _some_ decorator on a function, it might not be safe to
track content out of it (since the decorator could do anything), but in this
case, we can see what the decorator does, so we should be able to handle it (but
we don't right now).

By my understanding of how type-tracking works, if we track content through
`my_decorator`, then we would also track content to the result of
`unrelated_func()`, which I wanted to make sure our tests would catch.

I found out the core of the problem seems to come from our lack of being able to
track to the inner scope, and added an explicit test for that.
 2021-02-09 13:43:10 +01:00
alexet
8dd5a7e7c7 Javascript Extractor: Update <tt> tages to <code> 2021-02-09 12:10:09 +00:00
Alexander Eyers-Taylor
bed10ad562 Merge pull request #5113 from github/alexet/fix-var-decls-spec 
Update the language specification to allow empty var_decls
 2021-02-09 11:08:23 +00:00
Alexander Eyers-Taylor
7583904046 Update the language specification to allow empty var_decls 
This is a degenerate form that is accepted in the compiler even if they don't make much sense. 

Fixes #5060
 2021-02-08 18:54:13 +00:00
CodeQL CI
8a2e063af7 Merge pull request #5107 from asgerf/js/json-in-script-tag 
Approved by erik-krogh
codeql-cli/v2.4.4 		2021-02-08 09:52:53 +00:00
Erik Krogh Kristensen
504db8739d fix typo in execa change-note file name 2021-02-08 10:00:26 +01:00
Erik Krogh Kristensen
8ca75e41d2 add change note 2021-02-08 09:59:45 +01:00
Jonas Jensen
7859c5234a Merge pull request #5085 from geoffw0/msprintf2 
C++: Fix FormattingFunction regression.
 2021-02-06 16:06:35 +01:00
yoff
f1a0ec2dec Merge pull request #4981 from RasmusWL/port-url-redirect-query 
Python: Port url redirect query
 2021-02-06 00:39:10 +01:00
yoff
ddd362bc16 Update python/ql/src/semmle/python/frameworks/Django.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com>
 2021-02-05 23:31:20 +01:00
Asger Feldthaus
0ceb8aa638 JS: Bump extractor version 2021-02-05 21:55:43 +00:00
Asger Feldthaus
236b7c5887 JS: Tolerate JSON in script tags 2021-02-05 21:54:50 +00:00
Alexander Eyers-Taylor
9af99f195e Merge pull request #5095 from alexet/imporve-js-perf 
Javascript: Improve performance of ExplicitInvokeNode::getArgument
 2021-02-05 18:49:03 +00:00
yoff
7fef1a8817 Merge pull request #5069 from tausbn/python-api-graphs 
Python: Add support for API graphs
 2021-02-05 13:17:09 +01:00
Taus Brock-Nannestad
78cb53449d Python: Slight cleanup of Cached::call 
Makes it more similar to the other functions in this module.
 2021-02-05 12:47:26 +01:00
Taus
6c8dfb253d Python: Use flowsTo instead of hasLocalSource 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-02-05 12:42:41 +01:00
Tamás Vajk
d7505e41db Merge pull request #5091 from tamasvajk/feature/cleanup-nullable 
C#: Fix nullable warnings and some code quality issues
 2021-02-05 12:07:42 +01:00
Jonas Jensen
6e5d56cbcb Merge pull request #5097 from geoffw0/qldoceg11 
C++: QLDoc Improvements
 2021-02-05 12:00:35 +01:00
Shati Patel
474ddc9bc8 Merge pull request #5090 from RasmusWL/docs-fix-direct-query-link 
Docs: Use /blob/ instead of /tree/ for direct query link
 2021-02-05 10:50:40 +00:00
Jonas Jensen
c945ece80d Merge pull request #5100 from MathiasVP/fix-changenote-unsigned-difference-expression-compared-zero 
C++: Add query author and link to original PR in change-note
 2021-02-05 11:21:48 +01:00
Geoffrey White
55b0dbd7b8 C++: Autoformat. 2021-02-05 10:02:31 +00:00
Taus
a66743192e Python: Fix typo in docs 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-02-05 10:58:47 +01:00
Mathias Vorreiter Pedersen
a416a089b4 Update cpp/change-notes/2020-02-04-unsigned-difference-expression-compared-zero.md 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2021-02-05 09:48:54 +01:00
Tamás Vajk
87ba9d55b6 Merge pull request #4687 from tamasvajk/feature/csharp9-records 
C#: Extract record declarations
 2021-02-05 08:56:24 +01:00
Robert Marsh
649bd03db6 Merge pull request #5101 from NateD-MSFT/patch-1 
Add KeGetCurrentProcessorNumberEx to CWE-457 whitelist
 2021-02-04 16:59:07 -08:00
NateD-MSFT
9470a99092 Add KeGetCurrentProcessorNumberEx to CQE-457 whitelist 
Windows driver developers may call KeGetCurrentProcessorNumberEx in their driver.  This function optionally may initialize a provided structure, but this initialization always occurs.  The return value is the current processor being run on.  As such, this query incorrectly marks calls to KeGetCurrentProcessorNumberEx that initialize a structure that is later used as risky, even though in reality the initialization always succeeds.

See https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-kegetcurrentprocessornumberex
 2021-02-04 13:32:09 -08:00
Tamas Vajk
83f0fad014 Fix expected test AST 2021-02-04 21:08:01 +01:00
Tamas Vajk
f555c0642e Add change note 2021-02-04 21:08:01 +01:00
Tamas Vajk
f0b0845f9f Add 'record' QL class 2021-02-04 21:08:01 +01:00
Tamas Vajk
9ffc38f5b1 Fix deterministic ordering of class members in PrintAst 2021-02-04 21:08:01 +01:00
Tamas Vajk
a6fd7a3203 C#: Extract record declarations 2021-02-04 21:08:01 +01:00
Mathias Vorreiter Pedersen
993abd4499 C++: Add query author and link to original PR in change-note. 2021-02-04 20:23:27 +01:00
Taus
f0d5a91d59 Merge pull request #5093 from RasmusWL/fix-query-names-with-dunder 
Python: Fix query names with dunder (__)
 2021-02-04 18:47:45 +01:00
Taus Brock-Nannestad
d035937083 Python: Add change note 2021-02-04 18:43:44 +01:00
Taus Brock-Nannestad
a505eb6922 Python: Adhere to QLDoc style guide 2021-02-04 18:34:06 +01:00
Taus Brock-Nannestad
3c7d9c3c4b Python: Fix typo 2021-02-04 18:33:50 +01:00
Geoffrey White
2160edc789 C++: Clean up bits I didn't finish. 2021-02-04 17:16:45 +00:00
Geoffrey White
1f928c2910 CPP: Examples Element.qll. 2021-02-04 17:08:29 +00:00
Geoffrey White
8ae01789b1 CPP: Examples Specifier.qll. 2021-02-04 17:08:29 +00:00
Geoffrey White
500097ca76 CPP: Examples Preprocessor.qll. 2021-02-04 17:08:29 +00:00
Geoffrey White
4b9532c6f7 CPP: Examples Namespace.qll. 2021-02-04 17:08:29 +00:00
Taus Brock-Nannestad
f6e1ea5b2a Python: Fix missing global variable source nodes 
In lieu of removing the offending flow (which would likely have
consequences for a lot of other tests), I opted to simply _include_
the relevant nodes directly.
 2021-02-04 18:07:13 +01:00
Taus Brock-Nannestad
2524f23a46 Python: Add more test cases 
There is now a bit of redundancy in the tests, but I thought it useful
to actually include some of the cases called out explicitly in the
documentation, so as to make it easy to see that the code actually
does what we expect (in these cases, anyway).
 2021-02-04 18:05:33 +01:00
Taus Brock-Nannestad
aa7e9f0b56 Python: Add big explanatory comment about prefixes. 2021-02-04 18:03:34 +01:00