hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-06 11:10:23 +01:00
Code Issues Packages Projects Releases Wiki Activity
58,670 Commits 1,675 Branches 157 Tags
ef63ea8399c910489eac17bf2ac0e5dc743ff2c7
Commit Graph

58670 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Harry Maclean
ef63ea8399 Ruby: Update fixture 2023-09-14 08:54:48 +01:00
Harry Maclean
7ebd51163e Ruby: Handle more splat arg flow 
Allow flow from a splat argument to a positional parameter in cases
where there are positional arguments left of the splat. For example:

    def foo(x, y, z); end

    foo(1, *[2, 3])
 2023-09-14 08:54:48 +01:00
Erik Krogh Kristensen
111227e763 Merge pull request #14211 from erik-krogh/usingOutOfBounds 
JS: fix out of bounds string access in isUsingDecl
 2023-09-13 22:23:15 +02:00
erik-krogh
fdd349c1a3 fix out of bounds string access in isUsingDecl 2023-09-13 20:11:21 +02:00
Geoffrey White
e109892388 Merge pull request #14189 from geoffw0/protocol2 
Swift: Consistent additional taint steps between the cleartext-* queries
 2023-09-13 18:44:20 +01:00
Chuan-kai Lin
00c83f185a Merge pull request #14182 from cklin/deprecate-assume-small-delta 
Document assume_small_delta deprecation
 2023-09-13 07:54:33 -07:00
Mathias Vorreiter Pedersen
18fa6f5d64 Merge pull request #14202 from alexet/translated-element-location 
CPP: Add a location to TranslatedElement to help with debugging IR creation
 2023-09-13 15:19:24 +01:00
Alex Ford
79c305c1a1 Merge pull request #14124 from alexrford/rb/dataflow-query-refactor 
Ruby: Use the new dataflow API for checked in queries
 2023-09-13 14:24:47 +01:00
Tom Hvitved
bb7ba7872f Merge pull request #14203 from hvitved/ruby/semantic-merge-fix 
Ruby: Fix semantic merge conflict
 2023-09-13 14:53:18 +02:00
Max Schaefer
e722e3288f Merge pull request #13771 from github/max-schaefer/server-side-url-redirect-help 
JavaScript: Improve query help for `js/server-side-unvalidated-url-redirection`.
 2023-09-13 13:20:48 +01:00
yoff
62b41799d2 Merge pull request #14178 from yoff/python/broaden-sql-injection-frameworks 
Python: import all frameworks in SQL-injection query
 2023-09-13 14:14:09 +02:00
Mathias Vorreiter Pedersen
177fcacf38 Merge pull request #14134 from MathiasVP/add-surprising-lifetimes-to-experimental 
C++: Copy the Coding Standards' use-after-lifetime-ended query to Experimental
 2023-09-13 13:06:18 +01:00
Tom Hvitved
f3a78efe03 Ruby: Fix semantic merge conflict 2023-09-13 14:04:20 +02:00
yoff
7d931492d8 Update python/ql/lib/semmle/python/security/dataflow/SqlInjectionCustomizations.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2023-09-13 13:37:18 +02:00
Alex Ford
b5ec99cb2f Ruby: fix missing qldoc 2023-09-13 12:28:19 +01:00
Mathias Vorreiter Pedersen
a0018c92e1 Merge pull request #14193 from MathiasVP/fully-converted-expressions-for-flow-after-free 
C++: Use fully converted expressions for `cpp/use-after-free` and `cpp/double-free`
 2023-09-13 12:24:23 +01:00
Alex Eyers-Taylor
0c10fa0c87 CPP: Add a location to TranslatedElement to help with debugging IR creation 2023-09-13 12:21:30 +01:00
Ian Lynagh
bd1d6e1d1e Merge pull request #14188 from igfoo/igfoo/kotlin-1.9.20 
Kotlin: Support 1.9.20
 2023-09-13 12:19:46 +01:00
Erik Krogh Kristensen
cd5973764b Merge pull request #14112 from erik-krogh/pyAllowedHosts 
Py: add sanitizer guard for `url_has_allowed_host_and_scheme`
 2023-09-13 12:59:38 +02:00
Mathias Vorreiter Pedersen
af51a0a9ca C++: Respond to review comments. 2023-09-13 11:43:12 +01:00
Mathias Vorreiter Pedersen
81d20be1ee Update cpp/ql/src/experimental/Security/CWE/CWE-416/UseAfterExpiredLifetime.qhelp 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2023-09-13 11:37:32 +01:00
Rasmus Wriedt Larsen
7292730391 Python: Add change-note 2023-09-13 11:55:48 +02:00
Rasmus Wriedt Larsen
f62c4108ef Python: Move url_has_allowed_host_and_scheme to Django.qll 2023-09-13 11:55:44 +02:00
Tom Hvitved
7400b4741e Merge pull request #14108 from hvitved/dataflow/more-consistency-checks 
Data flow: Add `ArgumentNode` consistency checks
 2023-09-13 11:30:51 +02:00
Tom Hvitved
bb85f87d7b Merge pull request #11725 from hvitved/ruby/capture-field-flow 
Ruby: Reimplement flow through captured variables using field flow
 2023-09-13 10:52:36 +02:00
Geoffrey White
3bf0d66d6c Merge pull request #13906 from geoffw0/commandinject2 
Swift: Add tests and develop command injection query
 2023-09-13 08:59:06 +01:00
Stephan Brandauer
7a7dc9b68f Merge pull request #14184 from github/kaeluka/application-mode-new-candidates-fixes 
Java: Automodel, new candidates fix
 2023-09-13 09:27:10 +02:00
Tom Hvitved
88d2e2590f Ruby: Rename LambdaSelfParameterNode to LambdaSelfReferenceNode 2023-09-13 08:52:22 +02:00
Ian Lynagh
df9c601571 Kotlin: Pass memory limits to kotlinc in some tests 
We can run out of memory with the defaults
 2023-09-12 23:14:41 +01:00
Tom Hvitved
d3558f8579 Python: Update expected test output 2023-09-12 21:18:31 +02:00
Rasmus Wriedt Larsen
1de7460aba Python: Don't warn on multipleArgumentCall 2023-09-12 21:16:14 +02:00
Mathias Vorreiter Pedersen
05080924de C++: Don't use converted expressions in 'LeapYear.qll'. 2023-09-12 19:48:52 +01:00
Mathias Vorreiter Pedersen
b03054b1ed C++: Make sure some instruction also gives back the 'ParenthesisExpr's. 2023-09-12 19:46:42 +01:00
Mathias Vorreiter Pedersen
71fe6f5d4b C++: Use fully converted expressions in 'cpp/use-after-free' and 'cpp/double-free'. 2023-09-12 19:28:57 +01:00
Robert Marsh
ecf1d98ce5 Merge pull request #14165 from rdmarsh2/rdmarsh2/swift/keypath-write-flow 
Swift: flow through writeable keypaths
 2023-09-12 14:24:40 -04:00
Tom Hvitved
c9910f5464 C++: Update expected test output 2023-09-12 20:05:12 +02:00
Tom Hvitved
53302117a1 C#: Implement missingArgumentCallExclude and multipleArgumentCallExclude 2023-09-12 20:05:11 +02:00
Tom Hvitved
b470c36c82 Ruby: Implement multipleArgumentCallExclude 2023-09-12 20:05:11 +02:00
Tom Hvitved
c13a8e41ad Data flow: Add more consistency checks 2023-09-12 20:05:05 +02:00
Ian Lynagh
4908188060 Kotlin: Add 1.9.20 support 2023-09-12 18:28:33 +01:00
Ian Lynagh
4d1ceff7df Kotlin: Fix build 2023-09-12 18:28:33 +01:00
Ian Lynagh
2b9a425468 Kotlin: Support 1.9.20 2023-09-12 18:28:33 +01:00
Geoffrey White
0d7769f687 Merge pull request #13276 from geoffw0/sqlpathinject 
Swift: Add path injection sinks for sqlite3 and SQLite.swift
 2023-09-12 17:36:27 +01:00
Henning Makholm
596f7012ca Merge pull request #14191 from github/hmakholm/pr/monotonic-unique 
C++ tests: fix output of bug-stricken test
 2023-09-12 18:21:35 +02:00
Max Schaefer
a9e81672f0 Make suggestion to replace example.com more explicit. 2023-09-12 16:54:05 +01:00
Robert Marsh
c2868fe05a Swift: change note for keypath write dataflow 2023-09-12 15:53:50 +00:00
Robert Marsh
47ac54bb81 Swift: autoformat DataFlowPrivate 2023-09-12 15:52:53 +00:00
Robert Marsh
8f797c7189 Merge branch 'main' into rdmarsh2/swift/keypath-write-flow 2023-09-12 15:51:36 +00:00
Max Schaefer
7ddb7da65e Apply suggestions from code review 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
 2023-09-12 16:47:23 +01:00
Henning Makholm
bac175e881 C++ tests: fix output of bug-stricken test 
The expected output was incorrect and the result of an evaluator bug.
This change should go together with the internal PR that fixes this bug.
 2023-09-12 16:28:59 +02:00