hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-12 13:11:20 +01:00
Code Issues Packages Projects Releases Wiki Activity
84,428 Commits 1,689 Branches 160 Tags
f52f5b63e67fce53c64fd9e3b25a588d197fbcb5
Commit Graph

2999 Commits

Author SHA1 Message Date
Asger F
e95b3590f0 JS: Fix project layout detection for Next.js apps 
Some parts of the code did not handle case where 'pages' was located at 'app/pages'.
 2025-11-25 15:54:45 +01:00
Asger F
613895e0c0 Merge pull request #20424 from asgerf/js/overlay-manual-v4 
JS: Add overlay annotations
 2025-11-20 11:10:46 +01:00
Asger F
efa438a352 JS: Move identityFunctionStep back into CachedSteps module 2025-11-19 13:47:30 +01:00
Asger F
8fef60464e JS: Remove out-commented code 2025-11-19 13:46:10 +01:00
Asger F
a0965f33e3 JS: Also discard JSON, YAML, and XML 2025-11-18 13:29:00 +01:00
github-actions[bot]
5ee45af3aa Post-release preparation for codeql-cli-2.23.6 2025-11-18 09:53:12 +00:00
github-actions[bot]
18fa6799ce Release preparation for version 2.23.6 2025-11-17 16:38:07 +00:00
Asger F
4b57b4418f JS: Factor out some code 2025-11-17 10:48:15 +01:00
Asger F
a405b7b3e0 JS: Add discard predicates for locations 2025-11-17 10:47:37 +01:00
Asger F
c7341f295d JS: Fix bad join in BarrierGuards.qll 2025-11-13 09:46:27 +01:00
Asger F
578355ac27 JS: Fix bad join in CallGraphs.qll 2025-11-13 09:46:25 +01:00
Asger F
46b1387846 JS: Make isAssignedInUniqueFile global, as it should be 2025-11-13 09:46:20 +01:00
Asger F
6498cd1b07 JS: Remove obsolete overlay[global] annotations 2025-11-13 09:46:18 +01:00
Asger F
0594f84dfc JS: Improve join orders related to getABooleanValue() 2025-11-13 09:46:16 +01:00
Asger F
4645f327a5 JS: Avoid more bad joins due to locality 2025-11-13 09:46:14 +01:00
Asger F
269489e817 JS: Avoid bad join in shared predicate induced by 'forex'. 
Use manual recursion instead.
 2025-11-13 09:46:12 +01:00
Asger F
5dd87e379b JS: Add overlay[local] to restore magic in unwrap() predicate 
In this case we actually want magic to apply, but was prevented by locality.
 2025-11-13 09:46:10 +01:00
Asger F
e72232fd1d JS: Add more overlay[caller?] annotations 2025-11-13 09:46:06 +01:00
Asger F
66febb263d JS: Add some overlay[caller] and a pragma[nomagic] annotations 2025-11-13 09:46:05 +01:00
Taus
889209719b JS: Overlay annotations for some failing tests 
Locally these seem to get rid of the compilation warnings, but of course
CI is the true arbiter here.
 2025-11-13 09:46:03 +01:00
Asger F
c09563f775 JS: Make more general-purpose data flow things local 2025-11-13 09:46:01 +01:00
Asger F
b1418e1d70 JS: Add overlay[local?] to new summaries after rebasing 2025-11-13 09:46:00 +01:00
Asger F
2b338fc1d9 JS: Fix getRawEnclosingStmt call 2025-11-13 09:45:58 +01:00
Asger F
23e42c89ee JS: Overlay annotations for AST layer 2025-11-13 09:45:56 +01:00
github-actions[bot]
4014df9a6e Post-release preparation for codeql-cli-2.23.4 2025-11-04 17:57:52 +00:00
github-actions[bot]
64fcdd1f2f Release preparation for version 2.23.4 2025-11-03 14:52:23 +00:00
Asger F
c583b480af JS: Add pragma[nomagic] just to be safe 
The DIL is unchanged
 2025-10-30 15:31:51 +01:00
Asger F
a5819a14be JS: Fix bad join order in getNextToken() 2025-10-30 15:31:51 +01:00
Asger F
39f74d808b JS: Add compileForOverlayEval 2025-10-30 15:31:51 +01:00
Nora Dimitrijević
a0975e7e19 Constrain location overrides to actual sources/sinks 2025-10-28 09:42:20 +01:00
Nora Dimitrijević
bcdbe0b50a JS/PolynomialReDoSQuery 
javascript/ql/src/Performance/PolynomialReDoS.ql
 2025-10-28 09:40:16 +01:00
Nora Dimitrijević
94343254e3 JS/ShellCommandInjectionFromEnvironmentQuery 
javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.ql
 2025-10-28 09:40:14 +01:00
Nora Dimitrijević
71cf042607 JS/IndirectCommandInjectionQuery 
javascript/ql/src/Security/CWE-078/IndirectCommandInjection.ql
 2025-10-28 09:40:11 +01:00
Nora Dimitrijević
2a30ea923a JS/CommandInjectionQuery 
javascript/ql/src/experimental/heuristics/ql/src/Security/CWE-078/CommandInjection.ql

javascript/ql/src/Security/CWE-078/CommandInjection.ql
 2025-10-28 09:40:09 +01:00
Asger F
8d49f26f3d Merge pull request #20397 from asgerf/js/build-artifact-leak-fp 
JS: Fix FP in js/build-artifact-leak when keys come from an array of constants
 2025-10-28 06:40:13 +01:00
Asger F
d7cf5ef645 Merge pull request #20647 from asgerf/js/type-resolution-cache 
JS: Avoid magic and improve a join in type resolution
 2025-10-20 11:50:23 +02:00
Asger F
c6577c8590 JS: Avoid magic and improve a join in type resolution 2025-10-15 11:54:28 +02:00
github-actions[bot]
6dd07790ac Post-release preparation for codeql-cli-2.23.3 2025-10-14 11:16:33 +00:00
github-actions[bot]
33542f7d40 Release preparation for version 2.23.3 2025-10-14 09:30:24 +00:00
Asger F
10c9b747a5 Merge pull request #20586 from asgerf/js/api-graphs-block-this 
JS: Restrict receiver-flow in API graphs
 2025-10-08 08:41:56 +02:00
Asger F
587ad5c600 JS: Refine criteria so that explicit this-passing is not affected 2025-10-06 11:43:18 +02:00
Asger F
4d33190241 JS: Restrict this-argument passing in API graphs 2025-10-06 11:42:36 +02:00
github-actions[bot]
a7a4e43991 Post-release preparation for codeql-cli-2.23.2 2025-09-29 15:10:19 +00:00
github-actions[bot]
d2130a589b Release preparation for version 2.23.2 2025-09-29 10:28:45 +00:00
Simon Friis Vindum
26aa938acc Merge pull request #20452 from paldepind/rust/mad-source-parameter 
Rust, shared: Support `Parameter` in source MaD models
 2025-09-24 09:37:25 +02:00
Asger F
2e8091f0fb Merge pull request #20419 from asgerf/js/express-json-send 
JS: Model Express json and jsonp methods
 2025-09-24 09:25:32 +02:00
Simon Friis Vindum
7d6e2060e5 Adapt all languages to changes in shared library 2025-09-22 14:18:58 +02:00
Napalys Klicius
3a6a537986 JS: Add change note 2025-09-19 14:47:58 +02:00
Napalys Klicius
6cfc950159 JS: Model GraphQLObjectType resolve params as sources 2025-09-19 14:39:36 +02:00
Napalys Klicius
4f8166a661 Merge pull request #20450 from Napalys/js/graph-ql-ench 
JS: Improve graphql flow
 2025-09-17 16:32:01 +02:00