14969 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Rasmus Lerchedahl Petersen	fae915bbb5	Python: QL doc	2020-08-25 21:02:17 +02:00
Rasmus Lerchedahl Petersen	551ae42fb9	Merge branch 'main' of github.com:github/codeql into SharedDataflow_NestedComprehensions	2020-08-25 15:45:20 +02:00
Rasmus Lerchedahl Petersen	d67f57a0bb	Python: Remove dead code	2020-08-25 15:39:37 +02:00
Taus	000fa33d54	Merge pull request #4013 from yoff/SharedDataflow_SequenceFlow ... Python: Shared dataflow: Content flow	2020-08-25 15:38:14 +02:00
Rasmus Lerchedahl Petersen	56b78a664e	Python: Store step for generators	2020-08-25 15:36:26 +02:00
Rasmus Lerchedahl Petersen	ecf3928ed1	Python: Handle comprehensions with multiple fors	2020-08-25 15:21:08 +02:00
CodeQL CI	92c97b1778	Merge pull request #4124 from RasmusWL/python-taint-tracking-string-methods ... Approved by yoff	2020-08-25 14:14:47 +01:00
Rasmus Wriedt Larsen	2dbf83b579	Python: TaintTracking: Move tests of py3 string methods	2020-08-25 13:06:27 +02:00
Rasmus Wriedt Larsen	cf121cc4d0	Python: TaintTracking: stringMethods => stringManipualtion	2020-08-25 13:05:27 +02:00
Rasmus Lerchedahl Petersen	1cdb6be531	Merge branch 'main' of github.com:github/codeql into SharedDataflow_NestedComprehensions	2020-08-25 13:05:13 +02:00
Rasmus Wriedt Larsen	238e0845aa	Python: Minor refactoring	2020-08-25 12:50:41 +02:00
Rasmus Wriedt Larsen	0439b83c60	Python: Taint when using unicode	2020-08-25 12:50:32 +02:00
Rasmus Wriedt Larsen	2a29e26687	Python: Fix grammar ... Co-authored-by: yoff <lerchedahl@gmail.com>	2020-08-25 12:41:53 +02:00
Tamás Vajk	74db25d80c	C#: Enable nullability on Semmle.Extraction.CIL.Driver (#4114)	2020-08-25 11:44:08 +02:00
CodeQL CI	722b1a24f6	Merge pull request #4087 from erik-krogh/thisJsx ... Approved by asgerf	2020-08-25 10:20:32 +01:00
CodeQL CI	844abc51e8	Merge pull request #4108 from erik-krogh/packType ... Approved by asgerf	2020-08-25 10:17:28 +01:00
Rasmus Wriedt Larsen	483bd0e863	Python: Fix shared taint tracking tests ... Since there was a .ql file, qltest tried to run a test in test/experimental/dataflow/taintracking/ which failed since there was no code.	2020-08-25 11:15:11 +02:00
Tamás Vajk	dc62cd166c	C#: Enable nullability checks in Semmle.Extraction.Tests (#4112)	2020-08-25 08:40:30 +02:00
Erik Krogh Kristensen	b0d4e79653	split out trap tests to avoid "package.json" naming conflict in trap test	2020-08-24 21:36:34 +02:00
Rasmus Lerchedahl Petersen	2608509fa7	Merge branch 'main' of github.com:github/codeql into SharedDataflow_SequenceFlow	2020-08-24 17:16:33 +02:00
Rasmus Lerchedahl Petersen	e91581e9fa	Python: Experiments with nested comprhensions	2020-08-24 17:15:31 +02:00
CodeQL CI	e2c6a01c00	Merge pull request #4097 from erik-krogh/createRequire ... Approved by esbena	2020-08-24 15:57:10 +01:00
Rasmus Wriedt Larsen	d96ef73033	Python: Handle taint for f-strings ... Which we seem to not handle in the current taint tracking :O f-strings needs to be Python 3 only, so enabled that test setup. I really liked the idea for having the version specific tests right next to the normal tests, so you don't have to look in test/experimental/3/dataflow/i/will/forget/to/look/here.	2020-08-24 16:46:00 +02:00
Rasmus Wriedt Larsen	cb4b4e91ab	Python: Taint for string multiplication	2020-08-24 14:54:06 +02:00
Rasmus Wriedt Larsen	b688fe68d6	Python: Add options file to shared dataflow tests ... Since there isn't one in top-level of experimental, making a single import made tests go really slow :|	2020-08-24 14:54:05 +02:00
Rasmus Wriedt Larsen	5125c7a55c	Python: Add taint tests for encode/decode functions	2020-08-24 14:54:04 +02:00
Rasmus Wriedt Larsen	31b398937a	Python: Handle taint from bytes(obj)	2020-08-24 14:17:59 +02:00
Rasmus Wriedt Larsen	1e447c5ca2	Python: Handle taint for % formatting	2020-08-24 14:15:27 +02:00
Rasmus Wriedt Larsen	80745e8881	Python: Model string methods in shared taint tracking library	2020-08-24 13:58:42 +02:00
Rasmus Wriedt Larsen	a77f118b62	Python: Shared taint tracking: Handle string concat + subcript	2020-08-24 13:58:41 +02:00
Rasmus Wriedt Larsen	61f89ca3c3	Python: Add tests for shared taint tracking for strings ... I adopted the TestTaint testing setup that I made for the "old" taint tracking tests. This time around we should figure out if we can use .qlref or similar so it doesn't end up in multiple copies that are not kept up to date :| The `repr` predicate could probably be placed somewhere better. For now I just wanted something that could help me. I considered just expanding the `repr` predicate in `ql/src/semmle/python/strings.qll`, but since it's currently used by queries, I didn't want to do anything about it. Anyway, the output it gives is much more useful than seeing this ;) ``` | test.py:20 | ok | str_operations | test.py:20:9:20:10 | ts | | test.py:21 | fail | str_operations | test.py:21:9:21:18 | BinaryExpr | | test.py:22 | fail | str_operations | test.py:22:9:22:18 | BinaryExpr | | test.py:23 | fail | str_operations | test.py:23:9:23:21 | Subscript | | test.py:24 | fail | str_operations | test.py:24:9:24:13 | Subscript | | test.py:25 | fail | str_operations | test.py:25:9:25:18 | Subscript | | test.py:26 | fail | str_operations | test.py:26:9:26:13 | Subscript | | test.py:27 | fail | str_operations | test.py:27:9:27:15 | str() | | test.py:35 | fail | str_methods | test.py:35:9:35:23 | Attribute() | | test.py:36 | fail | str_methods | test.py:36:9:36:21 | Attribute() | | test.py:37 | fail | str_methods | test.py:37:9:37:22 | Attribute() | | test.py:38 | fail | str_methods | test.py:38:9:38:23 | Attribute() | | test.py:40 | fail | str_methods | test.py:40:9:40:19 | Attribute() | | test.py:41 | fail | str_methods | test.py:41:9:41:23 | Attribute() | | test.py:42 | fail | str_methods | test.py:42:9:42:36 | Attribute() | | test.py:44 | fail | str_methods | test.py:44:9:44:25 | Attribute() | | test.py:45 | fail | str_methods | test.py:45:9:45:45 | Attribute() | | test.py:47 | fail | str_methods | test.py:47:9:47:21 | Attribute() | | test.py:48 | fail | str_methods | test.py:48:9:48:19 | Attribute() | | test.py:49 | fail | str_methods | test.py:49:9:49:18 | Attribute() | | test.py:51 | fail | str_methods | test.py:51:9:51:32 | Attribute() | | test.py:52 | fail | str_methods | test.py:52:9:52:34 | Attribute() | | test.py:54 | fail | str_methods | test.py:54:9:54:21 | Attribute() | | test.py:55 | fail | str_methods | test.py:55:9:55:19 | Attribute() | | test.py:56 | fail | str_methods | test.py:56:9:56:18 | Attribute() | | test.py:57 | fail | str_methods | test.py:57:9:57:21 | Attribute() | | test.py:58 | fail | str_methods | test.py:58:9:58:18 | Attribute() | | test.py:59 | fail | str_methods | test.py:59:9:59:18 | Attribute() | | test.py:60 | fail | str_methods | test.py:60:9:60:21 | Attribute() | | test.py:62 | fail | str_methods | test.py:62:9:62:26 | Attribute() | | test.py:63 | fail | str_methods | test.py:63:9:63:42 | Attribute() | | test.py:65 | fail | str_methods | test.py:65:9:65:26 | Attribute() | | test.py:66 | fail | str_methods | test.py:66:9:66:42 | Attribute() | | test.py:69 | fail | str_methods | test.py:69:9:69:25 | Attribute() | | test.py:70 | fail | str_methods | test.py:70:9:70:26 | Attribute() | | test.py:71 | fail | str_methods | test.py:71:9:71:22 | Attribute() | | test.py:72 | fail | str_methods | test.py:72:9:72:21 | Attribute() | | test.py:73 | fail | str_methods | test.py:73:9:73:23 | Attribute() | | test.py:78 | ok | str_methods | test.py:78:9:78:39 | Attribute() | ```	2020-08-24 13:58:39 +02:00
Erik Krogh Kristensen	309346841a	Merge branch 'main' into packType	2020-08-24 12:44:24 +02:00
Erik Krogh Kristensen	5acfd92e0f	bump the extractor version	2020-08-24 12:42:19 +02:00
Erik Krogh Kristensen	d633410e3c	make the extractor not crash on invalid "package.json" files	2020-08-24 12:42:08 +02:00
CodeQL CI	765c40ef03	Merge pull request #4019 from erik-krogh/asyncCalls ... Approved by asgerf	2020-08-24 11:18:42 +01:00
Taus	b8d6f76749	Merge pull request #4056 from yoff/SharedDataflow_ParameterTests ... Python: Shared dataflow, parameter routing tests	2020-08-24 11:36:30 +02:00
Erik Krogh Kristensen	65a1769d43	Merge branch 'main' into asyncCalls	2020-08-21 14:58:27 +02:00
Erik Krogh Kristensen	1b655f9046	use threadsafe cache stored in ExtractorState	2020-08-21 14:45:24 +02:00
Erik Krogh Kristensen	7aca84cd45	search directly for "package.json" instead of iterating through the files in a folder	2020-08-21 14:31:49 +02:00
Erik Krogh Kristensen	3f0f2c796c	pass extension instead of locationManager to isAlways*Module	2020-08-21 14:27:47 +02:00
Erik Krogh Kristensen	bbbb0a2c5e	specialize module.createRequire support to ES2015 modules	2020-08-21 14:14:05 +02:00
Calum Grant	a93a84fb2e	Merge pull request #4065 from hvitved/csharp/dataflow-type-restriction ... C#: Restrict `DataFlowType` to types belonging to `Node`s	2020-08-21 11:57:29 +01:00
yoff	d05954e5cc	Merge pull request #4109 from RasmusWL/python-basic-taint-tracking ... Python: Basic taint tracking with shared library	2020-08-21 12:20:22 +02:00
Rasmus Lerchedahl Petersen	e1343c7f1e	Python: Support set literals.	2020-08-21 11:15:04 +02:00
Rasmus Lerchedahl Petersen	ccff84d546	Python: Test flow into conprehension	2020-08-21 10:40:22 +02:00
Rasmus Lerchedahl Petersen	f9b1c5e4bd	Python: Fix bug pointed out by reviewer	2020-08-21 10:04:27 +02:00
yoff	bfd9c0860f	Apply suggestions from code review ... Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>	2020-08-21 09:43:29 +02:00
Tom Hvitved	86b91cec8a	Merge pull request #4111 from tamasvajk/feature/nullability-extraction ... C#: Fix nullability warning in Semmle.Extraction	2020-08-21 09:22:05 +02:00
Tom Hvitved	ea77828a6a	Merge pull request #4116 from hvitved/csharp/print-ast-order-top-level ... C#: Order top-level elements by location in `PrintAst.qll`	2020-08-21 09:09:20 +02:00
Tom Hvitved	b8cde180b9	C#: Order top-level elements by location in PrintAst.qll	2020-08-21 06:17:37 +02:00