hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity
43,392 Commits 1,673 Branches 157 Tags
faf33efeb832e382ef7cba4ca76f1d10e08292df
Commit Graph

43392 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Nebel
faf33efeb8 C#: Improve join ordering further for InterpretedCallable. 2022-09-22 19:10:14 +02:00
Michael Nebel
32816fa68f C#: Improve join in the InterpretedCallable characteristic predicate. 2022-09-15 10:54:27 +02:00
Anders Schack-Mulligen
d713910714 Merge pull request #10334 from aschackmull/java/uniontypeflow 
Java: Implement union type flow and replace ad-hoc variable tracking in dispatch
 2022-09-14 13:34:28 +02:00
Erik Krogh Kristensen
2ece9773be Merge pull request #10410 from erik-krogh/nonAsciiRange 
JS: don't report every non-ascii range in js/overly-large-range
 2022-09-14 11:51:22 +02:00
Paolo Tranquilli
d7cdeb8ac0 Merge pull request #10412 from github/revert-10399-redsun82/swift-macos-arm 
Revert "Swift: print a helpful message on macOS ARM"
 2022-09-14 11:08:24 +02:00
Anders Schack-Mulligen
64e2f4164d Java: Add test for disjunctive type in call context. 2022-09-14 10:38:10 +02:00
Paolo Tranquilli
dad0e4decc Revert "Swift: print a helpful message on macOS ARM" 2022-09-14 10:34:46 +02:00
Anders Schack-Mulligen
9f200633ca Java: convert test to inline expectation 2022-09-14 10:17:31 +02:00
Anders Schack-Mulligen
83e7bf71d7 Java: Adjust qldoc. 2022-09-14 10:16:09 +02:00
Mathias Vorreiter Pedersen
6074f22d3f Merge pull request #10335 from github/redsun82/swift-weak-hashing-phase-1 
Swift: first version of query targeting weak hashing
 2022-09-14 08:29:47 +01:00
Paolo Tranquilli
c3320a3afe Apply suggestions from code review 
Co-authored-by: hubwriter <hubwriter@github.com>
 2022-09-14 08:21:58 +02:00
erik-krogh
252394666c sync files 2022-09-13 20:44:05 +02:00
erik-krogh
e7aef17d30 don't report every non-ascii range in js/overly-large-range 2022-09-13 20:43:52 +02:00
Tom Hvitved
74eb6b2b98 Merge pull request #10400 from hvitved/ruby/singleton-class-object-scope 
Ruby: Adjust the scope of singleton class targets
 2022-09-13 20:01:21 +02:00
Ian Lynagh
f807b801ce Merge pull request #10401 from igfoo/igfoo/throw 
Kotlin: Remove a throw statement
 2022-09-13 17:41:31 +01:00
Tony Torralba
4708052741 Merge pull request #10408 from giper45/patch-1 
Updated vulnerable XSS.java version
 2022-09-13 17:50:47 +02:00
Henry Mercer
af25cf8be2 Merge pull request #10409 from github/codeql-ci/js/ml-powered-pack-release-0.3.3 
JS: Bump version numbers of ML-powered packs after 0.3.3 release
 2022-09-13 16:23:37 +01:00
Tamás Vajk
84bd8f179b Merge pull request #10403 from tamasvajk/kotlin-rework-cast 
Kotlin: Code quality improvements: refactor a cast
 2022-09-13 17:09:13 +02:00
Rasmus Wriedt Larsen
2e95e25afb Merge pull request #10406 from RasmusWL/ruby-instanceof 
Ruby: Rewrite a few `::Range` uses to `instanceof`
 2022-09-13 16:57:13 +02:00
Tony Torralba
ac46a38b9d Update java/ql/src/Security/CWE/CWE-079/XSS.java 2022-09-13 16:49:20 +02:00
Tony Torralba
2b027709e4 Update XSS qhelp 2022-09-13 16:39:48 +02:00
AlexDenisov
aacc368228 Merge pull request #10399 from github/redsun82/swift-macos-arm 
Swift: print a helpful message on macOS ARM
 2022-09-13 16:24:38 +02:00
Henry Mercer
bc2de7ed4b Merge branch 'main' into codeql-ci/js/ml-powered-pack-release-0.3.3 2022-09-13 15:15:56 +01:00
github-actions[bot]
b40def71b9 JS: Bump version of ML-powered library and query packs to 0.3.4 2022-09-13 14:11:16 +00:00
github-actions[bot]
e08e22ac32 JS: Bump patch version of ML-powered library and query packs 2022-09-13 14:06:57 +00:00
gx1
1c4488e7c8 Updated vulnerable XSS.java version 2022-09-13 15:58:25 +02:00
Tamas Vajk
2c757c714d Kotlin: Code quality improvements: refactor a cast 2022-09-13 15:44:54 +02:00
Rasmus Wriedt Larsen
511030df48 Ruby: Rewrite a few ::Range uses to instanceof 2022-09-13 15:44:29 +02:00
Ian Lynagh
2f8151d8d2 Kotlin: Remove a throw statement 
We have a way to carry on here, so we may as well do so
 2022-09-13 13:51:00 +01:00
Erik Krogh Kristensen
46751e515c Merge pull request #10388 from erik-krogh/exportNew 
JS: recognize returning an instance of a class as exporting that class
 2022-09-13 13:45:16 +02:00
Anders Schack-Mulligen
b8a1818422 Java: Fix test expectation. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
0e376b32d2 Java: extend typeflow tests to cover union types. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
d0f7052de2 Java: Support instanceof disjunction in union type flow. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
686e03e1cc Java: Fix perf issue. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
c8b93e0910 Java: Replace uses of deprecated variableTrack. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
a8eedce8ab Java: Replace ad-hoc variable tracking with union type flow in dispatch. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
6f06267892 Java: Implement union type flow. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
7692a9e2e7 Java: Minor TypeFlow tweaks. 2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
85d4742a01 Java: Add dispatch test showing lack of union types. 2022-09-13 13:30:40 +02:00
Tom Hvitved
4247843a27 Ruby: Adjust the scope of singleton class targets 
In

```rb
class << x
  ...
end
```

the scope of `x` is not the singleton class itself, but rather the outer scope.
 2022-09-13 11:39:38 +02:00
Tom Hvitved
87db5fc6b1 Ruby: Add tests for getEnclosing{Method,Module} 2022-09-13 11:39:15 +02:00
Erik Krogh Kristensen
2739b9cfd8 Merge pull request #10390 from erik-krogh/unmentionedGuard 
QL: add unmentioned guard class query
 2022-09-13 11:04:13 +02:00
Paolo Tranquilli
9227203336 Swift: print a helpful message on macOS ARM 
Also remove the tentative way compilation was expected to be fixed on
macOS ARM without really working.

In the future we will create universal binaries (which requires
compiling our prebuilt package for ARM as well), but until then we must
require the developer to pass `--cpu=darwin_x86_64` to the build
command when building on an ARM macOS platform like the M1. This will be
printed out explicitly now if it's not the case.
 2022-09-13 11:00:47 +02:00
Erik Krogh Kristensen
86417cec34 Merge pull request #10381 from erik-krogh/protoList 
JS: recognize a list of bad strings as a sanitizer for `js/prototype-polluting-assignment`
 2022-09-13 11:00:29 +02:00
Mathias Vorreiter Pedersen
7f6b400b78 Merge pull request #10366 from MathiasVP/use-use-flow-in-experimental 
C++: Use-use flow in `experimental`
 2022-09-13 09:30:48 +01:00
Erik Krogh Kristensen
dd5da79e46 recognize setters and getters of a class as exported 
Co-authored-by: Asger F <asgerf@github.com>
 2022-09-13 10:04:02 +02:00
erik-krogh
dd5db2e6d7 add to isSanitizerGuard 2022-09-13 07:27:51 +02:00
erik-krogh
3eb7675292 rename to DenyListInclusionGuard 2022-09-13 07:27:31 +02:00
erik-krogh
a567c132c1 fix all ql/unmentioned-guard 2022-09-12 22:42:46 +02:00
erik-krogh
9446cad32e add ql/unmentioned-guard class 2022-09-12 22:39:20 +02:00