hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-27 04:13:51 +01:00
Code Issues Packages Projects Releases Wiki Activity
85,907 Commits 1,694 Branches 161 Tags
codeql-cli/latest
Commit Graph

85907 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jonas Jensen
655f940085 C++: Accept changes in CWE-{119,120} tests 
These new results seem better than the previous ones, but the previous
ones are still there. Perhaps the `Buffer.qll` library could use some
adjustment, but this seems like an improvement in isolation.
 2019-09-17 13:16:36 +02:00
Jonas Jensen
fd6d06fe6f C++: Data flow through address-of operator (&) 
The data flow library conflates pointers and their objects in some
places but not others. For example, a member function call `x.f()` will
cause flow from `x` of type `T` to `this` of type `T*` inside `f`. It
might be ideal to avoid that conflation, but that's not realistic
without using the IR.

We've had good experience in the taint tracking library with conflating
pointers and objects, and it improves results for field flow, so perhaps
it's time to try it out for all data flow.
 2019-09-17 13:16:34 +02:00
Asger F
f8eff06aa1 JS: Change note 2019-09-17 11:20:39 +01:00
Luke Cartey
92b94c1a39 C#: Include runtime target in TTransitiveCaptureCall 
TTransitiveCaptureCall represents a control flow node that may
transitively call many different callables which capture a variable from
the current scope. Captured variables are represented as synthetic
parameters to the callable, at negative indices. However, each of the
different targets may capture a different subset of variables from the
enclosing scope, so we must include the target along side the CFN in
order to prevent incorrect capture flow.
 2019-09-17 03:05:29 -07:00
Tom Hvitved
396a72db5f Merge pull request #1898 from AndreiDiaconu1/ircsharp-collections 
C# IR: Object creation refactor and collection initializers
 2019-09-17 10:48:07 +02:00
Felicity Chapman
8a27af2016 Update remaining links to blog 2019-09-17 09:30:15 +01:00
Dave Bartolomeo
21f6ab787d C++: Rename predicates in FunctionInputsAndOutputs.qll and add QLDoc 2019-09-16 12:06:06 -07:00
Tom Hvitved
1f927516d8 Merge pull request #1936 from calumgrant/cs/nameof-qualified-namespace 
C# extractor: Handle nameof(A.B) where A.B is a qualified namespace
 2019-09-16 19:28:48 +02:00
Geoffrey White
3df31e6ccf CPP: Tiny qldoc fixes. 2019-09-16 16:52:48 +01:00
Calum Grant
4e6216379d Merge pull request #1935 from AndreiDiaconu1/ircsharp-forinitfix 
C# IR: Fix for init
 2019-09-16 16:24:30 +01:00
AndreiDiaconu1
43accd37e1 Address PR comments 2019-09-16 15:42:45 +01:00
Max Schaefer
df739e0fca JavaScript: Fix performance regression in IncorrectSuffixCheck. 2019-09-16 15:25:17 +01:00
Calum Grant
8eeded5982 C#: Handle nameof(A.B) where A.B is a nested namespace. 2019-09-16 15:12:10 +01:00
AndreiDiaconu1
fcb3d99351 C# IR: Fix for init 2019-09-16 11:57:37 +01:00
semmle-qlci
e6b748a8e7 Merge pull request #1875 from esben-semmle/js/blacklist-more-hardcoded-passwords 
Approved by xiemaisi
 2019-09-16 10:57:35 +01:00
Tom Hvitved
4f897b2628 C#: Address review comments 2019-09-16 10:45:37 +02:00
Esben Sparre Andreasen
a5645e168a JS: exclude keys from whitelist 2019-09-16 10:13:18 +02:00
Esben Sparre Andreasen
c9d31e90fe JS: add change notes 2019-09-16 10:11:43 +02:00
Esben Sparre Andreasen
0e2d2f8662 JS: whitelist some hardcoded dummy-passwords in two queries 2019-09-16 10:11:43 +02:00
Esben Sparre Andreasen
aa3f4a7048 JS: change passwords in tests 2019-09-16 10:09:59 +02:00
jf205
526c123016 Merge pull request #1931 from shati-patel/docs/ql-lexer 
Docs/QL lexer: Require whitespace character after annotation
 2019-09-14 07:00:31 +01:00
Dave Bartolomeo
553238a9e8 Merge pull request #1922 from jbj/qlcfg-const-pointer-to-member 
C++: Add PointerToFieldLiteral class
 2019-09-13 10:44:52 -07:00
Shati Patel
9187db585c QL lexer: Require whitespace character after annotation 2019-09-13 16:13:13 +01:00
shati-patel
fd4709d43a Merge pull request #1930 from jf205/js-links-122 
docs: update some links in a couple of javascript topics
 2019-09-13 15:58:23 +01:00
Asger F
a8e8ae868a JS: Update extractor version string 2019-09-13 15:48:31 +01:00
Asger F
173f32d2ba JS: Recognize 'require' calls in more cases 2019-09-13 15:48:31 +01:00
Asger F
3b7ecd5ccf JS: Add NumModules metric 2019-09-13 15:48:31 +01:00
Max Schaefer
fa4db5a841 JavaScript: Fix link to restify in library tutorial. 
(cherry picked from commit af24d125388ed89dcd364697d955026a1f46fd33)
 2019-09-13 15:28:21 +01:00
Max Schaefer
f1588b2622 JavaScript: Fix description of call graphs. 
(cherry picked from commit 2817cf060f6a506ee51a0296b3745e7406fc7cfc)
 2019-09-13 15:28:21 +01:00
james
ffa370a8ad docs: fix broken links in js topics 
(cherry picked from commit e8f867204d)
 2019-09-13 15:28:20 +01:00
semmle-qlci
82097f63ac Merge pull request #1903 from jf205/js-links 
Approved by asger-semmle
 2019-09-13 15:25:02 +01:00
Erik Krogh Kristensen
9dc9adda64 fix capitalization in test case 
Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
 2019-09-13 14:54:18 +01:00
Erik Krogh Kristensen
3fb64abb09 fix consistency and spelling in the documentation 
suggestions from the documentation team

Co-Authored-By: shati-patel <42641846+shati-patel@users.noreply.github.com>
 2019-09-13 14:52:11 +01:00
Jonas Jensen
7cfbe88e7b C++: IR DataFlow::Node.toString consistency 
The `toString` for IR data-flow nodes are now similar to AST data-flow
nodes. This should make it easier to use the IR as a drop-in replacement
in the future. There are still differences because the IR data flow
library takes conversions into account.

I did not attempt to align the new nodes we use for field flow. That can
come later, when we add field flow to IR data flow.
 2019-09-13 14:33:31 +02:00
Jonas Jensen
562bffe710 C++: Simplify toString of ImplicitParameterNode 
This string looked out of place compared to `ExplicitParameterNode`,
whose string is simply the name of the parameter and therefore
indistinguishable from an access to the parameter without looking at the
location also. This has not been a problem so far, and if we want to
distinguish more clearly between initial values and accesses at some
point, we should do it for `ExplicitParameterNode` and
`UninitializedNode` too.
 2019-09-13 14:33:26 +02:00
Erik Krogh Kristensen
c4f27ed4cc rename TaintedLength to LoopBoundInjection 2019-09-13 11:12:01 +01:00
Erik Krogh Kristensen
673e883c21 use superscript to denote the size of the tainted object 2019-09-13 11:00:11 +01:00
semmle-qlci
d0d3882121 Merge pull request #1919 from esben-semmle/js/fixup-1 
Approved by asger-semmle, xiemaisi
 2019-09-13 10:40:38 +01:00
semmle-qlci
1313821a25 Merge pull request #1904 from erik-semmle/passportModel 
Approved by asger-semmle, esben-semmle
 2019-09-13 10:38:14 +01:00
Erik Krogh Kristensen
5b2b60f132 change DOS to DoS, and other small documentation fixes 
Co-Authored-By: Max Schaefer <max@semmle.com>
 2019-09-13 10:26:01 +01:00
Tom Hvitved
f5cae9b6ea Merge pull request #1881 from aschackmull/java/pathgraph-nodes 
Java/C++/C#: Add nodes predicate to PathGraph.
 2019-09-13 10:32:47 +02:00
Dave Bartolomeo
e8cf3f876e Merge pull request #1660 from zlaski-semmle/zlaski/builtin-va-list 
Add a `__builtin_va_list` type, to complement `__builtin_va_*`
 2019-09-12 14:04:55 -07:00
Dave Bartolomeo
9072f6231f Merge pull request #1928 from jbj/autoformat-ssa 
C++: Autoformat IR SSA files
 2019-09-12 14:03:20 -07:00
zlaski-semmle
45640395a9 Merge pull request #1803 from geoffw0/qldoceg9 
CPP: Add syntax examples to QLDoc in Variable.qll
 2019-09-12 12:32:58 -07:00
Robert Marsh
7f6108259e Merge pull request #1927 from jbj/instructionNode 
C++: Add DataFlow::instructionNode
 2019-09-12 12:06:01 -07:00
Rebecca Valentine
f503e042fc Merge pull request #1877 from taus-semmle/python-modernise-non-iterator-query 
Python: Modernise the `py/non-iterable-in-for-loop` query.
 2019-09-12 11:14:40 -07:00
Calum Grant
b7db15646c Merge pull request #1858 from AndreiDiaconu1/ircsharp-continue 
C# IR: Add support for `ContinueStmt`
 2019-09-12 17:37:01 +01:00
Erik Krogh Kristensen
c2efb0afe7 two tiny qldoc changes 2019-09-12 16:58:07 +01:00
Erik Krogh Kristensen
119b1ffb80 changes based on review from max 2019-09-12 16:30:42 +01:00
Erik Krogh Kristensen
dc891dc420 added js/loop-bound-injection to javascript security suite 2019-09-12 15:50:50 +01:00