hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-26 04:43:00 +01:00
Code Issues Packages Projects Releases Wiki Activity
41,418 Commits 1,688 Branches 158 Tags
codeql-cli/v2.10.2
Commit Graph

41418 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
thiggy1342
486a394a7f Update ruby/ql/src/experimental/weak-params/WeakParams.ql 
Co-authored-by: Harry Maclean <hmac@github.com>
 2022-07-21 17:26:09 -04:00
thiggy1342
8fabc06d37 fix test assertion 2022-07-21 21:25:44 +00:00
thiggy1342
cc958dc171 Update ruby/ql/src/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql 
Co-authored-by: Harry Maclean <hmac@github.com>
 2022-07-21 17:19:33 -04:00
Arthur Baars
1399610bd4 Merge branch 'main' into encoding 2022-07-21 21:21:17 +02:00
Nick Rolfe
5f96c92fac QL: sync Ruby extractor changes 2022-07-21 17:38:33 +01:00
Nick Rolfe
ed0325f162 Merge pull request #9878 from github/nickrolfe/extractor-cleanup 
Ruby: some extractor refactoring
 2022-07-21 17:18:24 +01:00
Arthur Baars
7be106d7bb Ruby: handle magic coding: comments 2022-07-21 16:33:18 +02:00
Arthur Baars
27be3dff54 Merge pull request #9868 from aibaars/update-tree-sitter-ruby-3 
Ruby: update tree-sitter-ruby
 2022-07-21 16:08:32 +02:00
Nick Rolfe
8dae85e1b1 Ruby: avoid repeated construction of table name strings 2022-07-21 12:21:06 +01:00
Nick Rolfe
0a8ecd3cf7 Ruby: compute path string only once 2022-07-21 10:44:30 +01:00
Nick Rolfe
388c9ffb74 Ruby: separate trap-writer into its own module 2022-07-21 10:44:00 +01:00
Jeroen Ketema
ad8335d6f3 C++: Fix join-order problem in cpp/return-stack-allocated-memory 
Before on Abseil:
```
Evaluated relational algebra for predicate #select#cpe#12356#fffff@3ffb21o1 with tuple counts:
         1235939  ~0%    {2} r1 = SCAN functions OUTPUT In.0, In.0
         1235939  ~0%    {2} r2 = JOIN r1 WITH functions ON FIRST 1 OUTPUT Lhs.1, Lhs.0
        33500841  ~0%    {2} r3 = JOIN r2 WITH DataFlowUtil::Node::getEnclosingCallable#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1
          280683  ~3%    {3} r4 = JOIN r3 WITH MustFlow::MkLocalPathNode#0227f5a1#fff ON FIRST 1 OUTPUT Rhs.2, Lhs.1, Lhs.0
           40970  ~2%    {4} r5 = JOIN r4 WITH MustFlow::MustFlowConfiguration::hasFlowPath#dispred#f0820431#fff#cpe#23_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.0
           40970  ~0%    {5} r6 = JOIN r5 WITH MustFlow::MkLocalPathNode#0227f5a1#fff_20#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3, Lhs.0
           40970  ~1%    {5} r7 = JOIN r6 WITH DataFlowUtil::Cached::TInstructionNode#47741e1f#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3, Lhs.4
           40970  ~1%    {5} r8 = JOIN r7 WITH project#Instruction::VariableAddressInstruction#class#577b6a83#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Lhs.4
           40970  ~0%    {6} r9 = JOIN r8 WITH SSAConstruction::Cached::getInstructionAst#2b11997e#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Lhs.4, Rhs.1
           40970  ~2%    {7} r10 = JOIN r9 WITH SSAConstruction::Cached::getInstructionAst#2b11997e#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Lhs.4, Lhs.5, Rhs.1
               0  ~0%    {6} r11 = JOIN r10 WITH Instruction::Instruction::getEnclosingFunction#dispred#f0820431#3#ff ON FIRST 2 OUTPUT Rhs.1, Lhs.2, Lhs.3, Lhs.4, Lhs.5, Lhs.6
               0  ~0%    {5} r12 = JOIN r11 WITH functions ON FIRST 1 OUTPUT Lhs.5, Lhs.1, Lhs.2, Lhs.3, Lhs.4
               0  ~0%    {5} r13 = JOIN r12 WITH Element::ElementBase::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.3, Lhs.2, Lhs.4, Rhs.1
                         return r13
```

After:
```
Evaluated relational algebra for predicate #select#cpe#12356#fffff@1dbc97kv with tuple counts:
        40970  ~0%    {2} r1 = SCAN MustFlow::MustFlowConfiguration::hasFlowPath#dispred#f0820431#fff#cpe#23 OUTPUT In.1, In.0
        40970  ~0%    {3} r2 = JOIN r1 WITH MustFlow::MkLocalPathNode#0227f5a1#fff_20#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Rhs.1
        40970  ~7%    {4} r3 = JOIN r2 WITH MustFlow::MkLocalPathNode#0227f5a1#fff_20#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.0, Lhs.1, Lhs.2
        40970  ~2%    {4} r4 = JOIN r3 WITH DataFlowUtil::Cached::TInstructionNode#47741e1f#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3
        40970  ~2%    {4} r5 = JOIN r4 WITH project#Instruction::VariableAddressInstruction#class#577b6a83#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3
        40970  ~0%    {5} r6 = JOIN r5 WITH SSAConstruction::Cached::getInstructionAst#2b11997e#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Rhs.1
        40970  ~1%    {6} r7 = JOIN r6 WITH SSAConstruction::Cached::getInstructionAst#2b11997e#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Lhs.4, Rhs.1
        40970  ~0%    {6} r8 = JOIN r7 WITH Instruction::Instruction::getEnclosingFunction#dispred#f0820431#3#ff ON FIRST 1 OUTPUT Lhs.3, Rhs.1, Lhs.1, Lhs.2, Lhs.4, Lhs.5
            0  ~0%    {5} r9 = JOIN r8 WITH DataFlowUtil::Node::getEnclosingCallable#dispred#f0820431#fb ON FIRST 2 OUTPUT Lhs.5, Lhs.2, Lhs.3, Lhs.0, Lhs.4
            0  ~0%    {5} r10 = JOIN r9 WITH Element::ElementBase::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.3, Lhs.1, Lhs.2, Lhs.4, Rhs.1
                      return r10
```
 2022-07-21 11:27:02 +02:00
Jeroen Ketema
466eb4a845 Merge pull request #9870 from jketema/exec-tainted-join 
C++: Fix join-order problem in `cpp/command-line-injection`
 2022-07-21 11:22:02 +02:00
Cornelius Riemenschneider
a437fcbbcc Merge pull request #9705 from github/criemen/csharp-lua-tracing 
C#: Implement correct behavior for `dotnet build` tracing
 2022-07-21 11:01:33 +02:00
Chris Smowton
9593ceeda5 Kotlin: Special-case String.charAt naming 
In the Kotlin universe this is called `get` so that Kotlin programmers can use the `[]` operator on `String`s.
 2022-07-21 09:17:08 +01:00
Chris Smowton
1cbe26a54f Kotlin: fix for-loop iterators over primitive or wildcard types 
Array<*> can't be queried for an argument type, and IntArray doesn't have an argument at all; both were previously causing the extractor to fail to extract the whole file due to throwing an exception.
 2022-07-21 09:13:55 +01:00
Harry Maclean
4d0f6a0b96 Merge pull request #9788 from thiggy1342/add-activerecord-annotate 
RB: Add ActiveRecord::Relation#annotate to sqlFragmentArgument()
 2022-07-21 15:37:03 +12:00
thiggy1342
a10370f813 Merge branch 'main' into experimental-manually-check-request-verb 2022-07-20 16:33:36 -04:00
thiggy1342
b3f2159a7e Merge branch 'main' into experimental-strong-params 2022-07-20 16:33:32 -04:00
thiggy1342
17c80336f5 Merge branch 'main' into add-activerecord-annotate 2022-07-20 16:33:30 -04:00
Arthur Baars
8d80e0332e Ruby: update tree-sitter-ruby 2022-07-20 18:16:30 +02:00
Aditya Sharad
a1d9228a66 Merge pull request #9831 from adityasharad/docs/supported-frameworks-changelog-links 
Docs: Update supported languages page with links to CLI and pack information
 2022-07-20 07:36:37 -07:00
Jeroen Ketema
694d6395d5 C++: Fix join-order problem in cpp/command-line-injection 
Before on Abseil Linux:
```
Evaluated relational algebra for predicate ExecTainted::ExecState#class#91000ffb#fff@41084cm7 with tuple counts:
        40879811  ~0%    {2} r1 = SCAN DataFlowUtil::Node::getLocation#dispred#f0820431#ff OUTPUT In.1, In.0
        40879811  ~0%    {2} r2 = JOIN r1 WITH Location::Location::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, Rhs.1
            7527  ~3%    {3} r3 = JOIN r2 WITH ExecTainted::interestingConcatenation#91000ffb#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
            7527  ~0%    {4} r4 = JOIN r3 WITH DataFlowUtil::Node::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Lhs.0, Rhs.1
            7527  ~0%    {5} r5 = JOIN r4 WITH DataFlowUtil::Node::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Lhs.0, Lhs.3, Rhs.1
            7527  ~0%    {6} r6 = JOIN r5 WITH DataFlowUtil::Node::getLocation#dispred#f0820431#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.0, Lhs.3, Lhs.4
            7527  ~0%    {3} r7 = JOIN r6 WITH Location::Location::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT ((((((("ExecState (" ++ Rhs.1) ++ " | ") ++ Lhs.4) ++ ", ") ++ Lhs.1) ++ " | ") ++ Lhs.5 ++ ")"), Lhs.3, Lhs.2
                         return r7
```

After:
```
Evaluated relational algebra for predicate ExecTainted::ExecState#class#91000ffb#fff@1ffe61ps with tuple counts:
        7527  ~0%    {3} r1 = JOIN ExecTainted::interestingConcatenation#91000ffb#ff WITH DataFlowUtil::Node::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Rhs.1
        7527  ~0%    {4} r2 = JOIN r1 WITH DataFlowUtil::Node::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Rhs.1
        7527  ~1%    {5} r3 = JOIN r2 WITH DataFlowUtil::Node::getLocation#dispred#f0820431#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0, Lhs.2, Lhs.3
        7527  ~0%    {5} r4 = JOIN r3 WITH Location::Location::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3, Lhs.4, Rhs.1
        7527  ~4%    {6} r5 = JOIN r4 WITH DataFlowUtil::Node::getLocation#dispred#f0820431#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.0, Lhs.1, Lhs.2, Lhs.3, Lhs.4
        7527  ~0%    {3} r6 = JOIN r5 WITH Location::Location::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT ((((((("ExecState (" ++ Rhs.1) ++ " | ") ++ Lhs.3) ++ ", ") ++ Lhs.5) ++ " | ") ++ Lhs.4 ++ ")"), Lhs.1, Lhs.2
                     return r6
```
 2022-07-20 16:27:47 +02:00
thiggy1342
8c55a15fa6 Merge branch 'main' into experimental-manually-check-request-verb 2022-07-20 10:27:40 -04:00
thiggy1342
6f74a2609c Merge branch 'main' into experimental-strong-params 2022-07-20 10:26:49 -04:00
thiggy1342
f54fc1a88d Merge branch 'main' into add-activerecord-annotate 2022-07-20 10:26:44 -04:00
Jeroen Ketema
c2b7300709 Merge pull request #9848 from geoffw0/stringlengthconflation5 
Swift: More improvements for the string length conflation query
 2022-07-20 14:05:05 +02:00
Cornelius Riemenschneider
e9e5d948b3 C#: Implement proper dotnet build handling in the Lua tracing config. 
For proper C# tracing, `dotnet build` needs the parameter
/p:UseSharedCompilation=false. However, we can't pass that to the other
subcommands of `dotnet`, therefore we need to figure out which subcommand
of `dotnet` is being invoked.
 2022-07-20 10:11:36 +00:00
Cornelius Riemenschneider
ca819573f5 Merge pull request #9862 from github/adityasharad/codeql-cli-2.10.1-mergeback 
Merge codeql-cli-2.10.1 into main
 2022-07-20 10:42:34 +02:00
Paolo Tranquilli
3527897eff Swift: make type optional in TypeRepr 
A type representation may not have a type in unresolved things, which
for example pop up in inactive `#if` clauses.
 2022-07-20 09:13:34 +02:00
Aditya Sharad
7620a6f653 Docs: Update supported languages page with links to CLI and pack information 
Include links to the CLI changelog, CLI releases, bundle releases,
pack changelogs, and pack source.

Clarify that this support information applies to the current version of
the CLI, bundle, query packs, and library packs.
 2022-07-19 14:58:27 -07:00
Asger F
aa53841466 Merge pull request #9828 from github/post-release-prep/codeql-cli-2.10.1 
Post-release preparation for codeql-cli-2.10.1
 2022-07-19 19:49:50 +02:00
Henti Smith
018a76bb17 Merge pull request #9857 from github/henti/new_actions_predicates 
Added Workflow.getName and Step.GetId
 2022-07-19 16:12:54 +01:00
Henti Smith
dcc76ddf36 Apply suggestions from code review 
Co-authored-by: Henry Mercer <henrymercer@github.com>
 2022-07-19 15:53:12 +01:00
Henti Smith
0828474192 Added Workflow::getName and Step::GetId 2022-07-19 15:34:10 +01:00
thiggy1342
43a9b8960e Merge branch 'main' into experimental-manually-check-request-verb 2022-07-19 10:29:48 -04:00
thiggy1342
cf23d338f3 Merge branch 'main' into experimental-strong-params 2022-07-19 10:29:36 -04:00
thiggy1342
6bc2fe513d Merge branch 'main' into add-activerecord-annotate 2022-07-19 10:29:24 -04:00
Asger F
b9bdee6651 Merge branch 'main' into post-release-prep/codeql-cli-2.10.1 2022-07-19 16:24:35 +02:00
Cornelius Riemenschneider
03bf9eb166 Merge pull request #9837 from github/aeisenberg/definitions.ql 
Move definitions.ql back to src
 2022-07-19 14:43:10 +02:00
Taus
bfe90413e2 Merge pull request #9847 from alexet/alexet/fix-predicate-binding 
Python: Fix binding incorrect predicate.
 2022-07-19 13:59:13 +02:00
Arthur Baars
dcbd82907f Merge pull request #9845 from aibaars/skip-dotgit 
Ruby: skip .git folder
 2022-07-19 11:58:43 +02:00
Harry Maclean
ec1d1eb547 Ruby: Add change note 2022-07-19 14:33:51 +12:00
thiggy1342
962155fd61 fix changenotes 2022-07-19 00:33:04 +00:00
thiggy1342
9586259706 style tweak for checking multiple method names 2022-07-19 00:29:30 +00:00
thiggy1342
304203ad2f fix path problem output 2022-07-19 00:25:50 +00:00
Harry Maclean
7b8603c89b Ruby: Model Arel.sql 2022-07-19 11:27:15 +12:00
alexet
f9b6ca76e5 Python: Fix binding incorrect predicate. 2022-07-18 16:28:19 +01:00
thiggy1342
fc00e56058 Merge branch 'main' into experimental-manually-check-request-verb 2022-07-18 10:58:13 -04:00
Arthur Baars
c9e5206396 Ruby: skip .git folder 2022-07-18 15:26:38 +02:00