hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-06 18:21:07 +01:00
Code Issues Packages Projects Releases Wiki Activity
41,812 Commits 1,691 Branches 160 Tags
codeql-cli/v2.10.3
Commit Graph

41812 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tony Torralba
d0077b8c12 Added query ImplicitPendingIntents 2022-01-14 10:31:53 +01:00
Mathias Vorreiter Pedersen
68385dfab5 Merge pull request #7386 from github/redsun82/cpp-overrunning-write-precision-split 
C++: split `cpp/overrunning-write` into two
 2022-01-14 09:11:39 +00:00
Tom Hvitved
6c20585fc7 C#: Eliminate bad magic optimization 
```
[2022-01-14 08:57:14] (253s) Tuple counts for Stmt::getAChild#bbf/3@8dfbc66f after 1m53s:
                      4922010396 ~5%     {3} r1 = JOIN ControlFlowElement::ControlFlowElement::getEnclosingCallable_dispred#ff_10#join_rhs WITH ControlFlowElement::ControlFlowElement::getEnclosingCallable_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'cfe', Rhs.1 'cfe', Lhs.0 'c'
                      1597068    ~2%     {3} r2 = JOIN r1 WITH Element::Element::getAChild_dispred#ff ON FIRST 2 OUTPUT Lhs.0 'cfe', Lhs.2 'c', Lhs.1 'result'
                                         return r2
```
 2022-01-14 10:10:23 +01:00
Tom Hvitved
411d2b2876 C#: Update stats 2022-01-14 10:10:23 +01:00
Michael Nebel
f025db0371 C#: Add downgrade script for deleting using_global relation. 2022-01-14 10:10:23 +01:00
Michael Nebel
dcd6a6be40 C#: Add database upgrade script for adding the using_global relation. 2022-01-14 10:10:22 +01:00
Michael Nebel
a1eff1603a C#: Add test for global using directive. 2022-01-14 10:10:22 +01:00
Michael Nebel
c118d9bf6f C#: Add support for the global modifier for using directives. 2022-01-14 10:10:22 +01:00
Michael Nebel
e305a8a6c5 C#: Refactor Tuples to use expression body syntax. 2022-01-14 10:10:22 +01:00
Michael Nebel
6e72f6e2c4 C#: Refactor to re-use code to extract modifier tokens. 2022-01-14 10:10:13 +01:00
Edoardo Pirovano
f2818ebb5e Merge pull request #7489 from edoardopirovano/fix-example 
Fix example in JavaScript query
 2022-01-14 08:58:28 +00:00
Tony Torralba
8f73772955 Merge pull request #7595 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2022-01-14 09:32:13 +01:00
Anders Schack-Mulligen
0b24af901d Merge pull request #7349 from aschackmull/dataflow/state 
Dataflow: Add support for flow state
 2022-01-14 09:12:38 +01:00
github-actions[bot]
685336fa23 Add changed framework coverage reports 2022-01-14 00:10:33 +00:00
Henry Mercer
e9bb9f5294 JS: Update names, IDs, and tags for ML-powered queries 2022-01-13 17:45:40 +00:00
Henry Mercer
8e9d8c112d JS: Improve comments in FunctionBodyFeatures.qll 2022-01-13 17:20:42 +00:00
Henry Mercer
2aea3257cb JS: Improve documentation for getTokenizedAstNode 2022-01-13 17:20:41 +00:00
Andrew Eisenberg
4ffd8c62ac Merge pull request #7579 from github/aeisenberg/changenote-upgrades-removal 
Changenotes: Add changenotes for upgrades refactoring
 2022-01-13 09:09:06 -08:00
Andrew Eisenberg
c6deccf863 Minor fixes to the getting started docs 
Co-authored-by: Felicity Chapman <felicitymay@github.com>
 2022-01-13 09:02:10 -08:00
Henry Mercer
92d6fecc73 Optimize performance of body tokens 
The refactoring to remove the `CodeToFeatures` AST reintroduced a
performance problem. This commit resolves it by pushing size
restrictions into intermediate predicates.
 2022-01-13 16:29:04 +00:00
Michael Nebel
71baf32596 Update csharp/ql/consistency-queries/PrimaryQlClass.ql 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2022-01-13 16:36:31 +01:00
Owen Mansel-Chan
d41c55c69c Add needed predicates for Ruby and C# 
This was done manually.
 2022-01-13 15:10:19 +00:00
Owen Mansel-Chan
2de6340ff5 Sync FlowSummaryImpl.qll 
Done using sync-files.py
 2022-01-13 15:09:25 +00:00
Owen Mansel-Chan
83a25698bb Allow adding inputs and outputs needing reference 2022-01-13 15:09:17 +00:00
Tony Torralba
b6886b8e43 Move code to qll file 2022-01-13 15:28:57 +01:00
Tony Torralba
81feaaec02 Refactor PathMatchGuard 2022-01-13 15:24:41 +01:00
Anders Schack-Mulligen
c44cf29992 Merge pull request #7587 from owen-mc/add-default-taint-sanitizer-guard 
Dataflow: Add default taint sanitizer guard
 2022-01-13 14:44:55 +01:00
Tony Torralba
cd9a485c47 Refactor NullOrEmptyCheckGuard 2022-01-13 14:44:08 +01:00
Anders Schack-Mulligen
61490e74d8 Merge pull request #7561 from aschackmull/java/misc-perf 
Java: A few perf fixes for getASupertype*().
 2022-01-13 14:43:28 +01:00
Mathias Vorreiter Pedersen
6148af4621 C++: Fix join order in 'getConversionType4'. 2022-01-13 13:28:36 +00:00
Anders Schack-Mulligen
f7cf327e71 Dataflow: Sync 2022-01-13 13:28:43 +01:00
Anders Schack-Mulligen
a34c981209 Dataflow: Address comments. 2022-01-13 13:28:24 +01:00
Asger Feldthaus
708408a458 JS: Recognize "sql" option as a query string 2022-01-13 13:04:41 +01:00
Anders Schack-Mulligen
69973dadb3 Merge pull request #7548 from zbazztian/spring-taint-summaries 
Java: Add Spring and Apache Common Langs taint flow steps
 2022-01-13 13:00:41 +01:00
Paolo Tranquilli
e6763c858d C++: add bindingset to private Printf predicate 
That predicate turned out to create a lot of tuples, of which only a
minimal part was then used in the query.
 2022-01-13 11:59:48 +00:00
Paolo Tranquilli
64d15d6226 C++: fix inc.qhelp files and change notes 2022-01-13 11:59:48 +00:00
Paolo Tranquilli
7b4300e4cf C++: Apply suggestions in documentation 
Co-authored-by: Sarah Edwards <skedwards88@github.com>
 2022-01-13 11:59:48 +00:00
Paolo Tranquilli
9d49ad9f20 C++: use includes in OverrunWrite qhelp files 
Also added the relevant CERT C _and_ C++ standard references where they
were missing, and did some minor stylistic tweaks to
`OverrunWriteFloat.qhelp`.
 2022-01-13 11:59:48 +00:00
Paolo Tranquilli
c117a1e21f C++: demote VeryLikelyOverrunWrite cast results 
There were some false positives where something like

    int x;
    // ...
    sprintf(buff, "%ld", (long)x);

was considered as if the parameter had a non-trivial range analysis only
because the range of `int` is smaller than the range for `long`, without
any non-trivial range analysis actually done on `x`.

These will now be reported by `OverrunWrite` instead.
 2022-01-13 11:59:48 +00:00
Paolo Tranquilli
630982cc31 C++: auto format Printf.qll 2022-01-13 11:59:48 +00:00
Paolo Tranquilli
9f811b2439 C++: remove unused variables and fix tests 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
013216d5e6 C++: exclude widening from VeryLikelyOverrunWrite 
This also restrict what we consider "non-trivial" range analysis, as we
now require both ends to be non-trivially bounded for signed integers.
This avoids false positives stemming from a non trivial upper bound but
no meaningful lower bound, for example.
 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
aac029841a C++: doc fixes to VeryLikelyOverrunWrite 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
c8741f6475 C++: update 2021-12-14-overruning-write-split.md 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
1e4861a944 C++: shorten VeryLikelyOverrunWrite @name 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
106400238a C++: tweak overrunning write qhelp files 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
8ac34f3db5 C++: NoSpecifiedEstimateReason→Unspecified... 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
4a85b9b0cc C++: add VeryLikelyOverrunWrite.ql to cwe-120 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
97f1a5bac0 C++: add VeryLikelyOverrunWrite.qhelp 2022-01-13 11:59:47 +00:00
Paolo Tranquilli
10b62154a1 C++: add cpp/very-likely-overruning-write help 
Also update the help of `cpp/overruning-write`, as the case shown there
will actually not be flagged by that query any more.
 2022-01-13 11:59:47 +00:00