hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-24 20:02:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
42,524 Commits 1,686 Branches 158 Tags
codeql-cli/v2.10.5
Commit Graph

42524 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Michael Nebel
5659db73d3 C#: Update alle manually written summaries for constructors to use Argument[Qualifier] instead of ReturnValue. 2022-08-10 14:17:16 +02:00
Nora Dimitrijević
60f4049388 Re-autoformat StrncpyFlippedArgs.ql 2022-08-10 14:14:42 +02:00
Chris Smowton
2abd1f77f4 Go: implement conservative cross-thread dataflow 
Steps into captured variables are moved into jumpStep where they always should have been, and the store/load step implementation for channels is completed.

For the time being this takes a very conservative approach to identify channels that are likely connected: if there is exactly one receive site and one send site for a field, the two are presumed connected.
 2022-08-10 12:44:12 +01:00
Nora Dimitrijević
05f4f98aa0 Add change note 2022-08-10 13:42:21 +02:00
Nora Dimitrijević
8e60a4a478 Update StrncpyFlippedArgs.expected 
Add output lines for the newly implemented test case, test.cpp/test9().
 2022-08-10 13:42:21 +02:00
Nora Dimitrijević
df419003ad Use Strcpy.qll in StrncpyFlippedArgs.ql 
As a result, the query gets access to more types of strncpy-like
functions, as demonstrated by test.cpp, which now "fails" (i.e. works) for the new test
cases instroduced
in the previous commit.
 2022-08-10 13:42:21 +02:00
Nora Dimitrijević
554aea1bb8 New strcpy-variant in StrncpyFlippedArgs test 
Added wcsxfrm_l, which is not currently caught by the query,
meaning that in this case a successful
test implies missing functionality.
 2022-08-10 13:42:21 +02:00
Chris Smowton
8c32758ae5 Merge pull request #9829 from smowton/smowton/fix/kotlin-underscore-parameter-names 
Kotlin: Don't extract a name for a '_' parameter
 2022-08-10 12:28:26 +01:00
Tom Hvitved
2bb9e4859f C#: Handle dotnet exec csc.dll and the likes in the Lua tracer 2022-08-10 12:52:18 +02:00
Rasmus Wriedt Larsen
40d25cb34c Merge pull request #9849 from tausbn/python-fix-bad-essa-getInput-join 
Python: Fix bad join in ESSA `getInput`
 2022-08-10 11:45:23 +02:00
Chris Smowton
09e4c6b66b Add dataflow path-graph 2022-08-10 10:37:55 +01:00
Chris Smowton
2ca0b0c6b5 Inline qhelp overview 
A <p> at the top isn't allowed, and for some reason the inclusion is required to be a valid qhelp file.
 2022-08-10 10:37:48 +01:00
Michael Nebel
f1cc7bb60c C#: Consider FileStreams StoredFlowSources and propagate taint via StreamReader. 2022-08-10 11:08:27 +02:00
Michael Nebel
2b51e03223 C#: Add SecondOrder SQL injection example, where reading from a file. 2022-08-10 11:08:27 +02:00
Michael Nebel
1e7e49a528 C#: Add relevant stubs. 2022-08-10 11:08:27 +02:00
Michael Nebel
344770f06a C#: Update Sqlinjection test query output with new results. 2022-08-10 11:08:27 +02:00
Michael Nebel
fd67c34ee4 C#: Add sinks and summaries for adapters with tainted commands. 2022-08-10 11:08:27 +02:00
Michael Nebel
78cfb226a3 C#: Add some examples where adapter is used in conjunction with a tainted command. 2022-08-10 11:08:27 +02:00
Michael Nebel
86000f32e7 C#: Update SqlInjection query tests with new results. 2022-08-10 11:08:27 +02:00
Michael Nebel
aa13ab31e1 C#: Add SQLiteDataAdapter sinks. 2022-08-10 11:08:27 +02:00
Michael Nebel
1fb209990e C#: Add SQLiteDataAdapter examples. 2022-08-10 11:08:27 +02:00
Michael Nebel
ce9baaa1f3 C#: Update SQLInjection query test output. 2022-08-10 11:08:27 +02:00
Michael Nebel
6f9f771f58 C#: Add SQLiteCommand sinks. 2022-08-10 11:08:27 +02:00
Michael Nebel
d42752714c C#: Add SQLCommand examples. 2022-08-10 11:08:21 +02:00
Michael Nebel
7fc95fb49b Merge pull request #9988 from michaelnebel/csharp/updatestubs 
C#: Update .NET Core and ASP.NET Core Stubs.
 2022-08-10 11:02:35 +02:00
Rasmus Wriedt Larsen
b541103b7f Merge pull request #9846 from tausbn/python-fix-bad-syntactic_call_count-join 
Python: Fix bad join in `syntactic_call_count`
 2022-08-10 10:09:51 +02:00
Michael Nebel
0aa64b3a8f Merge pull request #10001 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2022-08-10 10:09:19 +02:00
Tom Hvitved
19043bdf38 Merge pull request #9976 from hvitved/ruby/hash-literal-summary-simplification 
Ruby: Simplify flow summaries for hash literals
 2022-08-10 08:57:33 +02:00
Erik Krogh Kristensen
d008975ff4 Merge pull request #9825 from erik-krogh/repeatedWord 
QL: add ql/repeated-word query
 2022-08-10 07:25:26 +02:00
github-actions[bot]
cb19ae2638 Add changed framework coverage reports 2022-08-10 00:16:31 +00:00
Harry Maclean
30ff18aec8 Merge pull request #9919 from hmac/hmac/ar-associations 
Ruby: ActiveRecord associations
 2022-08-10 11:13:39 +12:00
Esben Sparre Andreasen
0c6f28014c Merge pull request #9821 from erik-krogh/jsQlFix 
JS: fix some QL-for-QL warnings in JS
 2022-08-09 22:06:29 +02:00
Erik Krogh Kristensen
559ec7ba56 Merge branch 'main' into repeatedWord 2022-08-09 21:22:47 +02:00
smehta23
cf68a11267 Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp 
Co-authored-by: Chris Smowton <smowton@github.com>
 2022-08-09 11:59:28 -07:00
smehta23
4d80fd0b00 Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp 
Co-authored-by: Chris Smowton <smowton@github.com>
 2022-08-09 11:59:14 -07:00
smehta23
7da07400ea Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp 
Co-authored-by: Chris Smowton <smowton@github.com>
 2022-08-09 11:59:03 -07:00
smehta23
c2b670eff8 Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.qhelp 
Co-authored-by: Chris Smowton <smowton@github.com>
 2022-08-09 11:58:55 -07:00
Geoffrey White
6f696ccc3c Swift: Effect of merging with main to get the AnyTryExpr fix. 2022-08-09 19:02:59 +01:00
Geoffrey White
efcc696e6e Merge branch 'main' into defaulttaint 2022-08-09 18:59:36 +01:00
Geoffrey White
f2fead7ec7 Merge pull request #9995 from MathiasVP/swift-cfg-for-anytry 
Swift: CFG for `any!`
 2022-08-09 18:00:28 +01:00
Geoffrey White
36f410b9f7 Swift: Move taint logic from isAdditionalTaintStep to defaultAdditionalTaintStep. 2022-08-09 17:42:28 +01:00
Geoffrey White
242dc80907 Swift: Add taint test of try. 2022-08-09 17:42:25 +01:00
Geoffrey White
3bda9af97a Swift: Add taint test of Data. 2022-08-09 17:42:24 +01:00
Geoffrey White
42c3e29a29 Swift: Add taint test of URL. 2022-08-09 17:42:23 +01:00
Geoffrey White
068ec8ea20 Swift: More tests of taint flow through Strings. 2022-08-09 16:43:07 +01:00
Geoffrey White
0141609703 Swift: Rename test. 2022-08-09 16:41:26 +01:00
Tony Torralba
7f5fe85e2e Merge pull request #9975 from atorralba/atorralba/asynctask-improvs 
Java: Improve AsyncTask data flow support
 2022-08-09 17:10:09 +02:00
Erik Krogh Kristensen
da4da229b1 move tests to new test location 2022-08-09 16:25:00 +02:00
Erik Krogh Kristensen
49276b1f38 Merge branch 'main' into refacReDoS 2022-08-09 16:18:46 +02:00
Mathias Vorreiter Pedersen
5ee11c3d7b Swift: Accept test changes. 2022-08-09 15:12:42 +01:00