Commit Graph

47078 Commits

Author SHA1 Message Date
Rasmus Wriedt Larsen
a9e1e72196 Merge branch 'main' into shared-http-client-request 2022-09-06 10:52:27 +02:00
Rasmus Wriedt Larsen
528ef0eeaa Ruby: Use separate dataflow copy for HTTP client libs
As discussed with @hvitved offline. This helps out to ensrue we don't
needlessly evaluate dataflow for configurations that are not needed
anyway. That is, if other library modeling also used the same dataflow
configuration, which ends up being used in query A, then dataflow for
all the `DataFlowImplForLibraries` configurations would be computeted at
once. When we get to evaluate the query `RequestWithoutValidation.ql`
these results mgith have been forgotten since the predicates are not
cached, and everything will have to be computeted again.

In principle we could be added a dataflow copy for each framework.
However, since we know that the `disablesCertificateValidation`
member-predicates for all the HTTP client libraries will all be used at
the same time, and only for the one query, we only add ONE additional
copy.

Note that the only use of `DataFlowImplForLibraries` before this PR is
using `tainttrackingforlibraries.TaintTrackingImpl` (based on
DataFlowImplForLibraries) for regex computation.
c904ba1d16/ruby/ql/lib/codeql/ruby/Regexp.qll (L153)
Since this is currently transitively imported from Frameworks.qll
(through Core.qll, and core/String.qll), the previous approach didn't
actually violate the assumption about all configurations always being in
scope, but it might have been more by accident, than by purpose.
2022-09-06 10:43:36 +02:00
Rasmus Wriedt Larsen
25d09cd6d6 Ruby: Simplify getKeywordArgumentIncludeHashArgument
As suggested by @hvitved in review
2022-09-06 10:24:22 +02:00
Tom Hvitved
eff3747eb9 Docs: No longer mention required /p:UseSharedCompilation=false 2022-09-06 10:13:29 +02:00
Rasmus Wriedt Larsen
07457b2b5f Python: Apply suggestions from code review
Co-authored-by: Taus <tausbn@github.com>
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
d708abfc80 Python: Accept more .expected changes 2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
c9cd809ef2 Python: Add change-note 2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
e979dffc08 Python: Fix variable access from extractor-change
These changes are from internal PR.
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
985e87ccde Python: Add variable scope example with subclass 2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
0e3d520712 Python: Add variables regression test
As illustrated when running the python file, the non qualified reads in
the `use` method all refer to the global variables, whereas `ex =
func(baz)` are to the things defined on the class.

The important part of the .expected changes is that the _global_
variable `bar` is used inside the function, whereas it's the local
variable for `foo` (on class scope) that is used inside the function
(which is wrong).
2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
98db1af898 Python: Also show variable access 2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
fd4f60dd1b Python: Adjust variables tests 2022-09-06 10:11:37 +02:00
Rasmus Wriedt Larsen
ebd97f4496 Python: Add type-tracking regession example 2022-09-06 10:11:36 +02:00
erik-krogh
0776687991 fix leftover todo in js/insecure-temporary-file 2022-09-06 10:05:50 +02:00
Philip Ginsbach
6674e07eaa Merge pull request #10088 from github/parameterisedModules
parameterised modules in the QL language reference
2022-09-06 08:59:31 +01:00
Tom Hvitved
12015928c1 Merge pull request #10295 from hvitved/csharp/code-analysis-shared-compilation
C#: No longer manually disable shared compilation in `codeql-analysis.yml`
2022-09-06 09:45:31 +02:00
Asger F
5ef69628b3 Ruby: remove exists that ql4ql is unhappy about 2022-09-06 09:36:06 +02:00
Michael Nebel
0e52d2c9d3 C#: Add missing bi-directional imports. 2022-09-06 09:34:13 +02:00
Asger F
f07e0592d0 JS: Drive-by fix for accidental recursion 2022-09-06 09:30:02 +02:00
Asger F
c7c3ad29cd Python: sync with Python 2022-09-06 09:30:02 +02:00
Asger F
2cbba65617 JS: Sync with JS
fixup JS
2022-09-06 09:30:02 +02:00
Tom Hvitved
62986a23f3 C#: Add dotnet build integration test 2022-09-06 09:24:54 +02:00
Asger F
afd00161e8 Ruby: introduce getExtraNodeFromType
Using getExtraNodeFromPath with n=0 was a bit of a hack. In principle, the CodeQL libraries might care about the type, even though there are no relevant paths starting at that type.
2022-09-06 09:17:34 +02:00
Asger F
b99e9a58e7 Update ruby/ql/lib/codeql/ruby/frameworks/data/internal/ApiGraphModels.qll
Co-authored-by: Tom Hvitved <hvitved@github.com>
2022-09-06 09:10:24 +02:00
Tom Hvitved
9fd9a04c2f Merge pull request #10277 from hvitved/csharp/dotnet-publish-inject
C#: Also inject `/p:UseSharedCompilation=false` into `dotnet publish`
2022-09-06 09:02:00 +02:00
Tamás Vajk
5f841f71db Merge pull request #10291 from tamasvajk/kotlin-fix-array-set
Kotlin: Fix array `set` operator extraction
2022-09-06 09:01:05 +02:00
Arthur Baars
604af4f7b3 Merge pull request #10302 from github/rc/3.7
Merge 3.7 into main
2022-09-06 08:42:44 +02:00
Mathias Vorreiter Pedersen
885bf427bd C++: Accept test changes. 2022-09-05 23:26:03 +01:00
Mathias Vorreiter Pedersen
f6654e3d69 C++: As a bonus we now no longer need the 'TTranslatedRangeBasedForVariableDeclaration' IPA branch. This previously existed only to account for the missing 'DeclarationEntry's happening in range-based for loops. But these are now also handled by 'PseudoDeclarationEntry's. 2022-09-05 22:18:41 +01:00
Mathias Vorreiter Pedersen
fc85ef76ed C++: Introduce 'PseudoDeclarationEntry's to handle missing 'DeclarationEntry's during IR construction. 2022-09-05 22:17:14 +01:00
Arthur Baars
e8d13d156d Merge pull request #10298 from aibaars/suppress-require
Ruby: exclude 'require' and 'require_relative' definitions from call graph
2022-09-05 20:58:38 +02:00
Rasmus Lerchedahl Petersen
af08c6eb08 Python: remove repeated test file 2022-09-05 20:44:55 +02:00
Philip Ginsbach
cec63e4522 Update docs/codeql/ql-language-reference/modules.rst
Co-authored-by: Felicity Chapman <felicitymay@github.com>
2022-09-05 19:17:11 +01:00
Philip Ginsbach
aa539454b5 Update docs/codeql/ql-language-reference/index.rst
Co-authored-by: Felicity Chapman <felicitymay@github.com>
2022-09-05 19:17:06 +01:00
Mathias Vorreiter Pedersen
2da46ad691 C++: Add two testcases demonstrating malformed IR from missing declaration entries from decl stmts. 2022-09-05 17:49:20 +01:00
Geoffrey White
b6d5b6731a C++: Make QLDoc meet style guide. 2022-09-05 17:17:57 +01:00
Geoffrey White
234da636a4 C++: Change note. 2022-09-05 17:01:25 +01:00
Geoffrey White
008d583da8 C++: Modernize cpp/cleartext-storage-database. 2022-09-05 16:47:14 +01:00
Arthur Baars
b2431d0b50 Ruby: exclude 'require' and 'require_relative' definitions from call graph
The syntax_suggest library redefines Kernel.require/require_relative.
Somehow this causes performance issues on ruby/ruby. As a workaround
we exclude 'require' and 'require_relative'.
2022-09-05 16:52:52 +02:00
Rasmus Lerchedahl Petersen
d31d763328 Python: adjust test expectations
We now locate a `DataFlow::Node` rather than an 'AstNode`.
2022-09-05 16:45:43 +02:00
Tamás Vajk
1178dcb507 Merge pull request #10293 from tamasvajk/fix/ql4ql-pr-trigger
Workflow: Add paths filter to QL for QL workflow
2022-09-05 16:22:05 +02:00
Erik Krogh Kristensen
4e14177614 fix typo in change-note 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
54eb0414cb rename an upper-cased acronym 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
90bc8a5038 run the explicit-this patch on javascript/ 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
b398f968e2 expand change-note to mention classes that have a changed basetype 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
e64f96c1ce rewrite the change-note to emphasise that the change is potentially breaking 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
26f5643f3e update the deprecation notice of RouteExpr such that it points to public APIs 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
e387ebaedd add domNode.innerHTML += sink as a DOM sink 2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
74a79f8622 simplify int check
Co-authored-by: Asger F <asgerf@github.com>
2022-09-05 16:11:55 +02:00
Erik Krogh Kristensen
73a936104a fix typo in qldoc
Co-authored-by: Asger F <asgerf@github.com>
2022-09-05 16:11:55 +02:00