hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-17 04:56:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
48,840 Commits 1,714 Branches 162 Tags
codeql-cli/v2.12.0
Commit Graph

48840 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mathias Vorreiter Pedersen
a330cae2f9 C++: Update change-notes. 2020-11-10 17:24:45 +01:00
Mathias Vorreiter Pedersen
4bcf1f498b C++: Add new query for unsafe use of this. 2020-11-10 17:23:55 +01:00
Pavel Avgustinov
60ea9cec6e Update docs/ql-design-patterns.md 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com>
 2020-11-10 15:59:45 +00:00
Mathias Vorreiter Pedersen
884554692f Merge pull request #4645 from geoffw0/oddsends2 
C++: Odds and ends
 2020-11-10 16:59:10 +01:00
Mathias Vorreiter Pedersen
618d9c33a1 Merge pull request #4642 from geoffw0/memberfn 
C++: Improve MemberFunction.qll data flows
 2020-11-10 16:54:42 +01:00
Jonas Jensen
da90717ef0 Merge pull request #4641 from aschackmull/autoformat-setliterals 
C++/C#/Java/JavaScript/Python: Autoformat set literals.
 2020-11-10 16:11:11 +01:00
Tom Hvitved
7e89e57f5d Merge pull request #4606 from hvitved/csharp/dataflow/ef 
C#: Precise data flow for EntityFramework(Core)
 2020-11-10 15:54:20 +01:00
Rasmus Wriedt Larsen
14236709f6 Fix typo ql-design-patterns.md 
Co-authored-by: Pavel Avgustinov <54942558+p0@users.noreply.github.com>
 2020-11-10 15:39:45 +01:00
Nick Rolfe
ac4a1f1d9b Update comment to be a QLDoc comment 2020-11-10 14:14:27 +00:00
Geoffrey White
be537a8021 C++: Move ThrowExpr, ReThrowExpr definitions to a more logical location. 2020-11-10 14:06:58 +00:00
Nick Rolfe
1e1eb7ee33 Replace getEncodedFile with shared getFileBySourceArchiveName predicate 
While also making it work with paths for databases created on Windows.
 2020-11-10 13:55:27 +00:00
Geoffrey White
2beb7824ec C++: Backticks. 2020-11-10 13:35:05 +00:00
Geoffrey White
599034668f C++: Fix typo. 2020-11-10 13:32:31 +00:00
Geoffrey White
f109e8ccbc C++: Remove duplicate import. 2020-11-10 13:31:47 +00:00
Geoffrey White
c4fe8df04c C++: Support data flow from parameter deref to return value. 2020-11-10 13:17:34 +00:00
Geoffrey White
4563e32e92 C++: Remove data flows we shouldn't need in MemberFunction. 2020-11-10 13:17:24 +00:00
Anders Schack-Mulligen
89ef6ea4eb C++/C#/Java/JavaScript/Python: Autoformat set literals. 2020-11-10 13:32:27 +01:00
Chris Smowton
235b7c0bc5 Merge pull request #395 from sauyon/regexp 
SuspiciousCharacterInRegexp: Add fix for raw string literals
 2020-11-10 12:18:38 +00:00
Alvaro Muñoz
02cf49a773 apply codeql formatting 2020-11-10 11:46:42 +01:00
Rasmus Lerchedahl Petersen
109d55eb25 Python: Make ParameterNode a CfgNode 
Add a step from that `CfgNode` to the corresponding `EssaNode`.
The intended effect is seen in `ImpliesDataflow.expected`.
The efeect seen in other `.expected`-files is that parameter nodes
change type, that the extra steps are seen, and that flow from
`EssaVar`s is mirrored in flow from `CfgNode`s.
There is one surprise, which is the `.0` node in
`coverage/localFlow.expected`.
 2020-11-10 11:35:50 +01:00
Alvaro Muñoz
24a47fbb0f additional qldoc commentes 2020-11-10 10:48:47 +01:00
Alvaro Muñoz
3545edb92c address code review suggestions 2020-11-10 10:45:14 +01:00
Tom Hvitved
697b0ba4c1 C#: Address review comments 2020-11-10 10:42:05 +01:00
Erik Krogh Kristensen
ae7c7607f1 fix typos in documentation strings 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen
b5b4d6d62a add change note 2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen
5ecae55e77 add keys used by jsonwebtoken as CredentialsExpr 2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen
e75259d3a6 model the verify function in jsonwebtoken 2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen
6732493377 add model for jwt-decode 2020-11-10 10:41:36 +01:00
yoff
26286e534e Merge pull request #4174 from yoff/SharedDataflow_PointsToImpliesDataflow 
Python: Dataflow, Test that `pointsTo` implies data flow
merging now, will fix `self` in a later PR
 2020-11-10 10:25:29 +01:00
Robert Marsh
c00587d2cb C++/C#: Conflated memory as IR dump annotation 
Removes the IR consistency checks for conflated memory and marks
instructions that have a conflated result with a percent sign (%)
instead. This avoids reimplementing part of the alias analysis logic
in the consistency check.
 2020-11-09 14:55:47 -08:00
Robert Marsh
04ad94d1cc C++: model taint from pointers to aliased buffers 2020-11-09 13:52:08 -08:00
Robert Marsh
afbeca0d54 C++: Accept test outputs 2020-11-09 13:24:31 -08:00
Robert Marsh
95ed5465de C++: improve handling of function arguments in DTT 2020-11-09 13:02:06 -08:00
Robert Marsh
fbe857d1fa C++: require that other operands be predictable 
This brings back a constraint that was lost when switching
DefaultTaintTracking to use a TaintTracking::Configuration
 2020-11-09 13:00:55 -08:00
Robert Marsh
7d79be71d1 C++: taint tracking conf in DefaultTaintTracking 
Switch from using additional flow steps with a DataFlow::Configuration
in DefaultTaintTracking to using a TaintTracking::Configuration. This
makes future improvements to TaintTracking::Configuration reflected in
DefaultTaintTracking without further effort. It also removes the
predictability constraint in DefaultTaintTracking, which increases the
number of results, with both new true positives and new false positives.
Those may need to be addressed on a per-query basis.

There are some additional regressions from losing pointer/object
conflation for arguments. Those can be worked around by adding that
conflation to TaintTracking::Configuration until precise indirect
parameter flow is ready.
 2020-11-09 13:00:55 -08:00
Porcupiney Hairs
38de9b6433 add request forgery query 2020-11-10 01:19:35 +05:30
Sauyon Lee
0950baf4b7 Add additional tests for suspicious character in regexp regexp 2020-11-09 10:36:27 -08:00
Sauyon Lee
eb26b0abd1 SuspiciousCharacterInRegexp: Add fix for raw string literals 2020-11-09 10:10:47 -08:00
Sauyon Lee
52d253a95b Add isRaw to StringLit 2020-11-09 10:08:51 -08:00
CodeQL CI
1e048d8045 Merge pull request #4609 from asgerf/js/destructuring-export 
Approved by erik-krogh
 2020-11-09 15:47:00 +00:00
luchua-bc
bc899b6337 Move common code to a library and add more test cases 2020-11-09 14:14:54 +00:00
luchua-bc
b10552aa2e Specify exported Android components for local Android DoS 2020-11-09 14:10:01 +00:00
luchua-bc
76a0db84ee Query for detecting Local Android DoS caused by NFE 2020-11-09 14:10:00 +00:00
Arthur Baars
5f1e373355 Merge pull request #30 from github/string_contents 
Get latest fixes from tree-sitter-ruby repo
 2020-11-09 15:05:50 +01:00
Arthur Baars
81ceb22b14 Restore cache before running cargo fmt 
It appears cargo fmt also downloads the git dependencies which takes quite a while. The cache should contain a copy of the cloned repo, so restoring the cache early should speed things up.
 2020-11-09 14:25:54 +01:00
Anders Schack-Mulligen
31ec79819e Merge pull request #4631 from luchua-bc/java-nfe-library 
Java: Factor NumberFormatException out into a library file
 2020-11-09 13:50:31 +01:00
yoff
3215f50b73 Merge pull request #4632 from RasmusWL/python-move-configurations-out-of-queries 
Python: move configurations out of queries
 2020-11-09 13:10:33 +01:00
luchua-bc
a83f9ced96 Change the query to only catch the common exception rethrown case 2020-11-09 12:07:43 +00:00
luchua-bc
d765c7bbb2 Update qldoc 2020-11-09 11:23:48 +00:00
Asger Feldthaus
32c5bc4836 JS: Update test case output (new flow is correct) 2020-11-09 11:19:47 +00:00