hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-19 05:56:46 +01:00
Code Issues Packages Projects Releases Wiki Activity
48,840 Commits 1,716 Branches 162 Tags
codeql-cli/v2.12.0
Commit Graph

48840 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Geoffrey White
8786fe1ab8 C++: Add test missing test case involving tainted key. 2020-10-09 10:00:22 +01:00
Tom Hvitved
412524103c Merge pull request #4437 from hvitved/csharp/cfg/compiler-generated-array-lengths 
C#: Include compiler-generated array lengths in the CFG
 2020-10-09 10:54:56 +02:00
Max Schaefer
9db478aa03 Fix escaping in Makefile targets. 
Previously, invoking `make autoformat` would run a command of this form:

```sh
... | grep \\.go$ | ...
```

Note that the `$` is not escaped. This probably wasn't intended, even though it happens to work anyway, since the shell doesn't try to expand lone `$`s.

More problematically, invoking `make check-formatting` would run a command of this form:

```sh
... | grep \\.go| ...
```

Note that the `$` is gone, so it matches `.go` anywhere in the file name. In particular, it matches `ql/test/library-tests/semmle/go/frameworks/Protobuf/vendor/google.golang.org/protobuf/LICENSE`, which I think is responsible for the somewhat mysterious "expected 'package', found Copyright" errors we've been seeing from CI.

This PR fixes both targets to run

```sh
... | grep '\.go$' | ...
```

Because of the single quotes we only need a single backslash, and the `$` gets left alone.
 2020-10-09 09:07:24 +01:00
CodeQL CI
3894ecf779 Merge pull request #4441 from max-schaefer/js/add-negative-api-graphs-test 
Approved by erik-krogh
 2020-10-09 00:37:38 -07:00
Sauyon Lee
85c92251d6 Add a new binary for tracing 2020-10-08 23:31:06 -07:00
Sauyon Lee
de0582a67f autobuilder: extract out attempted build commands 2020-10-08 23:31:05 -07:00
Sauyon Lee
cd63ea84aa extractor: revamp argument parsing 2020-10-08 23:31:05 -07:00
Sauyon Lee
2da89c6527 extractor: factor out run from autobuilder 2020-10-08 23:31:05 -07:00
Sauyon Lee
eaf5342b7d Enable Go modules while determining module directory 2020-10-08 23:31:05 -07:00
Sauyon Lee
16796529fc Add package directory as a wanted root 2020-10-08 23:31:05 -07:00
Erik Krogh Kristensen
3b328baaef changes based on review 2020-10-08 21:54:23 +02:00
Erik Krogh Kristensen
65b90c411c Update javascript/ql/src/semmle/javascript/security/dataflow/CodeInjectionCustomizations.qll 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-10-08 21:28:50 +02:00
Erik Krogh Kristensen
d3e3c11fa6 add printAst query for printing JS/TS/JSON/YAML/HTML 2020-10-08 21:20:28 +02:00
Max Schaefer
4bf6f6ac7c JavaScript: Add a negative test for API graphs. 
The test ensures that flow summarization won't label property `f` of the first parameter of `assertNotNull` as a sink, which would be very imprecise.
 2020-10-08 19:53:23 +01:00
Geoffrey White
493b80c44d C++: Fix incorrect translations to hasQualifiedName. 2020-10-08 17:56:57 +01:00
Dave Bartolomeo
e4bfb75f90 C++: Fix pointer flow through temporary objects 2020-10-08 12:24:59 -04:00
Tamás Vajk
f42cbcbeae Merge pull request #4428 from tamasvajk/feature/force-nuget-single-restore 
C#: Add '-DisableParallelProcessing' flag to nuget restore in Autobuilder
 2020-10-08 18:23:12 +02:00
Taus
60eec7b136 Python: Update python/ql/src/experimental/dataflow/internal/Attributes.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2020-10-08 18:14:20 +02:00
Taus Brock-Nannestad
d46453caaa Python: Support named imports as attribute reads 
Required a small change in `DataFlow::importModule` to get the desired
behaviour (cf. the type trackers defined in `moduleattr.ql`, but this
should be harmless. The node that is added doesn't have any flow
anywhere.
 2020-10-08 18:08:55 +02:00
Geoffrey White
c555cfa22a C++: Replace isParameterDeref(_). 2020-10-08 16:55:45 +01:00
Tamas Vajk
f3f908383b C#: Adjust autobuilder tests for added nuget.exe flag 2020-10-08 17:07:40 +02:00
Tamas Vajk
522f41377f C#: Add '-DisableParallelProcessing' flag to nuget restore in Autobuilder 2020-10-08 17:02:14 +02:00
Geoffrey White
e01e4b5bde C++: Fix QLDoc comments. 2020-10-08 14:29:08 +01:00
Geoffrey White
5c1a510e4a C++: Model map::lower_bound, upper_bound and equal_range. 2020-10-08 14:22:43 +01:00
Geoffrey White
ef9a7c8cdb C++: Model map::merge. 2020-10-08 14:22:43 +01:00
Geoffrey White
b7ab89c892 C++: Model map::emplace, emplace_hint and map::try_emplace. 2020-10-08 14:22:43 +01:00
Jonas Jensen
b409cf6cea Merge pull request #4389 from gsingh93/bitwise-and 
Improve range analysis for bitwise and
 2020-10-08 15:18:15 +02:00
Geoffrey White
6394b1b478 C++: Additional test cases for emplace. 2020-10-08 14:11:24 +01:00
Taus Brock-Nannestad
df447c0af9 Python: Remove flow from getAttributeName 2020-10-08 15:01:24 +02:00
Taus Brock-Nannestad
ceb249680e Python: Reuse existing node fields 
Also changes `x = TCfgNode(y)` to `x.asCfgNode() = y` where applicable.
 2020-10-08 15:00:14 +02:00
Taus Brock-Nannestad
31596ef569 Python: Clean up and extend built-in call node classes 2020-10-08 14:57:39 +02:00
Taus Brock-Nannestad
e9ecc00b37 Python: Implement and use mayHaveAttributeName 2020-10-08 14:53:54 +02:00
Geoffrey White
61d5372d07 C++: Test spacing. 2020-10-08 13:43:49 +01:00
Geoffrey White
4c4dd0c959 C++: Fix a bug in the tests. 2020-10-08 12:57:30 +01:00
CodeQL CI
f179e7ebf4 Merge pull request #4291 from asgerf/js/lean-dependency-installation-plainjava 
Approved by erik-krogh
 2020-10-08 03:09:38 -07:00
Rasmus Wriedt Larsen
0b0763953e Python: Update description of CodeInjection 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2020-10-08 11:15:36 +02:00
yoff
7d086b23ff Update python/ql/src/experimental/dataflow/internal/DataFlowPrivate.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2020-10-08 10:53:52 +02:00
Tom Hvitved
ca4e5014ae C#: Include compiler-generated array lengths in the CFG 2020-10-08 10:35:50 +02:00
Rasmus Lerchedahl Petersen
19796a4c9c Python: Improve tests and make validTest happy 2020-10-08 10:35:01 +02:00
Tom Hvitved
ce8567c64a Merge pull request #4293 from hvitved/csharp/cfg/assertions 
C#: Model assertions in the CFG
 2020-10-08 10:32:13 +02:00
Chris Smowton
024e8ef715 Merge pull request #368 from sauyon/xpath-fix 
Update XPathExpressionString to match the Range pattern
 2020-10-08 09:24:04 +01:00
Rasmus Lerchedahl Petersen
cc0661bce1 Python: More/better comments 2020-10-08 10:11:00 +02:00
Tom Hvitved
b70f5bc954 Merge pull request #4433 from hvitved/csharp/dataflow/switch-expr 
C#: Add missing data-flow for switch expressions
 2020-10-08 09:13:43 +02:00
Anders Schack-Mulligen
cb00f8bcc4 Merge pull request #4362 from tamasvajk/feature/sign-analysis-cleanup 
Sign analysis cleanup
 2020-10-08 09:10:04 +02:00
Sauyon Lee
43de6ea836 Update XPathExpressionString to match the Range pattern 
Fixes #367
 2020-10-07 14:29:05 -07:00
Gulshan Singh
662736eb2d Fix compiler error after removing getLOp/getROp 2020-10-07 12:45:08 -07:00
Tamás Vajk
06f1c898dc Merge pull request #4349 from tamasvajk/feature/modulus-analysis 
ModulusAnalysis shared between C# and Java
 2020-10-07 21:21:20 +02:00
Rasmus Wriedt Larsen
46ec7fbf6e Python: Make builtin compile function additional taint step 2020-10-07 21:17:39 +02:00
Rasmus Wriedt Larsen
c69a61bac5 Python: Model exec and eval calls as CodeExecution 2020-10-07 21:14:19 +02:00
Rasmus Wriedt Larsen
73971cff76 Python: Model exec statement (Python 2 only) as CodeExecution 2020-10-07 21:12:35 +02:00