hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-29 11:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
48,840 Commits 1,723 Branches 164 Tags
codeql-cli/v2.12.0
Commit Graph

48840 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Aditya Sharad
b057ce8d46 Concepts: Add HTTP::ClientRequest class and module. 
Extensible model of client requests to a URL.
Ported from the CodeQL JavaScript library.
 2020-03-24 10:57:51 -07:00
Dave Bartolomeo
2b69cc9738 C#: Make IRConfiguration.qll just forward to the implementation 
Just like C++ already does.
 2020-03-24 13:33:50 -04:00
Max Schaefer
efbcec09ef JavaScript: Add type tracking to Postgres model. 2020-03-24 17:30:07 +00:00
Max Schaefer
330f11c2a3 Merge pull request #71 from intrigus-lgtm/patch-1 
Fix error in Qldoc
 2020-03-24 16:55:22 +00:00
intrigus-lgtm
24b3133e0c Fix error in Qldoc 2020-03-24 17:53:51 +01:00
Anders Schack-Mulligen
75523e4eb8 Java: Fix directory structure in experimental. 2020-03-24 16:47:55 +01:00
Jonas Jensen
8f419d1676 C++: Fix conflated-memory sanity query 
I had included `InitializeNonLocal` in the recursion because it made
everything look better in the presence of a bug that's since been fixed.
Taking it out means the sanity test is again aligned with the old
`isChiForAllAliasedMemory`.
 2020-03-24 16:46:59 +01:00
Jonas Jensen
4e588869d8 C++: Sync identical files 2020-03-24 16:46:42 +01:00
Dave Bartolomeo
cc76782545 Merge remote-tracking branch 'upstream/master' into codeql-c-analysis/34-Bad-Overlap 2020-03-24 11:38:39 -04:00
semmle-qlci
ce0b72f949 Merge pull request #3093 from erik-krogh/MorePathSinks 
Approved by asgerf
 2020-03-24 14:26:41 +00:00
Anders Schack-Mulligen
d8edae96df Java: Add test. 2020-03-24 15:24:17 +01:00
Rasmus Wriedt Larsen
05ecfc83f7 Python: Add test-case with swapped decorator order 2020-03-24 14:18:46 +01:00
Jonas Jensen
27832148a9 C++: Phi-node conflation is not about vvars 2020-03-24 13:56:42 +01:00
Jonas Jensen
95a8dcb3fd C++: failing test for non-conflated escaped var 2020-03-24 13:31:08 +01:00
Taus
fe00d1cbf4 Merge pull request #2888 from RasmusWL/python-tarslip-sanitizer 
Python: Improve tarslip sanitizer
 2020-03-24 12:59:20 +01:00
Max Schaefer
8dda4bd97f Merge pull request #66 from intrigus-lgtm/CWE-643 
CWE-643 XPathInjection on Go
 2020-03-24 10:53:57 +00:00
Rasmus Wriedt Larsen
3ed48aae4c Python: remove leftover arg in test code 2020-03-24 11:49:08 +01:00
Sauyon Lee
81e13473db Merge pull request #69 from max-schaefer/issue-72 
Track taint through element writes.
 2020-03-24 03:41:05 -07:00
Rasmus Wriedt Larsen
5ec0716cb0 Python: Add points-to regression when using @classmethod decorators 
Specifically a problem when using a second decorator
 2020-03-24 11:39:08 +01:00
Erik Krogh Kristensen
36981f385a Merge branch 'master' of git.semmle.com:Semmle/ql into MorePathSinks 2020-03-24 11:20:33 +01:00
Max Schaefer
752ee3909a Add queries to inspect and measure dispatch differences. 2020-03-24 09:34:42 +00:00
Max Schaefer
084fa80a57 Refine virtual call targets by local reasoning where possible. 2020-03-24 09:34:42 +00:00
Rasmus Wriedt Larsen
49fa7c8589 Python: update 1.24 changelog 2020-03-24 10:15:36 +01:00
Rasmus Wriedt Larsen
4b8020b98d Python: Autoformat Command.qll 2020-03-24 10:11:57 +01:00
semmle-qlci
4c9a6b73ee Merge pull request #3107 from erik-krogh/FArgs 
Approved by esbena
 2020-03-24 08:32:56 +00:00
Erik Krogh Kristensen
fa710c5864 Merge remote-tracking branch 'upstream/master' into UrlSearch 2020-03-24 00:23:15 +01:00
Erik Krogh Kristensen
5b4f091257 add test for remote flow sources in WebSockets 2020-03-23 23:58:20 +01:00
Erik Krogh Kristensen
6a1491d83d add SockJS to the existing WebSocket model 2020-03-23 23:56:11 +01:00
Erik Krogh Kristensen
9a18dc32c1 autoformat WebSocket tests 2020-03-23 23:49:26 +01:00
Erik Krogh Kristensen
7b7eddff1e remove previous SockJS implementation, and move example to WebSocket test 2020-03-23 23:45:05 +01:00
Asger F
a1e032bee6 Merge pull request #3098 from kyprizel/master 
Experimental SockJS support
 2020-03-23 22:39:10 +00:00
yo-h
d315864383 Merge pull request #3108 from aschackmull/java/finalizemethod 
Java: Fixup FinalizeMethod definition.
 2020-03-23 18:27:57 -04:00
Dave Bartolomeo
bebf89fed5 C++: Accept test diffs 
All changes look like real improvements.
 2020-03-23 17:20:19 -04:00
kyprizel
dec1b8b070 Update javascript/ql/src/experimental/SockJS/SockJS.qll 
Fix comments

Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-03-23 22:59:48 +03:00
kyprizel
b90ff5e84d Update javascript/ql/src/experimental/SockJS/SockJS.qll 
do not import specific libs

Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-03-23 22:59:23 +03:00
Jonas Jensen
29c4c8c0b2 C#: Fixup to follow C++ changes 2020-03-23 20:39:43 +01:00
Jonas Jensen
999051d20e C++: QLDoc terminology: object -> mem allocation 2020-03-23 20:32:47 +01:00
Dave Bartolomeo
c5ac357bfc C++/C#: Fix bad overlap sanity failures 
`Instruction.getDefinitionOverlap()` depends on `SSAConstruction::getMemoryOperandDefinition()`, which in turn depends on `SSAConstruction::hasMemoryOperandDefinition()`. When the definition in question came from a `Chi` instruction, `hasMemoryOperandDefinition()` incorrectly bound `overlap` to the overlap relationship between the original (non-`Chi`) instruction and the use. The fix is to make use of the `actualDefLocation` parameter to `getDefinitionOrChiInstruction()`, which specifies the location for the result of the `Chi` in that case.
 2020-03-23 14:57:41 -04:00
Jonas Jensen
b0d3c9ee6b C++: Fix getExtentOverlap for entire allocation 2020-03-23 19:49:39 +01:00
Dave Bartolomeo
a2741da8e2 C++/C#: Add sanity test for invalid overlap from getDefinitionOverlap() 
The result of `getDefinitionOverlap()` should never be `MayPartiallyOverlap`, because if that were the case, we should have inserted as `Chi` instruction and hooked the definition up to that instead.

There are quite a few existing failures.
 2020-03-23 14:37:06 -04:00
Rasmus Wriedt Larsen
b567205579 Python: Model fabric v1.x command injection sinks 2020-03-23 17:49:56 +01:00
Rasmus Wriedt Larsen
a57eadaeb6 Python: Model fabric/invoke command injection sinks 2020-03-23 17:33:41 +01:00
Anders Schack-Mulligen
f29f0f418f Dataflow: Exclude flow param-param flow through with identical params. 2020-03-23 17:27:53 +01:00
semmle-qlci
e5590091a0 Merge pull request #3109 from max-schaefer/js/performance-fixes 
Approved by asgerf
 2020-03-23 16:08:07 +00:00
Rasmus Wriedt Larsen
d475bb998e Python: Add abstract class CommandSink 
I'm going to add more in a sec, and listing *all* of them in CommandInjection.ql
started to be silly
 2020-03-23 17:04:08 +01:00
intrigus
1f635806b3 Fix copy-paste errors, remove debugging code 2020-03-23 16:49:45 +01:00
intrigus-lgtm
9187bacd3c Apply suggestion from code review 
Use getUnderlyingType() to account for named aliases.

Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
 2020-03-23 16:45:56 +01:00
Max Schaefer
55e7b22cdf JavaScript: Autoformat. 2020-03-23 14:37:04 +00:00
kyprizel
49e5a22cab Fixed code style for SockJS 
also fixed appCreation, thanks to Erik Krogh.
 2020-03-23 17:16:17 +03:00
Jonas Jensen
13465921a3 Merge pull request #3092 from dbartol/dbartol/VarArgIR2_ElectricBoogaloo 
C++: Better IR for varargs
 2020-03-23 14:13:54 +01:00