hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-31 04:38:18 +02:00
Code Issues Packages Projects Releases Wiki Activity
48,840 Commits 1,723 Branches 164 Tags
codeql-cli/v2.12.0
Commit Graph

48840 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Max Schaefer
72de4728a2 Suppress unhelpful magic. 2020-02-07 11:09:33 +00:00
Tom Hvitved
f30a42ce26 Data flow: Fix bad join-order in TPathNodeSink 
Avoids a Cartesian product on nodes:

```
[2020-02-07 11:01:22] (432s) Tuple counts for dom#DataFlowImpl::TPathNodeSink#ff:
                      0          ~0%      {2} r1 = JOIN DataFlowImpl::Configuration::isSource_dispred#ff AS L WITH DataFlowImpl::Configuration::isSink_dispred#ff AS R ON FIRST 2 OUTPUT R.<1>, R.<0>
                      101611     ~0%      {2} r2 = SCAN DataFlowImpl::PathNodeMid#class#ffffff AS I OUTPUT I.<5>, I.<0>
                      3534537047 ~3%      {3} r3 = JOIN r2 WITH DataFlowImpl::Configuration::isSink_dispred#ff AS R ON FIRST 1 OUTPUT r2.<1>, R.<1>, R.<0>
                      251        ~41%     {3} r4 = JOIN r3 WITH project#DataFlowImpl::pathStep#fffff AS R ON FIRST 2 OUTPUT R.<2>, r3.<2>, r3.<1>
                      251        ~50%     {2} r5 = JOIN r4 WITH DataFlowImpl::TNil#ff_1#join_rhs AS R ON FIRST 1 OUTPUT r4.<2>, r4.<1>
                      251        ~50%     {2} r6 = r1 \/ r5
                      323        ~67%     {3} r7 = JOIN r6 WITH DataFlowImpl::flow#ff AS R ON FIRST 1 OUTPUT r6.<1>, r6.<0>, R.<1>
                      288        ~58%     {3} r8 = SELECT r7 ON r7.<2> >= r7.<0>
                      251        ~53%     {3} r9 = SELECT r8 ON r8.<2> <= r8.<0>
                      251        ~50%     {2} r10 = SCAN r9 OUTPUT r9.<1>, r9.<0>
```
 2020-02-07 12:08:31 +01:00
Max Schaefer
69edfe08df Make regular expression for format strings more precise. 2020-02-07 11:05:44 +00:00
Max Schaefer
8b0d271717 Locally resolve calls to function expressions. 2020-02-07 11:05:44 +00:00
Max Schaefer
f6305f019d Minor refactoring. 2020-02-07 11:05:44 +00:00
Max Schaefer
46a8f8c8ed Remove Function.getACallExpr. 2020-02-07 11:05:44 +00:00
Max Schaefer
39b7272241 Teach Function.getACall to take virtual dispatch into account. 2020-02-07 11:05:44 +00:00
Max Schaefer
84002f585e Remove CallExpr.getACallee(). 2020-02-07 11:05:44 +00:00
Max Schaefer
cf0e38b22c Move virtual dispatch resolution from CallExpr to CallNode and generalise it very slightly. 2020-02-07 11:05:44 +00:00
Max Schaefer
253a394ae0 Make CallNode.getCalleeName() more robust to missing type information. 2020-02-07 11:05:44 +00:00
Max Schaefer
93a84684a5 Remove predicate CallExpr.calls. 
This sort of reasoning should be done at the data-flow level.
 2020-02-07 11:05:44 +00:00
Max Schaefer
9400442bea Add call graph test. 
This test uses annotations to encode the expected output directly into the source, hence the `.expected` files are trivial.
 2020-02-07 11:05:41 +00:00
Calum Grant
389e6266d9 Merge pull request #2773 from hvitved/csharp/useless-assignment-to-local-default 
C#: Remove false positives for `cs/useless-assignment-to-local`
 2020-02-07 10:37:19 +00:00
james
f2320bbe56 docs: add link to module resolution in ql spec 2020-02-07 10:26:31 +00:00
Sauyon Lee
5dbebe44f5 Package tests: also select raw database path 2020-02-07 02:25:26 -08:00
Sauyon Lee
2cb61911c3 Package tests: Limit to specific packages 2020-02-07 02:23:28 -08:00
Sauyon Lee
9a9561bb12 Remove vendored path prefix of vendored packages 2020-02-07 02:17:54 -08:00
Erik Krogh Kristensen
8ea6070120 add indirect command injection sink for a concatenated array 2020-02-07 11:04:34 +01:00
Asger Feldthaus
a2fa6bb41f JS: Add test case for lazy-cache 2020-02-07 09:50:37 +00:00
Jonas Jensen
19286bd82a Merge pull request #2765 from MathiasVP/ir-gvn-ast-wrapper-fixup 
C++: Make AST GVN a wrapper for IR-based GVN
 2020-02-07 08:49:15 +01:00
semmle-qlci
e05dd352ad Merge pull request #2768 from asger-semmle/js/protopol-packages 
Approved by esbena
 2020-02-07 07:21:04 +00:00
yo-h
9c3fed7550 Merge pull request #2734 from aschackmull/java/taint-postupdate 
Java: Improve taint step modeling to use postupdate nodes.
 2020-02-06 21:17:55 -05:00
Robert Marsh
dac4f0fac0 Merge pull request #2763 from jbj/ir-VariableNode 
C++: DefaultTaintTracking perf fix for globals
 2020-02-06 18:54:14 -05:00
Robert Marsh
2d3a742b7f C++: autoformat and accept test changes 2020-02-06 13:41:00 -08:00
Robert Marsh
692207472a Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams 2020-02-06 11:42:30 -08:00
Tom Hvitved
b3af3ad12f Data flow: Fix bad join order in getReturnPosition() 
Joining on the enclosing callable before the kind is crucial, as witnessed by this pipeline:

```
[2020-02-06 17:58:21] (1086s) Starting to evaluate predicate DataFlowImplCommon::getReturnPosition#ff/2@83c546
[2020-02-06 18:53:16] (4382s) Tuple counts for DataFlowImplCommon::getReturnPosition#ff:
                      385478      ~1%     {3} r1 = SCAN DataFlowImplCommon::Cached::TReturnPosition0#fff@staged_ext AS I OUTPUT I.<2>, I.<0>, I.<1>
                      385478      ~2%     {3} r2 = JOIN r1 WITH DataFlowImplCommon::Cached::TReturnPosition0#fff_2#join_rhs AS R ON FIRST 1 OUTPUT r1.<2>, r1.<1>, r1.<0>
                      58638116860 ~0%     {3} r3 = JOIN r2 WITH DataFlowImplCommon::ReturnNodeExt::getKind_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r2.<1>, r2.<2>
                      914049      ~0%     {2} r4 = JOIN r3 WITH DataFlowImplCommon::returnNodeGetEnclosingCallable#ff AS R ON FIRST 2 OUTPUT r3.<0>, r3.<2>
                                          return r4
```
 2020-02-06 19:06:40 +01:00
Mathias Vorreiter Pedersen
538c2b205d C++: Accept output 2020-02-06 18:44:08 +01:00
Sauyon Lee
c94f5dafb3 Merge pull request #237 from Semmle/go-build-env-windows 
Fix extractor build on Windows.
 2020-02-06 09:06:33 -08:00
Asger Feldthaus
91a5385e7f JS: Add libraries to change note 2020-02-06 14:59:52 +00:00
Asger Feldthaus
a628f787e8 JS: Fix qldoc comment 2020-02-06 14:59:52 +00:00
Asger Feldthaus
f84af74d1d JS: Handle more libraries 2020-02-06 14:59:52 +00:00
Asger Feldthaus
c559ab13e7 JS: Add test and handle parameter with source object 2020-02-06 14:59:52 +00:00
Asger Feldthaus
34a9dce33d JS: Detect property enumeration through for-own 2020-02-06 14:59:52 +00:00
Asger Feldthaus
418f841749 JS: Handle imports through lazy-cache 2020-02-06 14:59:52 +00:00
semmle-qlci
180e9d4731 Merge pull request #2779 from asger-semmle/js/protopol-regression-fix 
Approved by esbena
 2020-02-06 14:58:19 +00:00
Mathias Vorreiter Pedersen
2017ca8154 C++/C#: Sync identical files 2020-02-06 15:53:23 +01:00
Mathias Vorreiter Pedersen
f02513e376 C++: Exclude UnknownLocation results from getLocation if there is a location that's known 2020-02-06 15:53:22 +01:00
Mathias Vorreiter Pedersen
23ca363b87 C++: Formatting 2020-02-06 15:53:22 +01:00
Mathias Vorreiter Pedersen
98969e3bf9 C++: Accepted ir_gvn output after toString change 2020-02-06 15:53:22 +01:00
Erik Krogh Kristensen
75f23a189d update docstring 
Co-Authored-By: Asger F <asgerf@github.com>
 2020-02-06 15:53:03 +01:00
Mathias Vorreiter Pedersen
0d181a7101 C++: Add tests and accept output 2020-02-06 15:48:08 +01:00
Erik Krogh Kristensen
2865723059 add test for new barrier 2020-02-06 15:44:33 +01:00
Erik Krogh Kristensen
ade93e66e1 move the if(!x) from DataFLow to TaintTracking 2020-02-06 15:44:22 +01:00
Mathias Vorreiter Pedersen
69e085dda7 C++: Add getDebugString predicate and use it in ValueNumberPropertyProvider 2020-02-06 15:43:57 +01:00
Mathias Vorreiter Pedersen
ef89e3bdb5 C++: Added charpred to ensure that only instructions that have a source representation have a GVN 2020-02-06 15:43:57 +01:00
Mathias Vorreiter Pedersen
63f1d3ded7 C++: Replace rank[1] with min 2020-02-06 15:43:57 +01:00
Mathias Vorreiter Pedersen
2303dac0b7 C++: Implemented getKind to new GVN class and added predicates for obtaining expressions from a GVN 2020-02-06 15:43:57 +01:00
Mathias Vorreiter Pedersen
8041804bac C#: Include TValueNumber in internal files 2020-02-06 15:39:27 +01:00
Robert Marsh
2f91778e7e C++: add IR-based wrapper for value numbering 2020-02-06 15:35:20 +01:00
Robert Marsh
ffaaed0550 C++: separate IR ValueNumber newtype and interface 2020-02-06 15:35:20 +01:00