Asger F
3ccc3a2058
Ruby: move special treatment of Hash.[] into Hash.qll
2022-10-04 11:14:31 +02:00
Asger F
94d41b9fa4
Ruby: add hook for adding type-tracking steps
...
fixup docs
fixup docs
fixup TypeTrackingStep
2022-10-04 11:14:31 +02:00
Asger F
96711b2810
Ruby: improve join order in trackInstanceRec
2022-10-04 11:14:31 +02:00
Asger F
6e7aea85ef
Ruby: update benign test output
...
API graph tests only report the shortest path, and a new shortest path has appeared, but the old path is still there, so this is not a regression.
2022-10-04 11:14:31 +02:00
Asger F
c220f4e103
Ruby: prune unusable summaries earlier
...
Ruby: prune more aggressively
2022-10-04 11:14:30 +02:00
Asger F
ff4ce4a151
Ruby: use Element[n..] tokens in inject and reduce
2022-10-04 11:14:30 +02:00
Asger F
fd9c1e4507
Ruby: filter out obvious module 'prepend' calls
2022-10-04 11:14:30 +02:00
Asger F
00e52ad109
Ruby: add type-tracking variant of hash-flow test
...
Ruby: fixup type-tracking hash flow test
Fixup! type-tracking hash flow test result
2022-10-04 11:14:30 +02:00
Asger F
9302271c15
Ruby: Hack special-casing of hash literals
2022-10-04 11:14:30 +02:00
Asger F
bd11946aec
Ruby: support WithoutContent steps in restricted cases
...
fixup ContentFilter
fixup basicWith(out)contentstep
2022-10-04 11:14:28 +02:00
Asger F
323abf45ca
Ruby: Speed up evaluateSummaryComponentStackLocal
2022-10-04 11:12:09 +02:00
Asger F
a7d764d2a7
Ruby: Improve join order when generating edges
2022-10-04 11:12:09 +02:00
Asger F
8c43ab627f
Ruby: go to local source in load-store steps
2022-10-04 11:11:50 +02:00
Tony Torralba
2deb3e5625
Reapply "Java: Fix cartesian product"
...
This reverts commit c1654ce7cc
2022-10-04 11:11:44 +02:00
Asger F
8b389fe5f9
Ruby: use getACallSimple in more Hash methods
2022-10-04 11:08:46 +02:00
Asger F
74c3886167
Ruby: use getACallSimple in more Array methods
2022-10-04 11:08:46 +02:00
Asger F
c06743afb5
Ruby: update benign test updates
2022-10-04 11:08:46 +02:00
Asger F
f75f27d30e
Ruby: update test
2022-10-04 11:08:46 +02:00
Asger F
5b2d8b0894
Ruby: make Array.each a simple summary
2022-10-04 11:08:46 +02:00
Asger F
fbab0f50f2
Ruby: Evaluate longer summary component stacks
2022-10-04 11:08:46 +02:00
Asger F
0000a7d429
Ruby: Summarize load-store steps in type-tracking
...
fixup to LoadStore
2022-10-04 11:08:44 +02:00
Asger F
a4d4e406c6
Ruby: Summarize level steps in type tracking
2022-10-04 11:06:44 +02:00
Asger F
1c484d80aa
Ruby: add some calls to .each in call graph test
2022-10-04 11:06:44 +02:00
Asger F
ab672ded6a
Ruby: strip trailing whitespace in calls.rb test
2022-10-04 11:06:44 +02:00
tyage
7205903a36
Using implicit this
2022-10-04 18:06:30 +09:00
Chris Smowton
58cb5446c3
Add cross-check to getValueParameterLabel
2022-10-04 10:04:18 +01:00
Tony Torralba
281e49daf7
Revert "Java: Add CompilationUnit.getATypeAvailableBySimpleName()"
...
This reverts commit 431aa2cb79
2022-10-04 10:59:45 +02:00
Tony Torralba
01b950f68b
Revert "Java: Rename predicate to getATypeInScope"
...
This reverts commit fd99ae78b3
2022-10-04 10:59:43 +02:00
Tony Torralba
df29e05b9f
Revert "Java: Adjust ImpossibleJavadocThrows.ql"
...
This reverts commit c40b6285a2
2022-10-04 10:59:39 +02:00
Tom Hvitved
12536578d4
Merge pull request #10664 from hvitved/type-tracking-more-caching
...
Ruby/Python: Cache more type tracking predicates
2022-10-04 10:58:41 +02:00
tyage
f47c02431a
Merge branch 'main' into property-stringify
2022-10-04 09:57:54 +01:00
tyage
6ec2abbd2d
add change note
2022-10-04 17:57:08 +09:00
Tony Torralba
c1654ce7cc
Revert "Java: Fix cartesian product"
2022-10-04 10:56:32 +02:00
tyage
192c1f3d89
make test json.stringify
2022-10-04 17:40:52 +09:00
Mathias Vorreiter Pedersen
2593120300
Merge pull request #10597 from geoffw0/swifttaintsource
...
Swift: URL taint sources
2022-10-04 09:22:27 +01:00
tyage
726cd2ca8a
refactor test
2022-10-04 17:11:37 +09:00
tyage
9df0720da9
refactoring
2022-10-04 17:05:49 +09:00
tyage
2006ae8332
rename file
2022-10-04 17:05:15 +09:00
Tom Hvitved
76abf6fbd6
C#: Add another dotnet run integration test
2022-10-04 09:56:24 +02:00
Tom Hvitved
01830904ff
C#: Recognize options to dotnet run in tracer when injecting -p:UseSharedCompilation=false
2022-10-04 09:54:48 +02:00
Tamas Vajk
2c467376ea
Revert "Only log once the missing java-kotlin method mapping warnings"
...
This reverts commit 7524f3372d
2022-10-04 08:54:07 +02:00
tyage
8a7f23a8ea
support VarRef
2022-10-04 14:45:39 +09:00
tyage
33d204913c
add test for json stringify xss
2022-10-04 14:45:09 +09:00
Dilan Bhalla
888d756472
Merge branch 'dilan-java/guidance-exectainted' of https://github.com/dilanbhalla/codeql into dilan-java/guidance-exectainted
2022-10-03 14:49:45 -07:00
Dilan Bhalla
536276a82b
Merge branch 'main' of https://github.com/github/codeql into dilan-java/guidance-exectainted
2022-10-03 14:48:50 -07:00
dilanbhalla
35948b097d
Merge branch 'main' into dilan-java/guidance-exectainted
2022-10-03 13:56:05 -07:00
Rasmus Wriedt Larsen
d7be27a1c0
Python: Fix experimental py/ip-address-spoofing
...
I realized the modeling was done in a non-recommended way, so I changed
the modeling. It was very nice that I could use API graphs for the flask
part, and a little sad when I couldn't for Django/Tornado.
2022-10-03 21:19:30 +02:00
Harry Maclean
42a97b26bb
Merge pull request #10316 from hmac/hmac/actionview
...
Ruby: Model ActionView
2022-10-04 08:16:16 +13:00
Rasmus Wriedt Larsen
b01a0ae696
Python: Adjust .expected after flask source change
...
It's really hard to audit that this is all good.. I tried my best with
`icdiff` though -- and there is a problem with
ql/src/experimental/Security/CWE-348/ClientSuppliedIpUsedInSecurityCheck.ql
that needs to be fixed in the next commit
2022-10-03 20:35:49 +02:00
Robert Marsh
98f4caf76f
Merge pull request #10645 from MathiasVP/add-more-range-analysis-tests
...
C++: Port SimpleRangeAnalysis tests to the new range-analysis
2022-10-03 14:34:56 -04:00
