Andrew Eisenberg
996695dc6f
Merge pull request #10367 from github/aeisenberg/packs-docs-changes-3.7
...
Port Pack Docs changes to 3.7
2022-09-13 08:06:34 -07:00
Ian Lynagh
6a63b86f8a
Java: Member.getQualifiedName() tweaked
...
It now includes the qualified name of the declaring type.
2022-09-13 16:05:51 +01:00
Ian Lynagh
fc445736b2
Java: Use hasQualifiedName rather than getQualifiedName in ExternalAPIs
...
It's more efficient, as it doesn't require building intermediate
strings.
2022-09-13 15:58:00 +01:00
Rasmus Wriedt Larsen
2e95e25afb
Merge pull request #10406 from RasmusWL/ruby-instanceof
...
Ruby: Rewrite a few `::Range` uses to `instanceof`
2022-09-13 16:57:13 +02:00
Tony Torralba
ac46a38b9d
Update java/ql/src/Security/CWE/CWE-079/XSS.java
2022-09-13 16:49:20 +02:00
Tony Torralba
2b027709e4
Update XSS qhelp
2022-09-13 16:39:48 +02:00
AlexDenisov
aacc368228
Merge pull request #10399 from github/redsun82/swift-macos-arm
...
Swift: print a helpful message on macOS ARM
2022-09-13 16:24:38 +02:00
Henry Mercer
bc2de7ed4b
Merge branch 'main' into codeql-ci/js/ml-powered-pack-release-0.3.3
2022-09-13 15:15:56 +01:00
github-actions[bot]
b40def71b9
JS: Bump version of ML-powered library and query packs to 0.3.4
2022-09-13 14:11:16 +00:00
github-actions[bot]
e08e22ac32
JS: Bump patch version of ML-powered library and query packs
2022-09-13 14:06:57 +00:00
james
d782e6c37c
fix broken anchor
2022-09-13 15:01:16 +01:00
gx1
1c4488e7c8
Updated vulnerable XSS.java version
2022-09-13 15:58:25 +02:00
Rasmus Wriedt Larsen
ca66a29b18
Go: Rewrite ::Range patterns to use instanceof
2022-09-13 15:48:17 +02:00
Tamas Vajk
2c757c714d
Kotlin: Code quality improvements: refactor a cast
2022-09-13 15:44:54 +02:00
Rasmus Wriedt Larsen
511030df48
Ruby: Rewrite a few ::Range uses to instanceof
2022-09-13 15:44:29 +02:00
Rasmus Wriedt Larsen
6f5701f9c7
Go: Rewrite concepts to use extends ... instanceof ...
2022-09-13 15:36:16 +02:00
james
ff4b1ce913
fix indentation
2022-09-13 14:34:06 +01:00
erik-krogh
93a67101e7
add a QL-for-QL query highlighting some issues with alert-texts
2022-09-13 15:24:15 +02:00
erik-krogh
338aead8cc
add more guidance to the style-guide about alert messages
2022-09-13 15:22:43 +02:00
james
4e582debfc
mention compatibility with CLI used by GHES
2022-09-13 14:21:41 +01:00
Rasmus Wriedt Larsen
24d28e0482
Docs: Use instanceof in ::Range pattern description
...
Had to change the example away from Go, since their libs have not been
updated to use `instanceof` yet (but I'll make a PR from them shortly)
2022-09-13 15:21:15 +02:00
james
1fceeed32c
address review comments
2022-09-13 13:53:05 +01:00
Ian Lynagh
2f8151d8d2
Kotlin: Remove a throw statement
...
We have a way to carry on here, so we may as well do so
2022-09-13 13:51:00 +01:00
Erik Krogh Kristensen
46751e515c
Merge pull request #10388 from erik-krogh/exportNew
...
JS: recognize returning an instance of a class as exporting that class
2022-09-13 13:45:16 +02:00
Anders Schack-Mulligen
b8a1818422
Java: Fix test expectation.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
0e376b32d2
Java: extend typeflow tests to cover union types.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
d0f7052de2
Java: Support instanceof disjunction in union type flow.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
686e03e1cc
Java: Fix perf issue.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
c8b93e0910
Java: Replace uses of deprecated variableTrack.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
a8eedce8ab
Java: Replace ad-hoc variable tracking with union type flow in dispatch.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
6f06267892
Java: Implement union type flow.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
7692a9e2e7
Java: Minor TypeFlow tweaks.
2022-09-13 13:30:40 +02:00
Anders Schack-Mulligen
85d4742a01
Java: Add dispatch test showing lack of union types.
2022-09-13 13:30:40 +02:00
Mathias Vorreiter Pedersen
c7ccff2e20
C++: Accept test changes.
2022-09-13 12:11:22 +01:00
Asger F
d3d47a261c
JS: Accept test output again
2022-09-13 11:56:51 +02:00
Tom Hvitved
4247843a27
Ruby: Adjust the scope of singleton class targets
...
In
```rb
class << x
...
end
```
the scope of `x` is not the singleton class itself, but rather the outer scope.
2022-09-13 11:39:38 +02:00
Tom Hvitved
87db5fc6b1
Ruby: Add tests for getEnclosing{Method,Module}
2022-09-13 11:39:15 +02:00
Erik Krogh Kristensen
2739b9cfd8
Merge pull request #10390 from erik-krogh/unmentionedGuard
...
QL: add unmentioned guard class query
2022-09-13 11:04:13 +02:00
Paolo Tranquilli
9227203336
Swift: print a helpful message on macOS ARM
...
Also remove the tentative way compilation was expected to be fixed on
macOS ARM without really working.
In the future we will create universal binaries (which requires
compiling our prebuilt package for ARM as well), but until then we must
require the developer to pass `--cpu=darwin_x86_64` to the build
command when building on an ARM macOS platform like the M1. This will be
printed out explicitly now if it's not the case.
2022-09-13 11:00:47 +02:00
Erik Krogh Kristensen
86417cec34
Merge pull request #10381 from erik-krogh/protoList
...
JS: recognize a list of bad strings as a sanitizer for `js/prototype-polluting-assignment`
2022-09-13 11:00:29 +02:00
Asger F
87ab16a7af
JS: Update test expectations
2022-09-13 10:59:12 +02:00
erik-krogh
063c76b6d1
apply suggestions from review
2022-09-13 10:52:23 +02:00
Mathias Vorreiter Pedersen
4130616ab1
C++: Use experimental dataflow for the product flow library.
2022-09-13 09:41:03 +01:00
Robert Marsh
ededfaa40b
C++: use-use flow in ArrayAccessProductFlow
2022-09-13 09:39:39 +01:00
Robert Marsh
0fcfe5772f
C++: query-specific model for ffmpeg allocator
2022-09-13 09:39:31 +01:00
Robert Marsh
61017a7997
C++: prevent a bad join order
2022-09-13 09:39:11 +01:00
Mathias Vorreiter Pedersen
7f6b400b78
Merge pull request #10366 from MathiasVP/use-use-flow-in-experimental
...
C++: Use-use flow in `experimental`
2022-09-13 09:30:48 +01:00
Asger F
eca2632a3e
JS: Add change note
2022-09-13 10:17:34 +02:00
Asger F
f411798101
JS: Fix typo in alert message
2022-09-13 10:13:34 +02:00
Asger F
b4e6fb781a
JS: Consider empty regexp to be obviously empty
2022-09-13 10:13:03 +02:00
