hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-08 11:11:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
51,797 Commits 1,691 Branches 160 Tags
codeql-cli/v2.12.5
Commit Graph

51797 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Harry Maclean
fb86ef4aac Ruby: Model ActionController filters 
ActionController filters provide a way to register callbacks that run
before, after or around an action (i.e. HTTP request handler). They run
in the same class context as the action, so can get/set instance
variables and generally interact with the action in arbitrary ways.

In order to track flow between filters and actions, we have to model the
callback chain. This commit does that. A later change will add dataflow
steps to actually track flow through the chain.
 2023-01-30 17:41:36 +13:00
Sim4n6
7079def7ce Add an S3 source with Session or download_fileobj 2023-01-30 00:49:23 +01:00
erik-krogh
e3455a9b21 add support for axios used as a global variable 2023-01-29 22:55:20 +01:00
Mathias Vorreiter Pedersen
9573395237 Merge pull request #12005 from MathiasVP/flow-out-of-invalid-functions 
C++: Flow out of invalid functions
 2023-01-29 16:15:40 +00:00
Sim4n6
0707064ab5 Constrain the save/path step 2023-01-28 10:14:24 +01:00
Sim4n6
a4aaf0ec6f Remove a write step & update the builtin open step 2023-01-28 09:53:54 +01:00
Nora Dimitrijević
d5f11dfe60 Swift: db upgrade/downgrade script 2023-01-28 00:44:49 +01:00
Nora Dimitrijević
1396d07662 Swift: subsume IterableDeclContext into Decl [tests] 2023-01-28 00:44:49 +01:00
Nora Dimitrijević
9a5614e8c5 Swift: subsume IterableDeclContext into Decl [codegen'd] 2023-01-28 00:44:49 +01:00
Nora Dimitrijević
f96c18a6db Swift: subsume IterableDeclContext into Decl [hand-written] 2023-01-28 00:44:48 +01:00
Sim4n6
0e2f37825d Organize steps to correspond to the sample code 2023-01-27 23:58:03 +01:00
Sim4n6
ee213123ac Add builtin open as an additional step 2023-01-27 18:16:11 +01:00
Mathias Vorreiter Pedersen
95b15825f9 DataFlow: Sync identical files. 2023-01-27 16:24:31 +00:00
Mathias Vorreiter Pedersen
a691535e77 C++: Fix join order in 'fwdFlowRead'. 2023-01-27 16:24:08 +00:00
Jami Cogswell
85c228a0cd Java: remove old sinks 2023-01-27 10:40:17 -05:00
Jami Cogswell
a3fe8c0e93 Java: add change note 2023-01-27 10:35:16 -05:00
Jami Cogswell
9bf43483db Java: update package for QueryProducer sinks 2023-01-27 10:16:42 -05:00
Sim4n6
0b27b1314a Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2023-01-27 16:12:08 +01:00
Sim4n6
7a126a2317 Merge branch 'github:main' into UnsafeUnpack 2023-01-27 16:09:41 +01:00
Sim4n6
8ef2aa00e7 Update python/ql/src/experimental/Security/UnsafeUnpackQuery.qll 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2023-01-27 16:07:39 +01:00
Rasmus Wriedt Larsen
cef933f813 Python: Add comment explaining SINK3_F(kwargs["c"]) test 
Co-authored-by: yoff <yoff@github.com>
 2023-01-27 15:48:59 +01:00
Geoffrey White
6c0b50c696 Merge pull request #11980 from geoffw0/modern2 
Swift: Structure modernized queries more consistently
 2023-01-27 14:33:43 +00:00
Geoffrey White
794ba428a7 Merge pull request #11942 from geoffw0/rncrypt4 
Swift: add RNCryptor sinks to swift/static-initialization-vector
 2023-01-27 14:33:06 +00:00
Rasmus Wriedt Larsen
c099dbd04c Python: Expand notes around bound methods self argument passing 2023-01-27 15:27:45 +01:00
Sim4n6
207ed3da9c Constrain the object & the call 2023-01-27 15:07:20 +01:00
Mathias Vorreiter Pedersen
587b4fee9d C++: Add missing condition to 'isChiBeforeIteratorUse'. 2023-01-27 14:04:01 +00:00
James Fletcher
812306cb52 Merge pull request #12006 from felickz/patch-2 
Add link to codeql metadata article for problem.severity
 2023-01-27 13:59:06 +00:00
Mathias Vorreiter Pedersen
e48c93a3b5 Merge pull request #12003 from MathiasVP/positive-formulated-sanitizer-nonconst-format 
C++: Positively phrased sanitizer in `cpp/non-constant-format`
 2023-01-27 13:58:04 +00:00
alexet
1b0952c512 Use Java 11 for some integration tests 2023-01-27 13:51:44 +00:00
Chad Bentz
4fee536e6d table spacing 2023-01-27 08:19:43 -05:00
Sim4n6
18d8bbc9a4 Updated the expected results accordingly 2023-01-27 14:05:25 +01:00
Chad Bentz
3ef4d3118c Add link to codeql metadata article for problem.severity 2023-01-27 08:01:07 -05:00
Sim4n6
e41042418a Update the import relative to the dataflow config 2023-01-27 13:46:57 +01:00
Sim4n6
5f0bf1053a Update the dataflow test query and the expected results 2023-01-27 13:42:57 +01:00
Sim4n6
bca053f855 Move the config query to the parent directory 2023-01-27 13:42:14 +01:00
Mathias Vorreiter Pedersen
2b47e150c6 C++: Accept test changes. 2023-01-27 11:44:17 +00:00
Mathias Vorreiter Pedersen
ec7b406cc9 C++: Generate flow out of parameters whose enclosing function is missing a return statement. 2023-01-27 11:44:04 +00:00
Rasmus Wriedt Larsen
02b3a1b515 Python: At most one **kwargs ParameterNode per callable 
Similar to the Ruby changes from
https://github.com/github/codeql/pull/11461

I feel the change to `DataFlowFunciton.getParameter` where we use
`not exists(func.getArgByName(_))` is not very great, but I was not allowed
to use `not exists(this.getParameter(any(ParameterPosition _).isKeyword(_)))`
because of negative recursion.
 2023-01-27 11:14:42 +01:00
Mathias Vorreiter Pedersen
e8db563e98 C++: Reformulate the sanitizer in 'NonConstantFormat.ql'. It should no longer incorrectly sanitize indirect nodes for which there is no result for 'asIndirectExpr'. 2023-01-27 10:04:48 +00:00
Robert Marsh
6a91e85981 C++: fix UseImpl after merge conflict 2023-01-26 16:01:37 -05:00
Sim4n6
998f1bf215 Some reformatting 2023-01-26 18:54:36 +01:00
Robert Marsh
3648f26cca Merge remote-tracking branch 'origin/mathiasvp/replace-ast-with-ir-use-usedataflow' into global-flow 
Resolved trivial conflicts.
 2023-01-26 11:58:53 -05:00
Ian Lynagh
75562e7fb5 Kotlin: Remove legacy trap-locking support 2023-01-26 16:58:51 +00:00
Mathias Vorreiter Pedersen
ee62f2a223 C++: Fix global variable exclusion in DTT. 2023-01-26 16:49:58 +00:00
Mathias Vorreiter Pedersen
8c224429b3 C++: Better 'getType' for global variable nodes. 2023-01-26 16:49:49 +00:00
Nora
5993b60980 Update copy 2023-01-26 17:37:15 +01:00
Sim4n6
1a211485a4 Restrain the source and add two steps. 2023-01-26 17:07:59 +01:00
Michael B. Gale
f192191e8c Merge pull request #11997 from github/smowton/fix/deperrors-conditional 
Go: Fix DepErrors test
 2023-01-26 14:52:27 +00:00
Sim4n6
51b11de44a Add a Django Upload examples 2023-01-26 15:16:24 +01:00
Mathias Vorreiter Pedersen
bfe9ae22ad Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow 2023-01-26 13:03:49 +00:00