hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-05 07:06:47 +01:00
Code Issues Packages Projects Releases Wiki Activity
51,797 Commits 1,700 Branches 161 Tags
codeql-cli/v2.12.5
Commit Graph

51797 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Cornelius Riemenschneider
d8aae1c126 Add tests to track nullness by instanceof checks. 2019-11-21 18:38:27 +01:00
Max Schaefer
228e95a646 Merge pull request #185 from sauyon/open-redirect-fp1 
OpenRedirect: treat assignments to Url.Path as a barrier
 2019-11-21 16:51:16 +00:00
Sauyon Lee
81ba71e47b Address review comments 2019-11-21 08:29:01 -08:00
Erik Krogh Kristensen
94e9c0203d add test for exceptional taint-flow 2019-11-21 17:16:13 +01:00
shati-patel
b6a05399da C# change notes: Remove duplicated heading 2019-11-21 16:08:44 +00:00
Shati Patel
d8c6361312 Merge pull request #187 from max/rc/1.23 
Add change notes for 1.23.
 2019-11-21 16:07:21 +00:00
semmle-qlci
8cca9b05ea Merge pull request #2393 from max-schaefer/js/improve-incomplete-sanitization-docs 
Approved by mchammer01
 2019-11-21 16:04:19 +00:00
Max Schaefer
7136713a5f Add change notes for 1.23. 2019-11-21 15:50:40 +00:00
Asger F
ec8ced7963 TS: Fix a typos and leftover todo 2019-11-21 15:39:37 +00:00
Asger F
01ab8f07eb TS: Fix a crash when allowJs: true was set 2019-11-21 15:39:37 +00:00
Asger F
7d558d165a JS: Update extractor version string 2019-11-21 15:39:37 +00:00
Asger F
33a44de47d TS: Add upgrade script 2019-11-21 15:39:37 +00:00
Asger F
2c916cb4f3 TS: Update stats 2019-11-21 15:39:37 +00:00
Asger F
dd50d29827 TS: Fix crash in case of missing type roots 2019-11-21 15:39:37 +00:00
Asger F
4a885cbf92 TS: Expose optional parameters at syntax level 2019-11-21 15:39:37 +00:00
Asger F
b6b8213e13 TS: Handle rest parameters in call signatures 2019-11-21 15:39:37 +00:00
Asger F
f2c3d734ea TS: Update some more tests 2019-11-21 15:39:37 +00:00
Asger F
0c41d6910f TS: Pass tsconfig options correctly 2019-11-21 15:39:37 +00:00
Asger F
23f8d27447 TS: Simplify debugging 2019-11-21 15:39:37 +00:00
Asger F
8205a59688 TS: Unfold aliases in Type.unfold() 2019-11-21 15:39:37 +00:00
Asger F
e25ee182a0 TS: Extract type alias relation 2019-11-21 15:39:37 +00:00
Asger F
f11dc11ade TS: Fix type of RHS of TypeAliasDeclaration 2019-11-21 15:39:37 +00:00
Asger F
a3aef1e4e0 TS: Update TypeAlias test 2019-11-21 15:39:37 +00:00
Taus Brock-Nannestad
033524ce63 Python: Support forward references inside return type annotations. 
Should fix #2407.

Also allows for the string containing the forward reference to appear inside a
subexpression of the type annotation.
 2019-11-21 15:37:32 +01:00
James Fletcher
0b274e5b23 Merge pull request #2386 from shati-patel/docs/demos 
QL docs: Update links to blog/demos
 2019-11-21 13:53:05 +00:00
Erik Krogh Kristensen
42a0a62e4c remove 3 FP sources from use-of-returnless-function 2019-11-21 14:27:04 +01:00
Jonas Jensen
f98cd673fd C++: Autoformat 2019-11-21 14:02:53 +01:00
Esben Sparre Andreasen
edb94db6ef JS: add change notes 2019-11-21 13:20:08 +01:00
Esben Sparre Andreasen
03c83c9c9d JS: model React's getDerivedStateFromError 2019-11-21 13:18:43 +01:00
Esben Sparre Andreasen
23d29a80db JS: improve comment syntax 2019-11-21 13:16:40 +01:00
Esben Sparre Andreasen
6328a0a8b9 JS: improve FP filter for js/unbound-event-handler-receiver 2019-11-21 13:13:40 +01:00
Taus Brock-Nannestad
9fda4ab480 Python: Fix false positive in py/non-iterator-in-for-loop 
Should fix #1833, #2137, and #2187.

Internally, comprehensions are (at present) elaborated into local functions and
iterators as described in [PEP-289](https://www.python.org/dev/peps/pep-0289/).
That is, something like:

```
g = (x**2 for x in range(10))
```

becomes something akin to

```
def __gen(exp):
    for x in exp:
        yield x**2
g = __gen(iter(range(10)))
```

In the context of the top-level of a class, this means `__gen` looks as if it is
a method of the class, and in particular `exp` looks like it's the `self`
argument of this method, which leads the points-to analysis to think that `exp`
is an instance of the surrounding class itself.

The fix in this case is pretty simple: we look for occurrences of `exp` (in fact
called `.0` internally -- carefully chosen to _not_ be a valid Python
identifier) and explicitly exclude this parameter from being classified as a
`self` parameter.
 2019-11-21 11:49:29 +01:00
Rasmus Wriedt Larsen
53576a4781 Merge pull request #2397 from tausbn/python-make-tostrings-visible 
Python: Add `toString` information for all classes without such.
 2019-11-21 11:46:22 +01:00
Jonas Jensen
7f26f078eb C++: Fix isFromMacroDefinition join order 
This fixes the performance of `SignedOverflowCheck.ql` on
jluttine/suitesparse.
 2019-11-21 11:01:50 +01:00
Jonas Jensen
82499b035b C++: Use isFromMacroDefinition for exclusion 
The `SignedOverflowCheck.ql` query was very slow on certain snapshots
(jluttine/suitesparse and Chromium) due to bad magic in
`MacroInvocation::getAnAffectedElement_dispred#fb`. This commit doesn't
fix the bad magic but changes the exclusion mechanism to use a predicate
where we can better control the magic and optimization.

The query should also give more good results due to this new exclusion
mechanism, which is the same one used in its sibling,
`PointerOverflow.ql`.
 2019-11-21 10:40:36 +01:00
Robert Marsh
15f50e6a38 Update docs/language/learn-ql/cpp/dataflow.rst 
Co-Authored-By: James Fletcher <42464962+jf205@users.noreply.github.com>
 2019-11-20 15:44:29 -08:00
Max Schaefer
a54d30c053 Merge pull request #186 from sauyon/taint-split 
Split taintStep into many predicates
 2019-11-20 20:39:27 +00:00
Sauyon Lee
3f437612e1 Add qldoc to all taint step predicates. 2019-11-20 11:27:24 -08:00
Sauyon Lee
1092fe5870 Move SsaWithFields to the Ssa file and rework it for public use 
Also use it in OpenRedirect
 2019-11-20 11:20:55 -08:00
Sauyon Lee
4c9bf2265e OpenRedirect: treat assignments to Url.Path as a barrier 2019-11-20 11:20:54 -08:00
Robert Marsh
34593701b2 Merge branch 'master' into rdmarsh/cpp/ir-callee-side-effects 2019-11-20 10:03:32 -08:00
Geoffrey White
403899ecbc Merge pull request #2391 from jbj/CompareWhereAssignMeant-decltype 
C++: Fix FP for expression SFINAE with decltype
 2019-11-20 17:34:09 +00:00
Geoffrey White
5c855fc925 CPP: Change note. 2019-11-20 15:34:41 +00:00
Geoffrey White
2212c47db2 CPP: Use dataflow more consistently. 2019-11-20 15:34:40 +00:00
Geoffrey White
e6ea705ff2 CPP: Switch from a blacklist to whitelist approach for determining null termination. 2019-11-20 15:34:38 +00:00
Jonas Jensen
6616eb852e C++: Mention flow through fields 2019-11-20 16:25:13 +01:00
Geoffrey White
fbd9d9bdab CPP: Add a test case involving the std::string constructor. 2019-11-20 15:20:21 +00:00
Jonas Jensen
ff96e3a8ea C++: Also suppress ExprHasNoEffect in declspec etc 2019-11-20 15:44:39 +01:00
Jonas Jensen
4ad8995440 C++: Group all the 1.23 data flow changes 2019-11-20 15:34:49 +01:00
Jonas Jensen
a48f347db9 C++: Don't mention predicate hasStdName 
This predicate was removed before #1585 was merged, but we forgot to
remove it from the change note.
 2019-11-20 15:33:32 +01:00