hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-15 22:43:43 +01:00
Code Issues Packages Projects Releases Wiki Activity
51,820 Commits 1,690 Branches 160 Tags
codeql-cli/v2.12.6
Commit Graph

51820 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Wriedt Larsen
977792070a Java: Fix tag missing from getARelevantTag 2022-10-27 09:11:24 +02:00
Rasmus Wriedt Larsen
fc7eb5b4fc InlineExpectationsTest: sync 2022-10-27 09:02:28 +02:00
Rasmus Wriedt Larsen
dbd84b2d37 InlineExpectationsTest: Add quote around missing tag 
To aid with quickly scanning where the missing tag is. I just had to do
this myself looking over some test failures, and it all just blurred
into each other in the logs.

see https://github.com/github/codeql/actions/runs/3332266045/jobs/5512944867#step:5:467
 2022-10-27 09:02:28 +02:00
Tamás Vajk
f1fcb64e94 Merge pull request #10992 from tamasvajk/kotlin-unused-extension 
Kotlin: do not report on unused `object` extension parameters
 2022-10-27 08:50:33 +02:00
tyage
c22f9443f2 Refactoring Next.js parameter 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2022-10-27 10:28:51 +09:00
tyage
e8b751ae17 Update javascript/ql/src/change-notes/2022-10-26-nextjs-params.md 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2022-10-27 10:24:08 +09:00
tyage
ac27307a2b Update javascript/ql/lib/semmle/javascript/frameworks/Next.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2022-10-27 10:23:59 +09:00
tyage
54050bf1b6 update test result XssWithAdditionalSources 2022-10-27 10:23:37 +09:00
Harry Maclean
bdb143cf83 Merge pull request #10913 from thiggy1342/expand-ruby-ssrf-sinks-faraday-connection-new 
Ruby: Add Faraday::Connection.new as sink for SSRF query
 2022-10-27 10:33:44 +13:00
Dave Bartolomeo
23b572e9b7 Use ${workspace} for intra-workspace dependencies 
Now that the released CLI supports replacement variables in dependency version ranges, we can now mark our published library packs as depending on whatever version of their dependency is in our workspace, without having to manually bump the dependency version every release.

Note that when the packs are published, the dependencies in the published pack file are rewritten to have the correct specific version.
 2022-10-26 16:40:01 -04:00
Jami Cogswell
1bfdfc954b shorten class/predicate names 2022-10-26 16:30:14 -04:00
erik-krogh
2ace10b294 bump the version of the shared pack in the QL-for-QL qlpack.yml file 2022-10-26 22:16:42 +02:00
Chris Smowton
28b6e263ec Kotlin: reintroduce pointless wildcards when a Java declaration explicitly uses them 
For example, Java code might use `HasOutVariance<? extends String>`, or `HasInVariance<? super Object>`, both of which are needless wildcards and which the Kotlin extractor would previously have refused to reintroduce due to their not specifying a larger type than their bound. However this led to inconsistency with Java extraction, which
extracts the type as it appears in source.

This seems to particularly happen with generated code, e.g. the output of the Kotlin protobuf compiler.
 2022-10-26 20:05:27 +01:00
Daniel Santos
63c71b7d09 Merge branch 'main' into main 2022-10-26 14:05:26 -05:00
Ian Lynagh
0a470b0864 Kotlin: Handle /!unknown-binary-location/... paths specially on Windows 
The standard code wants to normalise it to C:/!unknown-binary-location/...
which is particularly annoying for cross-platform test output.
 2022-10-26 19:20:32 +01:00
Robert Marsh
25a1148e04 C++: autoformat 2022-10-26 14:11:37 -04:00
Henry Mercer
c1984ea35f Go: Update expected output 2022-10-26 19:11:21 +01:00
Robert Marsh
8e2d34f0b6 C++: Accept dataflow test changes 2022-10-26 14:10:23 -04:00
Daniel Santos
64da2cec50 removed unnecessary getACall and fixed formatting 2022-10-26 12:02:55 -05:00
Rasmus Wriedt Larsen
5e9897d150 InlineExpectationsTest: sync 2022-10-26 18:21:13 +02:00
Rasmus Wriedt Larsen
76e84ef63a InlineExpectationsTest: Fail if missing getARelevantTag 2022-10-26 18:20:37 +02:00
Mathias Vorreiter Pedersen
e43422a090 Merge pull request #10975 from rdmarsh2/rdmarsh2/inconsistent-loop-direction-repair 
C++: repair InconsistentLoopDirection
 2022-10-26 18:17:53 +02:00
Rasmus Wriedt Larsen
bfe9aa1225 InlineExpectationsTest: Add test showing what happens if you leave out getARelevantTag 2022-10-26 18:00:03 +02:00
Rasmus Wriedt Larsen
b3f29b0a53 Python: Add failing ESSA use-use test 
I initially created this as a dataflow test, but then realized it could
just be an ESSA test. I cound't find any existing ESSA tests though :|
so created a new dir for it.
 2022-10-26 17:49:33 +02:00
Geoffrey White
a32b08f56a Swift: remove redundant line. 2022-10-26 16:39:33 +01:00
Geoffrey White
e981a28b0f Swift: autoformat test. 2022-10-26 16:32:52 +01:00
Henry Mercer
b0b321a16f Go: Standardise formatting 2022-10-26 16:31:08 +01:00
Henry Mercer
4bc8529490 Go: Extract locations of successfully extracted files 
Switch the successfully extracted files query to the `location, message` results format so that we get rich location information when exporting the results of this query to SARIF.  Previously the query used the `message` results format, which meant the interpreted results lacked a location.
 2022-10-26 16:28:02 +01:00
Geoffrey White
0b3408b1f6 Swift: Fix typo. 2022-10-26 16:24:25 +01:00
Geoffrey White
5d21c51deb Swift: use hasQualifiedName in UnsafeWebViewFetch.ql. 2022-10-26 16:12:29 +01:00
Geoffrey White
0d41d4e90c Swift: for consistancy, lets have a simple hasName function as well. 2022-10-26 16:11:01 +01:00
Mathias Vorreiter Pedersen
562f052eb0 C++: Accept test changes. 2022-10-26 17:06:38 +02:00
Mathias Vorreiter Pedersen
bc9cd63ef0 C++: Add an 'IndirectExprNode(Base)' class similar to 'ExprNode(Base)' to structure conversions between indirect daaflow nodes and expressions. 2022-10-26 17:05:01 +02:00
Geoffrey White
b24a27d4ae Swift: Add hasQualifiedName methods and tests. 2022-10-26 16:03:49 +01:00
Robert Marsh
de89b4c69f C++: repair the ReturnCstr query 2022-10-26 11:02:23 -04:00
Robert Marsh
fc9f239a3b C++: make ConstructorCall df nodes the qualifier 
This makes the dataflow node for a ConstructorCall be the outnode of the
qualifier, which is the resulting constructed object. This should make
`asExpr` on a ConstructorCall do the "right thing" rather than selecting
the void-typed CallInstruction.
 2022-10-26 11:01:53 -04:00
Robert Marsh
adeb69e396 C++: autoformat 2022-10-26 10:49:06 -04:00
Mathias Vorreiter Pedersen
4bcba16748 Merge pull request #10833 from MathiasVP/repair-badly-bounded-write-2 
C++: Prepare `Buffer.qll` for IR-based use-use dataflow
 2022-10-26 16:38:33 +02:00
Karim Ali
420c35d4a2 add a query that detects the use of constant salts 2022-10-26 15:32:59 +02:00
Chris Smowton
fac383a3ac Merge pull request #10974 from smowton/smowton/fix/dont-translate-tochar 
Kotlin: don't try to call nonexistent `j.l.Number.toChar`
 2022-10-26 14:18:03 +01:00
Tamas Vajk
9cc7a30a75 Kotlin: do not report on unused object extension parameters 2022-10-26 15:06:51 +02:00
Tamas Vajk
fbcf7ea669 Kotlin: Add test case for unused extension parameters 2022-10-26 15:05:59 +02:00
Asger F
c9dfba344a Merge pull request #10925 from asgerf/ql/navigate-doc 
Docs: Mention new navigation commands
 2022-10-26 14:29:42 +02:00
Ian Lynagh
37c40c58d2 Merge pull request #10959 from igfoo/igfoo/diags 
Java/Kotlin: Add a diagnostics consistency query
 2022-10-26 13:07:01 +01:00
Mathias Vorreiter Pedersen
2ba94f7c89 Merge pull request #10838 from MathiasVP/repair-cleartext-transmission-2 
C++: Prepare `cpp/cleartext-transmission` for IR-based use-use dataflow
 2022-10-26 13:43:56 +02:00
Paolo Tranquilli
521e6235b5 Swift: use std::filesystem and picoSHA2 
This replaces usages of `llvm::fs` and string manipulation with
`std::filesystem`, also replacing `std::string` with
`std::filesystem::path` where it made sense.

Moreover MD5 hashing used in macOS file remapping was replaced by
SHA256 hashing using a small header-only SHA256 C++ library with an
MIT license, https://github.com/okdshin/PicoSHA2.

File contents hashing was relocated to the newly created `file` library
for later planned reuse.
 2022-10-26 13:23:44 +02:00
Ian Lynagh
dd7ec499df Kotlin: Ignore tags when comparing versions 
We thought that 1.7.20-Beta > 1.7.20, and so tried to use 1.7.0's
extractor with 1.7.20.
 2022-10-26 12:21:55 +01:00
erik-krogh
0f9b4334cc remove some FPs in js/password-in-configuration-file 2022-10-26 11:51:56 +02:00
Paolo Tranquilli
e422a4eef9 Swift: move TargetFile to a separate lib 2022-10-26 10:54:51 +02:00
erik-krogh
21e7e27e1f push more context into load/store steps from the exploratory flow-analysis 2022-10-26 10:52:47 +02:00