hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-09 11:41:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
51,820 Commits 1,691 Branches 160 Tags
codeql-cli/v2.12.7
Commit Graph

51820 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
github-actions[bot]
76e121e359 JS: Bump version of ML-powered library and query packs to 0.4.6 2023-01-10 21:11:23 +00:00
github-actions[bot]
dc88bdccc7 JS: Bump patch version of ML-powered library and query packs 2023-01-10 21:04:31 +00:00
Jami Cogswell
faae811be7 Java: try simplification of paramsString and paramsStringPart 2023-01-10 13:35:52 -05:00
Jami Cogswell
65aa064838 Java: update paramsString qldoc 2023-01-10 13:33:47 -05:00
Edward Minnix III
ce06df3152 Merge pull request #11628 from egregius313/egregius313/android-webview-addjavascriptinterface-dataflow 
Java: Add parameters of methods annotated @JavascriptInterface as remote flow sources
 2023-01-10 12:41:52 -05:00
Mathias Vorreiter Pedersen
8b01dfe696 Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow 2023-01-10 17:30:29 +00:00
erik-krogh
38ca68febb recognize "-->" as a bad tag filter 2023-01-10 18:09:56 +01:00
Florin Coada
4c1c12dd70 suggestions in list format 2023-01-10 11:18:56 -05:00
Jonathan Leitschuh
1d7881e03f Apply suggestions from code review 
Co-authored-by: Chris Smowton <smowton@github.com>
 2023-01-10 11:18:56 -05:00
Tony Torralba
b7364f5428 Update UnsafeDeserialization.qhelp 
Move the table under <recommendation>, minor fixes.
 2023-01-10 11:18:56 -05:00
Jonathan Leitschuh
3fa11c21c3 [Java] Document fixes for deserialization vulnerabilities by framework 
Related https://github.com/github/codeql/issues/11603
 2023-01-10 11:18:56 -05:00
Paolo Tranquilli
0ad585cfe6 Merge pull request #11860 from github/redsun82/swift-clang-14 
Swift: make compilation with newer STL possible
 2023-01-10 17:17:56 +01:00
Erik Krogh Kristensen
54c780bdf9 Merge pull request #11853 from erik-krogh/assignMore 
JS: add local flow when recognizing Object.assign calls for library-inputs
 2023-01-10 17:04:29 +01:00
Tony Torralba
ae8c75ac97 Generalize ConjunctionParent 2023-01-10 16:08:42 +01:00
Tony Torralba
72a11e737d Merge pull request #11775 from atorralba/atorralba/all/omittable-exists 
All: Remove omittable exists variables
 2023-01-10 16:07:06 +01:00
Ian Lynagh
3367da82c4 Kotlin: Accept test changes 
We get better locations with Kotlin 1.8.0.
 2023-01-10 14:41:30 +00:00
Ian Lynagh
b7eb521fa0 Kotlin: Fix custom_plugin test for Kotlin 1.8.0 2023-01-10 14:41:30 +00:00
Ian Lynagh
c71ea80029 Kotlin: Accept test changes 
We now get better locations, with Kotlin 1.8.0.
 2023-01-10 14:41:30 +00:00
Ian Lynagh
20b35e5d02 Kotlin: 1.8.0 changes 2023-01-10 14:41:30 +00:00
Ian Lynagh
c4119761cc Kotlin: Another 1.8 build fix 2023-01-10 14:41:30 +00:00
Ian Lynagh
89b3363761 Kotlin: Bump CI version to 1.8.0-Beta 2023-01-10 14:41:30 +00:00
Ian Lynagh
b51c3aae85 Kotlin: Logs test: Allow for -Beta versions etc when parsing the logs 2023-01-10 14:41:29 +00:00
Ian Lynagh
6fbda1a9f0 Kotlin: Accept test changes with 1.8 2023-01-10 14:41:29 +00:00
Ian Lynagh
f7d8d16ed3 Kotlin: Fix build for 1.8.0-Beta 
The build no longer works for Kotlin < 1.8: We get

    error: class 'org.jetbrains.kotlin.ir.IrElement' was compiled
           with an incompatible version of Kotlin. The binary version
           of its metadata is 1.8.0, expected version is 1.6.0.
 2023-01-10 14:41:29 +00:00
erik-krogh
62b69bbd3e autoformat 2023-01-10 15:38:13 +01:00
Erik Krogh Kristensen
6623e5fbf3 Merge pull request #11852 from erik-krogh/jsInfiniteChar 
JS: recognize an infinite repetition of a char-class like regex as a char-class like regex
 2023-01-10 15:32:22 +01:00
Erik Krogh Kristensen
ce8836fb65 Update javascript/ql/lib/semmle/javascript/PackageExports.qll 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2023-01-10 15:30:44 +01:00
erik-krogh
43696f5e27 add explicit this 2023-01-10 15:27:37 +01:00
erik-krogh
23a847b1cf track shell:true more in js/shell-command-constructed-from-input 2023-01-10 15:27:37 +01:00
Erik Krogh Kristensen
9f8d10de11 Merge pull request #11851 from erik-krogh/jsFixMissingThis 
JS: fix bad join-order in js/missing-this-qualifier
 2023-01-10 15:23:25 +01:00
Paolo Tranquilli
2fb5621527 Swift: replace $(CC) with clang 
On macOS `$(CC)` points to a wrapper that requires `DEVELOPER_DIR` to be
set in the environment. Using `clang` is slightly less generic, but
that's our default any way. Even if we do set a different clang version
somewhere, the selected version of GCC would not change, and the test
is targeting that.
 2023-01-10 14:58:21 +01:00
Paolo Tranquilli
943763a026 Swift: add -Wno-pragma-once-outside-header to check 2023-01-10 14:30:35 +01:00
Paolo Tranquilli
28d79eeb77 Swift: make compilation with different STL versions possible 
Previous to this patch the code contained a workaround for the standard
defect

https://cplusplus.github.io/LWG/issue3657

where `std::filesystem::path` did not have a `std::hash` implementation.

This patch allows compiling against versions of the STL that contain the
fix to the above issue. This is done by running the compiler against
code defining `std::hash<std::filesystem::path>`: if compilation
succeeds, it means the fix is not there and we need to use the
workaround, contained in `PathHash.h.workaround`. Otherwise, the fix is
there and we use `PathHash.h.fixed` instead, which only includes the
standard headers included by `PathHash.h.workaround`, so that one is a
drop-in replacement of the other.
 2023-01-10 14:14:33 +01:00
Jeroen Ketema
1a4048d238 Merge pull request #11830 from jketema/frontend-update 
C++: Changes for frontend update
 2023-01-10 14:01:46 +01:00
erik-krogh
5c388c554c fix that the TypeTracker was unrestricted for the base-case of nonFirstLocationType 2023-01-10 13:39:50 +01:00
erik-krogh
e02b67af63 add failing test 2023-01-10 13:39:50 +01:00
Tony Torralba
50cd40ed20 Swift: Remove omittable exists variables 2023-01-10 13:39:50 +01:00
Tony Torralba
7ef8099a8b Shared: Remove omittable exists variables 2023-01-10 13:39:50 +01:00
Tony Torralba
c9d1cd97fb Ruby: Remove omittable exists variables 2023-01-10 13:39:49 +01:00
Tony Torralba
f6c3f77602 QL: Remove omittable exists variables 2023-01-10 13:37:58 +01:00
Tony Torralba
d87c8c75d6 Python: Remove omittable exists variables 2023-01-10 13:37:35 +01:00
Tony Torralba
3b6dae41cd JavaScript: Remove omittable exists variables 2023-01-10 13:37:21 +01:00
Tony Torralba
32471d326e Java: Remove omittable exists variables 2023-01-10 13:37:19 +01:00
Tony Torralba
7a92970d89 Go: Remove omittable exists variables 2023-01-10 13:36:48 +01:00
Tony Torralba
2ca0df0369 C#: Remove omittable exists variables 2023-01-10 13:36:25 +01:00
Tony Torralba
3fcc99e5cb C++: Remove omittable exists variables 2023-01-10 13:36:01 +01:00
Erik Krogh Kristensen
f2658a0936 apply suggestions from doc review 
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
 2023-01-10 12:56:22 +01:00
erik-krogh
79e161e046 slightly broaden the regular expression that recognizes bad string-concats used as shell commands 2023-01-10 12:49:37 +01:00
Tony Torralba
da90ae0e8f Update java/ql/lib/semmle/code/java/dataflow/FlowSources.qll 2023-01-10 11:18:53 +01:00
Jeroen Ketema
8d46642de3 C++: Update dbscheme stats file 2023-01-10 10:41:43 +01:00