hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-31 08:06:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
60,239 Commits 1,673 Branches 157 Tags
codeql-cli/v2.15.2
Commit Graph

60239 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Lerchedahl Petersen
f253f9797f Python: update test expectations 2023-09-07 10:22:37 +02:00
Rasmus Lerchedahl Petersen
7edebbeaff Python: Add QLDocs 2023-09-07 10:22:37 +02:00
Rasmus Lerchedahl Petersen
c0b3245a53 Python: Enrich the NoSql concept 
This allows us to make more precise modelling
The query tests now pass.
I do wonder, if there is a cleaner approach, similar to
`TaintedObject` in JavaScript. I want the option to
get this query in the hands of the custumors before
such an investigation, though.
 2023-09-07 10:22:37 +02:00
Rasmus Lerchedahl Petersen
114984bd8c Python: Added tests based on security analysis 
currently we do not:
- recognize the pattern
   `{'author': {"$eq": author}}` as protected
- recognize arguements to `$where` (and friends)
   as vulnerable
 2023-09-07 10:22:37 +02:00
Rasmus Lerchedahl Petersen
bf8bfd91cd Python: Add inline query test 2023-09-07 10:22:30 +02:00
Rasmus Wriedt Larsen
d4c3dfffec Merge pull request #14158 from RasmusWL/fix-ssrf-example 
Python: Fix typo in SSRF example
 2023-09-07 10:22:21 +02:00
Max Schaefer
46d7165885 Explain about redirects to example.com. 2023-09-07 09:12:07 +01:00
Rasmus Wriedt Larsen
c85ea9a0c0 Python: Fix typo in SSRF example 2023-09-07 09:45:02 +02:00
Rasmus Lerchedahl Petersen
19046ea417 Python: more renames 2023-09-07 09:28:30 +02:00
Rasmus Lerchedahl Petersen
087961d179 Python: Refactor to allow customizations 
Also use new DataFlow API
 2023-09-07 09:28:30 +02:00
Rasmus Lerchedahl Petersen
db0459739f Python: rename file 2023-09-07 09:28:30 +02:00
Rasmus Lerchedahl Petersen
55707d395e Python: Make things compile in their new location 
- Move NoSQL concepts to the non-experimental concepts file
- fix references
 2023-09-07 09:28:30 +02:00
Rasmus Lerchedahl Petersen
60dc1afbc0 Python: prepare to promote NoSqlInjection 
Mostly move files, preserving authourship.
This will not compile.
 2023-09-07 09:28:29 +02:00
Michael B. Gale
ccbc6f446a Use git ls-files to find DLLs to index 2023-09-06 22:17:08 +01:00
Tom Hvitved
718e491800 C#: Clear TRAP stack when calling PopulateGenerics 2023-09-06 21:12:01 +02:00
Tom Hvitved
334502a3de Merge pull request #14153 from github/revert-14082-csharp/bump-dependencies 
Revert "C#: Bump all dependencies"
 2023-09-06 21:10:56 +02:00
Mathias Vorreiter Pedersen
3f6346737c Update 2023-09-06-as-defining-argument-off-by-one-fix.md 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2023-09-06 19:48:48 +01:00
Mathias Vorreiter Pedersen
87925abaa2 C++: Add change note. 2023-09-06 17:26:08 +01:00
Mathias Vorreiter Pedersen
14faa5d020 C++: Fix off-by-one in 'asDefiningArgument' so that the domain of the argument is '[1..]' like 'asIndirectArgument'. 2023-09-06 17:19:44 +01:00
Peter Stöckli
7aa5d2dc8a Python: move asyncio CMDi related tests to stdlib tests 2023-09-06 16:54:18 +02:00
Robert Marsh
5bdd9597d2 Merge branch 'main' into rdmarsh2/swift/dictionary-flow-tuples 2023-09-06 14:50:16 +00:00
Mathias Vorreiter Pedersen
12a717e3af Merge pull request #14141 from github/alexdenisov/unresolved-ast-nodes 
Swift: add queries for unresolved AST nodes
 2023-09-06 15:40:11 +01:00
Tom Hvitved
6e0ff56788 Revert "C#: Bump all dependencies" 2023-09-06 16:23:38 +02:00
Peter Stöckli
ede7d8fb6a Python: apply suggestions from code review for asyncio 2023-09-06 15:47:07 +02:00
Mathias Vorreiter Pedersen
2bed77de09 Merge branch 'main' into deduplicate-dataflow-results-take-3 2023-09-06 14:12:36 +01:00
Max Schaefer
a02f373e79 Use better sanitiser. 2023-09-06 14:06:16 +01:00
Mathias Vorreiter Pedersen
4cbe82353f C++: Accept more test changes. 2023-09-06 13:58:28 +01:00
Mathias Vorreiter Pedersen
b22199982e C++: Add change note. 2023-09-06 13:08:21 +01:00
Michael Nebel
a8e427ffe1 Merge pull request #14097 from michaelnebel/csharp/extractorerrormessages 
C#: Update extractor_messages relation schema.
 2023-09-06 14:01:36 +02:00
Cornelius Riemenschneider
76f1c7a4cd Merge pull request #14137 from github/dependabot/github_actions/actions/checkout-4 
Bump actions/checkout from 2 to 4
 2023-09-06 13:13:30 +02:00
Cornelius Riemenschneider
79d210f7bd Update .github/workflows/ruby-build.yml 
Co-authored-by: Arthur Baars <aibaars@github.com>
 2023-09-06 12:19:46 +02:00
Tom Hvitved
a06a9ffa29 Address review comments 2023-09-06 11:01:54 +02:00
Tom Hvitved
6de315d086 Add change note 2023-09-06 11:01:54 +02:00
Tom Hvitved
48e2dcfa35 Ruby: Reimplement flow through captured variables using field flow 2023-09-06 11:00:55 +02:00
Tom Hvitved
5d1c399371 Ruby: Add more data-flow tests for captured variables 2023-09-06 10:34:34 +02:00
Mathias Vorreiter Pedersen
3eb2da4c03 C++: No need to remove duplications manually. 2023-09-06 09:29:11 +01:00
Tom Hvitved
3a9c34c3c6 Merge pull request #14132 from hvitved/csharp/data-flow-property-write 
C#: Fix logic for flow into property writes
 2023-09-06 08:49:53 +02:00
Erik Krogh Kristensen
a11db7a80a Merge pull request #14148 from github/dependabot/cargo/ql/chrono-0.4.29 
Bump chrono from 0.4.28 to 0.4.29 in /ql
 2023-09-06 07:25:13 +02:00
dependabot[bot]
7f73c59304 Bump chrono from 0.4.28 to 0.4.29 in /ql 
Bumps [chrono](https://github.com/chronotope/chrono) from 0.4.28 to 0.4.29.
- [Release notes](https://github.com/chronotope/chrono/releases)
- [Changelog](https://github.com/chronotope/chrono/blob/main/CHANGELOG.md)
- [Commits](https://github.com/chronotope/chrono/compare/v0.4.28...v0.4.29)

---
updated-dependencies:
- dependency-name: chrono
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-09-06 03:58:08 +00:00
Chuan-kai Lin
163252d5f6 Merge pull request #14147 from github/release-prep/2.14.4 
Release preparation for version 2.14.4
 2023-09-05 13:50:45 -07:00
github-actions[bot]
abf2b12b1c Release preparation for version 2.14.4 2023-09-05 16:56:14 +00:00
Mathias Vorreiter Pedersen
570b08e2e9 Merge pull request #14143 from alexet/global-from-unreachble 
CPP: Handle globals flowing into "UnreacheachedInstruction"
 2023-09-05 16:58:55 +01:00
Peter Stöckli
9027eac312 Python: add change notes for asyncio CMDi sinks 2023-09-05 16:14:56 +02:00
Peter Stöckli
8c4dccc81b Python: initial support for CMDi via asyncio 2023-09-05 15:33:29 +02:00
Michael Nebel
b5d4987c0a C#: Add upgrade and downgrade scripts. 2023-09-05 15:32:09 +02:00
Michael Nebel
880da69d16 C#: Update extractor_messages relation schema. 2023-09-05 15:19:32 +02:00
Tamás Vajk
97f09e106e Merge pull request #14101 from tamasvajk/csharp/recursive-generics 
C#: Exclude base type extraction of recursive generics
 2023-09-05 14:24:51 +02:00
Ian Lynagh
5ea4c44701 Kotlin: Give some more informative errors messages 2023-09-05 12:33:49 +01:00
Alex Denisov
35e949945d Swift: add queries for unresolved AST nodes 2023-09-05 13:29:11 +02:00
Alex Eyers-Taylor
3db384ddc3 CPP: Handle globals flowing into "UnreacheachedInstruction" 2023-09-05 11:50:32 +01:00