hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-09 19:51:07 +01:00
Code Issues Packages Projects Releases Wiki Activity
62,527 Commits 1,689 Branches 160 Tags
codeql-cli/v2.16.0
Commit Graph

62527 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Nora Dimitrijević
9353549629 Swift: fixes responding to comments 2023-03-27 23:01:24 +02:00
Nora Dimitrijević
052a008926 Swift: Content-based dataflow through case let 2023-03-27 23:01:24 +02:00
Nora Dimitrijević
5c795632db Swift: add Pattern.getEnclosingPattern() 2023-03-27 23:01:24 +02:00
Nora Dimitrijević
c2e9ffab63 Swift: add EnumElementExpr + Pattern.getMatchingExpr() 2023-03-27 23:01:24 +02:00
Nora Dimitrijević
5419e65e01 Swift: add NamedPattern.getVarDecl() 2023-03-27 23:01:24 +02:00
Nora Dimitrijević
feb8243d5f Swift: move BindingPattern to the hidden AST 2023-03-27 23:01:24 +02:00
Nora Dimitrijević
9e8867aa96 Swift: update enum dataflow test with more cases 2023-03-27 23:01:23 +02:00
Mathias Vorreiter Pedersen
cbd4662696 Merge branch 'main' into skip-safe-conversions-in-range-analysis 2023-03-27 21:18:49 +01:00
smiddy007
82f8090e91 Merge branch 'main' into improve-insufficient-pw-hash-query 2023-03-27 15:37:02 -04:00
Robert Marsh
62d2f23904 Merge pull request #12673 from MathiasVP/range-analysis-of-add-expr 
C++: IR-based range analysis of addition
 2023-03-27 15:31:11 -04:00
smiddy007
55bcad5363 Merge branch 'main' into improve-insufficient-pw-hash-query 2023-03-27 15:21:57 -04:00
smiddy007
2caab8748e Merge branch 'improve-insufficient-pw-hash-query' of https://github.com/smiddy007/codeql into improve-insufficient-pw-hash-query 2023-03-27 15:20:24 -04:00
smiddy007
57ab5a06ae autoformatted 2023-03-27 15:20:08 -04:00
Ed Minnix
3d033fd727 Fix SqlConcatenated 2023-03-27 13:06:31 -04:00
Ed Minnix
9bfb13b942 Update to the Global/flow* api 2023-03-27 12:26:18 -04:00
Edward Minnix III
106e5e7145 Docs review suggestion 
Co-authored-by: Sarita Iyer <66540150+saritai@users.noreply.github.com>
 2023-03-27 12:16:44 -04:00
Edward Minnix III
43d79dc5b8 Apply docs review suggestions 
Co-authored-by: Sarita Iyer <66540150+saritai@users.noreply.github.com>
 2023-03-27 12:16:44 -04:00
Ed Minnix
0eaf222b54 Move public classes/predicates to top of library file 2023-03-27 12:16:44 -04:00
Ed Minnix
f28f1af5a4 Add InsecureLdapUrlSink 2023-03-27 12:16:44 -04:00
Edward Minnix III
24d4859149 Import changes 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2023-03-27 12:16:44 -04:00
Edward Minnix III
151357d02d Make classes/predicates not used outside of query private 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2023-03-27 12:16:44 -04:00
Ed Minnix
658c54a18f Change names of configuration to fit new naming convention 2023-03-27 12:16:44 -04:00
Ed Minnix
cb58936c08 Documentation changes 2023-03-27 12:16:44 -04:00
Ed Minnix
752620a34d Rename SSL configuration and fix PathGraph 2023-03-27 12:16:44 -04:00
Ed Minnix
efdfc2d0c3 Change version of PathNode used to appropriate module 2023-03-27 12:16:44 -04:00
Ed Minnix
59ce0d7682 Documentation changes 2023-03-27 12:16:44 -04:00
Ed Minnix
0f4709e769 Add change note 2023-03-27 12:16:44 -04:00
Ed Minnix
db60c08de7 Add security severity 2023-03-27 12:16:44 -04:00
Ed Minnix
6a0167fa7f Convert to using the new DataFlow modules 2023-03-27 12:16:44 -04:00
Ed Minnix
05da1dc4a3 Merge concatInsecureLdapString into InsecureLdapUrl constructor 2023-03-27 12:16:44 -04:00
Ed Minnix
98b445c6b7 Convert test to InlineExpectationsTest 2023-03-27 12:16:43 -04:00
Ed Minnix
3936aea690 Split Ldap query file into libraries 2023-03-27 12:16:43 -04:00
Ed Minnix
9275b54e97 Refactoring the InsecureLdapUrl constructor 2023-03-27 12:16:43 -04:00
Ed Minnix
938d953789 Refactor getLeftmostOperand method 2023-03-27 12:16:43 -04:00
Ed Minnix
5ff4fcbc76 Replace exists with any 2023-03-27 12:16:43 -04:00
Ed Minnix
57886e1713 Moved files from experimental to src/ 2023-03-27 12:16:43 -04:00
Chris Bellanti
6bf94e800b Added check to disabling certificate validation query 2023-03-27 12:16:20 -04:00
Taus
df192383b2 Merge pull request #9722 from ahmed-farid-dev/timing-attack-py 2023-03-27 18:09:35 +02:00
smiddy007
64b56ef107 Merge branch 'main' into improve-insufficient-pw-hash-query 2023-03-27 12:07:21 -04:00
smiddy007
3ef5f3070f small change 2023-03-27 12:02:35 -04:00
Mathias Vorreiter Pedersen
889dcfe2b2 Merge pull request #12674 from jketema/overrunning-join 
C++: Fix join-order problem in cpp/overrun-write
 2023-03-27 15:36:33 +01:00
Taus
a3c40a3ae4 Python: Add experimental tags 2023-03-27 14:23:36 +00:00
Rasmus Wriedt Larsen
0b9d16a43e Merge pull request #12636 from RasmusWL/sql-modeling 
Python: Some more SQL modeling
 2023-03-27 15:52:30 +02:00
Mathias Vorreiter Pedersen
9a57536f9f Merge branch 'main' into range-analysis-of-add-expr 2023-03-27 14:49:01 +01:00
Taus
af060e8c6b Merge branch 'main' into timing-attack-py 2023-03-27 15:27:13 +02:00
Erik Krogh Kristensen
d3c3f2dc90 Merge pull request #12628 from erik-krogh/betterReDoS 
ReDoS: better super-linear algorithm
 2023-03-27 15:26:49 +02:00
Asger F
32d7a80221 JS: Change note 2023-03-27 14:56:57 +02:00
Jeroen Ketema
213c4b0818 C++: Fix join-order problem in cpp/overrun-write 
Before on Wireshark:
```
[2023-03-27 12:59:25] Evaluated non-recursive predicate OverrunWriteProductFlow#fb5ce006::isSinkPairImpl#5#fffff@2ba90584 in 99742ms (size: 52640).
Evaluated relational algebra for predicate OverrunWriteProductFlow#fb5ce006::isSinkPairImpl#5#fffff@2ba90584 with tuple counts:
        1047588019  ~1%    {3} r1 = JOIN DataFlowUtil#47741e1f::InstructionNode#fff_20#join_rhs WITH OverrunWriteProductFlow#fb5ce006::bounded#3#fff_102#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Rhs.2
          67558965  ~0%    {4} r2 = JOIN r1 WITH Instruction#577b6a83::CallInstruction::getArgument#fbf_201#join_rhs ON FIRST 1 OUTPUT Rhs.2, Lhs.1, Lhs.2, Rhs.1
         613572640  ~0%    {5} r3 = JOIN r2 WITH ArrayFunction#ca0b6b68::ArrayFunction::hasArrayWithVariableSize#2#dispred#fff_201#join_rhs ON FIRST 1 OUTPUT Lhs.3, Rhs.1, Lhs.1, Lhs.2, Rhs.2
             52640  ~0%    {4} r4 = JOIN r3 WITH Instruction#577b6a83::CallInstruction::getStaticCallTarget#0#dispred#ff ON FIRST 2 OUTPUT Lhs.0, Lhs.4, Lhs.2, Lhs.3
             52640  ~0%    {4} r5 = JOIN r4 WITH Instruction#577b6a83::CallInstruction::getArgument#fbf ON FIRST 2 OUTPUT Rhs.2, Lhs.2, Lhs.3, Lhs.0
             52640  ~0%    {5} r6 = JOIN r5 WITH DataFlowUtil#47741e1f::InstructionNode#fff_20#join_rhs ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3, Rhs.1
             52640  ~0%    {5} r7 = JOIN r6 WITH Instruction#577b6a83::Instruction::getUnconvertedResultExpression#0#dispred#ff ON FIRST 1 OUTPUT Lhs.3, Lhs.4, Lhs.1, Lhs.2, Rhs.1
                           return r7
```

After:
```
[2023-03-27 13:56:36] Evaluated non-recursive predicate OverrunWriteProductFlow#fb5ce006::isSinkPairImpl#5#fffff@f936aapd in 777ms (size: 52640).
Evaluated relational algebra for predicate OverrunWriteProductFlow#fb5ce006::isSinkPairImpl#5#fffff@f936aapd with tuple counts:
        565480  ~5%    {2} r1 = SCAN Instruction#577b6a83::CallInstruction::getStaticCallTarget#0#dispred#ff OUTPUT In.1, In.0
          4420  ~1%    {3} r2 = JOIN r1 WITH ArrayFunction#ca0b6b68::ArrayFunction::hasArrayWithVariableSize#2#dispred#fff ON FIRST 1 OUTPUT Lhs.1, Rhs.1, Rhs.2
          4420  ~0%    {3} r3 = JOIN r2 WITH Instruction#577b6a83::CallInstruction::getArgument#fff ON FIRST 2 OUTPUT Rhs.2, Lhs.2, Lhs.0
          4420  ~0%    {4} r4 = JOIN r3 WITH DataFlowUtil#47741e1f::InstructionNode#fff_20#join_rhs ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Rhs.1
          4420  ~0%    {4} r5 = JOIN r4 WITH Instruction#577b6a83::Instruction::getUnconvertedResultExpression#0#dispred#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Lhs.3, Rhs.1
          4420  ~3%    {4} r6 = JOIN r5 WITH Instruction#577b6a83::CallInstruction::getArgument#fff ON FIRST 2 OUTPUT Rhs.2, Lhs.0, Lhs.2, Lhs.3
         52825  ~0%    {5} r7 = JOIN r6 WITH OverrunWriteProductFlow#fb5ce006::bounded#3#fff ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3, Rhs.2
         52640  ~0%    {5} r8 = JOIN r7 WITH DataFlowUtil#47741e1f::InstructionNode#fff_20#join_rhs ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Rhs.1, Lhs.4, Lhs.3
                       return r8
```
 2023-03-27 14:28:22 +02:00
Taus
700eb04487 Python: Lower precision of non-header queries 
cf. https://github.com/github/securitylab/issues/691#issuecomment-1387391014
 2023-03-27 12:22:17 +00:00
Mathias Vorreiter Pedersen
1a6186496f C++: Accept test changes. 2023-03-27 13:20:17 +01:00