hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-16 07:54:52 +01:00
Code Issues Packages Projects Releases Wiki Activity
66,447 Commits 1,680 Branches 158 Tags
codeql-cli/v2.17.2
Commit Graph

66447 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mathias Vorreiter Pedersen
f7c29e6bfb C++: Expose some previously private classes from our models so they can be used in queries. 2024-03-15 14:21:39 +00:00
Rasmus Lerchedahl Petersen
cfbc3f73ec Pyhton: add test for conflicting summaries 
We noticed that when
- a function has more than one summary (with different charpred)
- one summary is subsumed by a subpath (or something happens around the function being extracted)
- the function is called multiple times(we needed at least three)
one of the summaries would no longer lead to flow.
 2024-03-15 15:13:39 +01:00
Sim4n6
3acdd3382c Update the expected file 2024-03-15 14:17:23 +01:00
Sim4n6
26a16b7857 use of a single var "op" of type Cmpop 2024-03-15 14:17:23 +01:00
Sim4n6
a717bf1b9d Fix p tag in UnicodeDoS.qhelp 2024-03-15 14:17:23 +01:00
Sim4n6
af19a0342e Fix UnicodeDoS vulnerability in CWE-770 code 2024-03-15 14:17:23 +01:00
Sim4n6
085d803b14 Fix UnicodeDoS vulnerability in CWE-770 2024-03-15 14:17:23 +01:00
Sim4n6
31dc542111 Update request parameter name in good_1() function 2024-03-15 14:17:23 +01:00
Sim4n6
70ebc58b4c Refactor Unicode normalization code 2024-03-15 14:17:23 +01:00
Sim4n6
3d8868a6c3 Add routes for bad_5 and bad_6, and fix routes for good_3 and good_4 2024-03-15 14:17:23 +01:00
Sim4n6${{7*'7'}}
658b88e62f Update python/ql/src/experimental/Security/CWE-770/UnicodeDoS.ql 
update the Config API

Co-authored-by: yoff <lerchedahl@gmail.com>
 2024-03-15 14:17:23 +01:00
Sim4n6
1f767b887e Add some comments and docs 2024-03-15 14:17:23 +01:00
Sim4n6
5cc9170249 Add UnicodeDoS sink for werkzeug secure_filename 2024-03-15 14:17:23 +01:00
Sim4n6
342465057c Add Unicode DoS (CWE-770) 2024-03-15 14:17:23 +01:00
Mathias Vorreiter Pedersen
19c9ea7e20 C++: Implement alias and side effect models for iterators. 2024-03-15 12:13:43 +00:00
Mathias Vorreiter Pedersen
a51fe4a00e C++: Make the vector and iterator classes in 'ir.cpp' more realistic. This matches the one we use for dataflow tests. 2024-03-15 12:10:48 +00:00
Max Schaefer
d3e0a90ae5 Go: Mention raw string iterals in QHelp for go/incomplete-hostname-regexp. 2024-03-15 11:22:40 +00:00
Tom Hvitved
693c28a821 Merge pull request #15931 from hvitved/ql/remove-missing-override-query 
QL4QL: Remove `MissingOverride` query
 2024-03-15 11:28:41 +01:00
Owen Mansel-Chan
8e52483beb Add df-manual models in manually modeled classes 2024-03-15 10:10:23 +00:00
Tom Hvitved
80649786c3 QL4QL: Remove MissingOverride query 2024-03-15 11:06:15 +01:00
Tom Hvitved
e7b00a7b42 Ruby: Add post-update argument nodes for string constants 2024-03-15 10:47:39 +01:00
Rasmus Wriedt Larsen
7eb4419342 Python: Restrict type-tracking content to only be precise 
At least for now :)
 2024-03-15 10:24:57 +01:00
Rasmus Wriedt Larsen
6babb2ff90 Python: Accept .expected for typetracking-summaries 2024-03-15 10:24:33 +01:00
Rasmus Wriedt Larsen
00f2a6a65e Python: Update ssa-compute test expectations 2024-03-15 10:14:45 +01:00
Tony Torralba
171ff4d161 Merge pull request #15928 from github/workflow/coverage/update 
Update CSV framework coverage reports
 2024-03-15 09:24:57 +01:00
Ed Minnix
71cf948650 Classes extending SourceNode for local and stored source models 
Queries such as `cs/sql-injection` cast their source to a `SourceNode`
in order to describe them. For example:

```ql
import semmle.code.csharp.security.dataflow.flowsources.FlowSources

string getSourceType(DataFlow::Node source) {
   result = source.(SourceNode).getSourceType()
}
```

Models as data source models are not included in `SourceNode` by
default, they must be wrapped with a class extending `SourceNode`.

This adds such classes, which wrap the
`sourceNode(DataFlow::Node,string)` predicate and assigns a
`getSourceType`.
 2024-03-14 22:23:54 -04:00
github-actions[bot]
7f05743212 Add changed framework coverage reports 2024-03-15 00:16:16 +00:00
Joe Farebrother
f464f1b94e Accept test output + fix qldoc typo 2024-03-14 22:25:37 +00:00
Joe Farebrother
b4ed77343b Add change note + fix qldoc 2024-03-14 22:25:36 +00:00
Joe Farebrother
3e61be1b6a Add test cases 2024-03-14 22:25:36 +00:00
Joe Farebrother
5333c75919 Model additional string attributes 2024-03-14 22:25:36 +00:00
Joe Farebrother
8c31b612ca Model UploadedFile original_filename and read 2024-03-14 22:25:35 +00:00
Mathias Vorreiter Pedersen
6dddae0154 Merge pull request #15925 from MathiasVP/rename-dataflowutil-class 
C++: Follow-up to #15918
 2024-03-14 18:15:14 +00:00
Tony Torralba
ee3efbadae Merge pull request #15924 from atorralba/atorralba/go/hardcoded-credentials-fix 
Go: Consider more strings as hardcoded credentials
 2024-03-14 16:52:34 +01:00
Tamás Vajk
945121de1b Merge pull request #15922 from tamasvajk/buildless/namespace-extraction 
C#: Handle namespace resolution error more gracefully
 2024-03-14 16:19:48 +01:00
Michael Nebel
2280469564 Merge pull request #15902 from michaelnebel/csharp/uncontrolledformatstring 
C#: Remove hard-coded local sources from the uncontrolled-format-string query.
 2024-03-14 15:21:31 +01:00
Mathias Vorreiter Pedersen
7fdea27d33 C++: Rename 'IndirectTemporaryExpr' to 'IndirectOperandExprNode'. 2024-03-14 11:46:15 +00:00
Owen Mansel-Chan
2bd08838d4 Add manual neutral models for java.lang.ClassLoader 2024-03-14 11:40:06 +00:00
Owen Mansel-Chan
5b734c76b6 Add manual neutral models for java.util.Locale and its subclasses 2024-03-14 11:39:59 +00:00
Tony Torralba
20691e409c Add change note 2024-03-14 11:56:43 +01:00
Mathias Vorreiter Pedersen
9aefdca7a7 Merge pull request #15875 from MathiasVP/bring-back-type-barriers-in-non-constant-format 
C++: Clean up `cpp/non-constant-format`
 2024-03-14 10:51:23 +00:00
Tony Torralba
30d906d42a Merge pull request #15906 from atorralba/atorralba/java/jdk-neutrals 
Java: Add more neutral JDK models
 2024-03-14 11:07:06 +01:00
Geoffrey White
19cc620f18 C++: Effect of 'Fix dataflow node <> expression problem on prvalues' from main. 2024-03-14 09:47:38 +00:00
Rasmus Wriedt Larsen
7a3ee0f5f8 Python: Make IterableSequenceNode LocalSourceNode 
We do this to remove the inconsistencies, and to be ready for a future
where type-tracking support content tracker of depth > 1.

It works because targets of loadSteps needs to be LocalSourceNodes

predicate loadStep(Node nodeFrom, LocalSourceNode nodeTo, Content content) {
 2024-03-14 10:46:29 +01:00
Geoffrey White
f208594067 Merge branch 'main' into mad 2024-03-14 09:44:45 +00:00
Rasmus Wriedt Larsen
6ffaad1bc8 Python: Expand type-tracking tests with nested tuples 
I was initially surprised to see that this didn't work, until I
remembered that type-tracking only works with content of depth 1.
 2024-03-14 10:44:25 +01:00
Rasmus Wriedt Larsen
af8cef5b53 Python: Fixup deprecated type-tracker API 2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
2b09b084e0 Python: Add change-note 2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
7de304bf16 Python: Add proper type-tracking tests for content 
Instead of just relying on the call-graph tests
 2024-03-14 10:43:28 +01:00
Rasmus Wriedt Larsen
fa0c4e18fc Python: Expand dict-content tt test even more 
While it might be useful to track content to any lookup, it's not
something we do right now.
 2024-03-14 10:43:28 +01:00