hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-12 18:46:48 +01:00
Code Issues Packages Projects Releases Wiki Activity
85,368 Commits 1,712 Branches 162 Tags
codeql-cli/v2.24.0
Commit Graph

85368 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Chris Smowton
81ff394533 Be explicit about Kotlin database type 2024-11-01 19:02:28 +00:00
Geoffrey White
24c4e87f44 Swift: Fix stray []. 2024-11-01 16:30:15 +00:00
Geoffrey White
f3ea75d27c Swift: Further modelling updates / gap filling that doesn't seem to affect tests. 2024-11-01 16:19:41 +00:00
Geoffrey White
954fbc44bf Swift: Update prefix / suffix models for Swift 6. 2024-11-01 16:19:39 +00:00
Geoffrey White
be12649838 Swift: Update joined models for Swift 6. 2024-11-01 16:19:36 +00:00
Geoffrey White
6f0f73974a Swift: Update dropFirst / dropLast / reversed models for Swift 6. 2024-11-01 16:19:34 +00:00
Chris Smowton
5d3f723df9 Kotlin extractor: use special <nulltype> for null literals 
This matches the Java extractor's treatment of these literals, and so enables dataflow type-tracking to avoid special-casing Kotlin. Natively, Kotlin would regard this as kotlin.Nothing?, the type that can only contain null (kotlin.Nothing without a ? can take nothing at all), which gets Java-ified as java.lang.Void, and this will continue to be used when a null type has to be "boxed", as in representing substituted generic constraints with no possible type.
 2024-11-01 16:14:10 +00:00
Tom Hvitved
c4adec3010 Address review comment 2024-11-01 15:28:17 +01:00
yoff
cec0544ca5 Merge pull request #17789 from aschackmull/python/resolvecall-refactor 
Python: Refactor references to NormalCall.
 2024-11-01 14:20:34 +01:00
Anders Schack-Mulligen
bae61875cd UniversalFlow: Fixup some qldoc. 2024-11-01 14:04:27 +01:00
Taus
0bb5b4b9dc Merge pull request #17875 from github/tausbn/python-improve-parser-logging-and-timing 
Python: Improve parser logging/timing/customisability
 2024-11-01 12:47:46 +01:00
Taus
2892f0ff48 Merge pull request #17873 from github/tausbn/python-fix-generator-expression-locations 
Python: Even more parser fixes
 2024-11-01 12:47:19 +01:00
Simon Friis Vindum
a36095d85b Rust: Add local data flow test with if expression 2024-11-01 11:28:10 +01:00
Rasmus Wriedt Larsen
c0ad9ba529 Merge branch 'main' into js-threat-models 2024-11-01 10:48:32 +01:00
Rasmus Wriedt Larsen
dc8e645594 JS: Convert remaining queries to use ActiveThreatModelSourceAsSource 2024-11-01 10:47:10 +01:00
Tom Hvitved
03ffaac87a Merge pull request #17880 from hvitved/ruby/symbol-string-key-indifference 
Ruby: Do not distinguish between symbols and strings in hash keys
 2024-11-01 10:43:56 +01:00
Rasmus Wriedt Larsen
19fae76a94 JS: Remove dummy comment 
Co-authored-by: Asger F <asgerf@github.com>
 2024-11-01 10:24:22 +01:00
Paolo Tranquilli
03aef50836 Merge pull request #17883 from github/redsun82/rust-analysis 
Rust: use common config for analysis
 2024-10-31 17:46:15 +01:00
Paolo Tranquilli
c6585b726a Rust: use common config for analysis 
Now that the nightly bundle has the default query set, we don't need a special
inline config.
 2024-10-31 16:44:07 +01:00
Brandon Stewart
0b7de6e86a add rule to detect if default setup would be more appropriate 2024-10-31 15:28:55 +00:00
Jeroen Ketema
03ced1795a Merge pull request #17694 from jketema/multiple-entry-point 
C++: Do not generate IR for functions with multiple entry points
 2024-10-31 16:16:03 +01:00
Paolo Tranquilli
e5a199b821 Rust: accept test changes due to toString implementations 2024-10-31 16:02:56 +01:00
Paolo Tranquilli
1f356078ff Swift: temporarily accept test changes 2024-10-31 15:57:31 +01:00
Rasmus Wriedt Larsen
61e60de969 JS: Model readline as a stdin threat-model source 
Technically not always true, but my assumption is that +90% of the time
that's what it will be used for, so while we could be more precise by
adding a taint-step from the `input` part of the construction, I'm not
sure it's worth it in this case.

Furthermore, doing so would break with the current way we model
threat-model sources, and how sources are generally modeled in JS... so
for a very pretty setup it would require changing all the other `file`
threat-model sources to start at the constructors such as
`fs.createReadStream()` and have taint-propagation steps towards the
actual use (like we do in Python)...

I couldn't see an easy path forwards for doing this while keeping the
Concepts integration, so I opted for the simpler solution here.
 2024-10-31 14:29:30 +01:00
Rasmus Wriedt Larsen
eca8bf5a35 JS: Do simple modeling of process.stdin as threat-model source 2024-10-31 14:26:45 +01:00
Paolo Tranquilli
cee2ed0ec4 Rust: extract some resolved paths 2024-10-31 14:19:15 +01:00
Alvaro Muñoz
230b2ff4d8 Bump qlpack versions 2024-10-31 14:17:44 +01:00
Alvaro Muñoz
c6048a6fa1 tests: Update tests 2024-10-31 14:16:56 +01:00
Rasmus Wriedt Larsen
34b86c39c1 JS: Model fs.promises.readFile as file source 
You could argue that proper modeling be done in the same way as
`NodeJSFileSystemAccessRead` is done for the callback based `fs` API (in
NodeJSLib.qll). However, that work is straying from the core goals I'm
working towards right now, so I'll argue that "perfect is the enemy of
good", and leave this as is for now.
 2024-10-31 14:09:38 +01:00
Rasmus Wriedt Larsen
971f53870e JS: Include fs externs 
Makes a difference due to the modeling of NodeJSFileSystemAccessRead depending on these, see
412e841d69/javascript/ql/lib/semmle/javascript/frameworks/NodeJSLib.qll (L479-L488)

File copied from 7cef4322e7/javascript/externs/nodejs/fs.js
 2024-10-31 13:51:22 +01:00
Alvaro Muñoz
45b7547016 chore: clean up partial.ql debug query 2024-10-31 13:38:38 +01:00
Alvaro Muñoz
0211902116 models: add models for zentered/issue-forms-parser 2024-10-31 13:38:17 +01:00
Alvaro Muñoz
d85ca10772 fix: account for tojson(expr) expressions 2024-10-31 13:36:59 +01:00
Rasmus Wriedt Larsen
b47fa77dc6 JS: Add tests for stdin threat-model sources 2024-10-31 12:59:21 +01:00
Tom Hvitved
d0f9a0b9ce Rust: Add another unused-value test 2024-10-31 11:43:33 +01:00
Tom Hvitved
55a6ed7e8a Rust: Include link to variable in unused value query 2024-10-31 11:42:44 +01:00
Tom Hvitved
2b340b18dd Rust: Exclude results inside macro expansions from unused entity queries 2024-10-31 11:42:43 +01:00
Tom Hvitved
fec31a6da4 Rust: Include variable name in Unused{Variable,Value}.ql 2024-10-31 11:42:41 +01:00
Tom Hvitved
6b60865d7e Ruby: Do not distinguish between symbols and strings in hash keys 2024-10-31 11:42:09 +01:00
Tom Hvitved
2b37c6cd32 Merge pull request #17548 from hvitved/shared/inline-test-post-process 
Shared: Post-processing query for inline test expectations
 2024-10-31 11:40:11 +01:00
Tom Hvitved
f04a55ecb5 Ruby: Update hash extension tests 2024-10-31 11:00:33 +01:00
Alvaro Muñoz
ebd45ace50 feat: add source model for peter-murra/issue-forms-body-parser 2024-10-31 10:59:05 +01:00
Jeroen Ketema
5e3748ac12 C++: Update expected test results 2024-10-31 10:57:12 +01:00
Jeroen Ketema
1a830cdf14 C++: Do not generate IR for functions with multiple entry points in different locations 2024-10-31 10:55:52 +01:00
Jeroen Ketema
8cfd19cf2f C++: Add multiple entry point test 2024-10-31 10:55:48 +01:00
Tom Hvitved
977eb05f31 Merge pull request #17879 from paldepind/rust-speculative-taint 
Rust: Add predicate for speculative taint step
 2024-10-31 10:17:48 +01:00
Paolo Tranquilli
5a045beff9 Swift: turn off SIL verifications 2024-10-31 10:03:08 +01:00
Paolo Tranquilli
ce4273d461 Revert "Swift: use -typecheck in QL tests" 
This reverts commit 34b8b43843.
 2024-10-31 09:52:08 +01:00
Paolo Tranquilli
3aa7123032 Swift: restrict UnresolvedAstNodes to known locations 2024-10-31 09:26:14 +01:00
Simon Friis Vindum
00b8a29da7 Rust: Add predicate for speculative taint step 2024-10-31 09:09:39 +01:00