hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-02 05:38:21 +02:00
Code Issues Packages Projects Releases Wiki Activity
85,907 Commits 1,723 Branches 164 Tags
codeql-cli/v2.24.2
Commit Graph

85907 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Slavomir
9293bcde1d Fix ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected: calls to strings.NewReader are a step now. 2020-09-14 09:46:14 +01:00
Slavomir
3075294cd8 Move strings module to stdlib, and add more taint-tracking classes to it. 2020-09-14 09:46:13 +01:00
Slavomir
42c7f8cc0d Add taint-tracking for strconv package; rename module StrConv to Strconv and move into stdlib 2020-09-14 09:44:25 +01:00
Max Schaefer
b8d36b936e Merge pull request #321 from gagliardetto/standard-lib-pt-14 
Add taint-tracking for packages inside `mime/*`
 2020-09-14 09:26:29 +01:00
Tom Hvitved
19746023d9 C#: Tidy code for constructing underlying tuple structs 2020-09-14 10:08:58 +02:00
Erik Krogh Kristensen
6fb534f178 fix catastrophic join order in UnsafeJQueryPlugin 2020-09-14 09:59:48 +02:00
Erik Krogh Kristensen
9502869e3c improve join-order for aliasPropertyPresenceStep 2020-09-14 09:59:22 +02:00
Jonas Jensen
021aa647c1 Merge pull request #4142 from MathiasVP/mathiasvp/read-step-without-memory-operands 
C++: Use IR alias analysis for field flow
 2020-09-14 09:37:27 +02:00
Mathias Vorreiter Pedersen
78b24b76a0 C++: Remove the problematic taint tracking rule. It seems like we get the flows from dataflow already now. 2020-09-14 09:26:41 +02:00
Mathias Vorreiter Pedersen
34a57e2bd4 Merge pull request #4252 from jbj/normalize-bounds 
C++: SimpleRangeAnalysis: Always normalize bounds after a computation
 2020-09-14 09:16:32 +02:00
Faten Healy
6f20516f84 Update broken_crypto.py to AES instead of Blowfish 2020-09-13 21:07:28 +10:00
Faten Healy
826fc0a630 Update BrokenCryptoAlgorithm - Blowfish to AES 2020-09-13 21:04:07 +10:00
Asger Feldthaus
1d92cbb655 JS: Bump extractor version string 2020-09-12 09:22:12 +01:00
Taus Brock-Nannestad
e0f5b208da Python: Fix broken test of global typetracker flow 
The missing `global g` annotation meant `g = x` was interpreted as a
local assignment.
 2020-09-11 18:17:25 +02:00
lcartey@github.com
eb5782d908 C++: Support customizable ranges for RangeSsaDefinitions. 2020-09-11 17:12:10 +01:00
Geoffrey White
b404a339a4 C++: Correct isQualifierObject -> isQualifierAddress. 2020-09-11 16:15:47 +01:00
Max Schaefer
c10942d044 Merge pull request #320 from gagliardetto/standard-lib-pt-24 
Add taint-tracking for packages inside `text/*`
 2020-09-11 15:57:14 +01:00
Jonas Jensen
fee7ce6c7f Merge pull request #4221 from rajivshah3/fix/cpp-av-32-include 
C++: Allow .inc files to be included
 2020-09-11 16:53:43 +02:00
Geoffrey White
d3ca140eeb C++: Account for pointer / reference parameters to operator<<. 2020-09-11 15:20:54 +01:00
Max Schaefer
c889bc3dae Merge branch 'main' into standard-lib-pt-24 2020-09-11 14:09:50 +01:00
Rasmus Lerchedahl Petersen
0eb8b6c7b0 Python: Address review 2020-09-11 14:24:49 +02:00
Calum Grant
3414063f2e Update change-notes/1.25/analysis-python.md 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswl@github.com>
 2020-09-11 13:16:26 +01:00
Chris Smowton
84def5f6c2 Merge pull request #327 from smowton/smowton/feature/more-post-update-nodes 
Add PostUpdateNodes for nested structs and arrays
 2020-09-11 12:47:20 +01:00
CodeQL CI
903bc007b8 Merge pull request #4082 from max-schaefer/js/api-graph 
Approved by asgerf
 2020-09-11 04:41:38 -07:00
Jonas Jensen
172becd67f Merge pull request #4250 from lcartey/cpp/expose-getdefbounds 
C++: Expose getDef(Upper|Lower)Bound as an internal predicate.
 2020-09-11 13:26:08 +02:00
Mathias Vorreiter Pedersen
2d57abdcbe Merge branch 'main' into mathiasvp/read-step-without-memory-operands 2020-09-11 12:47:29 +02:00
Max Schaefer
903cffe7ed Merge pull request #317 from gagliardetto/standard-lib-pt-18 
Add taint-tracking for `reflect` package
 2020-09-11 11:26:48 +01:00
Geoffrey White
d648150322 C++: Autoformat. 2020-09-11 11:14:58 +01:00
Geoffrey White
dd53e3fe65 C++: Fix data flow to return value. 2020-09-11 11:14:58 +01:00
Geoffrey White
597757d76f C++: Model std::stringstream put and write. 2020-09-11 11:14:57 +01:00
Geoffrey White
66a5c38eef C++: Model std::stringstream constructor. 2020-09-11 11:14:57 +01:00
Jonas Jensen
ad11f76ec6 C++: Always normalize bounds after a computation 
This stops some cases of `-0.0` from propagating through the range
analysis, fixing a false positive on arvidn/libtorrent.

There seems to be no need for a corresponding change in the caller of
`getDefLowerBoundsImpl` since that predicate only contains computations
that cannot introduce negative zero.
 2020-09-11 11:59:00 +02:00
Rasmus Lerchedahl Petersen
5dbb4af5b5 Python: Implement BarrierGuard 2020-09-11 11:55:51 +02:00
Jonas Jensen
0c8e06ba68 C++: Tests for -0.0 in range analysis 2020-09-11 11:52:39 +02:00
Tom Hvitved
6c5b30d2a4 C#: Update CIL consistency test 2020-09-11 11:49:07 +02:00
Tom Hvitved
f225a17639 C#: Even more reflection for retrieving meta data handle 2020-09-11 11:49:07 +02:00
Chris Smowton
650bc1d38f Add PostUpdateNodes for derferenced expressions on an access path to a field- or element-write 2020-09-11 10:46:58 +01:00
lcartey@github.com
65d48a32b8 C++: Expose getDef(Upper|Lower)Bound as an internal predicate. 2020-09-11 09:49:18 +01:00
Tamas Vajk
d60b7c7297 C#: Improve empty collection check to not report on collections with property writes 2020-09-11 10:46:34 +02:00
Max Schaefer
e9bf3317b5 Merge pull request #328 from owen-mc/gorm-exec 
Update GORM model
 2020-09-11 08:41:09 +01:00
Max Schaefer
3758c6b7d8 Merge pull request #329 from smowton/smowton/feature/xss-detect-more-json-encoding 
Reflected XSS query: exclude more uses of encoding/json.Marshal
 2020-09-11 08:38:30 +01:00
Mathias Vorreiter Pedersen
ff09104089 Merge branch 'main' into mathiasvp/array-field-flow 2020-09-11 09:25:50 +02:00
Mathias Vorreiter Pedersen
399da6837a Merge pull request #4227 from jbj/SimpleRangeAnalysis-NotExpr 
C++: Support `(bool)x` and `!x` in SimpleRangeAnalysis
 2020-09-11 08:59:03 +02:00
Bas van Schaik
31495b876e Python script to generate lists of code scanning queries in CSV format (#4177) 
* Create a PowerShell script that can be used to report on the set of queries inside of a particular QL Suite.
* Translate PowerShell script into Python
* support running this script from anywhere within the CodeQL git repo
* print non-fatal error if metadata is not available
* make sure warning about missing pack is printed to stderr
* only run on pushes against main and rcs
* detect repo by checking remote, rather than first SHA
* specify full sha of dsaltares/fetch-gh-release-asset
* trigger workflow on PR that modifies paths of interest

Co-authored-by: Justin Hutchings <jhutchings1@users.noreply.github.com>
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com>
 2020-09-10 12:25:02 -07:00
Owen Mansel-Chan
13e82de53d Add change note 2020-09-10 17:29:06 +01:00
Chris Smowton
405babf5af Reflected XSS query: exclude more uses of encoding/json.Marshal 
Previously we only detected these if the marshalling directly fed the request body within the same function; now it's a general sanitiser for the purposes of XSS.
 2020-09-10 16:52:06 +01:00
Rasmus Wriedt Larsen
52d8f7d395 Merge pull request #4235 from yoff/SharedDataflow_UseUseFlow 
Python: Port use-use implementation from Java
 2020-09-10 16:12:28 +02:00
Rasmus Lerchedahl Petersen
92e7a5676d Python: Address review comments 2020-09-10 15:17:30 +02:00
yoff
3a19b1e7fd Apply suggestions from code review 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2020-09-10 15:06:06 +02:00
Owen Mansel-Chan
3af90c9fc8 Update GORM tests 2020-09-10 13:48:12 +01:00