hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-22 10:52:58 +01:00
Code Issues Packages Projects Releases Wiki Activity
17,948 Commits 1,685 Branches 158 Tags
codeql-cli/v2.4.0
Commit Graph

17948 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Anders Schack-Mulligen
2a0a568cbb Java: Remove duplicate class. 2020-01-30 17:04:35 +01:00
yo-h
dd517a433a Merge pull request #2671 from aschackmull/java/null-flow 
Java: Allow null literals as sources in data flow.
 2020-01-30 09:47:46 -05:00
Erik Krogh Kristensen
8fc273b9ec update expected output 2020-01-30 15:19:27 +01:00
Taus
b89273402d Merge pull request #2701 from RasmusWL/python-modernise-metrics 
Python: modernise import related queries
 2020-01-30 14:37:39 +01:00
Anders Schack-Mulligen
9bea581a23 Java: Improve taint for OutputStream.write and InputStream.read. 2020-01-30 14:29:56 +01:00
semmle-qlci
3158b8401a Merge pull request #2705 from erik-krogh/CVE75 
Approved by asgerf
 2020-01-30 13:07:05 +00:00
semmle-qlci
120b50f497 Merge pull request #2708 from asger-semmle/js/react-flow-through-imports 
Approved by esbena
 2020-01-30 13:05:07 +00:00
Erik Krogh Kristensen
162c19c348 changes based on review 2020-01-30 14:04:04 +01:00
Asger F
b88cc50cdb Apply suggestions from code review 
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
 2020-01-30 12:42:58 +00:00
Asger Feldthaus
1bf8165098 TS: Other review comments 2020-01-30 12:41:02 +00:00
Asger Feldthaus
92dbfb2858 JS: Handle LGTM_WORKSPACE and fix emptiness check 2020-01-30 12:31:25 +00:00
Asger Feldthaus
141d4bfb70 TS: Handle multiple slashes in scope name 2020-01-30 12:28:16 +00:00
Anders Schack-Mulligen
a167577551 Java: Add java.lang.Number as a sanitizer for SQL injection. 2020-01-30 12:01:36 +01:00
Jonas Jensen
d0ac846cac Merge pull request #2721 from aschackmull/java/taintgetter-changenote 
Java/C++/C#: Add change note for taint-getters.
 2020-01-30 11:42:37 +01:00
Jonas Jensen
148e87c61d C++: Put AliasedSSA.qll in new qlformat style 2020-01-30 11:38:16 +01:00
Anders Schack-Mulligen
ea3d7b1b2f Java: Adjust stubs and unit test. 2020-01-30 11:27:33 +01:00
Erik Krogh Kristensen
7637ebcc03 Merge remote-tracking branch 'upstream/master' into exceptionFPs 2020-01-30 10:56:41 +01:00
Anders Schack-Mulligen
d8b842298c Java: Autoformat. 2020-01-30 10:54:54 +01:00
Anders Schack-Mulligen
843fd37c75 Java: Add change note. 2020-01-30 10:52:16 +01:00
Anders Schack-Mulligen
75c549baa1 Java: Deprecate ParExpr. 2020-01-30 10:52:16 +01:00
Anders Schack-Mulligen
b7a8d0e903 Apply suggestions from code review 
Co-Authored-By: Jonas Jensen <jbj@github.com>
 2020-01-30 10:41:13 +01:00
Jonas Jensen
f0f752844e Merge remote-tracking branch 'upstream/master' into dbartol/Indirections 
Conflicts:
	cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasedSSA.qll
	csharp/ql/src/semmle/code/csharp/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll
 2020-01-30 10:26:44 +01:00
Jonas Jensen
036e16af8b Merge remote-tracking branch 'upstream/master' into ir-crement-load 
Conflicts:
	cpp/ql/src/semmle/code/cpp/ir/implementation/raw/internal/TranslatedExpr.qll
 2020-01-30 09:07:30 +01:00
Jonas Jensen
c4d2163321 Merge pull request #2673 from aschackmull/ql/autoformat-comparisonterm 
Java/C++/C#: Autoformat comparison terms
 2020-01-30 08:47:50 +01:00
Robert Marsh
71d87be773 C++: add flow through partial loads in DTT 2020-01-29 17:51:42 -08:00
Dave Bartolomeo
790cbf0d6b C#: Fix bad merge 2020-01-29 17:32:15 -07:00
Dave Bartolomeo
6249446ba0 Merge remote-tracking branch 'upstream/master' into dbartol/Indirections 2020-01-29 17:29:44 -07:00
Robert Marsh
1472101613 Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams 2020-01-29 14:44:29 -08:00
Robert Marsh
74ea9bcdf4 C++: fix merge issue 2020-01-29 14:37:41 -08:00
Robert Marsh
1a458aa450 C++: IR dataflow edges through outparams 2020-01-29 14:37:41 -08:00
Dave Bartolomeo
46c414b53f C++: Document regular expressions in InlineExpectationsTest 2020-01-29 13:24:55 -07:00
Dave Bartolomeo
1277881294 C++: Document InlineExpectationsTest 2020-01-29 13:07:34 -07:00
Esben Sparre Andreasen
31743c42e5 Update javascript/ql/src/semmle/javascript/frameworks/Koa.qll 
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-01-29 20:28:29 +01:00
ggolawski
ebd2b932e8 Update java/ql/src/Security/CWE/CWE-90/LdapInjection.qhelp 
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
 2020-01-29 20:05:20 +01:00
Robert Marsh
37570c7750 Merge pull request #2676 from jbj/dataflow-partial-chi 
C++: data flow through partial chi operands where type is known
 2020-01-29 13:44:06 -05:00
Jonas Jensen
52d2bebd1c C++: Taint through most partial chi operands 
This changes the flow to be taint rather than data flow, and it extends
it to include chi instructions with unknown type as long as they're not
for the `AliasedVirtualVariable`.

We're losing three good test results because these tests are not
affected by `DefaultTaintTracking.qll`. The taint step added here can
later be ported to `TaintTrackingUtil.qll` to recover these results, but
we probably want a better API than transitive-closure search through
instructions before doing that.
 2020-01-29 18:02:03 +01:00
Geoffrey White
f673791fe8 Merge pull request #2717 from jbj/DefaultTaintTracking-memcpy 
C++: Add taint from gets through memcpy
 2020-01-29 16:28:45 +00:00
Mathias Vorreiter Pedersen
bbb0e212e3 Merge pull request #2720 from jbj/taint-diff-import 
C++: Always use the old library for the diff test
 2020-01-29 17:20:31 +01:00
Calum Grant
7caae01ad1 C#: Exclude fields that are created 2020-01-29 15:47:12 +00:00
Anders Schack-Mulligen
2039ec37e5 Java/C++/C#: Add change note for taint-getters. 2020-01-29 16:26:23 +01:00
Tom Hvitved
474815bf57 Merge pull request #2660 from calumgrant/cs/release-notes 
C#: Add release notes and precisions to queries
 2020-01-29 16:05:45 +01:00
Jonas Jensen
0436caecdc C++: Always use the old library for the diff test 
This change ensures that the diff test will show the difference between
the old and the new library even after we switch the default
implementation of `security.TaintTracking` to be the new one.
 2020-01-29 16:03:35 +01:00
Jonas Jensen
4a77f2b53c Merge remote-tracking branch 'upstream/master' into ir-crement-load 
Update test output to fix semantic merge conflict.
 2020-01-29 15:56:05 +01:00
Jonas Jensen
9b651ea92c C++: Fix mapping of sources from Expr to Node 
The code contained the remains of how `isUserInput` in `Security.qll`
used to be ported to IR. It's wrong to use that port since many queries
call `userInput` directly to get the "cause" string.
 2020-01-29 15:50:08 +01:00
Jonas Jensen
7bed6ad63b C++: Add taint from gets through memcpy 2020-01-29 15:42:43 +01:00
Esben Sparre Andreasen
a6d3afd817 JS: support additional Koa request sources 2020-01-29 14:49:01 +01:00
Esben Sparre Andreasen
d4d910b681 JS: add koa test 2020-01-29 14:41:23 +01:00
Jonas Jensen
d7e8ea7cc5 Merge pull request #2641 from marcrepo/master 
Documentation update for Issue #2623
 2020-01-29 13:37:00 +01:00
Jonas Jensen
386e8e87d1 Merge pull request #2645 from geoffw0/typo 
CPP: Fix typo.
 2020-01-29 13:35:55 +01:00
Anders Schack-Mulligen
743b612d0d Javascript/Python: Sync XML.qll 2020-01-29 13:31:25 +01:00