hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-12 22:14:47 +01:00
Code Issues Packages Projects Releases Wiki Activity
17,948 Commits 1,681 Branches 158 Tags
codeql-cli/v2.4.0
Commit Graph

17948 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Alessio Della Libera
785f335ab8 Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-02 15:22:33 +02:00
Alessio Della Libera
548cb65a64 Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-02 15:22:23 +02:00
Alessio Della Libera
26046a4847 Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-02 15:22:07 +02:00
Alessio Della Libera
6ad88bf93f Update javascript/ql/src/experimental/Security/CWE-090/LdapInjection.ql 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-02 15:21:55 +02:00
Arthur Baars
3ed6465716 Address comments 2020-09-02 15:18:31 +02:00
Jonas Jensen
5760213490 Merge pull request #4190 from lcartey/cpp/range-analysis-extensible-assign-ops 
C++: Support `AssignOperation`s with `SimpleRangeAnalysisExpr`s
 2020-09-02 15:16:35 +02:00
Anders Schack-Mulligen
ed6c1798e2 Java: Fix reference to Unit. 2020-09-02 14:47:01 +02:00
Anders Schack-Mulligen
ca8fd6197a Merge pull request #4187 from RasmusWL/java-experimental-file-structure 
Java: Move files in experiemntal dirs to be consistent
 2020-09-02 14:41:26 +02:00
Mathias Vorreiter Pedersen
69c1eadfdc Merge branch 'main' into mathiasvp/read-step-without-memory-operands 2020-09-02 14:21:23 +02:00
Erik Krogh Kristensen
bb0e5d5718 give V8 build-ins their correct name 2020-09-02 14:05:59 +02:00
Rasmus Wriedt Larsen
bf3a266f58 Python: dataflow regression tests: remove taint tracking tests 
they will be reintroduced in an other PR
 2020-09-02 13:51:00 +02:00
Mathias Vorreiter Pedersen
5546830af7 C++: Fix a join order in readStep using the unbindInt predicate from the shared dataflow library. This is the tuple counts on ChakraCore before the fix: 
(5539s) Tuple counts for DataFlowPrivate::readStep#fff:
3208924     ~0%      {2} r1 = SCAN Operand::NonPhiMemoryOperand::getAnyDef_dispred#3#ff AS I OUTPUT I.<1>, I.<0>
3208924     ~2%      {2} r2 = JOIN r1 WITH DataFlowUtil::TInstructionNode#ff AS R ON FIRST 1 OUTPUT r1.<1>, R.<1>
751306      ~8%      {2} r3 = JOIN r2 WITH Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r2.<1>
751306      ~0%      {3} r4 = JOIN r3 WITH DataFlowUtil::TInstructionNode#ff AS R ON FIRST 1 OUTPUT r3.<0>, r3.<1>, R.<1>
751306      ~0%      {4} r5 = JOIN r4 WITH Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r4.<1>, r4.<0>, r4.<2>
751306      ~2%      {4} r6 = JOIN r5 WITH Operand::NonPhiMemoryOperand::getAnyDef_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r5.<1>, r5.<2>, r5.<3>
209341      ~0%      {4} r7 = JOIN r6 WITH Instruction::Instruction::getResultType_dispred#fb AS R ON FIRST 1 OUTPUT R.<1>, r6.<1>, r6.<2>, r6.<3>
7115323     ~1%      {6} r8 = JOIN r7 WITH DataFlowPrivate::FieldContent#class#ffff_1023#join_rhs AS R ON FIRST 1 OUTPUT R.<2>, R.<3>, r7.<1>, r7.<2>, r7.<3>, R.<1>
81341188413 ~0%      {5} r9 = JOIN r8 WITH SSAConstruction::Cached::getUsedInterval#fff_120#join_rhs AS R ON FIRST 2 OUTPUT r8.<3>, R.<2>, r8.<2>, r8.<4>, r8.<5>
137684      ~7%      {3} r10 = JOIN r9 WITH Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff AS R ON FIRST 2 OUTPUT r9.<2>, r9.<4>, r9.<3>
751306      ~0%      {3} r11 = JOIN r4 WITH Instruction::LoadInstruction::getSourceAddress_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r4.<1>, r4.<2>
94306       ~0%      {3} r12 = JOIN r11 WITH Instruction::FieldInstruction::getField_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r11.<1>, r11.<2>
152363      ~6%      {3} r13 = JOIN r12 WITH DataFlowPrivate::FieldContent::getField_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r12.<1>, R.<1>, r12.<2>
290047      ~22%     {3} r14 = r10 \/ r13
                     return r14

and after:

(851s) Tuple counts for DataFlowPrivate::readStep#fff:
3208924 ~0%      {2} r1 = SCAN Operand::NonPhiMemoryOperand::getAnyDef_dispred#3#ff AS I OUTPUT I.<1>, I.<0>
3208924 ~2%      {2} r2 = JOIN r1 WITH DataFlowUtil::TInstructionNode#ff AS R ON FIRST 1 OUTPUT r1.<1>, R.<1>
751306  ~8%      {2} r3 = JOIN r2 WITH Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, r2.<1>
751306  ~0%      {3} r4 = JOIN r3 WITH DataFlowUtil::TInstructionNode#ff AS R ON FIRST 1 OUTPUT r3.<0>, r3.<1>, R.<1>
751306  ~0%      {4} r5 = JOIN r4 WITH Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff AS R ON FIRST 1 OUTPUT r4.<0>, r4.<1>, r4.<2>, R.<1>
751306  ~0%      {5} r6 = JOIN r5 WITH Instruction::CopyInstruction::getSourceValueOperand_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r5.<1>, r5.<0>, r5.<2>, r5.<3>
751306  ~0%      {5} r7 = JOIN r6 WITH Operand::NonPhiMemoryOperand::getAnyDef_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r6.<1>, r6.<2>, r6.<3>, r6.<4>
209341  ~1%      {5} r8 = JOIN r7 WITH Instruction::Instruction::getResultType_dispred#fb AS R ON FIRST 1 OUTPUT R.<1>, r7.<1>, r7.<2>, r7.<3>, r7.<4>
7115323 ~0%      {7} r9 = JOIN r8 WITH DataFlowPrivate::FieldContent#class#ffff_1023#join_rhs AS R ON FIRST 1 OUTPUT r8.<4>, r8.<1>, r8.<2>, r8.<3>, R.<1>, R.<2>, R.<3>
7116087 ~0%      {9} r10 = JOIN r9 WITH SSAConstruction::Cached::getUsedInterval#fff@staged_ext AS R ON FIRST 1 OUTPUT r9.<1>, r9.<2>, r9.<3>, r9.<0>, r9.<4>, r9.<5>, r9.<6>, R.<1>, R.<2>
449879  ~4%      {9} r11 = SELECT r10 ON r10.<5> <= r10.<7>
193804  ~1%      {9} r12 = SELECT r11 ON r11.<5> >= r11.<7>
154980  ~0%      {9} r13 = SELECT r12 ON r12.<6> <= r12.<8>
137684  ~0%      {9} r14 = SELECT r13 ON r13.<6> >= r13.<8>
137684  ~7%      {3} r15 = SCAN r14 OUTPUT r14.<0>, r14.<4>, r14.<2>
751306  ~0%      {3} r16 = JOIN r4 WITH Instruction::LoadInstruction::getSourceAddress_dispred#ff AS R ON FIRST 1 OUTPUT R.<1>, r4.<1>, r4.<2>
94306   ~0%      {3} r17 = JOIN r16 WITH Instruction::FieldInstruction::getField_dispred#3#ff AS R ON FIRST 1 OUTPUT R.<1>, r16.<1>, r16.<2>
152363  ~6%      {3} r18 = JOIN r17 WITH DataFlowPrivate::FieldContent::getField_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r17.<1>, R.<1>, r17.<2>
290047  ~22%     {3} r19 = r15 \/ r18
                 return r19
 2020-09-02 13:50:55 +02:00
Rasmus Wriedt Larsen
552637a446 Python: dataflow regression tests: fix flow_in_iteration 2020-09-02 13:50:24 +02:00
Rasmus Wriedt Larsen
4977790617 Python: dataflow regression tests: fix source2 2020-09-02 13:49:56 +02:00
Mathias Vorreiter Pedersen
7d00b49d05 C++: Accept test changes 2020-09-02 13:42:35 +02:00
Rasmus Wriedt Larsen
34c5da563e Python: Move files in experiemntal dirs to be consistent 
Except for dataflow (where we have a lot of changes, and I don't want to
introduce lots of merge conflicts right now).
 2020-09-02 13:39:01 +02:00
Rasmus Wriedt Larsen
9c8b829d65 Python: Fix formatting 2020-09-02 13:27:35 +02:00
Arthur Baars
223d94219e C#: autobuild: fix buildless mode for CodeQL 2020-09-02 13:23:23 +02:00
lcartey@github.com
fdfa75f3ec C++: Range analysis, allow extensible assign operations 
- defDependsOnDef supporting all analyzable AssignOperations
 - getDef(Upper|Lower)Bound supporting all analyzable AssignOperations
 2020-09-02 12:22:14 +01:00
Rasmus Wriedt Larsen
7a54d0b493 Java: Move files in experiemntal dirs to be consistent 2020-09-02 13:19:21 +02:00
Jonas Jensen
8e8c65a164 Merge pull request #4146 from jbj/partiallyDefinesVariableAt 
C++: Fix two join orders in FlowVar.qll
 2020-09-02 13:11:29 +02:00
Erik Krogh Kristensen
a24db09418 only flag unused array-destructs if it is the last variable 2020-09-02 11:40:35 +02:00
CodeQL CI
48a1ee6233 Merge pull request #4130 from erik-krogh/bbFix 
Approved by asgerf
 2020-09-02 10:38:50 +01:00
Anders Schack-Mulligen
89829e870d Java: Clean up SqlInjectionLib. 2020-09-02 11:17:56 +02:00
Tom Hvitved
701e189c1b C#: Add change note 2020-09-02 10:52:22 +02:00
Tom Hvitved
1b769ebac9 C#: Address more review comments 2020-09-02 10:52:05 +02:00
Tom Hvitved
51dc1515ab C#: Address review comments 2020-09-02 10:52:05 +02:00
Tom Hvitved
92bf830a8a C#: Avoid bad magic in UselessUpcast.ql 2020-09-02 10:52:05 +02:00
Tom Hvitved
c7f776984f C#: Add CFG tests for callables with multiple implementations 2020-09-02 10:52:05 +02:00
Tom Hvitved
8a0355720a C#: Make Callable::get[Expression|Statement]Body() return all possible implementations 
Previosly, we returned only the body belonging to "the most likely" implementation,
based on a CFG size heuristics. However, now that more callables are mapped to the
same entity, it makes more sense to treat such callables (to some extent) like
partial methods. This means, for instance, that data flow will branch out to all possible
implementations, much like we do for virtual dispatch.
 2020-09-02 10:52:05 +02:00
Tom Hvitved
afbbafe132 C#: Simplify TypeRef.qll 2020-09-02 10:52:05 +02:00
Tom Hvitved
d17f88bbcd C#: Remove assembly prefix from all extractor IDs 2020-09-02 10:52:04 +02:00
Calum Grant
7628caa2db C#: Avoid typerefs for constructed types. 2020-09-02 10:52:04 +02:00
Calum Grant
aa99269015 C#: Fix merge conflicts. Unfortunately, the type of symbolEntityCache needed to be the same as objectEntityCache to fix nullability warnings. 2020-09-02 10:52:04 +02:00
Calum Grant
0cfe424fc2 C#: Address review comments. 2020-09-02 10:52:04 +02:00
Calum Grant
9a51192d86 C#: Move TypeRefs into a separate file and import it privately. Reorder imports into alphabetical order. 2020-09-02 10:52:04 +02:00
Calum Grant
4740b47f5d C#: Minor edits 2020-09-02 10:52:04 +02:00
Calum Grant
f4b1594461 C#: Unqualify method names and nested types. 2020-09-02 10:52:04 +02:00
Calum Grant
f61fdc6891 C#: Only resolve a single, canonical type for each typeref. 2020-09-02 10:52:04 +02:00
Calum Grant
90517580a5 C#: Address review comment: Make dictionary type more specific. 2020-09-02 10:52:04 +02:00
Calum Grant
cd51a67c0d C#: Take nullability into account when creating symbol entities. Otherwise, an entity with the wrong (cached) nullability could be created. 2020-09-02 10:52:04 +02:00
Calum Grant
d1cde2a815 C#: Address review comment. 2020-09-02 10:52:03 +02:00
Calum Grant
4657ddcb7c C#: Avoid qualifying explicit interface implementations. 2020-09-02 10:52:03 +02:00
Calum Grant
6649d72a2d C#: Qualify type parameters with the entity that declares them 2020-09-02 10:52:03 +02:00
Calum Grant
6e5c2ef0e7 C#: Remove assembly qualifier from some trap-ids. 2020-09-02 10:52:03 +02:00
Calum Grant
29b3759655 Merge pull request #3961 from tausbn/python-add-typetracker 
Python: Add type tracker and step summary implementation.
 2020-09-02 09:42:14 +01:00
Mathias Vorreiter Pedersen
9887d8b7eb C++: Remove redundant rules 2020-09-02 10:33:12 +02:00
Erik Krogh Kristensen
f0a0f41c3c allow urls that are prefixed with # or ? in js/unsafe-external-link 2020-09-02 10:19:42 +02:00
Jonas Jensen
db45b29806 Merge pull request #4102 from rdmarsh2/rdmarsh2/cpp/input-iterators-1 
C++: Basic input iterator models
 2020-09-02 07:57:35 +02:00
ubuntu
042d07161c Rename getQueryCall to getQueryCallSink 2020-09-01 22:43:31 +02:00