hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-13 06:24:46 +01:00
Code Issues Packages Projects Releases Wiki Activity
17,948 Commits 1,681 Branches 158 Tags
codeql-cli/v2.4.0
Commit Graph

17948 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
CodeQL CI
722b1a24f6 Merge pull request #4087 from erik-krogh/thisJsx 
Approved by asgerf
 2020-08-25 10:20:32 +01:00
CodeQL CI
844abc51e8 Merge pull request #4108 from erik-krogh/packType 
Approved by asgerf
 2020-08-25 10:17:28 +01:00
Rasmus Wriedt Larsen
483bd0e863 Python: Fix shared taint tracking tests 
Since there was a .ql file, qltest tried to run a test in
test/experimental/dataflow/taintracking/ which failed since there was no code.
 2020-08-25 11:15:11 +02:00
yoff
3140b43db2 Apply suggestions from code review 
Co-authored-by: Taus <tausbn@github.com>
 2020-08-25 10:48:01 +02:00
Tamás Vajk
dc62cd166c C#: Enable nullability checks in Semmle.Extraction.Tests (#4112) 2020-08-25 08:40:30 +02:00
Robert Marsh
9aa3735165 C++: add tests for non-std:: iterators 2020-08-24 14:19:34 -07:00
Tamas Vajk
66e3739e72 Fix failing PrintAst test 2020-08-24 22:41:08 +02:00
Erik Krogh Kristensen
b0d4e79653 split out trap tests to avoid "package.json" naming conflict in trap test 2020-08-24 21:36:34 +02:00
Geoffrey White
adbfad21ef C++: Correct the localFlow test. 2020-08-24 18:05:30 +01:00
ubuntu
22f5ae4ad4 Format code 2020-08-24 18:53:37 +02:00
Geoffrey White
c0aaed2fac Merge branch 'main' into oparray2 2020-08-24 17:36:18 +01:00
Geoffrey White
ae807f7f33 C++: Autoformat. 2020-08-24 17:36:07 +01:00
Rasmus Wriedt Larsen
13148b42d3 Python: Handle taint of f-strings 2020-08-24 17:23:10 +02:00
Rasmus Wriedt Larsen
2f090df6d3 Python: Transform comments to QLDoc for security.strings.Basic 2020-08-24 17:20:04 +02:00
Rasmus Lerchedahl Petersen
2608509fa7 Merge branch 'main' of github.com:github/codeql into SharedDataflow_SequenceFlow 2020-08-24 17:16:33 +02:00
Rasmus Lerchedahl Petersen
e91581e9fa Python: Experiments with nested comprhensions 2020-08-24 17:15:31 +02:00
Rasmus Wriedt Larsen
be2acc00db Python: Add test for tainted f-string 2020-08-24 17:14:51 +02:00
CodeQL CI
e2c6a01c00 Merge pull request #4097 from erik-krogh/createRequire 
Approved by esbena
 2020-08-24 15:57:10 +01:00
Rasmus Wriedt Larsen
d96ef73033 Python: Handle taint for f-strings 
Which we seem to not handle in the current taint tracking :O

f-strings needs to be Python 3 only, so enabled that test setup. I really liked
the idea for having the version specific tests right next to the normal tests,
so you don't have to look in
test/experimental/3/dataflow/i/will/forget/to/look/here.
 2020-08-24 16:46:00 +02:00
Tamas Vajk
3dea6b3218 C#: Change implicitly sized array test input 2020-08-24 16:14:00 +02:00
Tamas Vajk
7516825b5f C#: Fix computed sizes for implicitly sized array creation 2020-08-24 16:14:00 +02:00
Geoffrey White
1c38a4d5d6 Update cpp/ql/src/semmle/code/cpp/dataflow/internal/TaintTrackingUtil.qll 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2020-08-24 14:33:51 +01:00
Tamas Vajk
699cafa890 C#: Add implicitly sized array creations to tests 2020-08-24 15:27:35 +02:00
Geoffrey White
d3c8ffb995 C++: Clean up, comment, and restrict the new flow to the post-update node of the returned reference. 2020-08-24 14:07:06 +01:00
Geoffrey White
f2caa8a2b0 C++: Reverse taint through function models returning a reference. 2020-08-24 14:05:04 +01:00
Geoffrey White
f25ef26c37 C++: Permit taint flow to the left side of an assignment. 2020-08-24 14:01:49 +01:00
Geoffrey White
1da78ada14 C++: Model 'operator[]' and 'at' for std::string, std::vector and other containers. 2020-08-24 13:58:43 +01:00
Rasmus Wriedt Larsen
cb4b4e91ab Python: Taint for string multiplication 2020-08-24 14:54:06 +02:00
Rasmus Wriedt Larsen
b688fe68d6 Python: Add options file to shared dataflow tests 
Since there isn't one in top-level of experimental, making a single import made
tests go really slow :|
 2020-08-24 14:54:05 +02:00
Rasmus Wriedt Larsen
5125c7a55c Python: Add taint tests for encode/decode functions 2020-08-24 14:54:04 +02:00
Geoffrey White
f6770c5b88 C++: Add tests for std::string 'operator[]' and 'at()'. 2020-08-24 13:49:39 +01:00
Rasmus Wriedt Larsen
31b398937a Python: Handle taint from bytes(obj) 2020-08-24 14:17:59 +02:00
Rasmus Wriedt Larsen
1e447c5ca2 Python: Handle taint for % formatting 2020-08-24 14:15:27 +02:00
Rasmus Wriedt Larsen
80745e8881 Python: Model string methods in shared taint tracking library 2020-08-24 13:58:42 +02:00
Rasmus Wriedt Larsen
a77f118b62 Python: Shared taint tracking: Handle string concat + subcript 2020-08-24 13:58:41 +02:00
Rasmus Wriedt Larsen
61f89ca3c3 Python: Add tests for shared taint tracking for strings 
I adopted the TestTaint testing setup that I made for the "old" taint tracking
tests. This time around we should figure out if we can use .qlref or similar so
it doesn't end up in multiple copies that are not kept up to date :|

The `repr` predicate could probably be placed somewhere better. For now I just
wanted something that could help me. I considered just expanding the `repr`
predicate in `ql/src/semmle/python/strings.qll`, but since it's currently used
by queries, I didn't want to do anything about it.

Anyway, the output it gives is much more useful than seeing this ;)

```
| test.py:20 | ok   | str_operations | test.py:20:9:20:10 | ts |
| test.py:21 | fail | str_operations | test.py:21:9:21:18 | BinaryExpr |
| test.py:22 | fail | str_operations | test.py:22:9:22:18 | BinaryExpr |
| test.py:23 | fail | str_operations | test.py:23:9:23:21 | Subscript |
| test.py:24 | fail | str_operations | test.py:24:9:24:13 | Subscript |
| test.py:25 | fail | str_operations | test.py:25:9:25:18 | Subscript |
| test.py:26 | fail | str_operations | test.py:26:9:26:13 | Subscript |
| test.py:27 | fail | str_operations | test.py:27:9:27:15 | str() |
| test.py:35 | fail | str_methods | test.py:35:9:35:23 | Attribute() |
| test.py:36 | fail | str_methods | test.py:36:9:36:21 | Attribute() |
| test.py:37 | fail | str_methods | test.py:37:9:37:22 | Attribute() |
| test.py:38 | fail | str_methods | test.py:38:9:38:23 | Attribute() |
| test.py:40 | fail | str_methods | test.py:40:9:40:19 | Attribute() |
| test.py:41 | fail | str_methods | test.py:41:9:41:23 | Attribute() |
| test.py:42 | fail | str_methods | test.py:42:9:42:36 | Attribute() |
| test.py:44 | fail | str_methods | test.py:44:9:44:25 | Attribute() |
| test.py:45 | fail | str_methods | test.py:45:9:45:45 | Attribute() |
| test.py:47 | fail | str_methods | test.py:47:9:47:21 | Attribute() |
| test.py:48 | fail | str_methods | test.py:48:9:48:19 | Attribute() |
| test.py:49 | fail | str_methods | test.py:49:9:49:18 | Attribute() |
| test.py:51 | fail | str_methods | test.py:51:9:51:32 | Attribute() |
| test.py:52 | fail | str_methods | test.py:52:9:52:34 | Attribute() |
| test.py:54 | fail | str_methods | test.py:54:9:54:21 | Attribute() |
| test.py:55 | fail | str_methods | test.py:55:9:55:19 | Attribute() |
| test.py:56 | fail | str_methods | test.py:56:9:56:18 | Attribute() |
| test.py:57 | fail | str_methods | test.py:57:9:57:21 | Attribute() |
| test.py:58 | fail | str_methods | test.py:58:9:58:18 | Attribute() |
| test.py:59 | fail | str_methods | test.py:59:9:59:18 | Attribute() |
| test.py:60 | fail | str_methods | test.py:60:9:60:21 | Attribute() |
| test.py:62 | fail | str_methods | test.py:62:9:62:26 | Attribute() |
| test.py:63 | fail | str_methods | test.py:63:9:63:42 | Attribute() |
| test.py:65 | fail | str_methods | test.py:65:9:65:26 | Attribute() |
| test.py:66 | fail | str_methods | test.py:66:9:66:42 | Attribute() |
| test.py:69 | fail | str_methods | test.py:69:9:69:25 | Attribute() |
| test.py:70 | fail | str_methods | test.py:70:9:70:26 | Attribute() |
| test.py:71 | fail | str_methods | test.py:71:9:71:22 | Attribute() |
| test.py:72 | fail | str_methods | test.py:72:9:72:21 | Attribute() |
| test.py:73 | fail | str_methods | test.py:73:9:73:23 | Attribute() |
| test.py:78 | ok   | str_methods | test.py:78:9:78:39 | Attribute() |
```
 2020-08-24 13:58:39 +02:00
Jonas Jensen
b2cd98a98f C++: Confirm correct behaviour on C++20 
Making `constexpr` imply `const` was correct for C++11 and was a correct
emulation of a GCC bug on GCC < 5.0. This test confirms that the problem
isn't there in C++20.
 2020-08-24 13:42:40 +02:00
Philippe Antoine
07610e0899 Format document 2020-08-24 13:12:54 +02:00
Ian Lynagh
3ead154c9a C++: Add VariableDeclarationEntry test to library-tests/variables/global 2020-08-24 11:51:52 +01:00
Erik Krogh Kristensen
309346841a Merge branch 'main' into packType 2020-08-24 12:44:24 +02:00
Erik Krogh Kristensen
5acfd92e0f bump the extractor version 2020-08-24 12:42:19 +02:00
Erik Krogh Kristensen
d633410e3c make the extractor not crash on invalid "package.json" files 2020-08-24 12:42:08 +02:00
Erik Krogh Kristensen
eb84f97e7f Merge branch 'main' into ts4 2020-08-24 12:20:48 +02:00
CodeQL CI
765c40ef03 Merge pull request #4019 from erik-krogh/asyncCalls 
Approved by asgerf
 2020-08-24 11:18:42 +01:00
Anders Schack-Mulligen
d82fee11b1 Java: Add data flow for record getters. 2020-08-24 11:51:04 +02:00
Jonas Jensen
cd8e9a1ece C++: Demonstrate that constexpr implies const 
This test shows that a member function declared `constexpr` also gets a
`const` specifier.
 2020-08-24 11:39:41 +02:00
Taus
b8d6f76749 Merge pull request #4056 from yoff/SharedDataflow_ParameterTests 
Python: Shared dataflow, parameter routing tests
 2020-08-24 11:36:30 +02:00
Ian Lynagh
fb62ce6d25 C++: Give fewer types to global variables 
Follows change in the extractor.
 2020-08-24 00:49:33 +01:00
Mathias Vorreiter Pedersen
6f750dac88 Merge remote-tracking branch 'origin/main' into alternative-instruction-operand-flow 2020-08-23 18:46:07 +02:00
ubuntu
3e97ec85b2 Add CodeQL to detect LDAP Injection in JS 2020-08-23 15:24:29 +02:00