hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-16 07:54:52 +01:00
Code Issues Packages Projects Releases Wiki Activity
17,948 Commits 1,680 Branches 158 Tags
codeql-cli/v2.4.0
Commit Graph

17948 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mathias Vorreiter Pedersen
a0603692cb C++: Add LoadChain and StoreChain nodes to handle reverse reads in dataflow 2020-05-29 13:53:53 +02:00
Rasmus Wriedt Larsen
59548a523e Python: Add change-note about UntrustedStringKind imports 2020-05-29 13:45:10 +02:00
Philip Ginsbach
2d47537f11 Slightly modified version of Henning's suggestion 2020-05-29 12:41:58 +01:00
Erik Krogh Kristensen
f7ad210331 use SSA instead of internal AccessPath API 2020-05-29 13:08:19 +02:00
Erik Krogh Kristensen
05bfba4f99 use getImmediatePredecessor instead of getALocalSource() 2020-05-29 13:01:09 +02:00
Jonas Jensen
453de6bf4e Merge pull request #3583 from MathiasVP/qldoc-for-unix-constants 
C++: QLDoc for Constants
 2020-05-29 12:27:59 +02:00
Mathias Vorreiter Pedersen
335baaef73 C++: Add testcases for partial definitions with long access paths 2020-05-29 12:15:39 +02:00
Rasmus Wriedt Larsen
48be57c8fd Python: Improve QLDoc for ExternalStringDictKind 2020-05-29 12:06:57 +02:00
Rasmus Wriedt Larsen
b083c01520 Python: Deprecate StringDictKind 
This QL

```codeql
import python
import semmle.python.dataflow.TaintTracking
import semmle.python.security.strings.Untrusted

from CollectionKind ck
where
    ck.(DictKind).getMember() instanceof StringKind
    or
    ck.getMember().(DictKind).getMember() instanceof StringKind
select ck, ck.getAQlClass(), ck.getMember().getAQlClass()
```

generates these 6 results.

```
1	{externally controlled string}          ExternalStringDictKind	UntrustedStringKind
2	{externally controlled string}	        StringDictKind	        UntrustedStringKind
3	[{externally controlled string}]	SequenceKind	        ExternalStringDictKind
4	[{externally controlled string}]	SequenceKind	        StringDictKind
5	{{externally controlled string}}	DictKind	        ExternalStringDictKind
6	{{externally controlled string}}	DictKind	        StringDictKind
```

StringDictKind was only used in *one* place in our library code. As illustrated
above, it pollutes our set of TaintKinds. Effectively, every time we make a
flow-step for dictionaries with tainted strings as values, we do it TWICE --
once for ExternalStringDictKind, and once for StringDictKind... that is just a
waste.
 2020-05-29 12:06:57 +02:00
Rasmus Wriedt Larsen
87bc8ae28d Python: Don't use UntrustedStringKind in web lib 
If I wanted to use my own TaintKind and not have any interaction with
`UntrustedStringKind` that wouldn't be possible today since these standard http
libraries import it directly. (also, I wouldn't get any sources of my custom
TaintKind from turbogears or bottle). I changed them to use the same pattern of
`ExternalStringKind` as everything else does.
 2020-05-29 12:06:57 +02:00
Mathias Vorreiter Pedersen
ae4f6edc6a Merge pull request #3204 from jbj/Expr-location-workaround 
C++: Move Expr location workaround to Expr.qll
 2020-05-29 11:58:50 +02:00
Philip Ginsbach
bb9e800241 remove "experimental syntax" box for type unions 2020-05-29 10:24:42 +01:00
Philip Ginsbach
299d87aa8e better explanation of the purpose of type unions 
Co-authored-by: Pavel Avgustinov <54942558+p0@users.noreply.github.com>
 2020-05-29 10:22:57 +01:00
Philip Ginsbach
0562b4a2dd restricted _subsets_ of algebraic datatypes 
Co-authored-by: Pavel Avgustinov <54942558+p0@users.noreply.github.com>
 2020-05-29 10:21:58 +01:00
Asger Feldthaus
f3a08375b4 JS: Use newer yarn.lock format 2020-05-29 09:45:50 +01:00
Jonas Jensen
7d4d435f25 Merge remote-tracking branch 'upstream/master' into Expr-location-workaround 
Conflicts:
	cpp/ql/test/library-tests/dataflow/fields/dataflow-ir-consistency.expected
 2020-05-29 10:04:12 +02:00
Mathias Vorreiter Pedersen
a305d39111 Merge pull request #3577 from dbartol/github/codeql-c-analysis-team/69 
C++: Fix `MemoryLocation` with multiple `VirtualVariables`
 2020-05-29 09:40:58 +02:00
Mathias Vorreiter Pedersen
0467995f4f C++: Make explicit that O_CREAT and O_EXCL are Linux-specific 2020-05-29 09:36:08 +02:00
Jonas Jensen
9813258a3e Merge remote-tracking branch 'upstream/master' into Expr-location-workaround 
Conflicts and semantic conflicts in `library-tests/dataflow/fields` and
`library-tests/ir/ir`.
 2020-05-29 08:44:37 +02:00
Jonas Jensen
87ad519541 Merge pull request #3569 from geoffw0/strftime 
C++: Taint flow consistency change for strftime
 2020-05-29 08:05:25 +02:00
yo-h
1fea545160 Merge pull request #3573 from aschackmull/java/private-interface-methods 
Java: Fix for private interface methods.
 2020-05-28 20:31:55 -04:00
yo-h
c2de08ca51 Merge pull request #3499 from aschackmull/java/instanceof-pattern-cfg 
Java: Add CFG edges for Java 14 pattern-matching instanceof.
 2020-05-28 20:24:39 -04:00
Robert Marsh
a638a08bc5 C++: autoformat 2020-05-28 17:06:14 -07:00
Robert Marsh
f82c97b84a C++: fix IR control flow for cast in placement new 2020-05-28 16:53:21 -07:00
Robert Marsh
56d0762380 C++: add test for placement new with cast 2020-05-28 16:36:26 -07:00
Robert Marsh
732da9cc4c Merge pull request #3586 from MathiasVP/qldoc-for-remaining-controlflow 
C++: QLDoc for the remaining elements in the controlflow directory
 2020-05-28 15:59:19 -07:00
Robert Marsh
a897caec76 C++: outbound dataflow via this indirections 2020-05-28 15:30:41 -07:00
Robert Marsh
7dc30e3fdc C++: add output indirections for this 2020-05-28 15:30:41 -07:00
Dave Bartolomeo
476f27e427 Merge from master 2020-05-28 17:27:08 -04:00
Dave Bartolomeo
01ef8795bf C++: Updated fixed test expectation 2020-05-28 17:24:38 -04:00
Robert Marsh
0d8472bd9e Merge pull request #3571 from rdmarsh2/ir-this-parameter 
Treat `this` as a parameter in IR generation
 2020-05-28 14:16:12 -07:00
Calum Grant
2b90b50587 Merge pull request #3528 from hvitved/csharp/cfg/cs6-initializers 
C#: Fix CFG for C# 6 initializers
 2020-05-28 21:40:52 +01:00
Calum Grant
499e349bff Merge pull request #3529 from hvitved/csharp/cs6-nested-initializer-type 
C#: Fix extracted type for nested object initializers
 2020-05-28 21:25:57 +01:00
Jonas Jensen
8b8c00de75 Merge pull request #3584 from jbj/devcontainer 
Codespaces: initial configuration
 2020-05-28 19:06:02 +02:00
Robert Marsh
d8b5d3bce8 C++: accept test fixes 2020-05-28 08:45:01 -07:00
Robert Marsh
693789c2cc Merge branch 'master' into ir-this-parameter 
Bring in new tests so their output can be fixed
 2020-05-28 08:32:10 -07:00
Mathias Vorreiter Pedersen
7b2c9c5aed C++: Add quotes to improve readability. 2020-05-28 16:48:48 +02:00
Mathias Vorreiter Pedersen
5fb79cde9a C++: Sync identical files 2020-05-28 16:45:52 +02:00
Mathias Vorreiter Pedersen
0671586aac C++: QLDoc for the remaining elements in the controlflow directory 2020-05-28 16:35:46 +02:00
Geoffrey White
6fcfd0310f C++: Autoformat. 2020-05-28 15:23:48 +01:00
Geoffrey White
c9e1ccf320 Merge branch 'master' into strftime 2020-05-28 15:22:16 +01:00
Jonas Jensen
19d4011b8a Codespaces: initial configuration 
This was adapted from https://github.com/github/vscode-codeql-starter.
 2020-05-28 14:01:36 +02:00
Jonas Jensen
688f540843 Merge pull request #3582 from MathiasVP/qldoc-for-controlflow 
C++: QLDoc for BasicBlock, ControlFlowGraph and Dataflow
 2020-05-28 13:52:43 +02:00
Philip Ginsbach
63a6422dbf incorporated Henning's example for type unions into the handbook 2020-05-28 12:32:31 +01:00
Erik Krogh Kristensen
5bb308dc8f sanitize variables used in an HTML escaping switch-case 2020-05-28 12:37:41 +02:00
Mathias Vorreiter Pedersen
1ef0643b60 C++: QLDoc for Constants 2020-05-28 12:24:23 +02:00
Calum Grant
725a8f55ca Merge pull request #3574 from hvitved/csharp/unification-performance 
C#: Fix performance issue in unification library
 2020-05-28 10:39:02 +01:00
Mathias Vorreiter Pedersen
52da5755b3 C++: Respond to review comments. 2020-05-28 11:20:13 +02:00
Jonas Jensen
1b23f3ec90 C++: Accept two more changed tests 2020-05-28 11:18:14 +02:00
Erik Krogh Kristensen
1a2db10a90 recognize barrier guard where the result is stored in a variable 2020-05-28 10:24:42 +02:00