semmle-qlci
29b8a0db92
Merge pull request #3508 from asger-semmle/js/shared-data-flow-node
...
Approved by esbena
2020-05-20 10:58:09 +01:00
Anders Schack-Mulligen
8cbc01d49b
Java: Add a few qltest cases for nullness and range analysis FPs.
2020-05-20 10:44:15 +02:00
Erik Krogh Kristensen
33e0f25f3c
use NodeJSLib::Path instead of DataFlow::moduleMember
2020-05-20 10:30:23 +02:00
Erik Krogh Kristensen
7c51dff0f7
share implementation between TaintedPath and ZipSlip
2020-05-20 10:10:04 +02:00
Tom Hvitved
36e29e0f75
C#: Add CFG tests for C# 6 initializers
2020-05-20 09:33:51 +02:00
Tom Hvitved
e9839198f4
Merge pull request #3484 from calumgrant/cs/index-initializers
...
C#: Extract indexed initializers correctly
2020-05-20 09:22:47 +02:00
Tom Hvitved
97080731ad
Merge pull request #3486 from h3ku/master
...
CSHARP: Add experimental query for tainted WebClient
2020-05-20 08:17:05 +02:00
Rasmus Lerchedahl Petersen
4d6ad32f04
Python: Update test expectations.
...
As ar as I can tell, all these are improvements
2020-05-20 08:11:03 +02:00
Robert Marsh
28c2acabe5
Merge pull request #3505 from dbartol/github/codeql-c-analysis-team/69
...
C++/C#: Remove `UnmodeledDefinition` instruction
2020-05-19 17:17:53 -07:00
Dave Bartolomeo
3832d4cae6
C++: Mark deprecated overrides as deprecated
...
The QL compiler is about to be changed to emit a warning when overriding a deprecated predicate. This PR marks the existing overrides of deprecated predicates as `deprecated` themselves, which avoids the warning.
The `Print.qll` models seem to preserve the `isWideCharDefault()` predicate for backwards compatibility, so we can't remove them and must continue overriding them.
The `XML.qll` override is necessary because both superclasses declare the `getName()` predicate. One is `deprecated`, and the other is `abstract`, so we have to have an override.
2020-05-19 16:33:33 -04:00
semmle-qlci
0a8b3adc25
Merge pull request #3518 from felicitymay/merge-124-master
...
Approved by shati-patel
2020-05-19 19:30:47 +01:00
Felicity Chapman
99d7a21425
Merge branch 'rc/1.24' into merge-124-master
2020-05-19 19:04:44 +01:00
Felicity Chapman
cca3922d00
Merge pull request #3517 from felicitymay/1.24/SD-54-update-contact
...
CodeQL 1.24: Update information on support
2020-05-19 18:57:34 +01:00
Tom Hvitved
f0f833b58f
Merge pull request #3512 from jbj/mergeback-2020-05-19
...
Mergeback rc/1.24 -> master
2020-05-19 19:51:36 +02:00
Felicity Chapman
70d642a956
Update information on support
2020-05-19 18:17:17 +01:00
Erik Krogh Kristensen
5b569a4d6d
add a sanitizer for chained replace-calls
2020-05-19 19:16:58 +02:00
Geoffrey White
fdf4e83c25
C++: Solve tuple count bulge that may affect performance.
2020-05-19 16:59:37 +01:00
Jonas Jensen
d38700a87c
Merge remote-tracking branch 'upstream/master' into mergeback-2020-05-19
...
Conflicts:
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/tainted.expected
cpp/ql/test/library-tests/dataflow/DefaultTaintTracking/test_diff.expected
2020-05-19 17:44:15 +02:00
Asger Feldthaus
9d006327df
JS: Update qldoc for ValueNode
2020-05-19 15:57:07 +01:00
semmle-qlci
26dfca80f6
Merge pull request #3510 from max-schaefer/cull-boring-queries
...
Approved by asgerf, esbena
2020-05-19 15:41:53 +01:00
Asger Feldthaus
b39e0ec091
JS: Update output due to whitelisting change
2020-05-19 15:30:36 +01:00
Hector Cuesta
66d77a43bd
Fix typo in comment and TaintTrackingConfiguration name
2020-05-19 15:15:03 +01:00
Hector Cuesta
e18d8c5234
Remove duplicated CWE in security tag
2020-05-19 15:12:43 +01:00
Hector Cuesta
7d1ef92fbf
Remove unnecessary CWE reference.
2020-05-19 15:09:17 +01:00
Mathias Vorreiter Pedersen
f0f7e531d7
Merge pull request #3511 from jbj/simplify-field-conflation-test
...
C++: Simplify field conflation test
2020-05-19 16:04:45 +02:00
yo-h
bfeaeccf60
Merge pull request #3507 from aschackmull/java/cleanup-deprecated-overrides
...
Java: Clean up deprecated overrides.
2020-05-19 09:47:57 -04:00
Tom Hvitved
431403f5db
Data flow: Remove deprecated predicates
2020-05-19 15:42:59 +02:00
Tom Hvitved
2519e8a5f1
C#: Remove more deprecated classes and predicates
2020-05-19 15:39:17 +02:00
Tom Hvitved
9db8b993a9
C#: Remove two deprecated predicates
2020-05-19 15:32:29 +02:00
Bt2018
19d2a404c9
Add AndroidRString RefType to clarify the Android query
2020-05-19 08:44:26 -04:00
Max Schaefer
a803120414
Lower precision for a number of queries.
...
These queries are currently run by default, but don't have their results displayed.
Looking through results on LGTM.com, they are either false positives (e.g., `BitwiseSignCheck` which flags many perfectly harmless operations and `CompareIdenticalValues` which mostly flags NaN checks) or harmless results that developers are unlikely to care about (e.g., `EmptyArrayInit` or `MisspelledIdentifier`).
With this PR, the only queries that are still run but not displayed are security queries, where different considerations may apply.
2020-05-19 13:43:17 +01:00
Jonas Jensen
5318d42c4f
Merge remote-tracking branch 'upstream/rc/1.24' into mergeback-2020-05-19
2020-05-19 14:42:58 +02:00
Jonas Jensen
486f06ab18
C++: Simplify field conflation test
...
It turned out the `memcpy` step was not even necessary.
2020-05-19 14:12:11 +02:00
Erik Krogh Kristensen
b71919299b
Apply suggestions from code review
...
Co-authored-by: Asger F <asgerf@github.com >
2020-05-19 14:03:03 +02:00
Alexander Eyers-Taylor
57dbe5793f
Merge pull request #3501 from jbj/dispatch-global-union
...
C++: Fix struct field conflation in IR data flow
2020-05-19 12:29:25 +01:00
Esben Sparre Andreasen
76bce40a8b
JS: test fixups
2020-05-19 13:12:34 +02:00
Asger F
875c3706e3
Update javascript/ql/src/semmle/javascript/CFG.qll
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2020-05-19 12:08:51 +01:00
Asger Feldthaus
3f30564d93
JS: Autoformat
2020-05-19 12:05:32 +01:00
Geoffrey White
7d630c458e
Merge branch 'master' into fp2762
2020-05-19 11:43:50 +01:00
Asger Feldthaus
0db0ddf476
JS: Add a change note
2020-05-19 11:07:35 +01:00
Asger Feldthaus
525b9871e0
JS: Update benign test output changes
2020-05-19 11:07:08 +01:00
Asger Feldthaus
b5b93f33bc
JS: Bump to TypeScript 3.9.2
2020-05-19 11:07:08 +01:00
Anders Schack-Mulligen
6f03a0bc39
Merge pull request #3487 from luchua-bc/java-sensitive-jboss-logging
...
Add JBoss logging
2020-05-19 11:04:18 +02:00
Anders Schack-Mulligen
c36e6213f1
Merge pull request #3288 from ggolawski/jndi-injection
...
CodeQL query to detect JNDI injections
2020-05-19 11:03:29 +02:00
Asger Feldthaus
f49b36aec7
JS: Change note
2020-05-19 09:52:26 +01:00
Anders Schack-Mulligen
9d7329de30
Java: Clean up deprecated overrides.
2020-05-19 10:41:41 +02:00
Erik Krogh Kristensen
0275ea955b
update expected output
2020-05-19 10:29:07 +02:00
Erik Krogh Kristensen
a4450c36f6
autoformat
2020-05-19 10:26:36 +02:00
Erik Krogh Kristensen
5a5192b890
add testing for complex path sanitizer in ZipSlip
2020-05-19 10:17:15 +02:00
semmle-qlci
0c081a8e87
Merge pull request #3497 from esbena/js/yield-and-local-objects
...
Approved by asgerf, erik-krogh
2020-05-19 09:02:22 +01:00
