hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-16 07:54:52 +01:00
Code Issues Packages Projects Releases Wiki Activity
19,777 Commits 1,680 Branches 158 Tags
codeql-cli/v2.4.4
Commit Graph

19777 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Krogh Kristensen
8b3e86c4f8 change note 2020-05-11 13:40:59 +02:00
Erik Krogh Kristensen
3ce60733cc add test case 2020-05-11 13:11:24 +02:00
Erik Krogh Kristensen
acb0f2e54f exclude "@babel/helpers - .." from js/unknown-directive 2020-05-11 12:42:18 +02:00
james
148c7eb34d docs: further reading ql training 2020-05-11 11:40:58 +01:00
james
3a00c4838e docs: further reading QL tutorials 2020-05-11 11:40:58 +01:00
james
5292051c3e docs: further reading for codeql queries section 2020-05-11 11:40:50 +01:00
Jonas Jensen
4f5b8f7306 Merge pull request #3430 from MathiasVP/comments-about-comments 
C++: Add QLDoc to CaptionedComments.qll and CommentedOutCode.qll
 2020-05-11 12:36:54 +02:00
Tom Hvitved
c837ab7d1a Apply suggestions from code review 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2020-05-11 11:42:50 +02:00
Mathias Vorreiter Pedersen
715fa9e446 Simplify comment 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2020-05-11 11:32:10 +02:00
Mathias Vorreiter Pedersen
104545f3a7 Replace 'Returns' with 'Gets' 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2020-05-11 11:31:51 +02:00
Calum Grant
91229f8d52 Merge pull request #3398 from hvitved/csharp/missing-x-frame-option 
C#: More results for `cs/web/missing-x-frame-options`
 2020-05-11 10:28:26 +01:00
Mathias Vorreiter Pedersen
411e52a231 C++: Replace @buildin_op with @builtin_op 2020-05-11 11:12:48 +02:00
Jonas Jensen
b3498bd0ad Merge pull request #3425 from MathiasVP/remove-more-abstract-classes 
C++: Remove abstract keyword from a couple of AST classes
 2020-05-11 10:55:35 +02:00
Jonas Jensen
bebd5ae36b C++: Call qualifiers are passed by reference 
After #3382 changed the escape analysis to model qualifiers as escaping,
there was an imbalance in the SSA library, where `addressTakenVariable`
excludes variables from SSA analysis if they have their address taken
but are _not_ passed by reference. This showed up as a missing result in
`TOCTOUFilesystemRace.ql`, demonstrated with a test case in #3432.

This commit changes the definition of "pass by reference" to include
call qualifiers, which allows SSA modeling of variables that have member
function calls on them.
 2020-05-11 09:39:48 +02:00
Jonas Jensen
8ff045b6a2 Merge pull request #3432 from geoffw0/toctou 
C++: Add a test of TOCTOUFilesystemRace.ql
 2020-05-11 09:18:51 +02:00
Tom Hvitved
c2c4142271 Merge pull request #3306 from calumgrant/cs/extraction-nullability 
C#: Enable nullability in Semmle.Extraction project
 2020-05-11 08:40:31 +02:00
Jonas Jensen
71c21e6eca C++: Accept test changes forgotten in 32e04b403 
Adding a new test case leads to changes in all `.expected` files in its
directory.

The new results show that the `DefinitionsAndUses` library does not
model `std::addressof` correctly, but that library is not intended to be
used for new code.
 2020-05-11 08:17:13 +02:00
Erik Krogh Kristensen
f8de69156e inline basicFlowStep into flowStep 2020-05-10 22:15:37 +02:00
Erik Krogh Kristensen
87167900d1 deduplicate - and slightly optimize IndirectInclusionTest 2020-05-10 22:15:37 +02:00
Erik Krogh Kristensen
6d05b40d23 eliminate recursion from GuardControlFlowNode::dominates 2020-05-10 22:15:34 +02:00
Cornelius Riemenschneider
3596ff7c51 Address review. 2020-05-10 19:34:16 +02:00
Artem Smotrakov
bab6f3788e Java: Added a query for unsafe TLS versions 
- Added experimental/Security/CWE/CWE-327/UnsafeTlsVersion.ql
- Added SslLib.qll
- Added a qhelp file with examples
- Added tests in java/ql/test/experimental/Security/CWE/CWE-327
 2020-05-10 19:14:52 +02:00
Mathias Vorreiter Pedersen
b34db333a5 C++: Add upgrade script 2020-05-09 13:41:39 +02:00
Grzegorz Golawski
a16295ebc0 Fix typos 2020-05-08 20:13:50 +02:00
yo-h
c54f8d8128 Merge pull request #3383 from aschackmull/java/printast 
Java: Library for pretty-printing AST in linear time.
 2020-05-08 13:01:39 -04:00
Jason Reed
beccdce108 C#: Refactor definitions query, add queries for ide search 
This enables jump-to-definition and find-references in the VS Code
extension, for C# source archives.
 2020-05-08 07:31:50 -04:00
jcreedcmu
c9788a7928 Merge pull request #3308 from jcreedcmu/jcreed/jump-to-def 
Add queries for VS Code jump-to-definition
 2020-05-08 07:29:02 -04:00
Mathias Vorreiter Pedersen
86f283dff2 C++: Add new stats file from Jenkins job 2020-05-08 09:15:58 +02:00
Grzegorz Golawski
afea9330b7 Fix the case where user-controlled input is passed as URL to env Hashtable 2020-05-08 00:44:22 +02:00
Grzegorz Golawski
df9921f870 Update according to the review comments 2020-05-07 23:19:13 +02:00
Geoffrey White
bff97d9fe5 C++: Effect of #3382. 2020-05-07 19:06:05 +01:00
Geoffrey White
6499197087 C++: Add a test of TOCTOUFilesystemRace.ql. 2020-05-07 19:03:32 +01:00
Robert Marsh
761e3186f5 Merge pull request #3426 from MathiasVP/test-3110 
C++: Add testcase for #3110
 2020-05-07 10:40:12 -07:00
Jason Reed
01eeebc068 Java: Refactor definitions query, add queries for ide search 
This enables jump-to-definition and find-references in the VS Code
extension, for Java source archives.
 2020-05-07 12:44:36 -04:00
Jason Reed
48e4079c64 JS: Refactor definitions query, add queries for ide search 
This enables jump-to-definition and find-references in the VS Code
extension, for javascript source archives.
 2020-05-07 12:44:36 -04:00
Mathias Vorreiter Pedersen
8df25c3025 C++: Add QLDoc 2020-05-07 18:34:26 +02:00
Jonas Jensen
4b9a3f1482 Merge remote-tracking branch 'upstream/master' into dataflow-defbyref-to-field 2020-05-07 16:48:41 +02:00
Jonas Jensen
88eeca39fb Merge commit '52d8acc1a198c5ea29c1dddceda1d6c0fb75de14' into dataflow-defbyref-to-field 
This is a partial merge from master. In particular, it takes in #3382
and #3385.
 2020-05-07 16:46:11 +02:00
Jonas Jensen
5e8bd0a724 C++: Fix variable name in comment 2020-05-07 16:38:15 +02:00
Jonas Jensen
32e04b4033 C++: Support std::addressof 
I didn't add this support in `AddressConstantExpression.qll` since I
think it would require extra work and testing to get the constexprness
right. My long-term plan for `AddressConstantExpression.qll` is to move
its functionality to the extractor.
 2020-05-07 16:30:44 +02:00
Tom Hvitved
948c2f7f7e C++: Add change note 2020-05-07 16:01:55 +02:00
Tom Hvitved
0b85f3fed4 Address review comments 2020-05-07 15:58:46 +02:00
Taus
2502d1c3ed Merge pull request #3410 from RasmusWL/python-fix-3397 
Python: More safe methods for py/modification-of-default-value
 2020-05-07 15:28:24 +02:00
Anders Schack-Mulligen
2561ba82db Merge pull request #3215 from aibaars/validating-object-input 
Java: teach UnsafeDeserialization about ValidatingObjectInputStream
 2020-05-07 14:57:50 +02:00
Cornelius Riemenschneider
1aa7a827af Add QLDoc. 2020-05-07 14:53:41 +02:00
Mathias Vorreiter Pedersen
594f3b1807 C++: Add testcase for #3110 2020-05-07 14:39:53 +02:00
Dave Bartolomeo
e435484740 C++/C#: Fix formatting 2020-05-07 08:39:01 -04:00
Mathias Vorreiter Pedersen
43ffcfe730 C++: Remove abstract keyword from BuiltInOperation 2020-05-07 13:18:12 +02:00
Taus
964b8478dc Merge pull request #3405 from jcreedcmu/jcreed/jump-to-def-python 
Python: Refactor definitions query, add queries for ide search
 2020-05-07 12:51:35 +02:00
Mathias Vorreiter Pedersen
dd0ca34038 C++: Remove abstract keyword from a couple of AST classes 2020-05-07 12:01:07 +02:00