hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-17 00:14:51 +01:00
Code Issues Packages Projects Releases Wiki Activity
19,777 Commits 1,679 Branches 158 Tags
codeql-cli/v2.4.4
Commit Graph

19777 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Erik Krogh Kristensen
ffdbe31a30 change-note 2020-05-04 09:08:46 +02:00
Erik Krogh Kristensen
cee986fa76 skip expressions that are alone in a file for js/useless-expression 2020-05-04 09:08:41 +02:00
Tom Hvitved
32b419229d C#: Address review comments 2020-05-04 09:01:49 +02:00
mithrilwoodrat
1053aa4c44 add query to found Tomcat config disables 'HttpOnly' flag 2020-05-04 12:26:03 +08:00
Grzegorz Golawski
f893954ea3 Add Spring LDAP and JMXServiceURL related sinks 2020-05-03 20:51:50 +02:00
Dave Bartolomeo
8e9e3c8919 Merge pull request #3395 from jbj/IRBlock-unique 
C++: Use `unique` aggregate in IRBlock computation
 2020-05-03 07:54:51 -04:00
Jonas Jensen
0a59045dc3 C++: Use unique aggregate in IRBlock computation 
This gives a slight speedup, and I think it makes the code shorter and
clearer.

On Wireshark, the time from the beginning of the `IRBlock` stage until
just before evaluation of `getInstruction` drops from 44s to 34s.
 2020-05-03 10:07:09 +02:00
John Doe
68b57502f9 JS SSTI CWE-094 2020-05-03 02:42:45 +03:00
Dave Bartolomeo
d8f32e3db5 Merge pull request #3392 from rdmarsh2/rdmarsh/cpp/qldoc-get-ConvertedResultExpression 
C++/C#: improve qldoc on IR get*ResultExpression
 2020-05-02 15:59:08 -04:00
semmle-qlci
c66ec3c981 Merge pull request #3380 from asger-semmle/js/cache-amd 
Approved by erik-krogh
 2020-05-02 20:18:22 +01:00
Cornelius Riemenschneider
bab893d2d1 Address review. 2020-05-02 15:27:56 +02:00
Dave Bartolomeo
a166a4d143 C++: A few IR QLDoc comments 2020-05-01 18:17:20 -04:00
Robert Marsh
83e222e5bd C++/C#: sync files 2020-05-01 14:17:43 -07:00
Robert Marsh
537db53a8d C++/C#: improve qldoc on IR get*ResultExpression 2020-05-01 14:12:44 -07:00
Nick Rolfe
4ce896b856 Merge pull request #3378 from matt-gretton-dann/codeql-c-extractor/49-consteval 
Add support for C++20's consteval specifier
 2020-05-01 17:56:56 +01:00
Erik Krogh Kristensen
efbd74a4a4 remove more spurious jQuery objects by using externs 2020-05-01 18:54:32 +02:00
Geoffrey White
c8292e4b8e Merge pull request #3148 from jbj/minmax-to-unique 
C++: Replace "min = max" with "unique"
 2020-05-01 17:43:32 +01:00
Erik Krogh Kristensen
2a1095abcc autoformat, and apply naming suggestion 2020-05-01 18:35:34 +02:00
Jonas Jensen
4ec0ae6698 Merge pull request #3388 from geoffw0/cleanupstuff 
C++: Small tidy up
 2020-05-01 17:29:12 +02:00
Jonas Jensen
62c7387a76 Merge pull request #3373 from sj/patch-4 
Update CODEOWNERS to use GitHub team identifiers after repo move
 2020-05-01 17:11:12 +02:00
Mathias Vorreiter Pedersen
2e3463740d Merge pull request #3382 from jbj/escape-qualifier 
C++: Addresses may escape through call qualifiers
 2020-05-01 16:23:46 +02:00
Mathias Vorreiter Pedersen
37f30d3bd2 Merge pull request #3385 from jbj/dataflow-remove-from-post 
C++: Remove an unneeded local-flow case
 2020-05-01 16:19:04 +02:00
Jonas Jensen
1b1095ee75 C++: Post-update flow through &, *, +, ... 
Flow from a definition by reference of a field into its object was
working inconsistently and in a very syntax-dependent way. For a
function `f` receiving a reference, `f(a->x)` could propagate data back
to `a` via the _reverse read_ mechanism in the shared data-flow library,
but for a function `g` receiving a pointer, `g(&a->x)` would not work.
And `f((*a).x)` would not work either.

In all cases, the issue was that the shared data-flow library propagates
data backwards between `PostUpdateNode`s only, but there is no
`PostUpdateNode` for `a->x` in `g(&a->x)`. This pull request inserts
such post-update nodes where appropriate and links them to their
neighbors. In this exapmle, flow back from the output parameter of `g`
passes first to the `PostUpdateNode` of `&`, then to the (new)
`PostUpdateNode` of `a->x`, and finally, as a _reverse read_ with the
appropriate field projection, to `a`.
 2020-05-01 15:40:19 +02:00
Geoffrey White
9b4884dfaf C++: Backticks. 2020-05-01 14:26:34 +01:00
Geoffrey White
200d7ed360 C++: Remove if-else. 2020-05-01 14:26:34 +01:00
Geoffrey White
4907677351 C++: Try to improve QLDoc on deconstructSizeExpr. 2020-05-01 14:26:33 +01:00
Jonas Jensen
9b9f5248af C++: Accept test changes 
Lambda invocations are apparently const. This was exposed by the fix in
the previous commit.
 2020-05-01 15:23:00 +02:00
Erik Krogh Kristensen
87365357ba remove spurious jQuery objects 2020-05-01 15:19:54 +02:00
Tom Hvitved
7327df0881 Merge pull request #3384 from hvitved/csharp/docs/dotnet-core-3.1 
C#: Update `version-compilers.rst` to mention .NET Core 3.1
 2020-05-01 15:17:33 +02:00
Geoffrey White
46332d4849 C++: Eliminate recursion from toString(). 2020-05-01 14:12:52 +01:00
Jonas Jensen
36bdcfa42d C++: Remove an unneeded local-flow case 
This case was added in dccc0f4db. The surrounding code has changed a lot
since then, and the case no longer seems to have an effect except to
create some dead ends and possibly cycles in the local flow graph.
 2020-05-01 15:08:15 +02:00
Tom Hvitved
fd32e1110a C#: Remove footnote from versions-compilers.rst 2020-05-01 13:57:28 +02:00
Tom Hvitved
8a41a5fc47 C#: Update version-compilers.rst to mention .NET Core 3.1 2020-05-01 13:48:24 +02:00
Jonas Jensen
5f74c24d4d C++: Test definitions through &, *, ... 2020-05-01 11:04:49 +02:00
Jonas Jensen
4ddf12119d C++: Don't suppress consistency checks for calls 
See https://github.com/github/codeql/pull/3162#discussion_r400849713.
 2020-05-01 11:04:42 +02:00
Taus
33f4503ac3 Merge pull request #3213 from RasmusWL/python-iter-str-seq-with-tests 
Python: supress non-useful results (w/ tests) for iter str/seq query
 2020-05-01 11:04:05 +02:00
Taus
40def2af05 Merge pull request #3311 from RasmusWL/python-parse_qs 
Python: Propagate taint through parse_qs
 2020-05-01 10:40:31 +02:00
Erik Krogh Kristensen
16823143dd refactor getAPropertyUsedInLoadStore 2020-05-01 09:58:11 +02:00
Erik Krogh Kristensen
1a42c9fd80 make predicates private 
Co-authored-by: Asger F <asgerf@github.com>
 2020-05-01 09:42:09 +02:00
Jonas Jensen
9fc27e9130 C++: Fix "is constant" check 
The check was supposed to check for constant type, not constant value.
This fixes a false negative that appeared in
`LargeParameter/test.cpp:106`.
 2020-05-01 09:04:31 +02:00
Rasmus Wriedt Larsen
e569d7ae41 Merge branch 'master' into python-parse_qs 2020-04-30 17:05:17 +02:00
Cornelius Riemenschneider
c856552b64 Add preOffset to the bindingset for simpleArrayLengthStep. 2020-04-30 15:00:12 +02:00
semmle-qlci
606a1145eb Merge pull request #3331 from RasmusWL/python-improve-file-taint 
Approved by tausbn
 2020-04-30 13:58:03 +01:00
Jonas Jensen
8ffa124bf9 C++: Addresses may escape through call qualifiers 
Also clarify the docs on `Call` to decrease the likelyhood of such an
omission happening again.

The updated test reflects that `f1.operator()` lets the address of `f1`
escape from the caller.
 2020-04-30 14:27:40 +02:00
Rasmus Wriedt Larsen
e0b4518a3e Merge branch 'master' into python-improve-file-taint 2020-04-30 11:24:29 +02:00
semmle-qlci
59a04282c1 Merge pull request #3381 from RasmusWL/docs-minor-python-fix 
Approved by shati-patel
 2020-04-30 10:11:28 +01:00
Rasmus Wriedt Larsen
862c4b0845 Docs: Fix result of cmp.getComparator(0) in Python tutorial 
Fixes https://github.com/github/codeql/issues/3360
 2020-04-30 10:59:59 +02:00
Tom Hvitved
b03e87f623 Merge pull request #3379 from calumgrant/cs/nullability-warning 
C#: Remove nullability warnings
 2020-04-30 08:38:28 +02:00
Cornelius Riemenschneider
b838426421 Move ArrayLengthAnalysis library to the correct location. 2020-04-29 21:07:44 +02:00
Jason Reed
62c128f9a4 C++: Add QLDoc. 2020-04-29 11:06:06 -04:00