Commit Graph

19777 Commits

Author SHA1 Message Date
Taus Brock-Nannestad
b990fac97b Python: Fix test failures.
How could the tests fail because of autoformatting, you may ask?

The answer is deprecation warnings. These specify the location of the deprecated
entity, and due to autoformatting these moved around.
2020-03-30 13:55:38 +02:00
Taus Brock-Nannestad
2229e34466 Python: Fix outdated link in ImportFailure.qhelp. 2020-03-30 13:14:37 +02:00
semmle-qlci
fce04f0bd0 Merge pull request #3127 from erik-krogh/PromiseTrack
Approved by asgerf
2020-03-30 11:56:33 +01:00
Tom Hvitved
9fa9c10361 Merge pull request #2921 from aschackmull/dataflow/consistency-checks
Java: Add data-flow consistency checks.
2020-03-30 12:47:41 +02:00
Taus Brock-Nannestad
ab4cef53c2 Python: Autoformat one final straggler. 2020-03-30 12:36:43 +02:00
Taus Brock-Nannestad
727cde31c9 Python: Autoformat a few final stragglers. 2020-03-30 12:30:14 +02:00
Taus Brock-Nannestad
6eb9c6f84d Merge branch 'master' into python-autoformat-almost-everything 2020-03-30 12:24:01 +02:00
Asger Feldthaus
a317b87b81 JS: Fix perf issue in DictionaryTaintStep 2020-03-30 11:23:47 +01:00
James Fletcher
675144cd3d Merge pull request #3146 from jf205/tidy-up-docs-prep
CodeQL docs: tidy up 'docs-preparation' branch following pre-migration work
2020-03-30 11:10:28 +01:00
Anders Schack-Mulligen
caf0d1528f Merge pull request #3155 from max-schaefer/add-module-comment
Data flow: Add module doc comment for `TaintTrackingImpl.qll`
2020-03-30 12:07:08 +02:00
Taus Brock-Nannestad
87a9f51c78 Python: Autoformat all .ql files. 2020-03-30 11:59:10 +02:00
James Fletcher
0f0dc3c2ae Update docs/language/learn-ql/python/ql-for-python.rst
Co-Authored-By: Alistair <54933897+hubwriter@users.noreply.github.com>
2020-03-30 10:48:23 +01:00
Max Schaefer
e5e94e3357 Data flow: Add module doc comment for TaintTrackingImpl.qll
Modelled after the correponding comment for `DataFlowImpl.qll`.
2020-03-30 10:35:47 +01:00
Taus
b4fbfa029e Merge pull request #3132 from RasmusWL/python-fix-iterable-unpacking-taint-CP
Python: Fix iterable-unpacking taint CP
2020-03-30 11:22:03 +02:00
Erik Krogh Kristensen
f55005a0ec more precise warning message for implicit string/number conversions 2020-03-30 11:17:56 +02:00
Anders Schack-Mulligen
b2769b42ed Merge pull request #3117 from adityasharad/java/jackson-taint-steps
Java: Add taint steps through Jackson serialization methods.
2020-03-30 10:34:56 +02:00
Anders Schack-Mulligen
57c9277601 Merge pull request #3142 from MathiasVP/no-magic-in-parameterThroughFlowCand
Data flow: No magic in returnFlowCallableCand
2020-03-30 10:15:48 +02:00
Dave Bartolomeo
6b24e3c8be C++: Fix formatting 2020-03-29 08:18:05 -04:00
Dave Bartolomeo
3eef2747d5 Fix LGTM alerts 2020-03-29 03:12:27 -04:00
Dave Bartolomeo
0952064eb3 Move sync-identical-files.py into public repo as sync-files.py
We currently use a script to keep certain duplicate QL files in sync across the repo. For historical reasons, this script has lived in the private repo alongside the rest of CodeQL, even though it's only used for files in the public `ql` repo. This PR moves the script into the public `ql` repo. It is still invoked by Jenkins scripts that live in the private repo during CI, but it can also be invoked directly without having a checkout of the private repo. This is useful for anyone who is modifying the dataflow or IR libraries with only a QL checkout.
2020-03-29 02:59:14 -04:00
luchua-bc
000d894d99 Include Gradle Logging 2020-03-28 14:00:28 -04:00
Mathias Vorreiter Pedersen
7fce4ce9d1 Include join order fix from #3142 2020-03-28 12:34:05 +01:00
Dave Bartolomeo
434e11c0c5 C++: Fix test output 2020-03-27 19:47:08 -04:00
Dave Bartolomeo
39dd9b7099 C++/C#: Fix formatting 2020-03-27 19:46:53 -04:00
luchua-bc
048a33e143 Remove user ids from the check since they get logged a lot and are less sensitive 2020-03-27 19:40:00 -04:00
Dave Bartolomeo
c3a6ca0d9a C++: Better support for complex numbers in IR and AST
This PR adds better support for differentiating complex and imaginary floating-point types from real floating-point types, in both the AST and in the IR type system.

*AST Changes*
- Introduces the new class `TypeDomain`, which can be either `RealDomain`, `ImaginaryDomain` or `ComplexDomain`. "type domain" is the term used for this concept in the C standard, and I couldn't think of a better one.
- Introduces `FloatingPointType.getDomain()`, to get the type domain of the type.
- Introduces `FloatingPointType.getBase()`, to get the numeric base of the type (either 2 or 10).
- Introduces three new subtypes of `FloatingPointType`: `RealNumberType`, `ComplexNumberType`, and `ImaginaryNumberType`, which differentiate between the types based on their type domain. Note that the decimal types (e.g., `_Decimal32`) are included in `RealNumberType`.
- Introduces two new subtypes of `FloatingPointType`: `BinaryFloatingPointType` and `DecimalFloatingPointType`, which differentiate between the types based on their numeric base, independent of type domain.

*IR Changes*
- `IRFloatingPointType` now has two additional parameters: the base and the type domain.
- New test that ensures that C++ types get mapped to the correct IR types.
- New IR test that verifies the IR for some basic usage of complex FP types.
2020-03-27 18:08:14 -04:00
Calum Grant
69041bc959 C#: Enable nullability in Autobuilder. 2020-03-27 20:26:38 +00:00
Nick Rolfe
1baf5df342 Merge pull request #3147 from dbartol/dbartol/FloatLiterals
C++: Fix test expectations for complex literals
2020-03-27 18:15:06 +00:00
Robert Brignull
90fad6f762 add code scanning suites 2020-03-27 17:03:23 +00:00
Shati Patel
28e5904079 Merge pull request #3149 from Semmle/jf205-patch-2
Change 'Set Literals' to 'Set literals'
2020-03-27 16:47:58 +00:00
James Fletcher
2c571d3655 Update language.rst 2020-03-27 16:40:48 +00:00
Jonas Jensen
710eb0cab9 C++: Replace "min = max" with "unique"
With the new `unique` aggregate added to QL, we can express directly
what the "min = max" pattern emulates.

Replacing "min and max" with `unique` might in general lead to fewer
results, but that happens only in cases where the aggregate expression
has multiple values. For the three predicates changed in this commit,
that should only happen on malformed databases.
2020-03-27 17:15:09 +01:00
Peter Stöckli
c6688eb349 Fix OpenStream documentation 2020-03-27 17:08:49 +01:00
Peter Stöckli
3de00443ff Review feeback for OpenStream 2020-03-27 17:06:58 +01:00
Rasmus Wriedt Larsen
d55acc38df Python: Constrain execution paths for taint_at_depth
Thanks Taus!
2020-03-27 16:20:08 +01:00
Erik Krogh Kristensen
4864e77430 Merge branch 'master' of git.semmle.com:Semmle/ql into UrlSearch 2020-03-27 15:59:29 +01:00
Philip Ginsbach
a91a5c3db9 "aggregation yields" => "query returns"
Co-Authored-By: Shati Patel <42641846+shati-patel@users.noreply.github.com>
2020-03-27 14:50:41 +00:00
Philip Ginsbach
23e4ae3f49 "and hence" => ", so"
Co-Authored-By: Shati Patel <42641846+shati-patel@users.noreply.github.com>
2020-03-27 14:50:07 +00:00
Philip Ginsbach
3406ee72ee Update docs/language/ql-handbook/expressions.rst
Co-Authored-By: Shati Patel <42641846+shati-patel@users.noreply.github.com>
2020-03-27 14:49:45 +00:00
Philip Ginsbach
811bc01d1e the `expression => <expression>`
Co-Authored-By: Shati Patel <42641846+shati-patel@users.noreply.github.com>
2020-03-27 14:49:23 +00:00
Philip Ginsbach
c91c3f24a0 fixed typo "the the"
Co-Authored-By: Shati Patel <42641846+shati-patel@users.noreply.github.com>
2020-03-27 14:47:57 +00:00
Dave Bartolomeo
3039aaf4f3 C++: Fix test expectations for complex literals 2020-03-27 10:33:19 -04:00
Shati Patel
0b62a1d980 Merge pull request #3144 from ginsbach/setliteralhandbook
Mention set literals in handbook
2020-03-27 14:25:56 +00:00
Peter Stöckli
5e62a6bebe Move CWE-036 directory to experimental 2020-03-27 15:10:15 +01:00
Peter Stöckli
74fc416a35 Merge branch 'master' into cwe-036 2020-03-27 14:54:41 +01:00
Erik Krogh Kristensen
0ebbd80745 autoformat 2020-03-27 14:54:34 +01:00
Philip Ginsbach
73845923aa Update docs/language/ql-handbook/expressions.rst
Co-Authored-By: Jonas Jensen <jbj@github.com>
2020-03-27 13:34:20 +00:00
Philip Ginsbach
90b82a0905 unique in aggregate section 2020-03-27 13:09:35 +00:00
Henning Makholm
875a70c0a3 Merge pull request #3129 from ginsbach/master
Set Literal in QL
2020-03-27 14:02:55 +01:00
Philip Ginsbach
d979bd958b better wording for the unique aggregate 2020-03-27 13:01:50 +00:00