hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-01 08:42:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
19,777 Commits 1,673 Branches 157 Tags
codeql-cli/v2.4.4
Commit Graph

19777 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Taus Brock-Nannestad
ad429f5ae1 Add tests. 2019-01-17 14:45:25 +01:00
Taus Brock-Nannestad
7c3dc929ac Add query and qhelp. 2019-01-17 14:45:25 +01:00
Asger F
e9c4f13a31 JS: Remove trailing whitespace again 2019-01-17 13:10:15 +00:00
Asger F
7a344c8546 JS: Add resolved promise taint test case 2019-01-17 13:08:55 +00:00
Asger F
b6fdbdcf84 JS: deduplicate promiseTaintStep 2019-01-17 13:04:16 +00:00
Asger F
882b337c15 JS: Move ResolvedPromiseDefinition into StandardLibrary.qll 2019-01-17 13:02:03 +00:00
Asger F
fc27b26bd5 JS: Remove duplicate PromiseFlowStep 2019-01-17 12:56:40 +00:00
Asger F
66901dc7b8 JS: remove duplicate ES2015PromiseDefinition 2019-01-17 12:55:38 +00:00
Jonas Jensen
6b9aaf63d7 C++: Speed up getAFeasiblePredecessorBlock 
This predicate was unbearably slow on a ChakraCore snapshot (and
probably everywhere else):

    ReachableBlock::getAFeasiblePredecessorBlock#2#ff#antijoin_rhs .. 1m6s
    ReachableBlock::getAFeasiblePredecessorBlock#ff#antijoin_rhs .... 31.8s

With this change, the predicate is so fast that it doesn't even show up
in the clause timing report.

It's possible that we only tested this for performance in 1.18, and then
it has regressed in 1.19. Otherwise I can't explain how we've missed
this. I'm using QL for Eclipse 1.20.0.201901070127.
 2019-01-17 13:36:20 +01:00
Mark Shannon
801d8cb3a5 Python: Remove fragile and unnecessary test. 2019-01-17 12:31:19 +00:00
Mark Shannon
73095c53b8 Python: Add another AST test. 2019-01-17 11:24:41 +00:00
Jonas Jensen
2478d440c2 C++: Address doc review comments 2019-01-17 12:01:49 +01:00
Calum Grant
f85f05d55f Merge pull request #776 from hvitved/csharp/delegate-ref-assignment 
C#: Recognize `ref` assignments through delegate calls
 2019-01-17 10:35:26 +00:00
Max Schaefer
8f8068695d JavaScript: Bump extractor version to avoid trap cache. 2019-01-17 09:30:18 +00:00
Max Schaefer
ce65fcedc1 JavaScript: Abort AutoBuild if an exception happens in one of the extractor threads. 2019-01-17 09:29:49 +00:00
Max Schaefer
7765c6d486 JavaScript: Await termination of extractor threadpool. 2019-01-17 09:29:49 +00:00
Max Schaefer
3b5315aa7e JavaScript: Improve logging. 2019-01-17 09:29:49 +00:00
Max Schaefer
a6cb63e9c8 JavaScript: Make number of threads configurable through LGTM_INDEX_THREADS. 
If the number of threads specified is one or lower, we fall back onto single-threaded extraction.
 2019-01-17 09:29:49 +00:00
Max Schaefer
d625ebf86d JavaScript: Extract JavaScript files after TypeScript files. 
This way we only start multi-threaded extraction after the TypeScript parser has already been shut down, reducing the chance of running out of memory.
 2019-01-17 09:29:49 +00:00
Max Schaefer
57133f91ff JavaScript: Prevent interleaved progress messages on stdout. 2019-01-17 09:29:49 +00:00
Max Schaefer
1c84dc011a JavaScript: Parallelise extraction of JavaScript (but not TypeScript) files. 2019-01-17 09:29:49 +00:00
Max Schaefer
8014ded973 JavaScript: Remove static state in JSDocParser. 2019-01-17 09:29:49 +00:00
Max Schaefer
5832f7c3ad JavaScript: Pull ExtractorState out of FileExtractor. 2019-01-17 09:29:49 +00:00
Max Schaefer
335d43b122 JavaScript: Make AutoBuild less stateful. 2019-01-17 09:29:49 +00:00
Jonas Jensen
9c42b5fab7 C++: Relax commented-out code heuristic for } 
I looked through a few hundred results from this query on lgtm.com and
found that most of the FPs had to do with comment lines ending in `}`.
This change should fix most of them, at the cost of very few false
negatives.

On Wireshark, this query goes from 7,425 results to 6,686 results before
filtering for generated code. Almost all the lost results were FP,
except a handful of results involving initializer lists.
 2019-01-17 10:20:48 +01:00
Max Schaefer
a058d7a502 JavaScript: Fix examples in flow-summaries.rst 
The S-expression examples still used the old order of parameters for `parameter` and `member`.
 2019-01-17 09:12:40 +00:00
Jonas Jensen
92b48bf6af C++: Add another test for CommentedOutCode.ql 2019-01-17 09:15:25 +01:00
Geoffrey White
c62cfb338a CPP: Clean up comment. 2019-01-16 19:10:35 +00:00
Geoffrey White
fb669e02ca CPP: Change note. 2019-01-16 19:05:51 +00:00
Geoffrey White
49cfa43fd8 CPP: Improve accuracy further. 2019-01-16 19:05:51 +00:00
Geoffrey White
105f8dddd0 CPP: Better fileHeaderLimit. 2019-01-16 19:05:50 +00:00
Geoffrey White
91c736229c CPP: Performance is better as a single regexp. 2019-01-16 19:05:50 +00:00
Geoffrey White
e3056ca96c CPP: Improve accuracy of AutogeneratedFile.qll. 2019-01-16 19:05:50 +00:00
Tom Hvitved
9031e19c88 C#: Recognize ref assignments through delegate calls 2019-01-16 15:53:31 +01:00
Max Schaefer
bca941ddf6 Merge pull request #765 from asger-semmle/class-receiver-propagation 
JS: support flow out of "this" in constructor call
 2019-01-16 14:40:19 +00:00
Tom Hvitved
fc5076b466 C#: Add test for assignment through delegate ref argument 2019-01-16 15:22:45 +01:00
Taus Brock-Nannestad
a422215272 Add change note for 1.20 2019-01-16 14:55:12 +01:00
Taus Brock-Nannestad
e8c092ad72 Python: Support the dill pickling library. 2019-01-16 14:53:42 +01:00
Jonas Jensen
22b15037fc C++: Split DataFlow::Node.asExpr into two 
The existing `Node.asExpr` predicate changes semantics so it becomes the
one that most users should use when they don't want to think about
`Conversion`s. A new `Node.asConvertedExpr` predicate is added and has
the same semantics as the old `Node.asExpr` predicate. It's for advanced
users that know about `Conversion`s and want to account for them.
 2019-01-16 14:17:57 +01:00
Jonas Jensen
dcb24e07c3 C++: Remove getFullyConverted call in sink def 
With this change, the `IRDataflowTestCommon.qll` and
`DataflowTestCommon.qll` files use the same definitions of sources and
sinks. Since the IR data flow library is meant to be compatible with the
AST data flow library, this is what we ought to be testing.

Two alerts change but not necessarily for the right reasons.
 2019-01-16 13:56:52 +01:00
Mark Shannon
65337ef835 Merge pull request #564 from taus-semmle/python-insecure-ssl-version 
Python: Check for insecure versions of SSL and TLS.
 2019-01-16 12:32:30 +00:00
Mark Shannon
7b8468d81b Python: Add bulk regression test for CFG successors. 2019-01-16 11:48:58 +00:00
Mark Shannon
e506bf85e8 Python: Add some regression tests for CFG of comparisons. 2019-01-16 11:45:20 +00:00
Mark Shannon
d1d898efac Python: Add regression test for code that proved problematic with the new parser. 2019-01-16 11:44:11 +00:00
Mark Shannon
bc4301f7b1 Python: Add an extra test for import parsing. 2019-01-16 11:32:59 +00:00
Mark Shannon
b8a91d4b1e Python tests: Add a few tests to check parsing and location of comparisons. 2019-01-16 11:27:57 +00:00
Asger F
a1c7f32fb6 JS: change note 2019-01-16 11:14:00 +00:00
Asger F
9aaea40719 JS: address comments and support TrackedNode 2019-01-16 11:12:38 +00:00
Asger F
6d1eab8a4b JS: support flow out of "this" in constructor call 2019-01-16 11:09:38 +00:00
Taus
370a9e491c Merge pull request #761 from markshannon/python-fix-regex-test-depth 
Python tests: Increase import depth to ensure sre_constants module is imported
 2019-01-16 11:38:02 +01:00