hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-30 07:36:34 +01:00
Code Issues Packages Projects Releases Wiki Activity
19,777 Commits 1,673 Branches 157 Tags
codeql-cli/v2.4.4
Commit Graph

19777 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Robert Marsh
d9e6a6ea24 Move cached predicates to cached module 2018-11-06 12:02:38 -08:00
Robert Marsh
bf946c3ec3 C++: remove comments about Java implies predicates 
The Java guards library includes a set of "implies" predicates to handle
short-circuiting conditionals. C++ handles those in IR generation, so
dominance on the IR produces correct results for controlling blocks.
 2018-11-06 12:02:38 -08:00
Robert Marsh
554fea46c7 C++: Sign analysis for casts and unsigned integers 2018-11-06 12:02:38 -08:00
Robert Marsh
d1ae939c9c C++: use guards and operands in sign analysis 2018-11-06 12:02:38 -08:00
Robert Marsh
08e9eea1f2 Add NegateInstruction 2018-11-06 12:02:38 -08:00
Robert Marsh
a3c6b8e575 C++: port sign analysis library from Java 2018-11-06 12:02:38 -08:00
Jonas Jensen
e03b4f0cb6 Merge pull request #293 from geoffw0/zerosizebuffer 
CPP: Better handling of zero-sized buffers
 2018-11-06 20:08:39 +01:00
semmle-qlci
33c02fe928 Merge pull request #355 from hvitved/csharp/guards-logic 
Approved by calumgrant
 2018-11-06 19:06:30 +00:00
Dave Bartolomeo
62a5aef0de Merge pull request #410 from jbj/range-analysis-tests 
C++: Tests for two range analysis bugs
 2018-11-06 10:51:12 -08:00
Geoffrey White
ee4cfe8eb7 CPP: Update expected output for changes elsewhere. 2018-11-06 17:58:33 +00:00
Geoffrey White
e6e0d69b7d CPP: Re-apply effect of discover_walk. 2018-11-06 17:53:18 +00:00
Geoffrey White
301c133bef CPP: More descriptive. 2018-11-06 17:53:18 +00:00
Geoffrey White
2042c9c863 CPP: Extend the CPP-205 test (results prior to discover_walk). 2018-11-06 17:53:18 +00:00
Arthur Baars
89d728a50f Merge pull request #412 from adityasharad/merge/master-next-061118 
Merge master into next.
 2018-11-06 18:46:50 +01:00
Geoffrey White
b671ef504d Merge pull request #413 from jbj/return-this-getblock 
C++: Restore `exists(getBlock())` in AV Rule 82
 2018-11-06 17:04:05 +00:00
Geoffrey White
9c97176896 CPP: Tabs/spaces. 2018-11-06 17:01:30 +00:00
Anders Schack-Mulligen
fa3fa33c51 Java: Don't construct nonsense SSA for unreachable code. 2018-11-06 16:43:08 +01:00
Anders Schack-Mulligen
2004445817 Merge pull request #409 from yh-semmle/java/move-tests 
Java: move/tweak some tests
 2018-11-06 16:38:03 +01:00
Jonas Jensen
9382c9d528 C++: Regression tests for AV Rule 82 
Without the last commit, this addition to the test gives the following
results:

```
+| AV Rule 82.cpp:176:14:176:22 | operator= | Assignment operator in class Forgivable does not return a reference to *this. |
+| AV Rule 82.cpp:181:14:181:22 | operator= | Assignment operator in class Forgivable does not return a reference to *this. |
```
 2018-11-06 16:13:44 +01:00
Esben Sparre Andreasen
e396a55653 JS: change notes for type inference improvements 2018-11-06 16:04:46 +01:00
Esben Sparre Andreasen
a79a6a07b8 JS: stop tracking properties of object literals 2018-11-06 16:04:46 +01:00
Esben Sparre Andreasen
a07c094437 JS: introduce TypeInferredCalleeWithAnalyzedReturnFlow 2018-11-06 16:04:46 +01:00
Esben Sparre Andreasen
fef3573152 JS: use global layer in AnalyzedNode::getABooleanValue and -getAType 2018-11-06 16:04:46 +01:00
Geoffrey White
792369917a CPP: Fix CWE tags. 2018-11-06 14:36:12 +00:00
Geoffrey White
698f8953c7 CPP: Change note. 2018-11-06 14:29:08 +00:00
Geoffrey White
dd8aa5a8d9 CPP: Fix StrncpyFlippedArgs.ql as well. 2018-11-06 14:29:08 +00:00
Geoffrey White
ad44416189 CPP: Move the fix into Buffer.qll so that it applies to other queries. 2018-11-06 14:29:08 +00:00
Sauyon Lee
f99f44a571 If a destination buffer has size 0, there's probably some hackery going on 2018-11-06 14:29:08 +00:00
Jonas Jensen
da73a033e5 C++: Restore exists(getBlock()) in AV Rule 82 
I removed this condition in #362, thinking it was covered by the new
conditions on return statements, but it turns out it wasn't in at least
the following cases.

1. Assignment operators that are deleted or marked private in order to
   make them inaccessible.
2. Templates whose body was not extracted.

While some of these results are technically valid, they are not nearly
as interesting as the results that this query was designed to produce.
 2018-11-06 13:42:20 +01:00
Asger F
1252cde7f3 JS: remove a comma 2018-11-06 12:24:34 +00:00
Asger F
dcf6218d1d JS: update test expectations 2018-11-06 12:22:05 +00:00
Asger F
799cd33b88 JS: add change note 2018-11-06 12:13:34 +00:00
Asger F
c991d67fcb JS: fix typos 2018-11-06 12:12:43 +00:00
Asger F
460521616c JS: rename getIteratee to getIteratorCallback 2018-11-06 12:12:43 +00:00
Asger F
97d65fb82f JS: fix bad join ordering 2018-11-06 12:12:43 +00:00
Asger F
b40fa3845f JS: add model of async package 2018-11-06 12:12:43 +00:00
Aditya Sharad
553c2f5d34 Merge master into next. 
As of 2846d80f1c.
 2018-11-06 11:52:51 +00:00
semmle-qlci
76475fef3b Merge pull request #406 from xiemaisi/js/configuration-fiddling 
Approved by asger-semmle
 2018-11-06 11:51:12 +00:00
Jonas Jensen
4a02b3946d C++: Tests for two range analysis bugs 2018-11-06 11:57:41 +01:00
Asger F
87e0027974 JS: address comments 2018-11-06 10:29:04 +00:00
Asger F
56707fc79a JS: recognize more conditionals in useless-conditional 2018-11-06 10:28:05 +00:00
Jonas Jensen
786377d8dc Merge pull request #408 from dave-bartolomeo/dave/NonVirtualDestructorInBaseClass 
C++: Fork AV Rule 78 into NonVirtualDestructorInBaseClass
 2018-11-06 09:51:27 +01:00
Dave Bartolomeo
3133bf6675 C++: Fix test expectation 2018-11-05 14:19:59 -08:00
Dave Bartolomeo
0c796de831 C++: Fork AV Rule 78 into NonVirtualDestructorInBaseClass 
AV Rule 78 has proved too noisy for use on lgtm.com. However, if we make the rule less noisy by, say, allowing a protected destructor to be non-virtual, we're no longer actually enforcing AV Rule 78. Instead, I've copied AV Rule 78 into NonVirtualDestructorInBaseClass.ql, given the new query the `@id` that AV Rule 78 had, and given AV Rule 78 a new JSF-specific `@id`. The new rule allows non-public non-virtual destructors, which is the problem originally reported by an lgtm.com user.
 2018-11-05 14:16:35 -08:00
Jonas Jensen
ba91f3e77c Merge pull request #401 from geoffw0/loopdir 
CPP: Speed up inconsistentLoopDirection.ql.
 2018-11-05 18:22:19 +01:00
yh-semmle
64a50c522d Java: tweak a test 2018-11-05 12:10:08 -05:00
yh-semmle
c0fcf7fc9b Java: move a few more tests 2018-11-05 12:08:43 -05:00
yh-semmle
f3fbc8a153 Java: move a few tests 2018-11-05 12:08:42 -05:00
Aditya Sharad
bfa4c30784 C++: Improve performance of ExprEvaluator::getFunctionValue. 
Changes the `forex` range to join on both `this` (the current `ExprEvaluator`) and `ret` (the expected function return value),
so that we look at the relevant return values rather than all interesting functions.
 2018-11-05 16:51:23 +00:00
Geoffrey White
5cd7103841 Merge pull request #403 from jbj/FlowVar-getAnAccess-perf 
C++: Performance fix for FlowVar.getAnAccess
 2018-11-05 16:46:49 +00:00