hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-28 06:36:33 +01:00
Code Issues Packages Projects Releases Wiki Activity
20,350 Commits 1,673 Branches 157 Tags
codeql-cli/v2.4.5
Commit Graph

20350 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Taus Brock-Nannestad
ca48e57e30 Actions: Peg external actions to specific SHAs 2021-02-19 16:50:08 +01:00
Asger Feldthaus
5264d24f34 JS: Model vue-router 2021-02-19 15:37:24 +00:00
Tamas Vajk
e1b90912de Limit C# codeql analysis to the csharp folder 2021-02-19 16:13:22 +01:00
Geoffrey White
79338052ad C++: Add CWE-676 tag. 2021-02-19 14:55:31 +00:00
Shati Patel
d490bea9a9 Merge pull request #5211 from shati-patel/docs-telemetry 
Docs (CodeQL for VS Code): Move info about telemetry into codeql.github.com
 2021-02-19 13:59:18 +00:00
Shati Patel
97eb98e9eb Emphasize that telemetry is disabled by default 2021-02-19 13:42:47 +00:00
Mathias Vorreiter Pedersen
fef824c37a C++: Implement models for poll, accept and select. 2021-02-19 14:03:54 +01:00
Taus Brock-Nannestad
6095138acc Actions: Address comments on change note CI check 
- Fail the CI check if change note is missing.
- Disregards changes outside of `*/ql/src`.
- Runs the workflow on label changes, and upon moving the PR out of
  draft mode.
- Only fails the CI check if the PR is out of draft.
- Changes label to `no-change-note-required`.
 2021-02-19 13:55:35 +01:00
Felicity Chapman
f9ff1f2c9c Remove personal assignment 
This is part of the work to revise the process for requesting docs content team reviews on pull requests.
 2021-02-19 11:38:15 +00:00
Rasmus Wriedt Larsen
a19da54c9e Python: Exclude flask.request imports as RemoteFlowSource 
When I changed the taint modeling in 19b7ea8d85, that obviously also means that
some of the related locations for alerts will change. So that's why all the
examples needs to be updated.

Besides this, I had to fix a minor problem with having too many alerts. If
running a query agaisnt code like in the example below, there would be 3 alerts,
2 of them originating from the import.

```
from flask import Flask, request
app = Flask(__name__)
@app.route("/route")
def route():
    SINK(request.args.get['input'])
```

The 2 import sources where:

- ControlFlowNode for ImportMember
- GSSA Variable request

I removed these from being a RemoteFlowSource, as seen in the diff.

I considered restricting `FlaskRequestSource` so it only extends
`DataFlow::CfgNode` (and make the logic a bit simpler), but I wasn't actually
sure if that was safe to do or not... If you know, please let me know :)
 2021-02-19 12:22:05 +01:00
Rasmus Wriedt Larsen
9798e60d0f Merge pull request #5203 from tausbn/python-add-typebacktrackers 
Python: Add `TypeBackTracker`
 2021-02-19 12:02:53 +01:00
Rasmus Wriedt Larsen
6ad3ce19d7 Style Guide: Fix two-letter acronym 
The old text was based on what was in the [Dart guideline](https://dart.dev/guides/language/effective-dart/style#do-capitalize-acronyms-and-abbreviations-longer-than-two-letters-like-words) and was not adjusted in the PR when we changed our inspiration to be the [.NET guideline](https://docs.microsoft.com/en-us/dotnet/standard/design-guidelines/capitalization-conventions) -- (it was only changed in the examples in our internal discussion)
 2021-02-19 11:51:45 +01:00
Anders Schack-Mulligen
9721182523 Merge pull request #5080 from github/RasmusWL/naming-for-acronyms 
Update CodeQL Style guide to mention acronyms
 2021-02-19 11:38:25 +01:00
Taus Brock-Nannestad
03d3f2c8e8 Actions: Add change note checker 2021-02-19 10:16:50 +01:00
Anders Schack-Mulligen
dae65f687a Merge pull request #5150 from Marcono1234/marcono1234/conditional-expr-branch 
Java: Add ConditionalExpr.getBranchExpr(boolean)
 2021-02-19 10:12:43 +01:00
Bas van Schaik
8f8b8be1e9 Include @xcorail in code reviews for experimental queries 2021-02-18 18:07:09 +00:00
Rasmus Wriedt Larsen
779a464dad Update ql-style-guide.md to not mention abbreviation 
This rule is only really intended for acronyms, and not abbreviations in general (like `Stmt` instead of `Statement`).
 2021-02-18 17:54:59 +01:00
Rasmus Wriedt Larsen
12511440fe Update ql-style-guide.md 
Replacing the HTTP example with a SSA variable example. I didn't want to keep both, to not bloat this section.
 2021-02-18 17:52:24 +01:00
Geoffrey White
c4cca83019 Merge pull request #5196 from MathiasVP/fix-dataflow-regression-const-member-function 
C++: Fix missing dataflow "out of" const member functions
 2021-02-18 16:43:38 +00:00
Shati Patel
4dd1be5ba1 Polish headings and formatting 2021-02-18 15:45:17 +00:00
Shati Patel
28848ecf32 Link to new article 2021-02-18 15:44:17 +00:00
Erik Krogh Kristensen
814b5577f5 improve join-order for Configuration::barrierGuardBlocksEdge 2021-02-18 16:43:43 +01:00
Erik Krogh Kristensen
33f310b91e use manual recursion in Refinements::inGuard 2021-02-18 16:42:40 +01:00
CodeQL CI
f81860c402 Merge pull request #5200 from erik-krogh/apiJoin 
Approved by max-schaefer
 2021-02-18 07:40:38 -08:00
CodeQL CI
3062f4160a Merge pull request #5207 from github/RasmusWL/js-backtrack-grammar 
Approved by erik-krogh
 2021-02-18 07:11:23 -08:00
Rasmus Wriedt Larsen
cc72fc82f0 Merge branch 'main' into flask-clean-models 2021-02-18 16:08:18 +01:00
Rasmus Wriedt Larsen
9a42f2fb26 Python: Add missing QLdoc for FlaskMethodViewClass 2021-02-18 16:07:47 +01:00
Taus Brock-Nannestad
880451f659 Python: Add change note 2021-02-18 15:59:34 +01:00
Chris Smowton
321df82851 Apply review feedback: comment style, bracketing, and use proper MISSING test annotations 2021-02-18 14:56:52 +00:00
Taus
e9cbdc4ad3 Update python/ql/src/semmle/python/dataflow/new/TypeTracker.qll 
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
 2021-02-18 15:53:15 +01:00
Rasmus Wriedt Larsen
bb2613b02b Python: Flask model now ready to be publicly exposed 
With a single call-out for a member-predicate that is only for internal use.
 2021-02-18 15:36:30 +01:00
Rasmus Wriedt Larsen
35876f1939 Python: Re-introduce Response::instance() in flask model 
We don't actually need it for anything right now, but I have plans for the
future where would need it.

Although it would be nice to have it as an `API::Node`, and we could re-write
implementations so we could provide it in this instance, I'm not convinced we
can do that in general right now.

For example, if <n'th> parameter of a function has to be modeled as belonging to
a certain type, I don't see any way to specify that as an API::Node.

For me, that's ok. Until we _can_ specify things like this as API::Nodes in the
future, I would like to keep things consistent, and use `DataFlow::Node` as the
result type.
 2021-02-18 15:22:16 +01:00
Rasmus Wriedt Larsen
141e2665ea Python: Align ViewClass naming with django 
Just as part of tyding up
 2021-02-18 15:10:21 +01:00
Shati Patel
48ace064cc Copy telemetry doc 
No changes except for rst formatting
 2021-02-18 14:09:36 +00:00
Rasmus Wriedt Larsen
19b7ea8d85 Python: Align flask taint modeling with rest of code 
This was a good time to do this, so we don't have 2 different ways of doing the
same thing.

I needed to do this to figure out if we should expose
`API::moduleImport("flask").getMember("request")` in a helper predicate or
not. I think I ended up using more refenreces to this in the end. Although it's
not unreasonable to let someone do this themselves, I also think it's reasonable
that we provide a helper predicate for this.
 2021-02-18 15:04:07 +01:00
Tamás Vajk
f3814c6468 Merge pull request #5144 from tamasvajk/feature/refactor-2 
C# Share entity base classes between CIL and source extraction
 2021-02-18 13:52:52 +01:00
Tamás Vajk
8e7a823b9a Merge pull request #5083 from raulgarciamsft/master 
Adding queries related to the Solorigate campaign
 2021-02-18 13:50:45 +01:00
Anders Schack-Mulligen
954e0b9496 Java: Add empty file to test. 2021-02-18 13:10:29 +01:00
Rasmus Wriedt Larsen
ba61099172 Python: flask.make_response as InstanceSource of flask.Response 2021-02-18 12:52:59 +01:00
Rasmus Wriedt Larsen
e3d530dbbc Python: Flask: Remove more type-tracking helper predicates 2021-02-18 12:13:47 +01:00
Rasmus Wriedt Larsen
e4ea5f25dc Python: Flask: Moderize app and blueprint 2021-02-18 12:09:37 +01:00
Rasmus Wriedt Larsen
7de488b987 Python: Flask: Moderize views 2021-02-18 12:05:56 +01:00
Rasmus Wriedt Larsen
ffd3c6b016 JS: Minor grammar cleanup of type back-tracking 2021-02-18 11:31:30 +01:00
Anders Schack-Mulligen
74d35f4f37 Java: Add support for value-preserving steps. 2021-02-18 11:26:15 +01:00
Anders Schack-Mulligen
04eeeda2c9 Java: Add documentation for the final column. 2021-02-18 11:23:49 +01:00
Anders Schack-Mulligen
6f583baa90 Java: More documentation and support for field writes. 2021-02-18 11:18:31 +01:00
CodeQL CI
d94f20ff2f Merge pull request #5194 from RasmusWL/type-tracking-snippets 
Approved by tausbn
 2021-02-18 02:13:21 -08:00
Mathias Vorreiter Pedersen
88263cb89e Merge pull request #5114 from geoffw0/codeqltestdoc 
Documentation: Make our policy for copied example code clear and visible.
 2021-02-18 10:43:17 +01:00
Erik Krogh Kristensen
6f384630f1 Apply suggestions from code review 
Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com>
 2021-02-18 10:36:49 +01:00
Mathias Vorreiter Pedersen
3082d70345 Merge branch 'main' into fix-dataflow-regression-const-member-function 2021-02-18 09:34:51 +01:00