hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-27 22:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity
21,651 Commits 1,673 Branches 157 Tags
codeql-cli/v2.5.2
Commit Graph

21651 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Cornelius Riemenschneider
cea1049745 Merge pull request #5249 from geoffw0/cleanupstr 
C++: QLDoc Pure.qll
 2021-02-24 16:42:41 +01:00
Tamas Vajk
4711856c2b Remove commented code 2021-02-24 16:21:19 +01:00
Tamas Vajk
841ef9a4ae Make derived 'Context' classes internal and adjust visibility of members in base 'Context' 2021-02-24 16:21:19 +01:00
Tamas Vajk
539fdf952a Extend base context in CIL project 2021-02-24 16:21:19 +01:00
Tamas Vajk
5fca946678 C#: Split 'Context' class between CIL and source extraction 2021-02-24 16:21:19 +01:00
Bas van Schaik
4b884bd5d2 Merge branch 'main' into sj-patch-1 2021-02-24 15:10:26 +00:00
CodeQL CI
bf66bdbb95 Merge pull request #5253 from RasmusWL/no-getAnArg 
Approved by tausbn
 2021-02-24 06:34:31 -08:00
Rasmus Wriedt Larsen
d05a8b8c46 Python: Remove getAnArg in DataFlow::CallCfgNode 
Until we've had further discussion on what is the right approach to
naming (internal discussion in https://github.com/github/codeql-python-team/issues/95)
 2021-02-24 14:58:48 +01:00
Felicity Chapman
a05904f812 Merge pull request #5216 from github/felicitymay-update-process 
Remove personal assignment to writers
 2021-02-24 12:59:08 +00:00
Tamás Vajk
fd4eca6039 Merge pull request #5254 from tamasvajk/feature/fix-merge 
C#: Fix merge conflict (with + refactoring)
 2021-02-24 12:07:34 +01:00
Rasmus Wriedt Larsen
a6e5ec2e09 Python: Port py/flask-debug 2021-02-24 11:37:25 +01:00
Rasmus Wriedt Larsen
0cad5ce5ca Python: Expand py/flask-debug tests a bit 2021-02-24 11:35:17 +01:00
CodeQL CI
d2816b33e2 Merge pull request #5240 from erik-krogh/vsPerf 
Approved by asgerf
 2021-02-24 02:26:16 -08:00
Taus Brock-Nannestad
404649d5f1 Python: Get rid of superfluous options file 2021-02-24 11:24:43 +01:00
Rasmus Wriedt Larsen
5c6989cf02 Revert "Python: Accept RequestWithoutValidation expected output change" 
Apparently CI is able to produce the ../ path, I have absolutely no clue what is
goign on...
 2021-02-24 11:14:18 +01:00
Erik Krogh Kristensen
055275b971 change stats file 2021-02-24 11:12:31 +01:00
Anders Schack-Mulligen
add960bc4d Merge pull request #4880 from luchua-bc/java/sensitive-query-with-get 
Java: Sensitive GET Query
 2021-02-24 11:08:47 +01:00
Asger Feldthaus
bb858d38c4 JS: Tweak ExprNode 2021-02-24 10:03:45 +00:00
Tamas Vajk
380058a4bd C#: Fix merge conflict (with + refactoring) 2021-02-24 10:50:51 +01:00
yoff
8262f0343b Merge pull request #5208 from RasmusWL/flask-clean-models 
Python: Cleanup Flask models now that we have API graphs
 2021-02-24 10:36:30 +01:00
Erik Krogh Kristensen
16150a6419 update printAst expected output 2021-02-24 10:29:29 +01:00
Erik Krogh Kristensen
ed47697c09 update expected output 2021-02-24 10:29:12 +01:00
Geoffrey White
358a8fee7d C++: 'side-effect free'. 2021-02-24 09:25:11 +00:00
Taus Brock-Nannestad
af644a0adb Python: Decrease import depth in regex tests 
These were increased because of the indirection needed to get to the
regex flags, but as we no longer rely on this, we can make do with a
smaller import depth.
 2021-02-24 10:23:01 +01:00
Rasmus Wriedt Larsen
5bb4a1a45a Python: Use explicit argument specification instead of getAnArg 
I've seen quite a few places where `getAnArg` leads to wrong behavior, and I
generally just don't like it.
 2021-02-24 10:19:34 +01:00
Taus Brock-Nannestad
e77c1059a3 Python: Use source nodes and prevent bad join order 2021-02-24 10:18:54 +01:00
Taus Brock-Nannestad
cac6c4acc9 Python: Add deprecation notice to mode_from_mode_object 2021-02-24 10:18:21 +01:00
Rasmus Wriedt Larsen
0b9a65d234 Python: Accept RequestWithoutValidation expected output change 
I have no clue why this changed, but since it's only the `..` part, I guess
we'll live with it
 2021-02-24 10:13:25 +01:00
Rasmus Wriedt Larsen
cef37d19ce Python: Split CWE-295 tests 
Mostly just because it's nice. But now we can avoid having the same `options`
files for the tests.
 2021-02-24 10:12:45 +01:00
Rasmus Wriedt Larsen
0ffc801f9b Python: Remove options for InsecureTemporaryFile tests 2021-02-24 09:57:51 +01:00
Erik Krogh Kristensen
5091bb652f bump extractor version 2021-02-24 09:39:09 +01:00
Erik Krogh Kristensen
971ce83f8e add change note 2021-02-24 09:34:54 +01:00
Erik Krogh Kristensen
bcb3d5aec2 add tests for nested type unions through aliases 2021-02-24 09:34:54 +01:00
Erik Krogh Kristensen
85ed402b1a add test for union types 2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
5ae3c5952c support abstract signatures 2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
f385c55f2c add support for rest types elements in the middle of a tuple 2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
74630b0fd8 fix file lookup for exclude patterns 2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
8cf28c6186 update TypeScript to 4.2 2021-02-24 09:34:47 +01:00
yoff
c3d2001e85 Merge pull request #5251 from tausbn/python-port-missing-host-key-validation-query 
Python: Port missing host key validation query
 2021-02-24 08:43:52 +01:00
yo-h
1d654febfd Merge pull request #5195 from aschackmull/java/cwe-548-test 
Java: Add empty file to test.
 2021-02-23 21:12:40 -05:00
Taus Brock-Nannestad
2942a11a69 Python: Import API graphs privately 2021-02-23 22:45:39 +01:00
Taus Brock-Nannestad
f241dbabab Python: Clean up query a bit 2021-02-23 22:33:18 +01:00
Taus Brock-Nannestad
002d0fe565 Python: Port missing host key query 2021-02-23 22:26:03 +01:00
Taus Brock-Nannestad
e812eb777d Python: Port URL sanitisation queries to API graphs 
Really, this boils down to "Port `re` library model to use API graphs
instead of points-to", which is what this PR actually does.

Instead of using points-to to track flags, we use a type tracker. To
handle multiple flags at the same time, we add additional flow from

`x` to `x | y` and `y | x`

and, as an added bonus, the above with `+` instead of `|`, neatly
fixing https://github.com/github/codeql/issues/4707

I had to modify the `Qualified.ql` test slightly, as it now had a
result stemming from the standard library (in `warnings.py`) that
points-to previously ignored.

It might be possible to implement this as a type tracker on
`LocalSourceNode`s, but with the added steps for the above operations,
this was not obvious to me, and so I opted for the simpler
"`smallstep`" variant.
 2021-02-23 22:02:35 +01:00
Rasmus Wriedt Larsen
358ade67e5 Merge pull request #5248 from tausbn/python-port-insecure-temporary-file 
Python: Port `py/insecure-temporary-file`
 2021-02-23 21:37:59 +01:00
Tamás Vajk
91928fa098 Merge pull request #5220 from tamasvajk/feature/limit-codescanning-csharp 
Limit C# codeql analysis to the csharp folder
 2021-02-23 21:05:38 +01:00
Tamás Vajk
e6532cbd75 Merge pull request #4695 from tamasvajk/feature/csharp9-with-expr 
C#: Extract 'with' expressions
 2021-02-23 21:04:51 +01:00
Geoffrey White
431a004127 C++: QLDoc. 2021-02-23 19:10:03 +00:00
Taus Brock-Nannestad
b8ce5e969e Python: Port py/insecure-temporary-file 2021-02-23 20:02:22 +01:00
yoff
9eed17f647 Merge pull request #5152 from RasmusWL/improve-pyyaml-support 
Python: Improve pyyaml support
 2021-02-23 19:58:04 +01:00