hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-24 02:43:40 +01:00
Code Issues Packages Projects Releases Wiki Activity
33,872 Commits 1,693 Branches 161 Tags
codeql-cli/v2.8.4
Commit Graph

33872 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Asger Feldthaus
0ceb8aa638 JS: Bump extractor version 2021-02-05 21:55:43 +00:00
Asger Feldthaus
236b7c5887 JS: Tolerate JSON in script tags 2021-02-05 21:54:50 +00:00
Taus
d3a79ecff1 Update python/ql/src/semmle/python/frameworks/Flask.qll 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-02-05 22:54:27 +01:00
Jonathan Leitschuh
f00b0baaea Update java/ql/src/Security/CWE/CWE-1104/MavenPomDependsOnBintray.qhelp 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2021-02-05 16:31:37 -05:00
Taus Brock-Nannestad
3d2548ed28 Python: Get rid of remaining type trackers in Flask model 
At this point, we may want to reconsider whether we really want the
deeply-nested module structure we had before (and which made the type
trackers somewhat bearable).

There's also a question of how we can make this a bit more
smooth. I think we need to consider exactly how we would like the
interface to this to work.
 2021-02-05 21:58:08 +01:00
Taus Brock-Nannestad
5bfde2c0f2 Python: Fix overly broad class attribute node class 
This is not strictly necessary, but it was bothering me that this
simply covered _all_ nodes that were both definitions and names at the
same time. Now it actually encompasses what the documentation claims
it does.
 2021-02-05 21:56:57 +01:00
Taus Brock-Nannestad
7f3c6acd08 Python: Handle class attribute references in API graph 
This is slightly dubious, and should really be in the currently
unimplemented "def" counterpart to the "use" bits we already have.

However, it seems to work correctly, and in the spirit of moving
things along, this seemed like the easier solution. We can always
replace the implementation with the "proper" approach at a later point.
 2021-02-05 21:54:35 +01:00
Alexander Eyers-Taylor
9af99f195e Merge pull request #5095 from alexet/imporve-js-perf 
Javascript: Improve performance of ExplicitInvokeNode::getArgument
 2021-02-05 18:49:03 +00:00
Jonathan Leitschuh
bfa9324266 CWE-1104: Maven POM dependence upon Bintray/JCenter 2021-02-05 13:05:51 -05:00
Arthur Baars
37c4e6cbdf Merge pull request #98 from github/aibaars/erb-extractor 
Quick and dirty ERB extraction
 2021-02-05 18:45:47 +01:00
Raul Garcia (MSFT)
d48a713f30 Fixing cutom edges predicate 2021-02-05 09:27:08 -08:00
Arthur Baars
b553eb6964 CFG: make 'for .. in' post-order 
Use the 'in' as the intermediate node that checks whether the Enumerable
has more elements.
 2021-02-05 18:23:31 +01:00
Arthur Baars
4ae55a718a CFG: make 'while' post-order 2021-02-05 18:23:31 +01:00
Raul Garcia (MSFT)
681e6a9303 Adding Solorigate context for the generic backdoor queries. 2021-02-05 09:02:59 -08:00
Taus Brock-Nannestad
ef600575ca Python: Add API graph support for subclasses 2021-02-05 16:52:58 +01:00
Taus Brock-Nannestad
b39cbf82c6 Python: Port Flask models to use API graphs 
Most of the type trackers in this model were easily replaceable with
uses of the API graph, but the ones for tracking subclasses are
problematic, as these take us out of the API graph.
 2021-02-05 14:41:42 +01:00
Arthur Baars
5bb32b983c Merge pull request #115 from github/aibaars/dataflow 
My first dataflow step
 2021-02-05 14:13:38 +01:00
yoff
7fef1a8817 Merge pull request #5069 from tausbn/python-api-graphs 
Python: Add support for API graphs
 2021-02-05 13:17:09 +01:00
Shati Patel
6a46be2379 Install sphinx extension for building markdown tables 2021-02-05 12:07:06 +00:00
Shati Patel
5f17fa8366 Docs: Add outline for CWE coverage page 2021-02-05 12:06:57 +00:00
Taus Brock-Nannestad
78cb53449d Python: Slight cleanup of Cached::call 
Makes it more similar to the other functions in this module.
 2021-02-05 12:47:26 +01:00
Taus
6c8dfb253d Python: Use flowsTo instead of hasLocalSource 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-02-05 12:42:41 +01:00
Tamás Vajk
d7505e41db Merge pull request #5091 from tamasvajk/feature/cleanup-nullable 
C#: Fix nullable warnings and some code quality issues
 2021-02-05 12:07:42 +01:00
Jonas Jensen
6e5d56cbcb Merge pull request #5097 from geoffw0/qldoceg11 
C++: QLDoc Improvements
 2021-02-05 12:00:35 +01:00
Shati Patel
474ddc9bc8 Merge pull request #5090 from RasmusWL/docs-fix-direct-query-link 
Docs: Use /blob/ instead of /tree/ for direct query link
 2021-02-05 10:50:40 +00:00
Jonas Jensen
c945ece80d Merge pull request #5100 from MathiasVP/fix-changenote-unsigned-difference-expression-compared-zero 
C++: Add query author and link to original PR in change-note
 2021-02-05 11:21:48 +01:00
Geoffrey White
55b0dbd7b8 C++: Autoformat. 2021-02-05 10:02:31 +00:00
Taus
a66743192e Python: Fix typo in docs 
Co-authored-by: yoff <lerchedahl@gmail.com>
 2021-02-05 10:58:47 +01:00
Arthur Baars
846173732b Add newline at the end of each code region in an ERB file 2021-02-05 09:49:25 +01:00
Mathias Vorreiter Pedersen
a416a089b4 Update cpp/change-notes/2020-02-04-unsigned-difference-expression-compared-zero.md 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2021-02-05 09:48:54 +01:00
Arthur Baars
9d974bd56d Extract ERB files 2021-02-05 09:48:54 +01:00
Tamás Vajk
87ba9d55b6 Merge pull request #4687 from tamasvajk/feature/csharp9-records 
C#: Extract record declarations
 2021-02-05 08:56:24 +01:00
luchua-bc
a183b00166 Query to detect main method in servlets 2021-02-05 03:53:01 +00:00
Raul Garcia (MSFT)
3dc1b81d65 Changing ProcessNameToHash query to path-problem. Any additional feedback will be welcomed 2021-02-04 17:54:35 -08:00
Raul Garcia (MSFT)
9ef4aef28e Changing location for NonCryptographicHash qll 
Changing the TimeBomb query to path-problem (any suggestions to improve it would be welcomed, no previous experience iwth path-problem queries)
 2021-02-04 16:59:38 -08:00
Robert Marsh
649bd03db6 Merge pull request #5101 from NateD-MSFT/patch-1 
Add KeGetCurrentProcessorNumberEx to CWE-457 whitelist
 2021-02-04 16:59:07 -08:00
Raul Garcia (MSFT)
d5c9db42de Fixing format 2021-02-04 14:26:03 -08:00
NateD-MSFT
9470a99092 Add KeGetCurrentProcessorNumberEx to CQE-457 whitelist 
Windows driver developers may call KeGetCurrentProcessorNumberEx in their driver.  This function optionally may initialize a provided structure, but this initialization always occurs.  The return value is the current processor being run on.  As such, this query incorrectly marks calls to KeGetCurrentProcessorNumberEx that initialize a structure that is later used as risky, even though in reality the initialization always succeeds.

See https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-kegetcurrentprocessornumberex
 2021-02-04 13:32:09 -08:00
Raul Garcia (MSFT)
1d8f8286a5 Fixes to address some of the comments during PR 2021-02-04 13:25:43 -08:00
Raul Garcia (MSFT)
8e85145df4 Updated Readme file 2021-02-04 12:51:31 -08:00
Tamas Vajk
83f0fad014 Fix expected test AST 2021-02-04 21:08:01 +01:00
Tamas Vajk
f555c0642e Add change note 2021-02-04 21:08:01 +01:00
Tamas Vajk
f0b0845f9f Add 'record' QL class 2021-02-04 21:08:01 +01:00
Tamas Vajk
9ffc38f5b1 Fix deterministic ordering of class members in PrintAst 2021-02-04 21:08:01 +01:00
Tamas Vajk
a6fd7a3203 C#: Extract record declarations 2021-02-04 21:08:01 +01:00
Mathias Vorreiter Pedersen
993abd4499 C++: Add query author and link to original PR in change-note. 2021-02-04 20:23:27 +01:00
Raul Garcia (MSFT)
979fdd2c6a Addressing multiple comments 2021-02-04 10:23:01 -08:00
Taus
f0d5a91d59 Merge pull request #5093 from RasmusWL/fix-query-names-with-dunder 
Python: Fix query names with dunder (__)
 2021-02-04 18:47:45 +01:00
Taus Brock-Nannestad
d035937083 Python: Add change note 2021-02-04 18:43:44 +01:00
Taus Brock-Nannestad
a505eb6922 Python: Adhere to QLDoc style guide 2021-02-04 18:34:06 +01:00