Erik Krogh Kristensen
b7a0b8765e
add js/http-dependency query
2022-01-19 10:05:39 +01:00
Harry Maclean
08d48b9375
Add top-level doc comment to GraphQL.qll
2022-01-19 21:42:46 +13:00
Tony Torralba
b2c7175ac5
Merge pull request #7641 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2022-01-19 09:34:01 +01:00
Tom Hvitved
f02aeafef1
Ruby: Move regex/non-regex split into TAstNode to convey disjointness
2022-01-19 09:22:01 +01:00
github-actions[bot]
f7240be136
Add changed framework coverage reports
2022-01-19 00:09:52 +00:00
Jaroslav Lobačevski
a1b0315d90
Update cpp/ql/src/experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
2022-01-19 00:52:10 +01:00
Andrew Eisenberg
01b5881de6
Docs: Remove reference to checking out main branch
...
We are no longer including information about how to check out
github/codeql, so this paragraph doesn't fit any more.
2022-01-18 15:48:33 -08:00
Andrew Eisenberg
0cd6556964
Docs: Update analyzing databases docs
...
Add more information about running packs. Include the `--download` flag.
2022-01-18 15:03:08 -08:00
Andrew Eisenberg
7fcf567eda
Docs: Simplify getting started docs
...
It is no longer necessary to check out a version of `github/codeql` as
a sibling directory to the distribution. Instead, users can download
the required packs as needed. using the `pack download` command or
the `--download` option for `codeql database analyze`.
2022-01-18 15:03:08 -08:00
Harry Maclean
4f7f92490a
Distinguish regex components from strings
...
Create a set of classes for components of regex literals,
separate from those of string literals. This allows us to special-case
components of free-spacing regexes (ones with the /x flag) to not have a
`getValueText()`.
This in turn is useful because our regex parser can't handle free-spacing
regexes, so excluding them ensures that we don't generate erroneous
ReDoS alerts.
2022-01-19 11:23:40 +13:00
Jaroslav Lobačevski
3fa2516898
Update cpp/ql/src/experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
2022-01-18 21:47:55 +01:00
Jaroslav Lobačevski
d1c89562b8
Apply suggestions from code review
2022-01-18 21:45:13 +01:00
Chris Smowton
84097468cc
Merge pull request #7286 from luchua-bc/java/unsafe-url-forward-dispatch
...
Java: CWE-552 Query to detect unsafe request dispatcher usage
2022-01-18 18:19:20 +00:00
Henry Mercer
63672ca394
Merge pull request #7616 from github/henrymercer/js-atm-add-query-help
...
JS: Add query help for ML-powered queries
2022-01-18 18:11:53 +00:00
Chris Smowton
1e32514600
Avoid using this for a non-extending supertype, and remove needless casts
2022-01-18 17:20:40 +00:00
Benjamin Muskalla
9e91b805d6
Sort Lang3 models
2022-01-18 18:10:37 +01:00
Benjamin Muskalla
e6800c877c
Merge Lang3 rows
2022-01-18 18:10:37 +01:00
Benjamin Muskalla
736e68820c
Split out Lang3 models
2022-01-18 18:10:37 +01:00
Benjamin Muskalla
67b60dcf78
Sort Lang2 rows
2022-01-18 18:10:36 +01:00
Benjamin Muskalla
82bda6d573
Merge Lang2 summary models
2022-01-18 18:10:36 +01:00
Benjamin Muskalla
8eb6743586
Split out Lang2 rows
2022-01-18 18:10:33 +01:00
Chris Smowton
d744cf9053
Clean up guard logic:
...
* Always sanitize after the second guard, not the first
* Only check basic-block dominance in one place
* One BarrierGuard extension per final guard
2022-01-18 17:10:06 +00:00
Chris Smowton
748008ad51
Remove dangling reference to UnsafeRequestPath.java
2022-01-18 17:08:38 +00:00
luchua-bc
a3d65a8ed0
Update recommendation in qldoc and make examples more comprehendible
2022-01-18 17:01:26 +00:00
Geoffrey White
982fb8f73a
C++: Add change note.
2022-01-18 16:38:44 +00:00
Robert Marsh
024bd27485
Merge pull request #7578 from MathiasVP/store-dest-should-not-be-use
...
C++: Store destinations should not be uses for dataflow SSA
2022-01-18 11:36:15 -05:00
Jeff Gran
47697f59c1
Ruby: Add classes for detecting user input from graphql-ruby
2022-01-18 09:13:58 -07:00
CodeQL CI
1912c56f82
Merge pull request #7631 from RasmusWL/sqlalchemy-scoped-session
...
Approved by tausbn
2022-01-18 14:31:49 +00:00
Rasmus Wriedt Larsen
95e935e9c1
Python: Support SQLAlchemy scoped_session
2022-01-18 14:34:31 +01:00
Erik Krogh Kristensen
30d896bdbb
QL: make the alert-message more precise when the type-cast is also redundant
2022-01-18 14:25:43 +01:00
Jaroslav Lobačevski
92f5a5f893
Reduce FPs in IncorrectPrivilegeAssignment.ql
...
Implements suggestions from https://github.com/github/codeql/pull/6949#issuecomment-976482965
2022-01-18 13:43:17 +01:00
Erik Krogh Kristensen
14d2f5fe02
QL: add a new ql/could-be-cast query
2022-01-18 13:37:32 +01:00
Erik Krogh Kristensen
a1f4c85dea
QL: update expected output for the printAst test
2022-01-18 13:37:04 +01:00
Erik Krogh Kristensen
1ec868eeae
QL: various improvements to Ast.qll
2022-01-18 13:23:33 +01:00
Erik Krogh Kristensen
95ae113994
QL: downgrade redundant-inline-cast to a warning query
2022-01-18 13:22:01 +01:00
Erik Krogh Kristensen
ea7945bac1
QL: show recommendation queries by default, and remove the MissingQLDoc query
2022-01-18 13:21:07 +01:00
Henry Mercer
be0c26f83d
Merge pull request #7617 from github/henrymercer/js-atm-update-alert-messages
...
JS: Update alert messages for ML-powered queries
2022-01-18 11:37:02 +00:00
Mathias Vorreiter Pedersen
cb0cc8d859
Merge pull request #7625 from geoffw0/nullterm4
...
C++: Fix some code duplication.
2022-01-18 11:18:06 +00:00
Tony Torralba
b16b0270d2
Merge pull request #6779 from atorralba/atorralba/android-implicit-pending-intents
...
Java: CWE-927 - Query to detect the use of implicit PendingIntents
2022-01-18 12:14:47 +01:00
Geoffrey White
548a62d1ab
C++: Fix branch related FPs in cpp/improper-null-termination.
2022-01-18 11:13:08 +00:00
Felicity Chapman
c3ed74d63c
Merge pull request #7604 from github/lgtm-1.29-docs
...
Update version numbers in CodeQL support notes for LGTM 1.29
2022-01-18 11:09:38 +00:00
Chris Smowton
9819752bdd
Merge pull request #7526 from smowton/smowton/fix/restore-nodes-edges-consistency
...
Don't include arg -> param edges in PathGraph::edges where arg is not reachable
2022-01-18 11:05:47 +00:00
Benjamin Muskalla
7e215a5193
Merge pull request #7599 from bmuskalla/modelWriter
...
Java: Model Appenable and Writer
2022-01-18 11:55:27 +01:00
Henry Mercer
1893b9f7a9
Merge pull request #7376 from github/henrymercer/js-atm-absent-features-optimization
...
JS: Update featurization for absent features optimization
2022-01-18 10:15:53 +00:00
Tony Torralba
f103d45340
Merge branch 'main' into atorralba/android-implicit-pending-intents
2022-01-18 10:50:49 +01:00
Mathias Vorreiter Pedersen
e1598aba5e
C++: Fix spelling.
2022-01-18 09:44:36 +00:00
Tony Torralba
3ff7710a18
Improve ExplicitIntent's QLDoc
2022-01-18 10:43:52 +01:00
Tony Torralba
fe2755c4a0
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-01-18 10:41:19 +01:00
Benjamin Muskalla
365a8d9bbd
Fix flow for fluent appendable api
2022-01-18 10:41:00 +01:00
Benjamin Muskalla
8e6a15640f
Model basic channel APIs
2022-01-18 10:40:39 +01:00
