hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-17 15:33:45 +01:00
Code Issues Packages Projects Releases Wiki Activity
36,554 Commits 1,692 Branches 160 Tags
codeql-cli/v2.9.2
Commit Graph

36554 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Rasmus Wriedt Larsen
7017beca47 Python: Model CookieWrite for twisted 
Had to split the call to `request.cookies.append` since inline
expectation tests didn't like the expectation that contained `=` :(
 2021-06-24 17:34:43 +02:00
Rasmus Wriedt Larsen
4606444b85 Python: Model CookieWrite for flask 2021-06-24 17:34:43 +02:00
Rasmus Wriedt Larsen
65c526df86 Python: Model CookieWrite for tornado 2021-06-24 17:34:43 +02:00
Rasmus Wriedt Larsen
9340d658a4 Python: Model CookieWrite for django 2021-06-24 17:34:43 +02:00
Rasmus Wriedt Larsen
930ed0a712 Python: Minor django fixup 2021-06-24 17:34:43 +02:00
Rasmus Wriedt Larsen
226425e831 Python: Model CookieWrite for aiohttp 2021-06-24 17:34:43 +02:00
Rasmus Wriedt Larsen
e1af1f11ee Python: Add HTTP::Server::CookieWrite concept 
along with tests, but no implementations (to ease reviewing).

---

I've put quite some thinking into what to call our concept for this.

[JS has `CookieDefinition`](581f4ed757/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll (L148-L187)), but I couldn't find a matching concept in any other languages.

We used to call this [`CookieSet`](f07a7bf8cf/python/ql/src/semmle/python/web/Http.qll (L76)) (and had a corresponding `CookieGet`).

But for headers, [Go calls this `HeaderWrite`](cd1e14ed09/ql/src/semmle/go/concepts/HTTP.qll (L97-L131)) and [JS calls this `HeaderDefinition`](581f4ed757/javascript/ql/src/semmle/javascript/frameworks/HTTP.qll (L23-L46))

I think it would be really cool if we have a naming scheme that means the name for getting the value of a header on a incoming request is obvious. I think `HeaderWrite`/`HeaderRead` fulfils this best. We could go with `HeaderSet`/`HeaderGet`, but they feel a bit too vague to me. For me, I'm so used to talking about def-use, that I would immediately go for `HeaderDefinition` and `HeaderUse`, which could work, but is kinda strange.

So in the end that means I went with `CookieWrite`, since that allows using a consistent naming scheme for the future :)
 2021-06-24 17:34:43 +02:00
Nick Rolfe
a6dd2fa0a1 Split ReDoS query into .ql and .qll, and add .qhelp 2021-06-24 16:32:45 +01:00
Arthur Baars
7574d1cad7 Merge pull request #220 from github/aibaars/update-build-yml 
Update build.yml
 2021-06-24 16:38:26 +02:00
Arthur Baars
be1d4c3d2c Address comment 2021-06-24 16:31:24 +02:00
Arthur Baars
ade36691b6 Remove unnecessary qualifier 2021-06-24 16:13:29 +02:00
Arthur Baars
dfc96de4cc Update build.yml 2021-06-24 16:09:45 +02:00
Mathias Vorreiter Pedersen
a294fb07f5 C++: Add change-note. 2021-06-24 16:01:59 +02:00
Arthur Baars
95399b2d0a Refactor ApiGraphs.qll 2021-06-24 15:58:02 +02:00
Arthur Baars
4f96834711 Add ConstantAccessCfgNode 2021-06-24 15:57:48 +02:00
Mathias Vorreiter Pedersen
af56c782bf C++: Add QLDoc. 2021-06-24 15:57:01 +02:00
Mathias Vorreiter Pedersen
38c487abf9 Merge branch 'main' into more-random-sources-in-uncontrolled-arithmetic 2021-06-24 15:56:15 +02:00
Mathias Vorreiter Pedersen
5bfb78b583 C++: Block flow through all bitwise 'and' and 'or' operations. This seems to be a common source of false positives on LGTM. 2021-06-24 15:53:59 +02:00
Mathias Vorreiter Pedersen
e8bba78825 C++: Convert 'cpp/uncontrolled-arithmetic' to use a 'TaintTracking::Configuration'. 2021-06-24 15:51:44 +02:00
Felicity Chapman
4a8b71a245 Make initial changes for multi-db options 2021-06-24 14:44:08 +01:00
Anders Schack-Mulligen
95ad8b55fe Merge pull request #6107 from aschackmull/dataflow/implicit-reads 
Dataflow: Add support for implicit reads
 2021-06-24 15:38:35 +02:00
Anders Schack-Mulligen
01fc3e6559 C++/C#/Java/Python: Add change notes. 2021-06-24 14:29:34 +02:00
Anders Schack-Mulligen
cd0efbe7ce Dataflow: Sync. 2021-06-24 14:19:17 +02:00
Anders Schack-Mulligen
1c1d11a4a4 DataFlow: Address review comments. 2021-06-24 14:18:45 +02:00
Mathias Vorreiter Pedersen
c0ffd9027f C++: Add more random sources. 2021-06-24 13:40:00 +02:00
haby0
3cf71c50b8 Mobile stubs 2021-06-24 19:24:38 +08:00
Anders Schack-Mulligen
1e511c0a9e Merge pull request #6137 from smowton/smowton/feature/java-util-optional 
Java: Model java.util.Optional
 2021-06-24 13:21:36 +02:00
Arthur Baars
6bed50a86b Rename predicate with snake cased name 2021-06-24 11:59:13 +02:00
Tamás Vajk
173be0cce0 Merge pull request #6144 from tamasvajk/feature/stub-dapper 
C#: Change Dapper stub to nuget-based one (stub also System.Data.SqlC…
 2021-06-24 11:41:12 +02:00
Rasmus Wriedt Larsen
686638a65f Merge pull request #6049 from RasmusWL/jmespath 
Python: Add modeling of `jmespath`
 2021-06-24 11:13:19 +02:00
Tamas Vajk
477dfa28ec Fix framework coverage commenting action 
This commit handles the case when the current run finds no coverage change and the previous run is identified,
but it doesn't have the required artifacts.
 2021-06-24 10:44:36 +02:00
Mathias Vorreiter Pedersen
c8c77396fa C++: Get rid of the trivial 'True' condition. Turns out it's not actually needed. 2021-06-24 09:57:54 +02:00
Mathias Vorreiter Pedersen
656ff4aee9 C++: Add more QLDoc. 2021-06-24 09:57:25 +02:00
Mathias Vorreiter Pedersen
d70ea5f6e0 Update cpp/ql/src/semmle/code/cpp/controlflow/StackVariableReachability.qll 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2021-06-24 09:27:11 +02:00
Edoardo Pirovano
0909c9ff22 Performance: Fix bad join order in dataflow library 2021-06-24 08:24:17 +01:00
Tamas Vajk
ad6e47be39 Apply code review findings 2021-06-24 09:13:08 +02:00
Tamas Vajk
7557b7a67d Add scheduled coverage job to open PR with changes 2021-06-24 09:13:08 +02:00
Tamás Vajk
4a19a9978a Merge pull request #6115 from tamasvajk/feature/framework-coverage-comment-noise 
Only post comment with framework coverage change if it changed or wasn't done before
 2021-06-24 08:44:03 +02:00
CodeQL CI
c02c96369d Merge pull request #6139 from erik-krogh/colors 
Approved by esbena
 2021-06-23 14:02:17 -07:00
Mathias Vorreiter Pedersen
2938ad5f8f C++: Add testcase demonstrating the fix from a8c57ec4aa. 2021-06-23 23:01:49 +02:00
yo-h
ffdc752720 Merge pull request #6059 from smowton/smowton/fix/qualified-name-generic-types 
Adapt to static methods and nested types returning unbound declaring types
 2021-06-23 14:45:51 -04:00
Arthur Baars
b2be1c3b3d Update ql/src/codeql_ruby/ApiGraphs.qll 
Co-authored-by: Tom Hvitved <hvitved@github.com>
 2021-06-23 20:40:22 +02:00
Chris Smowton
4c777eb04a Add change note 2021-06-23 18:54:27 +01:00
Geoffrey White
06591956ff C++: Rename some variables. 2021-06-23 17:54:47 +01:00
Mathias Vorreiter Pedersen
43bbd4f7ad C++: Fix join order with 'pragma[noopt]'. 2021-06-23 18:34:04 +02:00
Geoffrey White
a2c904d0c0 C++: Clarify the meanings of predicates. 2021-06-23 17:17:50 +01:00
Geoffrey White
eeb84d4209 C++: Add more test cases for the toctou query. 2021-06-23 17:12:53 +01:00
Tamás Vajk
8518e7c5a3 Merge pull request #6146 from tamasvajk/feature/stub-nhibernate 
C#: Change nHibernate stub to nuget-based one
 2021-06-23 18:00:45 +02:00
Tamás Vajk
4dc70fa959 Merge pull request #6145 from tamasvajk/feature/stub-jsonnet 
C#: Change Newtonsoft.Json stub to nuget-based one
 2021-06-23 18:00:27 +02:00
Chris Smowton
f6ba4e0235 Merge pull request #6142 from artem-smotrakov/better-spring-exporters 
Added sinks for RmiBasedExporter and HessianExporter
 2021-06-23 16:39:10 +01:00