Commit Graph

36554 Commits

Author SHA1 Message Date
Anders Schack-Mulligen
810de73246 C/C++: Update qltest expected output. 2021-06-21 14:47:31 +02:00
Anders Schack-Mulligen
14b485efa4 Merge pull request #6119 from smowton/smowton/fix/jaxrs-tests-field-flow
Increase field flow branch limit in Jax-RS tests
2021-06-21 14:43:59 +02:00
Tom Hvitved
abe5e3d953 Merge pull request #210 from github/hvitved/dataflow/consistency
Data flow: Add consistency queries
2021-06-21 14:42:55 +02:00
Anders Schack-Mulligen
d383c0f69b Java: Remove temporary store-as-taint. 2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
65ac8be5ac Java: Add defaultImplicitTaintRead and sync. 2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
38319a4832 C/C++: Make Content public as DataFlow::Content. 2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
aa82d0b815 Java: Make Content public as DataFlow::Content. 2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
80880320d5 Dataflow: Sync. 2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
b7ac329ba1 DataFlow: Add support for configuration-specific implicit reads. 2021-06-21 14:41:19 +02:00
Mathias Vorreiter Pedersen
238c483e5b C++: Make any non-overflowing arithmetic operation a barrier. 2021-06-21 14:05:34 +02:00
Mathias Vorreiter Pedersen
18e5d3cce8 C++: Add false positive with multiplication. 2021-06-21 14:04:27 +02:00
Chris Smowton
e2aaae8181 Increase test fieldFlowBranchLimit to 1000
Might as well head off future failures in this test

Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
2021-06-21 12:51:37 +01:00
Chris Smowton
c5eef7be8c Increase field flow branch limit in Jax-RS tests
This fixes apparently-missing results by allowing the dataflow library to persist even when there are many Map implementations possibly available.
2021-06-21 12:46:13 +01:00
Geoffrey White
6f808c9e4c C++: Update change note. 2021-06-21 12:32:48 +01:00
Geoffrey White
79198974dc Merge branch 'main' into weak-crypto3 2021-06-21 11:55:29 +01:00
Anders Schack-Mulligen
9110dfaeb3 Merge pull request #6095 from hvitved/dataflow/local-cc-join
Data flow: Fix `getLocalCallContext` join-order
2021-06-21 12:53:38 +02:00
Geoffrey White
90e2a2d222 C++: Change note. 2021-06-21 11:30:12 +01:00
Nick Rolfe
35eb4a3af4 Merge pull request #214 from github/regexp_naming
Use RegExp prefix instead of Regex, for consistency with other languages.
2021-06-21 11:06:19 +01:00
Asger Feldthaus
0754ed2b5c JS: Change note 2021-06-21 11:46:44 +02:00
Rasmus Wriedt Larsen
d6ec4d30fc Python: Twisted refactor of getRequestParamIndex 2021-06-21 10:54:28 +02:00
Tom Hvitved
b820f3f20d Merge pull request #212 from github/hvitved/ssa/assigns-pred
Add `Ssa::WriteDefinition::assigns/1` predicate
2021-06-21 10:46:48 +02:00
Rasmus Wriedt Larsen
8208aebd7e Python: Apply suggestions from code review
Co-authored-by: yoff <lerchedahl@gmail.com>
2021-06-21 10:43:25 +02:00
Shati Patel
bbb5a39c02 Merge pull request #6072 from shati-patel/shati-patel/vs-code-setting
[Already shipped] Docs: Update setting in CodeQL for VS Code
2021-06-21 08:34:14 +01:00
jorgectf
b10ade17be Update HeaderDeclaration input naming 2021-06-20 00:13:59 +02:00
jorgectf
0e61558644 Empty commit 2021-06-19 18:39:58 +02:00
Taus
e79ded9046 Add exclusions to Module consistency test 2021-06-19 12:41:16 +00:00
Taus
2515fc0ebc QL: Add exclusions to Module consistency test 2021-06-19 12:41:16 +00:00
Taus
6d1dc24fa7 Autoformat 2021-06-19 12:36:10 +00:00
Taus
7a117caaea QL: Autoformat 2021-06-19 12:36:10 +00:00
Taus
6bff0f48a2 Remove SuperAccess::getType()
This had a bad effect on our call resolution, so I'm reverting it for
now. We may want to diverge from the language specification here.
2021-06-19 12:17:17 +00:00
Taus
2fa4424f71 QL: Remove SuperAccess::getType()
This had a bad effect on our call resolution, so I'm reverting it for
now. We may want to diverge from the language specification here.
2021-06-19 12:17:17 +00:00
Taus
b9238ea436 Update printAst test
to reflect the renaming of `Aggregate` to `FullAggregate`.
2021-06-19 12:16:42 +00:00
Taus
4c4a2658fe QL: Update printAst test
to reflect the renaming of `Aggregate` to `FullAggregate`.
2021-06-19 12:16:42 +00:00
Taus
e3a4d3074c Exclude a few more paths from tests 2021-06-19 11:54:50 +00:00
Taus
fb8f549d93 QL: Exclude a few more paths from tests 2021-06-19 11:54:50 +00:00
Taus
815337dde1 Split up Aggregate properly
Previously, we had `Aggregate` and `ExprAggregate` as separate classes,
the latter of which representing aggregates that contain only an
expression.

This was a problem for the `rank` aggregate, as it inherited from
`Aggregate`, but _could_ also contain just an expression (even if this
is rather rare).

To fix this, I renamed `Aggregate` to `FullAggregate` (to make the
division clearer), and added a new type `Aggregate` that represents the
union of these two types. Now `Rank` can inherit from the new class
`Aggregate` and everything is dandy.
2021-06-19 11:50:50 +00:00
Taus
76b55c4a5a QL: Split up Aggregate properly
Previously, we had `Aggregate` and `ExprAggregate` as separate classes,
the latter of which representing aggregates that contain only an
expression.

This was a problem for the `rank` aggregate, as it inherited from
`Aggregate`, but _could_ also contain just an expression (even if this
is rather rare).

To fix this, I renamed `Aggregate` to `FullAggregate` (to make the
division clearer), and added a new type `Aggregate` that represents the
union of these two types. Now `Rank` can inherit from the new class
`Aggregate` and everything is dandy.
2021-06-19 11:50:50 +00:00
Taus
1e973f3681 Fix getType for aggregates
We were only including the `strict` variant of `count` and not any of
the other ones (spot the mistake!).

Also, `unique` was added as a recognised aggregate name.
2021-06-19 11:47:45 +00:00
Taus
8d17a95265 QL: Fix getType for aggregates
We were only including the `strict` variant of `count` and not any of
the other ones (spot the mistake!).

Also, `unique` was added as a recognised aggregate name.
2021-06-19 11:47:45 +00:00
Taus
0ff0aecb22 Add more getType overrides
Mainly adds ones for primitive types.

One peculiarity: the language specification states that the type of
`super` is the same as the type of `this`, and _not_ the type of
the superclass on which the method is actually accessed. This seems a
bit strange to me, so I thought I would highlight it specifically.

Also, I'm not entirely sure that the rules around type coercion for
the various binary operators are 100% correct.
2021-06-19 11:40:12 +00:00
Taus
602c9e720e QL: Add more getType overrides
Mainly adds ones for primitive types.

One peculiarity: the language specification states that the type of
`super` is the same as the type of `this`, and _not_ the type of
the superclass on which the method is actually accessed. This seems a
bit strange to me, so I thought I would highlight it specifically.

Also, I'm not entirely sure that the rules around type coercion for
the various binary operators are 100% correct.
2021-06-19 11:40:12 +00:00
jorgectf
058ade4d8e Merge remote-tracking branch 'upstream/main' into jorgectf/python/jwt-queries 2021-06-18 22:21:38 +02:00
jorgectf
6565680dd6 Finish query 2021-06-18 22:16:39 +02:00
Taus
3aea270e10 Python: Autoformat 2021-06-18 18:30:27 +00:00
jorgectf
017a778a20 Polish make_response and fix extend argument 2021-06-18 20:21:11 +02:00
yo-h
26a04d6659 Merge pull request #6108 from tamasvajk/fix/coverage-commenter
Fix diff in the framework coverage PR comment
2021-06-18 14:02:15 -04:00
Taus
aeac03663f Python: Remove old ClickHouseDriver.qll
The merge must've gone wrong some way, as this file is not supposed to
exist in `experimental` anymore.
2021-06-18 17:41:09 +00:00
Taus
348b20ca9d Merge branch 'main' of https://github.com/github/codeql into python-a-few-minor-cleanups 2021-06-18 17:38:43 +00:00
Taus
9351688da8 Python: asCfgNode cleanup 2021-06-18 17:22:42 +00:00
Taus
c386f4a009 Python: Clean up py/insecure-protocol
Going all the way to the AST layer seemed excessive to me, so I rewrote
it to do most of the logic at the data-flow layer. In principle this
_could_ result in more names being computed (due to splitting), but in
practice I don't expect this make a big difference.
2021-06-18 17:22:42 +00:00