hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-28 12:53:49 +01:00
Code Issues Packages Projects Releases Wiki Activity
36,554 Commits 1,697 Branches 161 Tags
codeql-cli/v2.9.2
Commit Graph

36554 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Arthur Baars
8f1c916242 Merge pull request #66 from github/aibaars/cfg-2 
CFG: make all simple nodes instance of StandardLeftToRight{Pre,Post}Tree
 2020-12-18 13:26:05 +01:00
Erik Krogh Kristensen
b2116dc5b4 add more tests for polynomial/exponential redos 2020-12-18 13:19:17 +01:00
Mathias Vorreiter Pedersen
2bf8e47932 Merge branch 'main' into default-taint-tracking-operand-instruction-interleaving 2020-12-18 11:59:10 +01:00
Mathias Vorreiter Pedersen
7ccd48e53c Make DefaultTaintTracking do operand->instruction->operand interleaving like DataFlowUtil. 2020-12-18 11:57:16 +01:00
Nick Rolfe
c4ca537574 Merge pull request #75 from github/stmts_exprs 
Add AST classes and tests for operations
 2020-12-18 10:40:27 +00:00
Nick Rolfe
6c828214f7 Make import private 2020-12-18 10:23:19 +00:00
Nick Rolfe
53fbfc369d Make params test pass for now 
- some toString improvements
- comment out getAPrimaryQlClass predicates that cause the test to fail
 2020-12-18 10:13:13 +00:00
Geoffrey White
dc4ca9b1b9 C++: Add qhelp and example. 2020-12-18 10:10:05 +00:00
Nick Rolfe
4718de08b2 Address review feedback 2020-12-18 10:08:45 +00:00
Tom Hvitved
d53faa86dc C#: Restrict FormatInvalid.ql and UncontrolledFormatString.ql to calls with insertions 2020-12-18 10:53:11 +01:00
Rasmus Lerchedahl Petersen
0629d3e6e7 Python: Enclosing callable for synthetic arguments 2020-12-18 10:45:24 +01:00
Rasmus Lerchedahl Petersen
a16d58dfc0 Python: Add tests cases with synthetic arguments 2020-12-18 10:41:42 +01:00
Jonas Jensen
fd7dec7f20 Merge pull request #4824 from geoffw0/modelchanges5 
C++: Add cases in the Allocation model.
 2020-12-18 09:16:01 +01:00
Tamas Vajk
8e8c3a9ded Add change note 2020-12-18 09:15:33 +01:00
Tamas Vajk
6fd1f0049d Add DB upgrade folder 2020-12-18 09:10:55 +01:00
John Lugton
3f1f83f667 remove experimental 2020-12-17 16:24:52 -08:00
John Lugton
6d5f9035e6 Minor fixes to XSS: 
Only want returns in request methods
Also care about non-string 1st args to HttpResult e.g. streams
 2020-12-17 16:17:26 -08:00
John Lugton
7d47bffd53 Tidy up ServiceStack.qll 
Use fully qualified names for classes
Make util predicate private
Make naming more consistent with rest of ql libs
 2020-12-17 16:17:26 -08:00
Chelsea Boling
d4acccb13c Update sink 2020-12-17 16:17:26 -08:00
Chelsea Boling
0a7e4b6840 Update sink based on feedback 2020-12-17 16:17:26 -08:00
Chelsea Boling
4e0f3a30ee Update sink based on feedback 2020-12-17 16:17:25 -08:00
Chelsea Boling
ba46eaa143 Refactor sink 2020-12-17 16:17:25 -08:00
Chelsea Boling
3c493511e9 Update file 2020-12-17 16:17:25 -08:00
Chelsea Boling
12e8107492 Add example 2020-12-17 16:17:25 -08:00
Chelsea Boling
5c7dedffb3 Update sinks 2020-12-17 16:17:25 -08:00
Chelsea Boling
71a08c3237 Update servicestack lib 2020-12-17 16:17:25 -08:00
John Lugton
d408ae7e10 Split ServiceStack into modules and incorporate into main lib 2020-12-17 16:17:25 -08:00
John Lugton
386eb2d56b move ServiceStack out of microsoft 2020-12-17 16:17:25 -08:00
Chelsea Boling
a2615339f7 Delete ServiceStack.qll 2020-12-17 16:17:24 -08:00
Chelsea Boling
cae6f91729 Create ServiceStack.qll 2020-12-17 16:17:24 -08:00
Chelsea Boling
dbe0170249 Add files via upload 2020-12-17 16:17:24 -08:00
Chelsea Boling
188dbde2d6 Create SQLInjection.ql 2020-12-17 16:17:24 -08:00
Chelsea Boling
96d11b7966 Create ServiceStack.qll 2020-12-17 16:17:24 -08:00
yoff
39acc9a40b Merge pull request #4735 from RasmusWL/python-untrusted-flow 
Python: Untrusted data used in external APIs
 2020-12-18 00:15:08 +01:00
yoff
9dd6439e3c Merge pull request #4749 from RasmusWL/command-injection-tests 
Python: Add some command injection tests
 2020-12-17 23:36:06 +01:00
yoff
8a44405365 Merge pull request #4827 from RasmusWL/reword-qldoc-for-type-tracking-classes 
Python: Reword QLDoc for class modeling with type-tracking
 2020-12-17 23:28:19 +01:00
Tamas Vajk
8eeab8fdd0 Add new stats file 2020-12-17 21:22:58 +01:00
Nick Rolfe
a87fe410af Simplify examples for unary plus/minus 2020-12-17 18:35:01 +00:00
Nick Rolfe
8b7af665b4 Simplify imports 2020-12-17 18:33:49 +00:00
Tom Hvitved
6893f57978 Merge pull request #74 from github/hvitved/cfg/fix-join-order 
CFG: Fix bad join-order
 2020-12-17 16:58:23 +01:00
Tom Hvitved
07c464b753 CFG: Fix bad join-order 
Before:
```
[2020-12-17 11:33:46] (211s) Tuple counts for ControlFlowGraphImpl::Trees::RescueEnsureBlockTree::nestedEnsure_dispred#ff/2@2ea588:
                      11409019   ~0%     {2} r1 = SCAN ControlFlowGraphImpl::getScope#ff AS I OUTPUT I.<1>, I.<0> 'this'
                      3714296409 ~0%     {3} r2 = JOIN r1 WITH ControlFlowGraphImpl::Trees::getAChildInScope#fff_102#join_rhs AS R ON FIRST 1 OUTPUT r1.<1> 'this', R.<1>, R.<2>
                      2359       ~0%     {2} r3 = JOIN r2 WITH ControlFlowGraphImpl::Trees::RescueEnsureBlockTree::getAnEnsureDescendant#ff AS R ON FIRST 2 OUTPUT r2.<2>, r2.<0> 'this'
                      1          ~0%     {2} r4 = JOIN r3 WITH ControlFlowGraphImpl::Trees::RescueEnsureBlockTree::getEnsure_dispred#ff_10#join_rhs AS R ON FIRST 1 OUTPUT r3.<1> 'this', R.<1> 'innerBlock'
                                         return r4
```

After:
```
[2020-12-17 15:20:37] (51s) Tuple counts for ControlFlowGraphImpl::Trees::RescueEnsureBlockTree::nestedEnsure_dispred#ff/2@c4f57d:
                      635      ~1%     {3} r1 = JOIN ControlFlowGraphImpl::Trees::RescueEnsureBlockTree::getEnsure_dispred#ff_10#join_rhs AS L WITH ControlFlowGraphImpl::Trees::getAChildInScope#fff_201#join_rhs AS R ON FIRST 1 OUTPUT R.<1>, L.<1> 'innerBlock', R.<2>
                      1        ~0%     {3} r2 = JOIN r1 WITH ControlFlowGraphImpl::Trees::RescueEnsureBlockTree::getAnEnsureDescendant#ff_10#join_rhs AS R ON FIRST 1 OUTPUT R.<1> 'this', r1.<2>, r1.<1> 'innerBlock'
                      1        ~0%     {2} r3 = JOIN r2 WITH ControlFlowGraphImpl::getScope#ff AS R ON FIRST 2 OUTPUT r2.<0> 'this', r2.<2> 'innerBlock'
                                       return r3
```
 2020-12-17 16:46:03 +01:00
Arthur Baars
ff751b97d2 CFG: make all simple nodes instance of StandardLeftToRight{Pre,Post}Tree 2020-12-17 16:39:54 +01:00
Arthur Baars
a15a066414 Merge pull request #72 from github/aibaars/fix-cfg 
CFG improvements
 2020-12-17 16:39:19 +01:00
Arthur Baars
b676c95218 Address comments 2020-12-17 16:35:51 +01:00
Nick Rolfe
73798312b9 Add classes and tests for operations 2020-12-17 15:16:37 +00:00
Tamas Vajk
f3a0d1d138 Add test to list all custom modifiers extracted from IL 2020-12-17 15:43:41 +01:00
Tamas Vajk
7662b55ecc C#: Extract init only accessors and custom modifiers 2020-12-17 15:43:41 +01:00
luchua-bc
bfb138d415 Update qldoc 2020-12-17 14:42:14 +00:00
Tom Hvitved
7a132149a2 C#: Add change note 2020-12-17 15:39:01 +01:00
Tom Hvitved
fe559c190e C#: Recognize format methods without insertion parameters 2020-12-17 15:39:01 +01:00