Mathias Vorreiter Pedersen
9e51908b02
Merge pull request #7551 from MathiasVP/fix-join-orders-in-unsigned-difference-expr-query
...
C++: Fix join orders in `cpp/unsigned-difference-expression-compared-zero`
2022-01-12 08:29:03 +00:00
Mathias Vorreiter Pedersen
2a02ce137a
C++: Fix join orders in 'exprIsSubLeftOrLess'.
...
Before:
Tuple counts for UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff/2@i3#a5071w3a after 24s:
304220 ~2% {2} r1 = JOIN UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff#prev_delta WITH Expr::BinaryOperation#class#f#join_rhs ON FIRST 1 OUTPUT Lhs.1, Rhs.0 'sub'
190061335 ~24% {2} r2 = JOIN r1 WITH DataFlowUtil::localFlowStep#ff ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n'
3956 ~0% {2} r3 = JOIN r1 WITH DataFlowUtil::localFlowStep#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n'
407983 ~1% {2} r4 = JOIN Expr::BinaryOperation#class#f#join_rhs WITH UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff#prev ON FIRST 1 OUTPUT Rhs.1 'n', Lhs.0 'sub'
380823 ~0% {2} r5 = JOIN r4 WITH DataFlowUtil::TExprNode#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1
0 ~0% {2} r6 = JOIN r5 WITH UnsignedDifferenceExpressionComparedZero::isGuarded#fff#prev_delta ON FIRST 2 OUTPUT Rhs.2, Lhs.0 'sub'
0 ~0% {2} r7 = JOIN r6 WITH DataFlowUtil::TExprNode#ff ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n'
3956 ~0% {2} r8 = r3 UNION r7
190065291 ~24% {2} r9 = r2 UNION r8
...
After:
Tuple counts for UnsignedDifferenceExpressionComparedZero::interestingSubExpr#f/1@654e29g3 after 228ms:
370 ~2% {2} r1 = ComparisonOperation::RelationalOperation::getGreaterOperand_dispred#fb AND NOT Exclusions::isFromMacroDefinition#b(Lhs.1 'sub')
370 ~0% {2} r2 = SCAN r1 OUTPUT In.1 'sub', In.0
370 ~3% {3} r3 = JOIN r2 WITH Expr::Expr::getFullyConverted_dispred#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0 'sub'
210 ~1% {2} r4 = JOIN r3 WITH SimpleRangeAnalysis::SimpleRangeAnalysisCached::exprMightOverflowNegatively#f ON FIRST 1 OUTPUT Lhs.2 'sub', Lhs.1
210 ~0% {3} r5 = JOIN r4 WITH Expr::Expr::getFullyConverted_dispred#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.0 'sub', Rhs.1
210 ~1% {3} r6 = JOIN r5 WITH ComparisonOperation::RelationalOperation::getLesserOperand_dispred#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'sub', Lhs.2
59 ~2% {4} r7 = JOIN r6 WITH Expr::Expr::getValue_dispred#ff ON FIRST 1 OUTPUT Lhs.1 'sub', Lhs.2, Rhs.1, toInt(Rhs.1)
17 ~0% {4} r8 = SELECT r7 ON In.3 = 0
17 ~0% {2} r9 = SCAN r8 OUTPUT In.1, In.0 'sub'
8 ~0% {2} r10 = JOIN r9 WITH Expr::Expr::getUnspecifiedType_dispred#bb ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'sub'
8 ~0% {1} r11 = JOIN r10 WITH Type::IntegralType::isUnsigned_dispred#f ON FIRST 1 OUTPUT Lhs.1 'sub'
return r11
Tuple counts for UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff/2@i2#61800weu after 1ms:
8 ~0% {2} r1 = JOIN UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff#prev_delta WITH UnsignedDifferenceExpressionComparedZero::interestingSubExpr#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0 'sub'
0 ~0% {2} r2 = JOIN r1 WITH DataFlowUtil::localFlowStep#ff ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n'
1 ~0% {2} r3 = JOIN r1 WITH DataFlowUtil::localFlowStep#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n'
0 ~0% {3} r4 = JOIN UnsignedDifferenceExpressionComparedZero::isGuarded#fff#prev_delta WITH UnsignedDifferenceExpressionComparedZero::interestingSubExpr#f ON FIRST 1 OUTPUT Lhs.1, Lhs.0 'sub', Lhs.2
0 ~0% {3} r5 = JOIN r4 WITH DataFlowUtil::TExprNode#ff ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n', Lhs.2
0 ~0% {2} r6 = JOIN r5 WITH UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff#prev ON FIRST 2 OUTPUT Lhs.2, Lhs.0 'sub'
0 ~0% {2} r7 = JOIN r6 WITH DataFlowUtil::TExprNode#ff ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1 'n'
1 ~0% {2} r8 = r3 UNION r7
1 ~0% {2} r9 = r2 UNION r8
...
2022-01-10 17:28:14 +00:00
Mathias Vorreiter Pedersen
f2d6bcd767
C++: Fix join order in 'isGuarded'.
...
Before:
Tuple counts for UnsignedDifferenceExpressionComparedZero::isGuarded#bff/3@ec24001m after 1.7s:
97431 ~0% {2} r1 = JOIN UnsignedDifferenceExpressionComparedZero::isGuarded#bff#join_rhs WITH project#BasicBlocks::Cached::basic_block_member ON FIRST 1 OUTPUT Rhs.1, Lhs.0 'sub'
11809769 ~1% {2} r2 = JOIN r1 WITH Guards::GuardCondition::controls_dispred#fff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'sub', Rhs.1
11809769 ~0% {4} r3 = JOIN r2 WITH project#BasicBlocks::Cached::basic_block_member ON FIRST 1 OUTPUT Lhs.1, Rhs.1, false, Lhs.0 'sub'
629277 ~4% {7} r4 = JOIN r3 WITH Guards::GuardCondition::ensuresLt_dispred#ffffff_045123#join_rhs ON FIRST 3 OUTPUT Lhs.3 'sub', Lhs.0, Lhs.1, false, Rhs.3 'left', Rhs.4 'right', Rhs.5
628120 ~4% {7} r5 = SELECT r4 ON In.6 >= 0
628120 ~1% {3} r6 = SCAN r5 OUTPUT In.0 'sub', In.4 'left', In.5 'right'
return r6
After:
Tuple counts for UnsignedDifferenceExpressionComparedZero::isGuarded#fff/3@i2#a5071x3a after 392ms:
103763 ~0% {2} r1 = SCAN UnsignedDifferenceExpressionComparedZero::exprIsSubLeftOrLess#ff#prev_delta OUTPUT In.0 'sub', 26
103763 ~0% {1} r2 = JOIN r1 WITH exprs ON FIRST 2 OUTPUT Lhs.0 'sub'
97431 ~0% {3} r3 = JOIN r2 WITH project#BasicBlocks::Cached::basic_block_member ON FIRST 1 OUTPUT Rhs.1, false, Lhs.0 'sub'
629277 ~0% {7} r4 = JOIN r3 WITH Guards::GuardCondition::ensuresLt_dispred#ffffff_450123#join_rhs ON FIRST 2 OUTPUT Lhs.2 'sub', Lhs.0, false, Rhs.2, Rhs.3 'left', Rhs.4 'right', Rhs.5
628120 ~0% {7} r5 = SELECT r4 ON In.6 >= 0
628120 ~1% {6} r6 = SCAN r5 OUTPUT In.0 'sub', In.1, In.3, In.4 'left', In.5 'right', In.6
628120 ~1% {6} r7 = r6 AND NOT UnsignedDifferenceExpressionComparedZero::isGuarded#fff#prev(Lhs.0 'sub', Lhs.3 'left', Lhs.4 'right')
628120 ~0% {5} r8 = SCAN r7 OUTPUT In.2, In.1, In.0 'sub', In.3 'left', In.4 'right'
628120 ~1% {3} r9 = JOIN r8 WITH Guards::GuardCondition::controls_dispred#fff ON FIRST 2 OUTPUT Lhs.2 'sub', Lhs.3 'left', Lhs.4 'right'
return r9
2022-01-10 17:03:40 +00:00
Tom Hvitved
fd60c6e1ad
Merge pull request #7510 from github/release-prep/2.7.5
...
Release preparation for version 2.7.5
2022-01-04 18:57:43 +01:00
github-actions[bot]
1dfcf427aa
Release preparation for version 2.7.5
2022-01-04 14:44:56 +00:00
Tom Hvitved
bfb573c86a
Merge pull request #7508 from hvitved/python/change-note-typo2
...
Python: Fix another change note typo
2022-01-04 14:10:37 +01:00
Tom Hvitved
6b4eaf674f
Python: Fix another change note typo
2022-01-04 13:53:07 +01:00
Erik Krogh Kristensen
b9964799f3
Merge pull request #7458 from erik-krogh/modelling
...
QL: add "modelling/modeling" to `ql/non-us-spelling`
2022-01-04 13:33:54 +01:00
Anders Schack-Mulligen
6457f42497
Merge pull request #7500 from zbazztian/stringbuilder-reverse-taint
...
Propagate taint through AbstractStringBuilder.reverse()
2022-01-04 13:28:14 +01:00
Geoffrey White
344e380fa3
Merge pull request #6949 from ihsinme/ihsinme-patch-073
...
CPP: Add query for CWE-266 Incorrect Privilege Assignment
2022-01-04 11:37:17 +00:00
Tom Hvitved
a2c1995b9b
Merge pull request #7506 from hvitved/python/change-note-typo
...
Python: Fix typo in change note
2022-01-04 11:47:48 +01:00
Anders Schack-Mulligen
f8380dabe0
Update java/ql/lib/semmle/code/java/frameworks/Strings.qll
2022-01-04 11:47:26 +01:00
Tom Hvitved
23fb3455c0
Python: Fix typo in change note
2022-01-04 11:06:23 +01:00
Tom Hvitved
1f8a291d6f
Merge pull request #7198 from hvitved/ruby/dataflow/arrays
...
Ruby: Flow through arrays/enumerables
2022-01-04 10:37:08 +01:00
yoff
5ba70ff3b6
Merge pull request #7369 from RasmusWL/filter-tag-cwe
...
JS/Py/Ruby: Add more CWEs to bad-tag-filter queries
2022-01-04 10:11:03 +01:00
Michael Nebel
c3007ff713
Merge pull request #7468 from michaelnebel/csharp-foreach-dataflow
...
C#: Re-factor the ForEachCapture query to use MaD flow summaries.
2022-01-04 09:46:39 +01:00
Tom Hvitved
de1697ab39
Merge pull request #7503 from dbartol/dbartol/move-change-notes
...
Move change notes to correct location
2022-01-04 09:35:21 +01:00
Dave Bartolomeo
5f5af4a29e
Move change notes to correct location
...
A few change notes slipped through the cracks of my previous change. These are now in the proper locations: `old-change-notes` for older notes, and `<lang>\ql\[src|lib]\change-notes` for current change notes.
2022-01-03 18:21:16 -05:00
Dave Bartolomeo
ded3c52a34
Merge pull request #7407 from github/post-release-prep/codeql-cli-2.7.4
...
Post-release preparation for codeql-cli-2.7.4
2022-01-03 17:09:58 -05:00
github-actions[bot]
1334d207fa
Post-release version bumps
2022-01-03 20:11:15 +00:00
Taus
ec533c8465
Merge pull request #7502 from tausbn/ql-support-trailing-comma-in-set-literals
...
QL: Support trailing comma in set literals
2022-01-03 17:06:46 +01:00
Taus
8845529548
QL: Support trailing comma in set literals
...
See
725395405e
2022-01-03 15:48:24 +00:00
Sebastian Bauersfeld
421bd1b970
Propagate taint through AbstractStringBuilder.reverse() and its overrides.
2022-01-03 10:38:27 +07:00
Tom Hvitved
882caf4011
Merge pull request #7470 from hvitved/csharp/dispatch-join-order
...
C#: Fix bad join-order in dispatch library
2021-12-22 19:11:33 +01:00
Alex Ford
0cbf136e21
Merge pull request #7273 from github/ruby/crypto-algorithms
...
Ruby: add CryptoAlgorithms library
2021-12-22 17:42:59 +00:00
Alex Ford
69f1c18a39
Merge pull request #7446 from jeffgran/jg/constant-write-access
...
[Ruby] Bugfix: ConstantWriteAccess::getQualifiedName() returns wrong value in some cases
2021-12-22 17:07:49 +00:00
Alex Ford
3da98ecb73
Bump a date
2021-12-22 16:38:16 +00:00
Alex Ford
a2104de8a0
Move CryptoAlgorithms::AlgorithmsName into a separate internal/CryptoAlgorithmNames.qll
2021-12-22 16:38:15 +00:00
Alex Ford
f16d77615d
Remove unused isStrongBlockMode predicate from CryptoAlgorithms.qll
2021-12-22 16:38:15 +00:00
Alex Ford
df0da980ea
Update ruby/ql/lib/codeql/ruby/security/OpenSSL.qll
...
Co-authored-by: Nick Rolfe <nickrolfe@github.com >
2021-12-22 16:38:15 +00:00
Alex Ford
27a40fb5cf
Ruby: OpenSSL QLDoc fixes
2021-12-22 16:38:15 +00:00
Alex Ford
97c75de771
Ruby: OpenSSL and CryptoAlgorithms test update
2021-12-22 16:38:15 +00:00
Alex Ford
e6bc45ee3b
Ruby: Base OpenSSL supported algorithms on OpenSSL 1.1.1 and LibreSSL 3.4.1
2021-12-22 16:38:15 +00:00
Alex Ford
d3af687767
Add more encryption algorithms and modes to CryptoAlgorithms::AlgorithmNames
...
Strong encryption algorithms: ARIA, IDEA, SEED, SM4
Strong block modes: CBC, CFB, CTR, OFB
2021-12-22 16:38:15 +00:00
Alex Ford
bdb2d8ba16
Ruby: split OpenSSL parts from CryptoALgorithms.qll and sync with JS/Python version
2021-12-22 16:38:15 +00:00
Alex Ford
0303c279e2
Ruby: add empty ruby file to avoid DataFlowConsistency failure
2021-12-22 16:38:15 +00:00
Alex Ford
1156581b52
Ruby: add CryptoAlgorithms library
2021-12-22 16:38:15 +00:00
Jeff Gran
accfd482d4
autoformat file
2021-12-22 08:44:35 -07:00
Jeff Gran
6acb87d542
add change-notes
2021-12-22 08:42:07 -07:00
Jeff Gran
f21398ce84
changed the name of one of the constants for a better test case
2021-12-22 08:42:07 -07:00
Jeff Gran
445c420a3d
rerun test --learn with rebuilt ruby extractor
2021-12-22 08:42:04 -07:00
Jeff Gran
07c7de5cfd
run test --learn, add a few more constants to constant.rb test case
2021-12-22 08:36:07 -07:00
Jeff Gran
7c032f6cb4
fix docs, fix deprecations
2021-12-22 08:35:55 -07:00
Jeff Gran
f35e866799
Capitalize "Gets"
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2021-12-22 08:35:55 -07:00
Jeff Gran
0c698996aa
use resolveConstanteWriteAccess instead, add a few more test cases
2021-12-22 08:35:55 -07:00
Jeff Gran
3df7793803
add more test cases, fix bug by adding getFullName() predicate
2021-12-22 08:35:55 -07:00
Jeff Gran
8e46eeb88c
fix expectations to expect the correct values
2021-12-22 08:35:52 -07:00
Tom Hvitved
55492ef348
Ruby: Update expected test output after rebase
2021-12-22 15:56:20 +01:00
Tom Hvitved
118d0d9ff5
Ruby: Use "Receiver" instead of "Self" in flow summaries
...
Flow summaries use the "outside view", i.e., the call sites, so "receiver"
is better than "self", as the latter uses the "inside view", i.e. the callees.
2021-12-22 15:56:20 +01:00
Tom Hvitved
3a30f58f74
Address review comments
2021-12-22 15:56:20 +01:00
Tom Hvitved
400802c5ce
Ruby: Add flow summaries for Array/Enumerable methods
2021-12-22 15:56:20 +01:00
Michael Nebel
748b2d2507
C#: Simplify the ForEachCapture query.
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2021-12-22 15:47:24 +01:00
Michael Nebel
fef6770a21
C#: Remove the callableFlow for the Add method in subtypes of System.Collections.IEnumerable.
2021-12-22 15:47:24 +01:00
Michael Nebel
51e3c582de
C#: Re-write ForEachCapture test to avoid using LibraryTypeDataFlow and rely in MaD summaries instead.
2021-12-22 15:47:24 +01:00
Tom Hvitved
8c18aaae74
Ruby: Prepare for data flow through arrays
2021-12-22 15:35:34 +01:00
Tom Hvitved
27f786b41e
Merge pull request #7442 from hvitved/ruby/dataflow/keyword-params
...
Ruby: Data flow for keyword arguments/parameters
2021-12-22 15:23:22 +01:00
Tom Hvitved
4133eb15d5
Ruby: Reintroduce old Argument[_] restriction to avoid large Cartesian product
2021-12-22 11:37:38 +01:00
Tom Hvitved
d196c77b3d
Ruby: Remove some redundant overrides
2021-12-22 11:25:13 +01:00
Tom Hvitved
f5471e34f8
C#: Fix bad join-order in dispatch library
...
Before
```
[2021-12-22 09:46:31] (395s) Tuple counts for Dispatch::Internal::hasCallable#fff/3@258418l2 after 5m27s:
49000 ~0% {2} r1 = JOIN Declaration::Declaration::getUnboundDeclaration_dispred#ff_10#join_rhs WITH project#Dispatch::Internal::DispatchMethodOrAccessorCall::getAStaticTargetExt#ff ON FIRST 1 OUTPUT Lhs.1 'c', Rhs.0
31302 ~3% {3} r2 = JOIN r1 WITH Type::ValueOrRefType::getAMember_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.0 'c', Lhs.1 'source', Rhs.1
299700 ~0% {3} r3 = JOIN r1 WITH Type::ValueOrRefType::hasOverriddenMember_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.0 'c', Lhs.1 'source', Rhs.1
16650 ~1% {3} r4 = JOIN r1 WITH Property::Accessor::getDeclaration_dispred#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'source', Lhs.0 'c'
15984 ~0% {3} r5 = JOIN r4 WITH Type::ValueOrRefType::getAMember_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.2 'c', Lhs.1 'source', Rhs.1
315684 ~1% {3} r6 = r3 UNION r5
346986 ~1% {3} r7 = r2 UNION r6
0 ~0% {3} r8 = JOIN r4 WITH Type::ValueOrRefType::hasOverriddenMember_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.2 'c', Lhs.1 'source', Rhs.1
666 ~0% {3} r9 = JOIN r1 WITH Type::hasNonOverriddenMember#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'source', Lhs.0 'c'
0 ~0% {3} r10 = JOIN r9 WITH boundedFastTC(Type::ValueOrRefType::getBaseClass_dispred#ff_10#join_rhs,Dispatch::Internal::hasCallable#fff#higher_order_body) ON FIRST 1 OUTPUT Lhs.2 'c', Lhs.1 'source', Rhs.1
0 ~0% {3} r11 = JOIN r4 WITH Type::hasNonOverriddenMember#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'source', Lhs.2 'c'
0 ~0% {3} r12 = JOIN r11 WITH boundedFastTC(Type::ValueOrRefType::getBaseClass_dispred#ff_10#join_rhs,Dispatch::Internal::hasCallable#fff#higher_order_body#1) ON FIRST 1 OUTPUT Lhs.2 'c', Lhs.1 'source', Rhs.1
0 ~0% {3} r13 = r10 UNION r12
0 ~0% {3} r14 = r8 UNION r13
346986 ~1% {3} r15 = r7 UNION r14
11963234000 ~2% {4} r16 = JOIN r15 WITH Dispatch::Internal::hasOverrider#ff ON FIRST 1 OUTPUT Lhs.2, Rhs.1 't', Lhs.1 'source', Lhs.0 'c'
207126 ~27% {3} r17 = JOIN r16 WITH Unification::Gvn::Cached::getGlobalValueNumber#ff ON FIRST 2 OUTPUT Lhs.2 'source', Lhs.1 't', Lhs.3 'c'
return r17
```
After
```
[2021-12-22 10:39:41] (0s) Tuple counts for Dispatch::Internal::hasCallable0#fff/3@82341e2h after 331ms:
93569 ~0% {2} r1 = JOIN Type::ValueOrRefType::getAMember_dispred#fb_10#join_rhs WITH OverridableCallable::OverridableCallable#f ON FIRST 1 OUTPUT Rhs.0 'c', Lhs.1
511767 ~0% {2} r2 = JOIN Type::ValueOrRefType::hasOverriddenMember_dispred#ff_10#join_rhs WITH OverridableCallable::OverridableCallable#f ON FIRST 1 OUTPUT Rhs.0 'c', Lhs.1
35659 ~0% {2} r3 = JOIN OverridableCallable::OverridableCallable#f WITH Property::Accessor::getDeclaration_dispred#ff ON FIRST 1 OUTPUT Rhs.1, Lhs.0 'c'
35659 ~4% {2} r4 = JOIN r3 WITH Type::ValueOrRefType::getAMember_dispred#fb_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'c', Rhs.1
547426 ~0% {2} r5 = r2 UNION r4
640995 ~4% {2} r6 = r1 UNION r5
74835 ~4% {2} r7 = JOIN r3 WITH Type::ValueOrRefType::hasOverriddenMember_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1 'c', Rhs.1
32748 ~0% {2} r8 = JOIN Type::hasNonOverriddenMember#fb_10#join_rhs WITH OverridableCallable::OverridableCallable#f ON FIRST 1 OUTPUT Lhs.1, Rhs.0 'c'
171228 ~0% {2} r9 = JOIN r8 WITH boundedFastTC(Type::ValueOrRefType::getBaseClass_dispred#ff_10#join_rhs,Dispatch::Internal::hasCallable0#fff#higher_order_body) ON FIRST 1 OUTPUT Lhs.1 'c', Rhs.1
9056 ~0% {2} r10 = JOIN r3 WITH Type::hasNonOverriddenMember#fb_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'c'
23633 ~1% {2} r11 = JOIN r10 WITH boundedFastTC(Type::ValueOrRefType::getBaseClass_dispred#ff_10#join_rhs,Dispatch::Internal::hasCallable0#fff#higher_order_body#1) ON FIRST 1 OUTPUT Lhs.1 'c', Rhs.1
194861 ~0% {2} r12 = r9 UNION r11
269696 ~0% {2} r13 = r7 UNION r12
910691 ~4% {2} r14 = r6 UNION r13
910691 ~2% {3} r15 = JOIN r14 WITH Declaration::Declaration::getUnboundDeclaration_dispred#ff ON FIRST 1 OUTPUT Rhs.1 'source', Lhs.0 'c', Lhs.1
579872 ~2% {3} r16 = JOIN r15 WITH project#Dispatch::Internal::DispatchMethodOrAccessorCall::getAStaticTargetExt#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1 'c', Lhs.0 'source'
753465 ~41% {3} r17 = JOIN r16 WITH Unification::Gvn::Cached::getGlobalValueNumber#ff ON FIRST 1 OUTPUT Rhs.1 't', Lhs.1 'c', Lhs.2 'source'
return r17
[2021-12-22 10:39:41] (0s) Tuple counts for Dispatch::Internal::hasCallable#fff/3@e44e67tv after 24ms:
201843 ~0% {3} r1 = JOIN Dispatch::Internal::hasOverrider#ff WITH Dispatch::Internal::hasCallable0#fff ON FIRST 2 OUTPUT Lhs.0 't', Lhs.1 'c', Rhs.2 'source'
return r1
```
2021-12-22 10:45:51 +01:00
Tamás Vajk
43b5d502b8
Merge pull request #7466 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-22 09:05:15 +01:00
github-actions[bot]
ba7a10de68
Add changed framework coverage reports
2021-12-22 00:10:19 +00:00
Nick Rolfe
9e259b67bb
Merge pull request #7305 from github/nickrolfe/user-controlled-bypass
...
Ruby: query to find user-controlled bypass of sensitive actions
2021-12-21 17:20:20 +00:00
Arthur Baars
a7aff11140
Merge pull request #7394 from aibaars/ruby-cfg-expr-post
...
Ruby: CFG: make all expressions "post-order" nodes
2021-12-21 16:36:42 +01:00
Nick Rolfe
5765f3684c
Ruby: add missing qldoc comment
2021-12-21 15:29:16 +00:00
Nick Rolfe
5db80dac51
Merge remote-tracking branch 'origin/main' into nickrolfe/user-controlled-bypass
2021-12-21 15:26:08 +00:00
Michael Nebel
c138a2796f
Merge pull request #7424 from michaelnebel/csharp-flow-summary-csv
...
C#: Flow summaries in CSV format.
2021-12-21 16:11:22 +01:00
Michael Nebel
8250fb4cf7
C#: Fixed typo in namespace.
2021-12-21 15:00:05 +01:00
Arthur Baars
a86ba3b14e
Ruby: rename WhenExpr to WhenClause
2021-12-21 12:31:24 +01:00
Mathias Vorreiter Pedersen
dae5af6be8
Merge pull request #7392 from MathiasVP/fix-join-order-in-is-argument-for-parameter
...
C++: Fix join order in `isArgumentForParameter`
2021-12-21 09:29:32 +01:00
Tom Hvitved
f66a08155b
Merge pull request #7460 from hvitved/ruby/cfg/nested-completion-non-linear-rec
...
Ruby: Reduce non-linear recursion in CFG completion library
2021-12-20 20:11:00 +01:00
Tom Hvitved
29cd346702
Ruby: Reduce non-linear recursion in CFG completion library
...
Before
```
noinline
incremental
Completion::nestedEnsureCompletion#ff(/* Completion::Completion */ Completion::TCompletion outer,
int nestLevel)
:-
(
(
Completion::TReturnCompletion#f(outer),
rec Completion::Completion#class#f(outer)
);
(
Completion::TBreakCompletion#f(outer),
rec Completion::Completion#class#f(outer)
);
(
Completion::TNextCompletion#f(outer),
rec Completion::Completion#class#f(outer)
);
(
Completion::TRedoCompletion#f(outer),
rec Completion::Completion#class#f(outer)
);
(
Completion::TRetryCompletion#f(outer),
rec Completion::Completion#class#f(outer)
);
(
Completion::TRaiseCompletion#f(outer),
rec Completion::Completion#class#f(outer)
);
(
Completion::TExitCompletion#f(outer),
rec Completion::Completion#class#f(outer)
)
),
exists(/* ControlFlowGraphImpl::Trees::BodyStmtTree */ cached dontcare AST::Cached::TAstNode _ |
ControlFlowGraphImpl::Trees::BodyStmtTree::getNestLevel_dispred#ff(_,
nestLevel)
)
| [base_case] false()
| [delta_order]
(
(
Completion::TReturnCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
);
(
Completion::TBreakCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
);
(
Completion::TNextCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
);
(
Completion::TRedoCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
);
(
Completion::TRetryCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
);
(
Completion::TRaiseCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
);
(
Completion::TExitCompletion#f(outer),
delta previous rec Completion::Completion#class#f(outer)
)
),
project#ControlFlowGraphImpl::Trees::BodyStmtTree::getNestLevel_dispred#ff(nestLevel),
not(previous rec Completion::nestedEnsureCompletion#ff(outer, nestLevel))
.
```
After
```
noinline
Completion::nestedEnsureCompletion#ff(Completion::TCompletion outer,
int nestLevel)
:-
(
Completion::TReturnCompletion#f(outer);
Completion::TBreakCompletion#f(outer);
Completion::TNextCompletion#f(outer);
Completion::TRedoCompletion#f(outer);
Completion::TRetryCompletion#f(outer);
Completion::TRaiseCompletion#f(outer);
Completion::TExitCompletion#f(outer)
),
project#ControlFlowGraphImpl::Trees::BodyStmtTree::getNestLevel_dispred#ff(nestLevel)
.
```
2021-12-20 19:22:47 +01:00
Arthur Baars
6c7114804e
Ruby: remove CaseExprChildMapping::getBranch
2021-12-20 19:21:36 +01:00
Arthur Baars
7644d60dae
Revert "Ruby: CFG: make WhenExpr post-order"
...
This reverts commit cff63fa7d7
2021-12-20 18:57:25 +01:00
Erik Krogh Kristensen
8019b52838
run the non-us patch with "modelled/modeled"
2021-12-20 17:47:15 +01:00
Erik Krogh Kristensen
4c1089fcf1
QL: add "modelled/modeled" to the ql/non-us-spelling query
2021-12-20 17:46:41 +01:00
Erik Krogh Kristensen
66c6a4d899
QL: move ql/non-us-spelling implementation to Query.qll file
2021-12-20 16:53:52 +01:00
Erik Krogh Kristensen
d17879e1f9
run the non-us patch
2021-12-20 16:24:41 +01:00
Mathias Vorreiter Pedersen
aa92fe8c90
Merge pull request #7338 from geoffw0/clrtxt2
...
C++: Improvements to cpp/cleartext-transmission
2021-12-20 16:05:12 +01:00
Michael Nebel
06b77eb4af
C#: Re-introduce callableFlow for Add as the test test/query-tests/Language Abuse/ForeachCapture/ForeachCapture.qlref needs to be re-written before it can be removed.
2021-12-20 16:00:59 +01:00
Tom Hvitved
06575efce9
Data flow: Fix bad join-order
2021-12-20 15:44:16 +01:00
Michael Nebel
d3f2894a8e
C#: Convert remaining missing parts of System.Collections.IEnumerable and sub types flow to CSV format (except for 'clearsContent').
2021-12-20 15:33:26 +01:00
Michael Nebel
0aefb1551e
C#: Convert at least System.Collection.[Generic.]ICollection flow to CSV format.
2021-12-20 15:33:26 +01:00
Michael Nebel
e9d4e38364
C#: Convert at least System.Collection.[Generic.]IList flow to CSV format.
2021-12-20 15:33:25 +01:00
Michael Nebel
44c1e3f28d
C#: Re-arrange framework imports.
2021-12-20 15:33:25 +01:00
Michael Nebel
aedfc428c2
C#: Convert at least the flow summaries for System.Collections[.Generic].IDictionary and subclasses.
2021-12-20 15:33:25 +01:00
Michael Nebel
b78ec4c693
C#: Add flow summary for System.Collections.IEnumerable in CSV format.
2021-12-20 15:33:25 +01:00
Michael Nebel
20637555b5
C#: Manual cleanup of previously added IEnumerable<>.GetEnumrator flow summaries.
2021-12-20 15:33:25 +01:00
Michael Nebel
ac5b2bfa41
C#: Add flow summary for IEnumerable<T>.GetEnumerator() and update tests.
2021-12-20 15:33:25 +01:00
Michael Nebel
f93c63aa60
C#: Convert flow summaries for extension methods for subtypes of System.Collection.IEnumerable to CSV format.
2021-12-20 15:33:25 +01:00
Michael Nebel
ec4d43fed2
C#: Add missing dataflow comment in CompilerServices.
2021-12-20 15:33:25 +01:00
Erik Krogh Kristensen
2f559696e4
QL: add "modelling/modeling" to ql/non-us-spelling
2021-12-20 15:30:46 +01:00
Tom Hvitved
aa9444b16c
Address review comment
2021-12-20 15:24:14 +01:00
Nick Rolfe
f18492e39b
Merge pull request #7443 from github/nickrolfe/behavior
...
QL4QL: catch behaviour/behavior in ql/non-us-spelling
2021-12-20 13:23:53 +00:00
Erik Krogh Kristensen
9ffdfb263f
Merge pull request #7441 from erik-krogh/ql-for-ql-next
...
QL-for-QL: Followup changes
2021-12-20 10:58:13 +01:00
Alex Ford
313e0c63fd
Merge pull request #7399 from github/ruby/stdlib-logger
...
Ruby: Model what is written to the log from stdlib `Logger` methods
2021-12-20 09:52:29 +00:00
Erik Krogh Kristensen
8b53cca3e8
QL: use environment instead of dynamic shell script construction
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2021-12-20 09:56:10 +01:00
Tom Hvitved
ed006d7283
Merge pull request #7231 from hvitved/csharp/dataflow/consistency-queries
...
C#: Enable data-flow consistency queries
2021-12-20 08:46:19 +01:00
Erik Krogh Kristensen
af47cba09a
QL: fix the remaining code-scanning errors for QL-for-QL
2021-12-17 21:34:13 +01:00
Erik Krogh Kristensen
30f8894854
QL: run the redundat inline cast patch
2021-12-17 20:50:15 +01:00
Erik Krogh Kristensen
571995c929
QL: run the implicit this patch
2021-12-17 20:49:32 +01:00
Erik Krogh Kristensen
31c8e4ed2a
QL: Fix the autobuilder (temporary bad fix)
2021-12-17 20:23:02 +01:00
Erik Krogh Kristensen
7a9e41c97d
QL: split out analysis of each CodeQL language
2021-12-17 20:22:59 +01:00
Erik Krogh Kristensen
f44f33788f
QL: cache the compiled extractor
2021-12-17 20:22:55 +01:00
Erik Krogh Kristensen
380d238c31
QL: run the QL-for-QL tests when a nested folder is changed
2021-12-17 20:22:30 +01:00
Erik Krogh Kristensen
8fbd056b4e
QL: add the QL-for-QL label automatically
2021-12-17 20:22:27 +01:00
Erik Krogh Kristensen
d612687ae7
QL: don't require change notes for QL-for-QL
2021-12-17 20:22:23 +01:00
Erik Krogh Kristensen
f7f9b4d3f4
QL: use erik-krogh/ql codeql-action
2021-12-17 20:22:20 +01:00
Erik Krogh Kristensen
ea1ee68fe1
QL: fix join order of ql/override-swapped-name
2021-12-17 20:22:20 +01:00
Erik Krogh Kristensen
5717a216d3
QL: fix bad join
2021-12-17 20:22:20 +01:00
Erik Krogh Kristensen
4d12d8dd5e
QL: update the stats file
2021-12-17 20:22:20 +01:00
Henry Mercer
bebf4ca8fc
Merge pull request #7357 from github/henrymercer/js-atm-only-featurize-with-flow
...
JS: Only featurize endpoints that are part of a flow path
2021-12-17 18:03:40 +00:00
Henry Mercer
d058d36b1f
Merge pull request #7445 from github/henrymercer/bump-atm-pack-version
...
Bump ATM pack version to 0.0.2
2021-12-17 17:54:50 +00:00
Henry Mercer
055432530f
Bump ATM pack version to 0.0.2
2021-12-17 16:49:59 +00:00
Henry Mercer
c1864531cd
JS: Push FeaturizationConfig context into more predicates
2021-12-17 16:31:56 +00:00
Henry Mercer
383437c571
JS: Only featurize endpoints that are part of a flow path
2021-12-17 16:31:56 +00:00
Nick Rolfe
dd12eab29b
Merge pull request #7444 from github/nickrolfe/ql-autobuilder
...
QL for QL: add autobuilder that respects LGTM_INDEX_FILTERS
2021-12-17 16:22:42 +00:00
Anders Schack-Mulligen
c03f189dec
Merge pull request #7434 from MathiasVP/fix-join-order-in-phi-node
...
C++: Fix join-order in `phi_node` predicate.
2021-12-17 17:06:57 +01:00
Nick Rolfe
e6c60ebd41
QL for QL: add autobuilder that respects LGTM_INDEX_FILTERS
2021-12-17 16:05:21 +00:00
Nick Rolfe
28912c508f
Fix non-US spelling of 'behavior'
2021-12-17 15:29:31 +00:00
CodeQL CI
5054d5b555
Merge pull request #7420 from RasmusWL/ssrf-new
...
Approved by yoff
2021-12-17 15:20:49 +00:00
Tom Hvitved
1e27ddf7c7
Ruby: Data flow for keyword arguments/parameters
2021-12-17 15:42:29 +01:00
Nick Rolfe
9ad9b81327
QL4QL: catch behaviour/behavior in ql/non-us-spelling
2021-12-17 14:30:33 +00:00
Rasmus Wriedt Larsen
83f87f0272
Python: Adjust .expected based on new comment
...
That was changed in 9866214
2021-12-17 15:29:41 +01:00
CodeQL CI
de4b655ddb
Merge pull request #7327 from asgerf/js/handlebars-more-raw-interpolation
...
Approved by erik-krogh
2021-12-17 14:07:57 +00:00
Mathias Vorreiter Pedersen
45753e519f
C++: Fully lock down the join order correctly.
2021-12-17 13:43:56 +00:00
Rasmus Wriedt Larsen
626009ea60
Python: Fix typo
2021-12-17 14:29:38 +01:00
yoff
9866214ebe
Update python/ql/test/query-tests/Security/CWE-918-ServerSideRequestForgery/full_partial_test.py
2021-12-17 14:26:43 +01:00
Arthur Baars
46144fe0a3
Ruby: InClause and WhenClause are no longer Expr
2021-12-17 14:04:25 +01:00
Arthur Baars
974ad070d1
Revert "Ruby: CFG make in-clause post-order"
...
This reverts commit 1343ed58a21eec2954876d8d42e877a382ba89c8.
2021-12-17 14:04:25 +01:00
Arthur Baars
560413f94a
Address comments
2021-12-17 14:04:25 +01:00
CodeQL CI
39ec7132af
Merge pull request #7049 from asgerf/js/routing-trees
...
Approved by erik-krogh
2021-12-17 12:26:38 +00:00
Tony Torralba
f3819e7b06
Merge pull request #7435 from github/atorralba/log4j-CVE-2021-45046
...
Java: New sinks for Log4j CloseableThreadContext
2021-12-17 13:19:51 +01:00
Tom Hvitved
77fcb8a18f
C#: Remove unused predicate
2021-12-17 13:14:11 +01:00
Tom Hvitved
e4d9f5f29e
Fix QL doc
2021-12-17 13:14:11 +01:00
Tom Hvitved
a0311609d0
C#: Add missing post-update nodes for reverse array stores a[i].f = x
2021-12-17 13:14:11 +01:00
Tom Hvitved
e47e824e16
C#: Restrict ExplicitParameterNode to those that belong to unbound callables
2021-12-17 13:14:11 +01:00
Tom Hvitved
4a331814a2
C#: Avoid overlap in getCSharpType
2021-12-17 13:14:11 +01:00
Tom Hvitved
f5a47126b1
C#: Fix DataFlow::Node::getEnclosingCallable for field initializer expressions
2021-12-17 13:14:11 +01:00
Tom Hvitved
5bdfcc8436
C#: Update QL doc
2021-12-17 13:14:11 +01:00
Tom Hvitved
c13d83ce40
C#: Restrict some call-back flow summaries
2021-12-17 13:14:08 +01:00
Tom Hvitved
0c9ca4546c
C#: Avoid overlap for () and System.ValueTuple in unification library
2021-12-17 13:13:36 +01:00
Tom Hvitved
7af9d75abc
C#: Add locations for more CIL methods
2021-12-17 13:13:36 +01:00
Tom Hvitved
ab2e0fdb18
Data flow: Sync files
2021-12-17 13:13:36 +01:00
Tom Hvitved
40043f13c6
C#: Enable data-flow consistency queries
2021-12-17 13:13:36 +01:00
Erik Krogh Kristensen
c70a2bebda
Merge pull request #7410 from erik-krogh/erik-krogh/publish-ql-for-ql
...
Add QL for QL
2021-12-17 12:55:25 +01:00
Mathias Vorreiter Pedersen
c1af8b93c2
C++: Better join-order fix.
2021-12-17 11:50:53 +00:00
Arthur Baars
83a8a60676
Ruby: CFG: consistency query to check that Expr nodes are post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
ba89653dff
Ruby: CFG: make RescueClause post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
db4b781fef
Ruby: CFG: make RescueModifier post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
cff63fa7d7
Ruby: CFG: make WhenExpr post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
a9286e897b
Ruby: CFG make in-clause post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
f49605569b
Ruby: CFG make more expressions post-order
2021-12-17 12:21:18 +01:00
Arthur Baars
a4ea7129c2
Ruby: CFG: make 'case' a PostOrder node
2021-12-17 12:21:18 +01:00
Rasmus Wriedt Larsen
83f1b2ca5d
Python: Add SSRF qhelp
...
I included examples of both types in the qhelp of both queries, to
provide context of what each of them actually are.
2021-12-17 11:48:26 +01:00
Anders Schack-Mulligen
3adc0b57ed
Merge pull request #7426 from MathiasVP/fix-join-order-in-http-string-literal-charpred
...
C++: Fix join-order in `HttpStringLiteral` charpred
2021-12-17 11:21:38 +01:00
Arthur Baars
96aef9f63f
Merge pull request #7393 from aibaars/ruby-simple-parameter-not-expr
...
Ruby: SimpleParameter should not be an Expr
2021-12-17 10:41:43 +01:00
Asger Feldthaus
89775428b4
JS: Autoformat
2021-12-17 10:32:02 +01:00
Asger Feldthaus
3e6389cad6
JS: Bump extractor version string
2021-12-17 10:32:00 +01:00
Asger Feldthaus
95a93fe033
JS: Change note
2021-12-17 10:31:50 +01:00
Asger Feldthaus
e2c6dd7d56
JS: Recognize {{& ... }} as an XSS sink
2021-12-17 10:31:50 +01:00
Asger Feldthaus
61cc84ba69
JS: Recognize leading/trailing ~ and & in mustache-tags
2021-12-17 10:31:50 +01:00
Asger Feldthaus
ce68a6d1c5
JS: Remove unneeded qualifier in static field access
2021-12-17 10:31:50 +01:00
Rasmus Wriedt Larsen
e7abe43e3e
Python: Add SSRF change-note
2021-12-17 10:04:55 +01:00
Tom Hvitved
734bfbd7ae
Merge pull request #7433 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-17 09:52:36 +01:00
Rasmus Wriedt Larsen
e309d8227c
Python: Remove debug predicate
...
Accidentally committed :|
2021-12-17 09:44:35 +01:00
Tony Torralba
6f2d91a8ad
Sinks for CloseableThreadContext
2021-12-17 09:17:04 +01:00
Mathias Vorreiter Pedersen
d840796494
C++: Fix join-order in 'phi_node' predicate.
2021-12-17 07:50:04 +00:00
github-actions[bot]
6c57cbba2b
Add changed framework coverage reports
2021-12-17 00:09:41 +00:00
Rasmus Wriedt Larsen
1d00730753
Python: Allow http[s]:// prefix for SSRF
2021-12-17 00:27:18 +01:00
Rasmus Wriedt Larsen
8d9a797b75
Python: Add tricky .format SSRF tests
2021-12-17 00:24:51 +01:00
Rasmus Wriedt Larsen
6f297f4e9c
Python: Fix SSRF sanitizer tests
...
They were very misleading before, because a sanitizer that happened
early, would remove taint from the rest of the cases by use-use flow :|
2021-12-16 23:24:08 +01:00
Rasmus Wriedt Larsen
4b5599fe17
Python: Improve full/partial SSRF split
...
Now full-ssrf will only alert if **all** URL parts are fully
user-controlled.
2021-12-16 22:48:51 +01:00
Rasmus Wriedt Larsen
cb934e17b1
Python: Adjust SSRF location to request call
...
Since that might not be the same place where the vulnerable URL part is.
2021-12-16 22:48:51 +01:00
Rasmus Wriedt Larsen
b1bca85162
Python: Add interesting test-case
2021-12-16 22:48:51 +01:00
Rasmus Wriedt Larsen
5a7efd0fee
Python: Minor adjustments to QLDoc of HTTP::Client::Request
2021-12-16 22:48:51 +01:00
Erik Krogh Kristensen
2626b0b3dc
QL: fix test workflow
2021-12-16 22:26:42 +01:00
Erik Krogh Kristensen
be076dc2c8
add Erik and Taus as QL-for-QL reviewers
2021-12-16 21:47:42 +01:00
Mathias Vorreiter Pedersen
53a1f935b7
C++: Fix join-order in 'HttpStringLiteral' charpred.
2021-12-16 17:12:50 +00:00
Chris Gavin
8fabbd697e
Merge pull request #7422 from github/todo-comment-kind
...
Add `kind` metadata to example query.
2021-12-16 16:36:15 +00:00
Chris Smowton
e3b2eed2d2
Merge pull request #7423 from github/atorralba/log4j-CVE-2021-45046
...
Java: Cover CVE-2021-45046 in the Log4jJndiInjection query
2021-12-16 16:00:45 +00:00
Nick Rolfe
dba26a92e9
Merge remote-tracking branch 'origin/main' into nickrolfe/user-controlled-bypass
2021-12-16 15:05:01 +00:00
Erik Krogh Kristensen
8eda061d2f
add dbscheme and codeql version to query hash
2021-12-16 15:49:07 +01:00
Tom Hvitved
579b58b8fa
Merge pull request #7402 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-16 15:42:10 +01:00
Arthur Baars
3ef707e358
Address comment
2021-12-16 15:38:41 +01:00
Arthur Baars
cdbd8b27d3
Ruby: SimpleParameter is not an Expr
2021-12-16 15:38:40 +01:00
Rasmus Wriedt Larsen
6ce1524192
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-12-16 15:19:37 +01:00
Chris Gavin
4a1e2ed408
Add a severity and select the correct number of columns.
2021-12-16 14:02:36 +00:00
Tom Hvitved
e9ef53c31b
Merge pull request #7390 from hvitved/ruby/deprecate-pattern-classes
...
Ruby: Deprecate `Pattern` classes
2021-12-16 14:36:13 +01:00
Tony Torralba
7d6cba77a0
Add tests
2021-12-16 13:44:01 +01:00
Tony Torralba
2e0ca6ce2b
Add stubs
2021-12-16 13:44:01 +01:00
Tony Torralba
7d70b77141
Add new sinks and taint steps
2021-12-16 13:43:58 +01:00
Chris Gavin
407c265daf
Add kind metadata to example query.
2021-12-16 12:12:36 +00:00
Michael Nebel
95d175e9e0
Merge pull request #7406 from michaelnebel/csharp-system-threading-csv
...
C#: Convert more flow summaries to CSV format.
2021-12-16 12:56:44 +01:00
Michael Nebel
d777ba8a25
C#: Cleanup private imports in LibraryTypeDataFlow.
2021-12-16 11:24:24 +01:00
Michael Nebel
a26403b359
Convert System.Tuple and friends flow to CSV format.
2021-12-16 11:20:04 +01:00
Asger Feldthaus
0e9c2377e3
JS: Use a field in RouterHandlerParameter
2021-12-16 10:26:35 +01:00
Michael Nebel
348e3b74f3
C#: Convert System.Text.Encoding flow to CSV format.
2021-12-16 10:03:12 +01:00
CodeQL CI
f274f06d9b
Merge pull request #7409 from asgerf/js/track-functions-with-methods
...
Approved by erik-krogh
2021-12-16 09:01:42 +00:00
CodeQL CI
acbf7913b2
Merge pull request #7408 from asgerf/js/trusted-types-sinks
...
Approved by esbena
2021-12-16 08:59:51 +00:00
Michael Nebel
a5c055581e
C#: Convert System.Runtime.CompilerServices.ConfiguredTaskAwaitable<>.ConfiguredTaskAwaiter flow to CSV format.
2021-12-16 09:36:39 +01:00
Michael Nebel
ddb7d722bc
C#: Convert System.Runtime.CompilerServices.TaskAwaiter<> flow to CSV format.
2021-12-16 09:36:39 +01:00
Michael Nebel
bdd44c1c46
C#: Convert System.Runtime.CompilerServices.ConfiguredTaskAwaitable flow to CSV format.
2021-12-16 09:36:39 +01:00
Michael Nebel
034d45ddc0
C#: Convert System.Threading.Tasks.TaskFactory flow to CSV format.
2021-12-16 09:36:39 +01:00
Michael Nebel
440976fe63
C#: Convert System.Threading.Tasks.Task<> flow to CSV format.
2021-12-16 09:36:39 +01:00
Michael Nebel
cde98c7799
C#: Convert System.Threading.Tasks.Task flow to CSV format.
2021-12-16 09:36:39 +01:00
Michael Nebel
90d7b94b8a
Merge pull request #7413 from hvitved/csharp/fix-test
...
C#: Fix broken `FlowSummariesFiltered` test
2021-12-16 09:31:33 +01:00
Rasmus Wriedt Larsen
1cc5e54357
Python: Add SSRF queries
...
I've added 2 queries:
- one that detects full SSRF, where an attacker can control the full URL,
which is always bad
- and one for partial SSRF, where an attacker can control parts of an
URL (such as the path, query parameters, or fragment), which is not a
big problem in many cases (but might still be exploitable)
full SSRF should run by default, and partial SSRF should not (but makes
it easy to see the other results).
Some elements of the full SSRF queries needs a bit more polishing, like
being able to detect `"https://" + user_input` is in fact controlling
the full URL.
2021-12-16 01:48:34 +01:00
github-actions[bot]
18489c0ded
Add changed framework coverage reports
2021-12-16 00:09:34 +00:00
Rasmus Wriedt Larsen
579de0c3f0
Python: Remove getResponse and do manual taint steps
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
f8fc583af3
Python: client request: getUrl => getAUrlPart
...
I think `getUrl` is a bit too misleading, since from the name, I would
only ever expect ONE result for one request being made.
`getAUrlPart` captures that there could be multiple results, and that
they might not constitute a whole URl.
Which is the same naming I used when I tried to model this a long time ago
a80860cdc6/python/ql/lib/semmle/python/web/Http.qll (L102-L111)
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
6f81685f48
Python: Add modeling of http.client.HTTPResponse
2021-12-15 21:55:04 +01:00
Rasmus Wriedt Larsen
a5bae30d81
Python: Add tests of http.client.HTTPResponse
2021-12-15 20:39:46 +01:00
Tom Hvitved
4ccf9bf67c
Address review comments
2021-12-15 19:57:27 +01:00
Tom Hvitved
8f1b2b3bb5
C#: Fix broken FlowSummariesFiltered test
2021-12-15 18:32:25 +01:00
Arthur Baars
b53e3499cb
Merge pull request #7249 from ShockwaveNN/patch-1
...
Fix ruby incorrect version in documentation
2021-12-15 18:32:24 +01:00
Asger Feldthaus
53b3581ed0
JS: Add test to stress flow through properties
2021-12-15 17:16:56 +01:00
Asger F
784991cce5
Update javascript/ql/lib/semmle/javascript/Routing.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-15 16:38:38 +01:00
Asger Feldthaus
79e6dcaf68
JS: Rename getValueAtAccessPath->getValueImplicitlyStoredInAccessPath
2021-12-15 16:37:28 +01:00
Asger Feldthaus
8aa4d8227e
JS: Rename RouteHandlerInput->RouteHandlerParameter
2021-12-15 16:32:18 +01:00
Tom Hvitved
3bc6247ad8
Merge pull request #7378 from hvitved/ruby/module-infinite-loop
...
Ruby: Prevent infinite recursion in module resolution library
2021-12-15 16:27:36 +01:00
Asger Feldthaus
218b746f6f
JS: Rename getAUseSite -> getRouteInstallation
2021-12-15 16:21:41 +01:00
Asger Feldthaus
4d85799fc7
JS: Add test for fastify-rate-limit
2021-12-15 16:18:22 +01:00
Asger Feldthaus
615b2ec539
JS: Fix handling of fastify-plugin
2021-12-15 16:04:46 +01:00
Asger Feldthaus
b226f767ad
JS: Fix tracking of fastify server instance
2021-12-15 16:04:45 +01:00
Asger Feldthaus
0ca9feb854
JS: Always treat routers as resuming dispatch
2021-12-15 16:01:59 +01:00
Asger F
1b20506947
Update javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-15 16:00:19 +01:00
Asger Feldthaus
995e33158f
JS: Add test for res.locals flow to template
2021-12-15 16:00:19 +01:00
Asger Feldthaus
04bdba85ea
JS: Shift line numbers in test expectations
2021-12-15 16:00:19 +01:00
Asger F
c1bb40f439
Update javascript/ql/lib/semmle/javascript/frameworks/Express.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-15 16:00:19 +01:00
Asger Feldthaus
b2016bddac
JS: Merge concepts of client/database in MongoDB model
2021-12-15 16:00:19 +01:00
Geoffrey White
b142a79a35
C++: Remove unnecessary additional taint step.
2021-12-15 14:35:54 +00:00
Tom Hvitved
c6696adfde
Ruby: Add test case that would make old module resolution library diverge
2021-12-15 15:18:42 +01:00
Tom Hvitved
2187994f5c
Ruby: Prevent infinite recursion in module resolution library
2021-12-15 15:15:19 +01:00
Geoffrey White
f82683cdf4
C++: Clean up QLDoc.
2021-12-15 14:08:43 +00:00
Geoffrey White
4891a649a2
C++: Newlines.
2021-12-15 13:52:47 +00:00
Arthur Baars
7ddfc00655
Merge branch 'main' into patch-1
2021-12-15 14:52:35 +01:00
Mathias Vorreiter Pedersen
8208f92f59
An alternative design for 'cpp/cleartext-transmission'.
2021-12-15 13:52:15 +00:00
Tony Torralba
7e644d8d7b
Merge pull request #6098 from atorralba/atorralba/entrypoint-field-steps
...
Java: Preserve taint on field-read-steps on entrypoint types
2021-12-15 14:51:38 +01:00
Erik Krogh Kristensen
76dcfd479e
more specific search path for dataset measure job
2021-12-15 14:36:43 +01:00
Erik Krogh Kristensen
133c496b94
Merge branch 'main' into erik-krogh/publish-ql-for-ql
2021-12-15 14:34:04 +01:00
Erik Krogh Kristensen
4beaceec68
QL: fix Buildins/Builtins typo
2021-12-15 14:26:58 +01:00
Erik Krogh Kristensen
fb979231f3
QL: merge the .codeqlmanifest.json file in the root
2021-12-15 14:22:40 +01:00
Erik Krogh Kristensen
0ac3e5c3ad
Merge QL for QL into github/codeql
2021-12-15 14:19:53 +01:00
Erik Krogh Kristensen
8d91ba2a6e
QL: fix Esbens workflow comments
2021-12-15 14:07:36 +01:00
Erik Krogh Kristensen
77cb822907
QL: fix search path for dataset measure
2021-12-15 13:34:33 +01:00
Tony Torralba
c1e4c05aa2
Update change note to new format
2021-12-15 13:08:34 +01:00
Tony Torralba
e2022f467c
Update java/ql/lib/semmle/code/java/dataflow/internal/TaintTrackingUtil.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-12-15 13:00:16 +01:00
Tony Torralba
a3b25f0eb5
Don't consider subtypes of fields
2021-12-15 13:00:16 +01:00
Tony Torralba
47002a3bd7
Fix test
2021-12-15 13:00:16 +01:00
Tony Torralba
1426c5b406
Consider parameterized types
2021-12-15 13:00:16 +01:00
Tony Torralba
7ce9b04941
Add change note
2021-12-15 13:00:15 +01:00
Tony Torralba
5e80044f11
Preserve taint on field-read-steps on entrypoint types
2021-12-15 13:00:15 +01:00
Asger Feldthaus
e64a6dc12a
JS: Add qldoc
2021-12-15 12:47:23 +01:00
Erik Krogh Kristensen
faaa74b1cd
QL: move .git files into the ql/ folder
2021-12-15 12:25:08 +01:00
Erik Krogh Kristensen
24c2578540
QL: cache query compilation
2021-12-15 12:25:08 +01:00
Erik Krogh Kristensen
5d93309ada
QL: call the product QL for QL (because it rolls nicely).
...
and update the readme.
2021-12-15 12:25:06 +01:00
Erik Krogh Kristensen
d89c41bae4
QL: update the readme
2021-12-15 12:24:51 +01:00
Asger Feldthaus
43ec721a87
JS: Add link to MDN docs for trusted types
2021-12-15 11:52:58 +01:00
Geoffrey White
9363d64166
Merge pull request #7395 from MathiasVP/fix-fp-in-pointless-self-comparison
...
C++: Fix FP in `cpp/comparison-of-identical-expressions`
2021-12-15 10:47:57 +00:00
Mathias Vorreiter Pedersen
65c301c39f
Update cpp/ql/test/query-tests/Likely Bugs/Arithmetic/BadAdditionOverflowCheck/templates.cpp
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2021-12-15 09:22:41 +00:00
Michael Nebel
0e7fdbeeab
Merge pull request #7384 from michaelnebel/csharp-mad-xml
...
C#: Convert XML related flow summaries to CSV and fix flow summaries test cases.
2021-12-15 09:51:20 +01:00
Harry Maclean
062f7fe390
Merge pull request #7340 from github/hmac/private-methods
...
Ruby: handle private module methods
2021-12-15 21:07:49 +13:00
Harry Maclean
a32711245f
Ruby: Further speed up private method modelling
2021-12-15 17:38:52 +13:00
Dave Bartolomeo
712d71856b
Merge pull request #7401 from github/release-prep/2.7.4
...
Release preparation for version 2.7.4
2021-12-14 16:42:33 -05:00
github-actions[bot]
59da2cdf69
Release preparation for version 2.7.4
2021-12-14 21:35:09 +00:00
Tom Hvitved
15caaa7ad6
Merge pull request #7377 from hvitved/csharp/overriable-class
...
C#: Introduce class `Overridable`
2021-12-14 20:01:12 +01:00
Dave Bartolomeo
6664a3814a
Merge pull request #7398 from github/dbartol/fix-change-notes
...
Fix change notes
2021-12-14 13:53:08 -05:00
Alex Ford
5fa6ecc5f1
Ruby: Model what is written to the log from stdlib Logger methods
2021-12-14 17:39:12 +00:00
Dave Bartolomeo
fa40d59332
Move older change notes to old-change-notes
...
Now that change notes are per-package, new change notes should be created in the `change-notes` folder under the affected pack (e.g., `cpp/ql/src/change-notes` for C++ query change notes. I've moved all of the change note files that were added before we started publishing them in packs to an `old-change-notes` directory under each language, to reduce the temptation to add new change notes there.
I'm working on a document to describe how and when to create change notes for packs separately.
2021-12-14 12:35:04 -05:00
Mathias Vorreiter Pedersen
310353060e
C++: Also fix the FP in 'cpp/comparison-canceling-subexpr'.
2021-12-14 17:08:10 +00:00
Dave Bartolomeo
a62f181d42
Move new change notes to appropriate packs
2021-12-14 12:05:15 -05:00
Mathias Vorreiter Pedersen
b2082cc3da
C++: Fix false positive in 'cpp/cpp/comparison-of-identical-expressions'.
2021-12-14 16:39:25 +00:00
Mathias Vorreiter Pedersen
9d14a85f3f
C++: Add false positive.
2021-12-14 16:38:19 +00:00
Erik Krogh Kristensen
dc9187778b
QL: simplify the build/analyze workflow into a single workflow
2021-12-14 17:29:35 +01:00
Alex Ford
861ae856b3
Merge pull request #7391 from github/ruby/callnode-more-predicates
...
Ruby: Add `getBlock` and `getNumberOfArguments` predicates to `DataFlow::CallNode`
2021-12-14 16:10:13 +00:00
Erik Krogh Kristensen
f5788b9441
QL: adjust remaining workflows to work in the QL folder
2021-12-14 17:03:26 +01:00
Michael Nebel
edf472b9ed
C#: Convert System.Xml.XmlReader flow to CSV format.
2021-12-14 16:01:40 +01:00
Erik Krogh Kristensen
fdb15d6073
QL: remove workflow that ran CodeQL with a published pack
2021-12-14 15:57:09 +01:00
Erik Krogh Kristensen
633597cc90
QL: remove the nightly ql-for-ql job
2021-12-14 15:57:09 +01:00
Erik Krogh Kristensen
b73b60d431
QL: remove the .devcontainer
2021-12-14 15:57:09 +01:00
Erik Krogh Kristensen
08b06422ff
QL: remove repo-tests
2021-12-14 15:57:09 +01:00
Michael Nebel
a04920f241
C#: Convert System.Xml.XmlDocument flow to CSV format.
2021-12-14 15:56:55 +01:00
Michael Nebel
4bf2a514ac
C#: XmlDocument only has instance Load methods.
2021-12-14 15:55:28 +01:00
Michael Nebel
376ee33707
C#: Convert System.Xml.XmlNode flow to CSV format.
2021-12-14 15:55:23 +01:00
Michael Nebel
4a71aa2165
C#: Update the flow summaries test expected output.
2021-12-14 15:53:16 +01:00
Michael Nebel
fc3299801b
C#: Fix issue with summary tests, such that the output is compatiable with flow summary interpreter.
2021-12-14 15:53:16 +01:00
Michael Nebel
2cac729598
C#: Convert System.Xml.XmlNamedNodeMap flow to CSV format.
2021-12-14 15:53:11 +01:00
Michael Nebel
c5728b2951
Merge pull request #7389 from michaelnebel/csharp-mad-io
...
C#: Convert flow summaries to CSV for System.IO.*
2021-12-14 15:49:08 +01:00
Bas van Schaik
80b9ccff2b
Merge pull request #7388 from github/sj-patch-log4j-query-description
...
Clarify Log4jJndiInjection.ql query name and help
2021-12-14 14:32:17 +00:00
Tom Hvitved
e882cdaca4
Ruby: Add missing getCallable() for nested destructured parameters
2021-12-14 15:04:40 +01:00
Tom Hvitved
10b2a0a54a
Ruby: Add test for nested destructured parameters
2021-12-14 15:04:40 +01:00
Tom Hvitved
9ea8b20e77
Ruby: Deprecate Pattern classes
2021-12-14 15:04:40 +01:00
Mathias Vorreiter Pedersen
dd6085f0a6
C++/C#: Sync identical files.
2021-12-14 13:56:39 +00:00
Mathias Vorreiter Pedersen
3da1c2bde1
C++: Fix join-order in 'isArgumentForParameter'.
2021-12-14 13:56:31 +00:00
Tony Torralba
68a0efaf0c
Formatting
2021-12-14 14:53:38 +01:00
Erik Krogh Kristensen
8eac1dcf15
QL: move .vscode folder inside the ql subfolder
2021-12-14 14:39:03 +01:00
Erik Krogh Kristensen
56a8cdb171
move files and folder, except dotfiles, into a ql subfolder
2021-12-14 14:34:53 +01:00
Erik Krogh Kristensen
d06ac78e4d
QL: move files and folder, except dotfiles, into a ql subfolder
2021-12-14 14:34:53 +01:00
Alex Ford
3262a14f22
Ruby: use DataFlow::CallNode#getBlock to remove a cast
2021-12-14 13:23:38 +00:00
Tom Hvitved
b524a6104d
Merge pull request #7368 from github/hvitved-patch-1
...
Update creating-codeql-databases.rst
2021-12-14 14:12:21 +01:00
Michael Nebel
b921fc62b8
C#: Some manual modifications to the System.IO flow summaries.
2021-12-14 14:02:25 +01:00
Alex Ford
f3dcccb64b
Ruby: Add getBlock and getNumberOfArguments predicates to DataFlow::CallNode
2021-12-14 12:58:15 +00:00
Michael Nebel
c1cf44b342
C#: Remove unneeded imports.
2021-12-14 13:47:57 +01:00
Michael Nebel
16bcb4ec86
C#: Convert System.IO.Path flow to CSV format.
2021-12-14 13:44:27 +01:00
Michael Nebel
ca5c6923da
C#: Convert System.IO.Compression flow to CSV format.
2021-12-14 13:37:08 +01:00
Bas van Schaik
d85ed9ea7a
Clarify Log4jJndiInjection.ql query help
2021-12-14 12:32:36 +00:00
Asger Feldthaus
7e947b2a65
JS: Use return value of trusted type policy callback as a sink
2021-12-14 13:28:46 +01:00
Michael Nebel
45e416b87b
C#: Convert System.IO.Stream flow to CSV format.
2021-12-14 13:28:25 +01:00
Michael Nebel
dd1ae0bbb5
C#: Convert System.IO.MemoryStream flow to CSV format.
2021-12-14 13:23:26 +01:00
Chris Smowton
85ff57bae6
Merge pull request #7354 from atorralba/atorralba/log4j-rce-experimental-query
...
Java: Experimental query for Log4j JNDI Injection
2021-12-14 11:32:13 +00:00
Tom Hvitved
a9c438924e
C#: Introduce class Overridable
...
The class `Overridable` generalizes the existing class `Virtualizable` by also
including accessors. This allows for quite a bit of code to be simplified.
2021-12-14 10:52:13 +01:00
Tom Hvitved
8d607e6251
Docs: Add paragraph about C# shared compilation
2021-12-14 10:40:07 +01:00
Tom Hvitved
37d76f5e49
Merge pull request #6791 from hvitved/csharp/update-nuget-packages
...
C#: Update nuget packages
2021-12-14 10:20:15 +01:00
Mathias Vorreiter Pedersen
6fda5e8f5b
Merge pull request #7272 from github/redsun82/cpp-overrunning-write-precision-split
...
C++: refactor buffer overwrite queries with estimate reasons
2021-12-14 08:50:30 +00:00
Ian Wright
1c79d1f985
Merge pull request #7352 from github/esbena/atm-endpoint-polish
...
ATM Endpoint filtering improvements
2021-12-14 08:19:23 +00:00
Paolo Tranquilli
0d7d60eebd
C++: add small docstring fix
2021-12-14 08:15:45 +00:00
Tamás Vajk
81dedfe22f
Merge pull request #7381 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-14 08:42:43 +01:00
Tony Torralba
aee617f911
Autoformat
2021-12-14 08:40:30 +01:00
github-actions[bot]
3c57602653
Add changed framework coverage reports
2021-12-14 00:09:54 +00:00
Harry Maclean
f21948d0ca
Ruby: Speed up private method modelling
2021-12-14 11:10:38 +13:00
Esben Sparre Andreasen
1949a4e59a
autoformat
2021-12-13 22:21:52 +01:00
Erik Krogh Kristensen
de4458346f
Merge pull request #7344 from SZFsir/main
...
JS: Improve inter-procedural type inference for FunctionExpr
2021-12-13 21:58:53 +01:00
Tony Torralba
1b761b3d12
Apply suggestions from code review
2021-12-13 20:38:06 +01:00
Tony Torralba
ff2f5a5f91
Apply suggestions from code review
...
Co-authored-by: Bas van Schaik <5082246+sj@users.noreply.github.com >
2021-12-13 19:44:38 +01:00
Tony Torralba
d2dc19900f
Apply suggestions from code review
...
Co-authored-by: Bas van Schaik <5082246+sj@users.noreply.github.com >
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-12-13 19:39:52 +01:00
Geoffrey White
041c2c77b3
C++: Separate two test cases slightly so that we get clearer test coverage of the interprocedural / multi-path cases.
2021-12-13 18:18:29 +00:00
Nick Rolfe
dc27089714
Merge pull request #7375 from github/nickrolfe/cargo_update
...
Ruby: update crate versions
2021-12-13 18:16:29 +00:00
Dave Bartolomeo
7732c0885f
Merge pull request #7374 from aeisenberg/aesenberg/upgrades-semver
...
Fix semver for upgrades references
2021-12-13 13:06:59 -05:00
Sergey
0f0bd34958
Update IncorrectPrivilegeAssignment.ql
2021-12-13 20:35:13 +03:00
Andrew Eisenberg
0669ef505e
Fix semver for upgrades references
...
Ensure the version range is flexible enough to handle
future version changes.
2021-12-13 09:03:33 -08:00
Aditya Sharad
372f099850
Merge pull request #7323 from adityasharad/atm/perf-debugging-std-lib
...
JS: Performance improvements to libraries using regex matching
2021-12-13 08:53:11 -08:00
Nick Rolfe
b18f7a9bd7
Ruby: update crate versions
2021-12-13 15:37:35 +00:00
Rasmus Wriedt Larsen
cf2ee0672f
Python: Model requests Responses
2021-12-13 15:09:46 +01:00
Michael Nebel
c0b61d7f73
Merge pull request #7370 from michaelnebel/csharp-mad-textreader
...
C#: Flow summaries for virtual members in abstract classes should also apply to overrides.
2021-12-13 15:00:54 +01:00
Rasmus Wriedt Larsen
35cba17642
Python: Consider taint of client http requests
2021-12-13 14:56:16 +01:00
Rasmus Wriedt Larsen
b68d280129
Python: Add modeling of requests
2021-12-13 14:56:16 +01:00
Alex Ford
124aac23c6
Merge pull request #7371 from github/ruby/comment-new-syntax
...
Ruby: use Ruby object instantiation syntax in a comment
2021-12-13 13:23:03 +00:00
Rasmus Wriedt Larsen
1ff56d5143
Python: Add tests of requests
...
Also adjusts test slightly. Writing
`clientRequestDisablesCertValidation=False` to mean that certificate
validation was disabled by the `False` expression is just confusing, as
it easily reads as _certificate validate was NOT disabled_ :|
The new one ties to each request that is being made, which seems like
the right setup.
2021-12-13 14:07:32 +01:00
Alex Ford
4ae92667e1
Ruby: use Ruby object instantiation syntax in a comment
2021-12-13 12:54:45 +00:00
Michael Nebel
ba23393c0d
C#: Update test as we now also implicitly gets flow summary for StreamReader.
2021-12-13 13:51:53 +01:00
Michael Nebel
a6eba04793
C#: Convert System.IO.TextReader flow to CSV format.
2021-12-13 13:51:18 +01:00
Esben Sparre Andreasen
c66d29998e
update test output for additional DatabaseAccesses
2021-12-13 13:42:28 +01:00
Michael Nebel
88bb8a2704
C#: Update flow summaries test cases.
2021-12-13 13:14:49 +01:00
Michael Nebel
d699ca9aa8
C#: Flow summaries should also apply for overides or virtual members in abstract classes.
2021-12-13 13:09:40 +01:00
Paolo Tranquilli
5ed7056707
C++: remove deprecation from getMaxData
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
3734e1ca4f
C++: auto format
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
06acaef43e
C++: fix deprecation comments in BufferWrite
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
a089898220
C++: remove reason from OverrunWrite output
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
85de6dd667
C++: make BufferWrite changes backward compatible
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
88d65b8fcb
C++: postpone change-notes addition
...
We can add it later when more consistent changes to the queries are made
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
2020786fb0
C++: fix format
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
b0242dc55b
C++: more idiomatic BufferWriteEstimationReason
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
160635ba3c
C++: add missing docs for a toString predicate
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
a6cbe6f94c
C++: add missing change note and docs
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
fb03561a31
C++: add docstrings to Printf and BufferWrite
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
aa68c51797
C++: preserve Printf and BufferWrite API
2021-12-13 11:28:02 +00:00
Paolo Tranquilli
598f283715
C++: add reason to buffer write estimations
2021-12-13 11:28:02 +00:00
Tamas Vajk
26194be8b6
Add workaround for equal lambda parameter symbols with different hashcodes
2021-12-13 11:59:24 +01:00
Michael Nebel
7ff2ee695d
Merge pull request #7348 from michaelnebel/csharp-mad-as-csv-json
...
C#: Convert flow summaries for JSon.NET
2021-12-13 11:57:55 +01:00
Rasmus Wriedt Larsen
7bf285a52e
Python: Alter disablesCertificateValidation to fit our needs
...
For the snippet below, our current query is able to show _why_ we
consider `var` to be a falsey value that would disable SSL/TLS
verification. I'm not sure we're going to need the part that Ruby did,
for being able to specify _where_ the verification was removed, but
we'll see.
```
requests.get(url, verify=var)
```
2021-12-13 11:37:12 +01:00
JrXnm
efc9e67ec2
Update javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll
...
Fix multiple declare may mismatch issue
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-13 18:36:06 +08:00
JrXnm
fad95d8935
Update javascript/ql/lib/semmle/javascript/dataflow/internal/InterProceduralTypeInference.qll
...
Commit coding style suggestion
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-13 18:32:11 +08:00
Rasmus Wriedt Larsen
08f6d1ab80
Python: Clearer sourceType for client response body
2021-12-13 11:24:38 +01:00
Rasmus Wriedt Larsen
5de79b4ffe
Python: Add HTTP::Client::Request concept
...
Taken from Ruby, except that `getURL` member predicate was changed to
`getUrl` to keep consistency with the rest of our concepts, and stick
to our naming convention.
2021-12-13 11:09:09 +01:00
Michael Nebel
f32d464c0f
C#: Ensure bi-directional import for External flow.
2021-12-13 10:50:49 +01:00
Michael Nebel
327cf444f4
C#: Convert Newtonsoft.JSon.Linq.JObject and Newtonsoft.JSon.Linq.JToken flow to CSV format.
2021-12-13 10:50:49 +01:00
Michael Nebel
f3c0eadbce
C#: Fix the existing callableFlow for JObject to target the inherited ToString methods from JToken.
2021-12-13 10:50:49 +01:00
Michael Nebel
58f36e4b31
C#: Convert NewtonSoft.Json.JSonSerializer flow to CSV format.
2021-12-13 10:50:49 +01:00
Michael Nebel
90e49508a3
C#: Convert Newtonsoft.Json.JsonConvert flow to CSV format.
2021-12-13 10:50:48 +01:00
Michael Nebel
a4bea05fa7
Merge pull request #7342 from michaelnebel/csharp-mad-as-csv3
...
C#: More Flow summaries in CSV format.
2021-12-13 10:32:28 +01:00
Rasmus Wriedt Larsen
1e45fa9ed4
JS/Py/Ruby: Add more CWEs to bad-tag-filter queries
...
CWE-185: Incorrect Regular Expression
The software specifies a regular expression in a way that causes data to
be improperly matched or compared.
https://cwe.mitre.org/data/definitions/185.html
CWE-186: Overly Restrictive Regular Expression
> A regular expression is overly restrictive, which prevents dangerous values from being detected.
>
> (...) [this CWE] is about a regular expression that does not match all
> values that are intended. (...)
https://cwe.mitre.org/data/definitions/186.html
From my understanding,
CWE-625: Permissive Regular Expression, is not applicable. (since this
is about accepting a regex match where there should not be a match).
2021-12-13 10:23:24 +01:00
Tom Hvitved
6f65f22db6
Update creating-codeql-databases.rst
...
Always use `/p:UseSharedCompilation=false` for `msbuild` / `dotnet build`.
2021-12-13 10:15:42 +01:00
Michael Nebel
be1e75471e
C#: Ensure bi-directional import for external flow.
2021-12-13 09:23:11 +01:00
Michael Nebel
1cab177f8a
C#: Convert System.Web.HttpUtility flow to CSV format.
2021-12-13 09:19:41 +01:00
Michael Nebel
0e0c3e3937
C#: Convert System.Web.HttpServerUtility flow to CSV format.
2021-12-13 09:19:41 +01:00
Michael Nebel
6301e726ee
C#: Update HttpServerUtility stub with HtmlEncode method and update flow summaries test.
2021-12-13 09:19:41 +01:00
Michael Nebel
1cd37dddf5
C#: Convert System.Net.WebUtility flow to CSV format.
2021-12-13 09:19:41 +01:00
Michael Nebel
07a4f5f748
C#: Update FlowSummaries test as the bogus flow summaries for the KeyValuePair default constructor has been removed.
2021-12-13 09:19:41 +01:00
Michael Nebel
679aad138e
C#: Convert System.Collections.Generic.KeyValuePair flow to CSV format.
2021-12-13 09:19:36 +01:00
Michael Nebel
42bf866fb3
C#: Convert System.Web.UI.WebControls.Textbox flow to CSV format.
2021-12-13 09:18:34 +01:00
Michael Nebel
9604ed883c
C#: Convert System.NET.IPHostEntry flow to CSV format.
2021-12-13 09:17:27 +01:00
Michael Nebel
d804893a49
C#: Convert System.Net.Cookie flow to CSV format.
2021-12-13 09:16:05 +01:00
Michael Nebel
03fb244545
C#: Convert System.Web.HttpCookie flow to CSV format.
2021-12-13 09:13:14 +01:00
Michael Nebel
a6360215f3
Merge pull request #7304 from michaelnebel/csharp-mad-as-csv2
...
C#: Convert flow summaries to CSV format.
2021-12-13 08:56:06 +01:00
Harry Maclean
0ca9852cc8
Merge pull request #7325 from github/hmac/action-controller-private-methods
...
Ruby: Don't count private methods as Rails actions
2021-12-13 20:47:22 +13:00
Harry Maclean
6223b166c2
Update test fixtures
...
At the same time, rename some classes in `private.rb` so they don't
interact with identically-named modules in `calls.rb`.
2021-12-13 16:24:25 +13:00
Harry Maclean
e1d290d4c0
Ruby: Don't count private methods as Rails actions
...
Private instance methods on ActionController classes aren't valid
request handlers. Routing to them will raise an exception.
2021-12-13 15:36:55 +13:00
Aditya Sharad
1857de1f33
JS: Speed up detection of jQuery marker comments
...
Combine two regexes into a single one.
This saves up to 5s on large databases by reducing the number
of separate scans of the comments table before regex matching.
The combined regex is slightly more permissive than the
original two, since it allows a combination of the two
matched formats. A string that matches one of the original
regexes will match the combined regex.
2021-12-10 15:30:02 -08:00
Nick Rolfe
b80a84c156
Merge pull request #7341 from github/nickrolfe/cookies
2021-12-10 19:52:23 +00:00
Aditya Sharad
6a1aea740f
JS: Avoid scanning individual comment lines to find generated code markers
...
Some subclasses of GeneratedCodeMarkerComment regex match against `getLine(_)`.
When evaluated, this results in multiple scans (one per subclass that uses it)
of all comment lines in the database, before regex matching against those lines.
To make these scans smaller, regex match against the entire comment text
without splitting them into lines.
This is achieved using `?m` (multiline) and line boundaries in the regexes.
2021-12-10 11:41:54 -08:00
Aditya Sharad
c9a87234ef
JS: Factor helper predicate to improve SensitiveWrite performance
2021-12-10 11:41:53 -08:00
Andrew Eisenberg
66c1629974
Merge pull request #7285 from github/post-release-prep-2.7.3-ddd4ccbb
...
Post-release preparation 2.7.3
2021-12-10 09:59:45 -08:00
Tony Torralba
43a10457dd
[Java] Query for Log4j JNDI Injection
2021-12-10 17:37:43 +01:00
Nick Rolfe
b6c5b4d213
Ruby: define ActionViewCookiesCall
2021-12-10 16:36:26 +00:00
yoff
d8857c7ce8
Merge pull request #7246 from tausbn/python/import-star-flow
...
Python: Support flow through `import *`
2021-12-10 16:34:32 +01:00
Henry Mercer
a46787ea07
Merge pull request #7351 from github/henrymercer/js-atm-heuristic-sinks-improvements
...
JS: Improve handling of heuristic sinks in endpoint filters
2021-12-10 14:56:45 +00:00
Rasmus Wriedt Larsen
bd9b96e154
Merge pull request #7331 from tausbn/python-fix-bad-callsite-points-to-join
...
Python: Fix bad `callsite_points_to` join
2021-12-10 15:39:49 +01:00
Rasmus Wriedt Larsen
8ee020f79c
Merge pull request #7332 from tausbn/python-fix-bad-scope-entry-points-to-join
...
Python: Fix bad `scope_entry_points_to` join
2021-12-10 15:33:13 +01:00
Esben Sparre Andreasen
13288be7fc
make ATM anti sink model for dojo.require
2021-12-10 15:07:51 +01:00
Esben Sparre Andreasen
9ffc02944d
add file write model for express-fileupload mv
2021-12-10 15:05:34 +01:00
Esben Sparre Andreasen
cfd2dcffa0
recognize more modelled database accesses
2021-12-10 14:54:59 +01:00
Esben Sparre Andreasen
b0f6cf1491
expose more marsdb calls as database accesses
2021-12-10 13:46:19 +01:00
Esben Sparre Andreasen
9df1ac7f75
treat redis and ioredis usage as database access
2021-12-10 13:26:26 +01:00
Esben Sparre Andreasen
10498c3643
treat jQuery as fully modelled
2021-12-10 12:51:45 +01:00
Nick Rolfe
a4da528812
Ruby: query to find user-controlled bypass of sensitive actions
2021-12-10 11:41:09 +00:00
Esben Sparre Andreasen
a1ee900f50
treat Base64 manipulations as non-sinks
2021-12-10 12:37:44 +01:00
Henry Mercer
6e167040f5
Merge pull request #7307 from adityasharad/atm/perf-debugging
...
JS/ATM: Various compilation fixes and performance improvements
2021-12-10 11:00:27 +00:00
Tom Hvitved
657cd89286
Merge pull request #7347 from hvitved/cfg/more-consistency-tests
...
Shared CFG: Add two more consistency queries
2021-12-10 10:50:39 +01:00
Tamas Vajk
d2822c2acc
Rework semantic model caching
2021-12-10 10:42:30 +01:00
Tamas Vajk
704a5e4bbf
Revert "C#: Avoid NPE in Parameter.Populate"
...
This reverts commit 08eb7e207d1e12c9578e07ee0a1d79bf6b62f60f.
2021-12-10 10:42:30 +01:00
Tom Hvitved
8ccbcf1bf8
C#: Avoid NPE in Parameter.Populate
2021-12-10 10:42:29 +01:00
Tom Hvitved
563b771163
C#: Update expected test output
2021-12-10 10:42:29 +01:00
Tom Hvitved
0a0657ada1
C#: Adapt to new Roslyn representation of implicit Main methods
2021-12-10 10:42:29 +01:00
Tom Hvitved
1c230d0888
C#: Update nuget packages
2021-12-10 10:42:29 +01:00
Michael Nebel
afa58f5676
C#: Ensure bi-directional importing of external flow for System.Text.
2021-12-10 10:28:35 +01:00
Arthur Baars
13f7fd88f1
Merge pull request #7283 from aibaars/ruby-pattern-matching-cfg
...
Ruby: pattern matching: CFG
2021-12-10 10:24:38 +01:00
Anders Schack-Mulligen
634ed91904
Merge pull request #7346 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-10 10:12:23 +01:00
Tom Hvitved
cf42427f54
Merge pull request #7321 from hvitved/csharp/cil/unique-type
...
C#: Avoid CIL instructions with multiple types
2021-12-10 09:58:06 +01:00
Tom Hvitved
f7f3890b40
Merge pull request #7320 from hvitved/csharp/unknown-type
...
C#: Populate `UnknownType`
2021-12-10 09:57:55 +01:00
Tom Hvitved
70f76d06c7
Shared CFG: Add two more consistency queries
2021-12-10 09:56:50 +01:00
Tom Hvitved
45c0d4a3b2
Merge pull request #7343 from hvitved/cfg/consistency-test
...
Shared CFG: Add another consistency test
2021-12-10 09:49:05 +01:00
Asger Feldthaus
b336c29283
JS: Track functions with methods
2021-12-10 09:38:29 +01:00
Asger Feldthaus
4ef2a5f4f1
JS: Add test
2021-12-10 09:38:29 +01:00
github-actions[bot]
7e5bfa5aa0
Add changed framework coverage reports
2021-12-10 00:09:34 +00:00
Aditya Sharad
271b23ba8f
JS: Expand explanatory comment about version placeholders
2021-12-09 13:43:08 -08:00
Aditya Sharad
0c3daabc51
JS: Fix broken regex matching predicate
...
The receiver string and the regex were in the wrong order,
leading to test failures when looking for matching comments.
2021-12-09 13:42:33 -08:00
Chris Smowton
753d886b0d
Merge pull request #6319 from haby0/java/MyBatisSqlInjection
...
[Java] CWE-089 MyBatis Mapper Sql Injection
2021-12-09 19:57:18 +00:00
Taus
6d247bfdf9
Merge pull request #7330 from tausbn/python-fix-bad-adjacentuseuse-join
...
Python: Fix bad join in SSA
2021-12-09 20:55:45 +01:00
Erik Krogh Kristensen
e7209d1ee1
Merge pull request #7216 from erik-krogh/ts45
...
JS: Add support for TypeScript 4.5
2021-12-09 20:33:52 +01:00
Geoffrey White
23d4d035e5
C++: Different approach to sensitive exprs.
2021-12-09 18:33:50 +00:00
Geoffrey White
65f4ccce28
C++: Another test case.
2021-12-09 18:20:52 +00:00
Chris Smowton
75f3ebf051
Fix OTHER XML tag
2021-12-09 17:55:03 +00:00
Chris Smowton
9f69c75c50
Fix XML tag
2021-12-09 17:44:49 +00:00
Chris Smowton
2cd70b96cd
Fix doctype
2021-12-09 17:44:08 +00:00
JrXnm
1a1a7413c2
JS: Improv inter-procedural type inference for FunctionExpr
2021-12-10 01:09:49 +08:00
Michael Nebel
d60b90acd3
C#: Manual update of System.String and System.Convert flow summaries.
2021-12-09 16:34:42 +01:00
Michael Nebel
e879ca7a3b
C#: Convert System.Convert flow to CSV format.
2021-12-09 16:34:42 +01:00
Michael Nebel
15b4b218c8
C#: Convert System.Nullable<> flow to CSV format.
2021-12-09 16:34:42 +01:00
Michael Nebel
bbab0e582a
C#: Convert System.Lazy<> flow to CSV format.
2021-12-09 16:34:42 +01:00
Michael Nebel
9e61dfb41f
C#: Convert System.Text.StringBuilder flow to CSV format.
2021-12-09 16:34:41 +01:00
Michael Nebel
5a26346ba5
C#: Allow the use of pointer types in CSV validation.
2021-12-09 16:34:41 +01:00
Michael Nebel
5376eb89b3
C#: Convert System.String flow to CSV format.
2021-12-09 16:34:41 +01:00
Michael Nebel
df482a9603
Merge pull request #7314 from michaelnebel/csharp-stubs-dataflow-global
...
C#: Update tests dataflow/global tests to use stubs.
2021-12-09 16:31:39 +01:00
Chris Smowton
470256da85
Copyedit
2021-12-09 15:10:07 +00:00
Tony Torralba
8bba3eb2b6
Merge pull request #6823 from atorralba/atorralba/android-notification-models
...
Android: Add models for `android.app.Notification` builders
2021-12-09 16:01:44 +01:00
Henry Mercer
f08f07e19e
JS: Improve handling of heuristic sinks in endpoint filters
...
Previously heuristic sinks were always included, to avoid us filtering
them out due to not being an argument to an external library call.
In this commit we move the argument to an external library call
filtering to the query-specific endpoint filters.
This lets us filter out heuristic sinks if they match one of the other
endpoint filters, reducing FPs.
2021-12-09 15:00:54 +00:00
Chris Smowton
d0a19fffee
Copyedit
2021-12-09 14:58:29 +00:00
Tom Hvitved
7e99426141
C#: Address review comments
2021-12-09 15:51:54 +01:00
Tom Hvitved
2bf5966fe3
C#: Address review comment
2021-12-09 15:44:43 +01:00
Arthur Baars
fd4915a564
Ruby: CFG: add default implementation for getAnInnerCompatibleCompletion
2021-12-09 15:23:26 +01:00
Arthur Baars
9d288c90a5
Ruby: CFG: better return type for getAMatchingSuccessorType
2021-12-09 15:23:26 +01:00
Arthur Baars
a7b3f1370f
Ruby: CFG: add test case
2021-12-09 15:23:26 +01:00
Arthur Baars
d0aa307bd3
Ruby: CFG: fix multiple successors failure for default parameters
2021-12-09 15:23:26 +01:00
Tom Hvitved
b887165005
Ruby: Code review suggestions
2021-12-09 15:23:26 +01:00
Arthur Baars
3689481c18
Ruby: CFG: make Completion.isValidFor work for getSugared AST nodes
2021-12-09 15:23:26 +01:00
Arthur Baars
660e52f2bf
Ruby: CFG: make VariableReferencePattern a PreOrder node
2021-12-09 15:23:26 +01:00
Arthur Baars
e9e3ef3ea2
Ruby: 'self' is not really a local variable
2021-12-09 15:23:26 +01:00
Arthur Baars
799c945299
Ruby: fix CFG for AsPattern
2021-12-09 15:23:26 +01:00
Arthur Baars
95f8f85aa2
Ruby: fix allowed completions for desugared CasePatterns
2021-12-09 15:23:26 +01:00
Arthur Baars
aacba0b522
Ruby: CFG: add test cases for pattern matching
2021-12-09 15:23:26 +01:00
Arthur Baars
513fe09dbb
Treat class names in array/find/hash patterns as sub-patterns
2021-12-09 15:23:26 +01:00
Arthur Baars
d17c055139
CFG
2021-12-09 15:23:25 +01:00
Arthur Baars
44a615839d
Add test case with rest variable and no prefix elements
2021-12-09 15:23:25 +01:00
Arthur Baars
f08eb8e616
Revert "Temporarily allow CFG inconsistencies"
...
This reverts commit dca1e34cd8
2021-12-09 15:23:25 +01:00
Michael Nebel
69f42b9c74
C#: Update remaining tests.
2021-12-09 15:21:08 +01:00
Tony Torralba
38250b0821
Remove unnecessary implicit read step
2021-12-09 15:18:38 +01:00
Tom Hvitved
cbc96dba8a
Shared CFG: Add another consistency test
...
Finds nodes with multiple normal successors, where one is the special simple
successor. For example, this would flag a node that has both a "simple" and
a "true" successor.
2021-12-09 15:08:19 +01:00
Tony Torralba
522a4bb9fa
Propagate extras through build methods
2021-12-09 14:56:52 +01:00
yoff
8e11c2c476
Merge pull request #7259 from RasmusWL/even-more-path-injection-sinks
...
Python: Add more path-injection sinks from `os` and `tempfile` modules
2021-12-09 14:46:41 +01:00
Michael Nebel
992801b7cb
C#: Update GetAnOutNode test.
2021-12-09 13:55:04 +01:00
Tom Hvitved
9ffa236c51
Merge pull request #7288 from hvitved/cfg/enclosing-scope
...
Shared CFG: Include CFG scope in `TElementNode`
2021-12-09 13:39:48 +01:00
Tony Torralba
c0c40cc05b
Remove synthetic fields
2021-12-09 13:34:41 +01:00
Tony Torralba
3a3c7fc59e
Fix stub
2021-12-09 13:34:41 +01:00
Tony Torralba
f209ff4f76
Use synthetic fields to improve taint precision
2021-12-09 13:34:39 +01:00
Tony Torralba
b7f7c5ba20
Change format of fluent models to make review easier
2021-12-09 13:33:19 +01:00
Tony Torralba
f63ffb0630
Add models for Notification builders
2021-12-09 13:33:17 +01:00
Tom Hvitved
069cf9d17f
C#: Exclude stubs in GetAnOutNode.ql test
2021-12-09 13:33:14 +01:00
Tom Hvitved
cbd21edc99
C#: Override File::isFromSource in tests to exclude stubs
2021-12-09 13:33:14 +01:00
Michael Nebel
2f85735b6a
C#: Use stubs instead of dll's in the dataflow global tests.
2021-12-09 13:25:11 +01:00
Tom Hvitved
69ba2e6f8c
Merge pull request #7337 from michaelnebel/csharp-synthetic-field
...
C#: Introduce synthetic fields and use them in Task<>.
2021-12-09 13:18:44 +01:00
Nick Rolfe
d46564caa6
Ruby: treat ActionController#cookies as a remote flow source
2021-12-09 12:13:17 +00:00
Nick Rolfe
f6a8b9a7e5
Ruby: add cookies call to frameworks test
2021-12-09 12:07:04 +00:00
Taus
b871342e83
Python: A small further performance improvement
...
Unrolling the transitive closure had slightly better performance here.
Also, we exclude names of builtins, since those will be handled by a
separate case of `isDefinedLocally`.
2021-12-09 10:29:55 +00:00
Michael Nebel
13347cd102
C#: Add Ql docs to synthetic fields.
2021-12-09 10:34:31 +01:00
Michael Nebel
9f4b965202
C#: Update the flow summaries produced for Task<> after introduction of synthetic fields.
2021-12-09 10:11:49 +01:00
Michael Nebel
d70d1fbf81
C#: Add support for the use of synthetic fields in flow summary CSV.
2021-12-09 10:11:48 +01:00
Michael Nebel
a43704ab43
C#: Update dataflow/global tests based on synthetic fields.
2021-12-09 10:11:48 +01:00
Michael Nebel
063398f24d
C#: Use synthetic fields for Task instead of referring to private fields.
2021-12-09 10:11:48 +01:00
Michael Nebel
60f3ff8c33
C#: Introduce type for Synthetic fields.
2021-12-09 10:11:48 +01:00
Harry Maclean
8df5aaa797
Ruby: Model private class methods
...
`Module#private_class_method` takes a symbol representing the name of a
method in the current module scope and makes that module private. This
is similar to `private`, but applies only to class (singleton) methods.
Unlike `private`, it must be called with an argument, and does not
change the ambient visibility for any subsequent method definitions.
class Foo
def public
end
def private1
end
private_class_method :private1
# This alternate form works because method definition
# returns its name as a symbol:
private_class_method def private2
end
end
2021-12-09 18:15:25 +13:00
Harry Maclean
e811ba1150
Ruby: handle private module methods
...
`private` can be used in both classes and modules.
2021-12-09 18:13:29 +13:00
haby0
8bcbf8e30f
rename isMybatisCollectionTypeSqlInjection
2021-12-09 09:16:33 +08:00
Taus
8517eff0f7
Python: Fix bad performance
...
A few changes, all bundled together:
- We were getting a lot of magic applied to the predicates in the
`ImportStar` module, and this was causing needless re-evaluation.
To address this, the easiest solution was to simply cache the entire
module.
- In order to separate this from the dataflow analysis and make it
dependent only on control flow, `potentialImportStarBase` was changed
to return a `ControlFlowNode`.
- `isDefinedLocally` was defined on control flow nodes, which meant we
were duplicating a lot of tuples due to control flow splitting, to no
actual benefit.
Finally, there was a really bad join in `isDefinedLocally` that was
fixed by separating out a helper predicate. This is a case where we
could use a three-way join, since the join between the `Scope`, the
`name` string and the `Name` is big no matter what.
If we join `scope_defines_name` with `n.getId()`, we'll get `Name`s
belonging to irrelevant scopes.
If we join `scope_defines_name` with the enclosing scope of the `Name`
`n`, then we'll get this also for `Name`s that don't share their `getId`
with the local variable defined in the scope.
If we join `n.getId()` with `n.getScope()...` then we'll get all
enclosing scopes for each `Name`.
The last of these is what we currently have. It's not terrible, but not
great either. (Though thankfully it's rare to have lots of enclosing
scopes.)
2021-12-08 22:53:45 +00:00
Geoffrey White
0031ed39ec
C++: Additional test cases.
2021-12-08 17:45:51 +00:00
Tom Hvitved
b49ca6a24c
Merge pull request #7335 from hvitved/ruby/dataflow/hide-desugared-nodes
...
Ruby: Hide desugared nodes in data-flow paths
2021-12-08 17:39:48 +01:00
haby0
a18aad8536
Fix one
2021-12-08 21:03:17 +08:00
Anders Schack-Mulligen
38d0bb4a60
Merge pull request #7260 from hvitved/dataflow/argument-parameter-matching
...
Data flow: Introduce `ParameterPosition` and `ArgumentPosition`
2021-12-08 12:49:08 +01:00
haby0
1d321c692b
Refactor isMybatisXmlOrAnnotationSqlInjection
2021-12-08 18:59:55 +08:00
Alex Ford
ede1503cc6
Merge pull request #7328 from github/ruby/customizations
...
Ruby: add `Customizations.qll` file
2021-12-08 10:54:23 +00:00
Tom Hvitved
283173ad02
Address review comments
2021-12-08 11:26:44 +01:00
Erik Krogh Kristensen
3145e8f9b7
add upgrade script
2021-12-08 10:53:47 +01:00
Erik Krogh Kristensen
1956405d17
Merge pull request #7284 from erik-krogh/myApply-part1
...
JS: remove paths without unmatched returns from polynomial-redos
2021-12-08 10:46:03 +01:00
Tom Hvitved
5735bb698d
Ruby: Hide desugared nodes in data-flow paths
2021-12-08 09:00:16 +01:00
yoff
0e33f730b1
Merge pull request #7329 from tausbn/tausbn/python-fix-syntax-error-locations
...
Python: Fix syntax error locations
2021-12-07 22:45:35 +01:00
Geoffrey White
5ee9684435
C++: Change note.
2021-12-07 20:42:36 +00:00
Geoffrey White
122f6385e6
C++: Improve recognition of stdin, stdout etc.
2021-12-07 20:42:35 +00:00
Geoffrey White
6896b20dcd
C++: Redesign and fix results that appear to be encrypted.
2021-12-07 20:42:13 +00:00
Alex Ford
ea7063f3c6
Ruby: make Customizations import private
2021-12-07 19:43:08 +00:00
Tom Hvitved
490872173a
Data flow: Sync files
2021-12-07 20:29:18 +01:00
Tom Hvitved
07ca1c2ec0
Data flow: Adjust parameterMatch join-orders
2021-12-07 20:29:00 +01:00
Erik Krogh Kristensen
fe1a473f07
Merge pull request #138 from github/erik-krogh/bump-this
...
bump the severity of `ql/implicit-this`
2021-12-07 20:12:21 +01:00
Erik Krogh Kristensen
a722aeb5e3
QL: Merge pull request #138 from github/erik-krogh/bump-this
...
bump the severity of `ql/implicit-this`
2021-12-07 20:12:21 +01:00
Taus
e7c298d903
Python: Fix bad scope_entry_points_to join
...
From `pritomrajkhowa/LoopBound`:
```
Definitions.ql-7:PointsTo::PointsToInternal::scope_entry_points_to#ffff#antijoin_rhs#2 ........... 55.1s
```
specifically
```
(443s) Tuple counts for PointsTo::PointsToInternal::scope_entry_points_to#ffff#antijoin_rhs#2/3@74a7cart after 55.1s:
184070 ~0% {3} r1 = JOIN PointsTo::PointsToInternal::scope_entry_points_to#ffff#shared#1 WITH Variables::GlobalVariable#class#f ON FIRST 1 OUTPUT Lhs.0 'arg2', Lhs.1 'arg0', Lhs.2 'arg1'
184070 ~0% {3} r2 = STREAM DEDUP r1
919966523 ~2% {4} r3 = JOIN r2 WITH Essa::EssaDefinition::getSourceVariable_dispred#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1 'arg0', Lhs.2 'arg1', Lhs.0 'arg2'
4281779 ~2293% {3} r4 = JOIN r3 WITH Essa::EssaVariable::getScope_dispred#ff ON FIRST 2 OUTPUT Lhs.1 'arg0', Lhs.2 'arg1', Lhs.3 'arg2'
return r4
```
First, this is an `antijoin`, so there's likely some negation involved.
Also, there's mention of `GlobalVariable`, `getScope`, and
`getSourceVariable`, none of which appear in `scope_entry_points_to`, so
it's likely that something got inlined.
Taking a closer look at the predicates mentioned in the body, we spot
`undefined_variable` as a likely culprit.
Evaluating this predicate in isolation reveals that it's not terribly
big, so we could try just marking it with `pragma[noinline]` (I opted
for the slightly more solid `nomagic`) and see how that fares. I also
checked that `builtin_not_in_outer_scope` was similarly small, and
made that one un-inlineable as well.
The result? Well, I can't even show you. Both `scope_entry_points_to`
and `undefined_variable` are so fast that they don't appear in the
clause timing report (so they can at most take 3.5s each to evaluate, as
that is the smallest timing in the list).
2021-12-07 18:51:44 +00:00
Taus
b502ca1ea7
Python: Fix bad callsite_points_to join
...
From `pritomrajkhowa/LoopBound`:
```
Definitions.ql-7:PointsTo::InterProceduralPointsTo::callsite_points_to#ffff#join_rhs#3 ........... 5m53s
```
specifically
```
(767s) Tuple counts for PointsTo::InterProceduralPointsTo::callsite_points_to#ffff#join_rhs#3/3@f8f86764 after 5m53s:
832806293 ~0% {4} r1 = JOIN PointsTo::InterProceduralPointsTo::callsite_points_to#ffff#shared#1 WITH PointsTo::InterProceduralPointsTo::var_at_exit#fff ON FIRST 1 OUTPUT Lhs.0, Lhs.1 'arg1', Rhs.1 'arg2', Rhs.2 'arg0'
832806293 ~0% {3} r2 = JOIN r1 WITH Essa::TEssaNodeRefinement#ffff_03#join_rhs ON FIRST 2 OUTPUT Lhs.3 'arg0', Lhs.1 'arg1', Lhs.2 'arg2'
return r2
```
This one is a bit tricky to unpack. Where is this `shared#1` defined?
```
EVALUATE NONRECURSIVE RELATION:
SYNTHETIC PointsTo::InterProceduralPointsTo::callsite_points_to#ffff#shared#1(int arg0, numbered_tuple arg1) :-
SENTINEL PointsTo::InterProceduralPointsTo::callsite_points_to#ffff#shared
SENTINEL Definitions::EscapingAssignmentGlobalVariable#class#f
SENTINEL Essa::TEssaNodeRefinement#ffff_03#join_rhs
{2} r1 = JOIN PointsTo::InterProceduralPointsTo::callsite_points_to#ffff#shared WITH Definitions::EscapingAssignmentGlobalVariable#class#f ON FIRST 1 OUTPUT Lhs.0 'arg0', Lhs.1 'arg1'
{2} r2 = STREAM DEDUP r1
{2} r3 = JOIN r2 WITH Essa::TEssaNodeRefinement#ffff_03#join_rhs ON FIRST 2 OUTPUT Lhs.0 'arg0', Lhs.1 'arg1'
{2} r4 = STREAM DEDUP r3
return r4
```
Looking at `callsite_points_to`, we see a likely candidate in `srcvar`.
It is guarded with an `instanceof` check for
`EscapingAssignmentGlobalVariable` (which lines up nicely with the
sentinel on its charpred) and `getSourceVariable` is just a projection
of `TEssaNodeRefinement`.
So let's try unbinding `srcvar` to prevent an early join.
The timing is now:
```
Definitions.ql-7:PointsTo::InterProceduralPointsTo::callsite_points_to#ffff ...................... 31.3s (2554 evaluations with max 101ms in PointsTo::InterProceduralPointsTo::callsite_points_to#ffff/4@i516#581fap5w)
```
(Showing the tuple counts doesn't make sense here, since all of the
`shared` and `join_rhs` predicates have been smooshed around.)
2021-12-07 18:25:53 +00:00
Taus
a716482c1f
Python: Fix bad join in SSA
...
On `pritomrajkhowa/LoopBound`:
```
Definitions.ql-3:SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentUseUse#ff ................. 4m35s
```
specifically
```
(376s) Tuple counts for SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentUseUse#ff/2@be04e9kp after 4m58s:
388843 ~0% {4} r1 = JOIN Essa::TPhiFunction#fff_2#join_rhs WITH SsaCompute::SsaComputeImpl::AdjacentUsesImpl::definesAt#ffff ON FIRST 1 OUTPUT Rhs.1, Lhs.0, Rhs.2, Rhs.3
3629812090 ~1% {7} r2 = JOIN r1 WITH SsaCompute::SsaComputeImpl::variableUse#ffff ON FIRST 1 OUTPUT Lhs.0, Rhs.2, Rhs.3, Lhs.2, Lhs.3, Lhs.1, Rhs.1 'use1'
0 ~0% {2} r3 = JOIN r2 WITH SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentVarRefs#fffff ON FIRST 5 OUTPUT Lhs.5, Lhs.6 'use1'
0 ~0% {2} r4 = JOIN r3 WITH SsaCompute::SsaComputeImpl::AdjacentUsesImpl::firstUse#ff ON FIRST 1 OUTPUT Lhs.1 'use1', Rhs.1 'use2'
897141 ~0% {2} r5 = SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentUseUseSameVar#ff UNION r4
return r5
```
Clearly we do not want to join on the variable so soon. So we unbind it
and get
```
(78s) Tuple counts for SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentUseUse#ff/2@40e0e6uv after 434ms:
3377959 ~2% {4} r1 = SCAN SsaCompute::SsaComputeImpl::variableUse#ffff OUTPUT In.0, In.2, In.3, In.1 'use1'
1026855 ~2% {4} r2 = JOIN r1 WITH SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentVarRefs#fffff ON FIRST 3 OUTPUT Lhs.0, Rhs.3, Rhs.4, Lhs.3 'use1'
129484 ~0% {2} r3 = JOIN r2 WITH SsaCompute::SsaComputeImpl::AdjacentUsesImpl::definesAt#ffff_1230#join_rhs ON FIRST 3 OUTPUT Rhs.3, Lhs.3 'use1'
0 ~0% {2} r4 = JOIN r3 WITH Essa::TPhiFunction#fff_2#join_rhs ON FIRST 1 OUTPUT Lhs.0, Lhs.1 'use1'
0 ~0% {2} r5 = JOIN r4 WITH SsaCompute::SsaComputeImpl::AdjacentUsesImpl::firstUse#ff ON FIRST 1 OUTPUT Lhs.1 'use1', Rhs.1 'use2'
897141 ~0% {2} r6 = SsaCompute::SsaComputeImpl::AdjacentUsesImpl::adjacentUseUseSameVar#ff UNION r5
return r6
```
2021-12-07 18:19:47 +00:00
Taus
59bac04d8f
Python: Fix Python 2 failures
2021-12-07 18:00:46 +00:00
Taus
ffc858e34d
Python: Add missing file
2021-12-07 17:29:35 +00:00
Alex Ford
bf0ecded04
Merge pull request #7326 from github/ginsbach/FixInstanceof
...
fix dependency cycle by removing superfluous classes
2021-12-07 17:05:26 +00:00
Taus
7437cd4d85
Python: Fix syntax error locations
2021-12-07 16:51:33 +00:00
Geoffrey White
511bee7a1a
C++: Fix results that flow to/from encryption routines.
2021-12-07 15:44:18 +00:00
Alex Ford
f85a47d41f
Ruby: add Customizations.qll file
2021-12-07 15:37:04 +00:00
Tom Hvitved
a2dc505c26
Merge pull request #7317 from hvitved/ruby/param-node-refactor
...
Ruby: Restructure `ParameterNode(Impl)`
2021-12-07 16:29:49 +01:00
Tom Hvitved
5183290439
Merge pull request #7315 from hvitved/ruby/inline-flow-test
...
Ruby: Add `InlineFlowTest.qll`
2021-12-07 16:29:34 +01:00
Henry Mercer
322e39446d
JS: Autoformat
2021-12-07 14:17:11 +00:00
Henry Mercer
016727d6b6
JS: Fix occasional duplicate body tokens
...
0e31439
2021-12-07 14:16:48 +00:00
Philip Ginsbach
b2c1b55c0c
rephrase extensions as aliases
2021-12-07 13:09:25 +00:00
Tom Hvitved
b17a93eaad
Merge pull request #7316 from hvitved/ruby/is-private-join
...
Ruby: Tweak `Method::isPrivate` join-orders
2021-12-07 13:58:19 +01:00
Tom Hvitved
4d797d6b3d
Merge pull request #7324 from github/hmac/empty-else-cfg
...
Ruby: Include empty StmtSequences in CFG
2021-12-07 13:19:15 +01:00
Philip Ginsbach
da43984ba4
fix dependency cycle by removing superfluous classes
2021-12-07 11:59:04 +00:00
Geoffrey White
b82425a35c
C++: Add various new test cases.
2021-12-07 11:58:56 +00:00
Geoffrey White
2d4a2e0d44
C++: Test spacing.
2021-12-07 11:58:06 +00:00
Rasmus Wriedt Larsen
ee23799a59
Merge pull request #7319 from RasmusWL/js-cwe-328
...
JS: Tag queries with CWE-328
2021-12-07 11:40:33 +01:00
Anders Schack-Mulligen
6c739b67fa
Merge pull request #7318 from RasmusWL/java-cwe-328
...
Java: Tag queries with CWE-328
2021-12-07 11:39:48 +01:00
Asger Feldthaus
23480b2d8f
JS: Remove stray TODO
2021-12-07 10:49:14 +01:00
Asger F
614c80706f
Apply suggestions from code review
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-07 10:48:44 +01:00
Asger Feldthaus
5559681916
JS: Change note
2021-12-07 10:46:18 +01:00
Asger Feldthaus
635ac0a209
JS: Fix perf issue in data flow step generation
2021-12-07 10:46:18 +01:00
Asger Feldthaus
da8e67b7ee
JS: Use routing trees to detect deeply tainted req.body
2021-12-07 10:46:18 +01:00
Asger Feldthaus
7492293c5b
JS: Add test with route handler indirection
2021-12-07 10:46:18 +01:00
Asger Feldthaus
3cbe94ac0a
JS: Add consistency checks to TemplateObjectInjection test
2021-12-07 10:46:18 +01:00
Asger Feldthaus
64db70f3ac
JS: Add explicit body-parsers to TemplateObjectInjection test
2021-12-07 10:46:18 +01:00
Asger Feldthaus
8af430d40f
JS: Shift line numbers in TemplateObjectInjection test
2021-12-07 10:46:17 +01:00
Asger Feldthaus
5f8ea3965d
JS: Do not flag auth endpoints that are immune to Login CSRF
2021-12-07 10:46:17 +01:00
Asger Feldthaus
66b1612e5e
JS: Treat non-cookie based auth as CSRF preventer
2021-12-07 10:46:17 +01:00
Asger Feldthaus
b73219392b
JS: Improve precision of missing CSRF middleware
2021-12-07 10:46:17 +01:00
Asger Feldthaus
d0e94e655d
JS: Exclude error handling from auth calls
2021-12-07 10:46:17 +01:00
Asger Feldthaus
400bf10cc3
JS: Move fastify-specific route handler step into extension point
2021-12-07 10:46:17 +01:00
Asger Feldthaus
71820569e1
JS: Instantiate for Fastify
2021-12-07 10:46:15 +01:00
Asger Feldthaus
cfb9265f0a
JS: Add template steps for res.locals.x
2021-12-07 10:44:53 +01:00
Asger Feldthaus
5269933461
JS: Port missing rate limiting query
2021-12-07 10:44:19 +01:00
Asger Feldthaus
389a3c9073
JS: Port CSRF query
2021-12-07 10:43:06 +01:00
Asger Feldthaus
16fa066636
JS: Fix false negative in Mongo model
2021-12-07 10:43:05 +01:00
Asger Feldthaus
3dd5d4d7b4
JS: Instantiate for Express and add tests
2021-12-07 10:43:03 +01:00
Erik Krogh Kristensen
3ebf1e3c13
Add codeql-go sources ( 894102defd)
2021-12-07 10:42:38 +01:00
Erik Krogh Kristensen
a3d11c61a8
QL: Add codeql-go sources ( 894102defd)
2021-12-07 10:42:38 +01:00
Erik Krogh Kristensen
d852b28653
Add codeql sources ( 3c59aa319e)
2021-12-07 10:42:34 +01:00
Erik Krogh Kristensen
44c3787457
QL: Add codeql sources ( 3c59aa319e)
2021-12-07 10:42:34 +01:00
Asger Feldthaus
aae4260819
JS: Routing model
2021-12-07 10:41:55 +01:00
Asger Feldthaus
e9575c3df6
JS: Support AdditionalUseStep in API graphs
2021-12-07 10:41:52 +01:00
Erik Krogh Kristensen
3c59aa319e
Merge pull request #7245 from erik-krogh/explicit-this-all-the-places
...
All langs: apply the explicit-this patch to all remaining code
2021-12-07 10:40:26 +01:00
Taus
7cd9369d91
Python: Autoformat
2021-12-07 09:29:24 +00:00
Taus
33a9f86f54
Python: Change integer in trois.py
2021-12-07 08:54:07 +00:00
Taus
dd33f4f4d2
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-12-07 09:48:53 +01:00
Harry Maclean
6f42153eac
Ruby: Include empty StmtSequences in CFG
...
Empty StmtSequences appear, for example, in the `else` branch of `if`
statements like the following:
foo
if cond
bar
else
end
baz
Before this change, the CFG for this code would look like this:
foo
│
│
▼
cond
│
true │
▼
bar
│
│
▼
if
│
│
▼
baz
i.e. there is linear flow through the condition, the `then` branch, and
out of the if. This doesn't account for the possibility that the
condition is false and `bar` is not executed. After this change, the CFG
looks like this:
foo
│
│
▼
cond
│ │
true │ │ false
▼ │
bar │
│ │
│ │
▼ ▼
if
│
│
▼
baz
i.e. we correctly account for the `false` condition.
2021-12-07 16:01:50 +13:00
Geoffrey White
4e68a4670b
Merge pull request #7322 from MathiasVP/fix-performance-of-unused-static-functions
...
C++: Fix performance of 'cpp/unused-static-function'.
2021-12-06 17:30:51 +00:00
Mathias Vorreiter Pedersen
4765772725
C++: Fix performance of 'cpp/unused-static-function'.
2021-12-06 16:41:10 +00:00
Tom Hvitved
243b92b28c
C#: Avoid CIL instructions with multiple types
2021-12-06 14:42:41 +01:00
Tom Hvitved
60c0bcf8f7
C#: Include dup instructions in CIL ExprMissingType consistency test
2021-12-06 14:37:07 +01:00
Tom Hvitved
c39fe59a04
C#: Populate UnknownType
2021-12-06 14:09:17 +01:00
Rasmus Wriedt Larsen
7ae1047fda
JS: Tag queries with CWE-328
...
CWE-328: Use of Weak Hash, see https://cwe.mitre.org/data/definitions/328.html
2021-12-06 14:02:24 +01:00
Rasmus Wriedt Larsen
ff9ed0d4fb
Java: Tag queries with CWE-328
...
CWE-328: Use of Weak Hash, see https://cwe.mitre.org/data/definitions/328.html
Since weak hash functions (md5/sha1) are considered for the
`java/weak-cryptographic-algorithm` query. See
caeeebf572/java/ql/lib/semmle/code/java/security/Encryption.qll (L148)
2021-12-06 13:59:00 +01:00
Tom Hvitved
5dbbb86d46
Ruby: Restructure ParameterNode(Impl)
2021-12-06 13:43:19 +01:00
Tom Hvitved
728e3abee5
Ruby: Tweak Method::isPrivate join-orders
2021-12-06 13:36:48 +01:00
Tom Hvitved
36569f997f
Ruby: Add InlineFlowTest.qll
2021-12-06 13:35:07 +01:00
Mathias Vorreiter Pedersen
6b1ac73a46
Merge pull request #7177 from ihsinme/ihsinme-patch-6141
...
fix request for cpp exceptions
2021-12-06 09:24:59 +00:00
Anders Schack-Mulligen
de1269f18f
Merge pull request #7308 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-06 09:58:49 +01:00
github-actions[bot]
c46ede02e6
Add changed framework coverage reports
2021-12-06 00:09:47 +00:00
Alex Ford
6adfea2365
Merge pull request #7163 from github/ruby/file-reader-extend
...
Ruby: Extend `FileSystemReadAccess` to include more potential sources of input from the filesystem
2021-12-05 23:32:43 +00:00
haby0
daf6a4ce07
Partial modification 2
2021-12-04 17:45:02 +08:00
Aditya Sharad
f68a40f82b
JS: Simplify calculation of token features for endpoints
...
Use a `strictcount` to identify whether there is exactly one feature or not.
If so, we use it. If not, we use the empty string.
Add context to ensure we filter the set of data flow nodes down to only
the set of endpoint nodes.
This performance optimisation avoids calculating the Cartesian product
of data flow nodes and feature names, but it does not avoid calculating
the (slightly smaller) Cartesian product of endpoint nodes and feature names.
Product size = number of endpoint nodes * number of feature names.
At time of writing there are 8 feature names.
2021-12-03 14:20:27 -08:00
Aditya Sharad
fac2769d85
JS: Replace an exists+concat with an equivalent strictconcat
2021-12-03 14:20:26 -08:00
Aditya Sharad
0e31439b7e
JS: Simplify aggregation of tokens into entity strings
...
Change the cutoff logic from `count` to `strictcount`, since we know it only applies
to a non-empty set of results.
Use a single `strictconcat` aggregate to combine tokens in order of location,
instead of computing a `rank` followed by a `concat`.
Strictness introduces a slight change of behaviour because missing tokens will now result
in no results from the predicate rather than an empty feature string.
2021-12-03 14:20:26 -08:00
Aditya Sharad
2a3b5fc2b2
JS: Performance optimisation for matching framework libraries with their marker comments
...
The `matchMarkerComment` predicate performs badly on any codebase with
a moderately large number of comments, because the current implementation
has to first compute the Cartesian product between the set of comments
and the set of framework library comment regexes.
Instead, match first against a single regex:
the union of all framework library comment regexes.
This computes a more benign Cartesian product, the same size as the set of comments.
See inline comments for more details.
2021-12-03 14:20:26 -08:00
Aditya Sharad
d0840afb80
JS: Fix compilation errors in EndpointFeatures library
...
Use the LabelParameter API instead of manually constructing the edge label.
2021-12-03 14:20:17 -08:00
Arthur Baars
9f48ae656f
Merge pull request #7306 from aibaars/ruby-parenthesized-pattern
...
Ruby: parenthesized patterns
2021-12-03 19:18:09 +01:00
Arthur Baars
0805daaa56
Update ruby/ql/lib/codeql/ruby/ast/Pattern.qll
...
Add missing backticks
2021-12-03 18:44:21 +01:00
Arthur Baars
51998294ad
Ruby: add AST classes for parenthesized patterns
2021-12-03 18:13:53 +01:00
Tony Torralba
4ae99592a3
Merge pull request #6801 from atorralba/atorralba/android_slice_models
...
Android: Add `androidx.slice.builders` models
2021-12-03 17:44:09 +01:00
Arthur Baars
205233b42f
Add trivial upgrade
2021-12-03 17:04:00 +01:00
Arthur Baars
3e1ebb954f
Ruby: update generated dbscheme and library
2021-12-03 17:02:08 +01:00
Arthur Baars
0cec59e043
Ruby: update tree-sitter grammar
2021-12-03 17:01:12 +01:00
Tony Torralba
8ffa195538
Merge branch 'main' into atorralba/android_slice_models
2021-12-03 16:59:33 +01:00
Nick Rolfe
5a2ef8321c
Merge pull request #7120 from github/nickrolfe/regexp_g_anchor
...
Ruby/Python: parse anchors in regexes as special characters
2021-12-03 15:24:38 +00:00
Michael Nebel
4128f56aa9
Merge pull request #7289 from michaelnebel/csharp-mad-as-csv
...
C#: Convert some of the existing flow summaries to CSV
2021-12-03 15:09:36 +01:00
haby0
6c6113b85b
Partial modification
2021-12-03 18:59:24 +08:00
Arthur Baars
802faf1197
Merge pull request #7296 from intrigus-lgtm/patch-7
...
Fix QL Doc typo.
2021-12-03 11:54:22 +01:00
Michael Nebel
7ad52e1365
C#: Address review comments from hvitved.
2021-12-03 11:12:31 +01:00
Michael Nebel
f00b62df76
C#: Convert System.Uri flow to CSV format.
2021-12-03 11:10:24 +01:00
Michael Nebel
90baef83ee
C#: Add flow summaries for another TryParse method in System.Boolean.
2021-12-03 11:10:24 +01:00
Michael Nebel
8eb041c172
C#: Convert System.Boolean flow to CSV format.
2021-12-03 11:10:24 +01:00
Tom Hvitved
520f598d49
Merge pull request #7301 from hvitved/ruby/cfg-disjunct-test
...
Ruby: Add CFG test for `||`
2021-12-03 09:57:40 +01:00
Tom Hvitved
d9704d7b39
Ruby: Adapt to shared CFG changes
2021-12-03 09:37:41 +01:00
Tom Hvitved
42f6dfc197
Sync files
2021-12-03 09:37:41 +01:00
Tom Hvitved
404f4a81a7
C#: Include CFG scope in TElementNode
2021-12-03 09:37:41 +01:00
Tom Hvitved
50dd4e7ee7
Ruby: Add CFG test for ||
2021-12-03 09:16:11 +01:00
Arthur Baars
f2800abee4
Merge pull request #7299 from github/nickrolfe/clippy_fixes
...
Ruby: extractor: fix warnings from Clippy
2021-12-02 18:52:22 +01:00
Taus
7f44cebed7
Python: Add missing hidden flow
...
The easiest way to implement this was to change the definition of
`module_export` to account for chains of `import *`. We reuse the
machinery from `ImportStar.qll` for this, naturally.
2021-12-02 17:11:56 +00:00
Taus
4138296ec6
Python: Add test for "hidden" import * flow
...
TL;DR: We were missing out on flow in the following situation:
`mod1.py`:
```python
foo = SOURCE
```
`mod2.py`:
```python
from mod1 import *
```
`test.py`:
```python
from mod2 import foo
SINK(foo)
```
This is because there's no node at which a read of `foo` takes place
within `test.py`, and so the added reads make no difference.
Unfortunately, this means the previous test was a bit too simplistic,
since it only looks for module variable reads and writes. Because of
this, we change the test to be a more traditional "all flow" style
(though restricted to `CfgNode`s).
2021-12-02 17:05:54 +00:00
Nick Rolfe
991d659cb2
Ruby: use unwrap_or_else to construct object only when needed
2021-12-02 16:30:45 +00:00
Nick Rolfe
976faf97d1
Ruby: remove redundant closure
2021-12-02 16:29:59 +00:00
Michael Nebel
19c34be1ea
Merge pull request #7297 from michaelnebel/csharp-accessor-flow
...
C#: Make it possible to define flow for property backing methods.
2021-12-02 16:24:19 +01:00
Michael Nebel
102b5e05e1
Merge pull request #7290 from michaelnebel/csharp-modify-flow-summaries-test
...
C#: Modify printing of flow summaries in test.
2021-12-02 16:22:47 +01:00
Geoffrey White
2b349b3024
Merge pull request #7295 from geoffw0/cwe260
...
C++: Add CWE tags to some queries.
2021-12-02 14:41:34 +00:00
intrigus
2c4ccb79a1
Fix QL Doc typos.
2021-12-02 15:30:29 +01:00
Geoffrey White
3043ac850c
C++: Update security-severity tags.
2021-12-02 14:04:49 +00:00
Michael Nebel
f6c36b469a
C#: Include test case for override of property.
2021-12-02 15:04:01 +01:00
Michael Nebel
f190d60912
C#: Make it possible to describe flow for properties using their backing methods.
2021-12-02 15:02:22 +01:00
Geoffrey White
eccba57536
C++: Add CWE-327 tag to cpp/boost/use-of-deprecated-hardcoded-security-protocol.
2021-12-02 12:32:14 +00:00
Geoffrey White
7aa6c62050
C++: Add CWE-326 tag to cpp/boost/tls-settings-misconfiguration.
2021-12-02 12:29:42 +00:00
Nick Rolfe
05415768c9
Merge remote-tracking branch 'origin/main' into nickrolfe/regexp_g_anchor
2021-12-02 12:07:13 +00:00
yoff
f10f053c36
Merge pull request #7228 from RasmusWL/fastapi-improvements
...
Python: FastAPI improvements
2021-12-02 12:58:53 +01:00
Geoffrey White
913d8361ba
C++: Add CWE-260 tag to cpp/cleartext-storage-file.
2021-12-02 11:54:51 +00:00
yoff
4609b2060a
Merge pull request #7217 from RasmusWL/more-path-injection-fps
...
Python: Add `x in <var>` test for StringConstCompare
2021-12-02 12:35:33 +01:00
Michael Nebel
8f3be9fbfd
C#: Update flow summaries test according to new printing format.
2021-12-02 11:28:06 +01:00
Michael Nebel
edf7724579
C#: Remove trailing whitespace after comma, when priting callable in CSV format.
2021-12-02 11:24:42 +01:00
Michael Nebel
37644d30d2
Merge pull request #7281 from michaelnebel/csharp-flowsummaries-filtered
...
C#: Filtered flow summaries
2021-12-02 11:23:36 +01:00
Erik Krogh Kristensen
6327fced6f
remove paths without unmatched returns from polynomial-redos
2021-12-02 10:03:28 +01:00
Michael Nebel
ad281c0365
C#: Sync FlowSummaryImpl files.
2021-12-02 09:03:00 +01:00
Michael Nebel
a8f673ffa4
C#: Add a test that only prints 'base' flow summaries.
2021-12-02 09:03:00 +01:00
Michael Nebel
e08c734c40
C#: Refactoring to allow override of the flow summaries reported by a test.
2021-12-02 08:54:59 +01:00
Michael Nebel
55c17f453f
Merge pull request #7280 from michaelnebel/csharp-newtonsoft-flowsummary
...
C#: Include the NewtonSoft.JSon stubs in the flow summaries test.
2021-12-02 08:47:58 +01:00
github-actions[bot]
87b968f337
Post-release preparation 2.7.3
2021-12-02 00:46:55 +00:00
Mathias Vorreiter Pedersen
9f8326a3fa
Merge pull request #7243 from geoffw0/sslquery2
...
C++: New query for SSL certificates not checked
2021-12-01 15:02:19 +00:00
Erik Krogh Kristensen
a077345227
Merge pull request #7180 from erik-krogh/apiLabel2
...
JS: Make the edges of API-graphs into IPA types
2021-12-01 15:33:04 +01:00
Erik Krogh Kristensen
73f2f52ed8
use the TYPE_ONLY_IMPORT context
2021-12-01 14:54:16 +01:00
Erik Krogh Kristensen
739906b60c
rename @import_or_export_declaration to @type_keyword_operand
2021-12-01 14:47:11 +01:00
Michael Nebel
9e10aee8a1
C#: Update the flow summaries test.
2021-12-01 14:34:32 +01:00
Michael Nebel
cc2914be3c
C#: Include NewtonSoft.Json stubs into the flow summaries test.
2021-12-01 14:34:04 +01:00
Erik Krogh Kristensen
de53727ab3
remove spurious whitespace
...
Co-authored-by: Asger F <asgerf@github.com >
2021-12-01 14:29:57 +01:00
Erik Krogh Kristensen
0a3d62c92a
rename mod -> module
2021-12-01 13:48:16 +01:00
Erik Krogh Kristensen
148da611c6
make the ApiLabel class non-abstract
2021-12-01 13:45:52 +01:00
Tom Hvitved
aad55ffbd6
Merge pull request #7279 from hvitved/csharp/json-net-fix-summaries
...
C#: Fix `Newtonsoft.Json.JsonSerializer.{Deserialize,Serialize}` summaries
2021-12-01 13:15:10 +01:00
Michael Nebel
75f9a947b3
Merge pull request #7257 from michaelnebel/csharp-nuget-packages
...
C#: Use .NET Core Nuget package stub i test
2021-12-01 13:04:24 +01:00
Michael Nebel
ed706d9bc1
Merge pull request #7269 from michaelnebel/chspar-nuget-stub-script
...
C#: Update the make_stubs_nuget script
2021-12-01 13:04:02 +01:00
Arthur Baars
e41cd810d3
Merge pull request #7154 from aibaars/ruby-pattern-matching
...
Ruby: pattern matching
2021-12-01 12:47:22 +01:00
Tom Hvitved
93e291cb3e
C#: Fix Newtonsoft.Json.JsonSerializer.{Deserialize,Serialize} summaries
2021-12-01 11:41:16 +01:00
Anders Schack-Mulligen
cde853c095
Merge pull request #7270 from aschackmull/dataflow/stage2-refactor
...
Dataflow: Stage 2 refactor
2021-12-01 11:09:08 +01:00
haby0
6742beae1b
use <code> tags
2021-12-01 16:24:46 +08:00
Tom Hvitved
31374b485c
Data flow: Update documentation
2021-12-01 09:01:06 +01:00
Tom Hvitved
e410244fe0
Python: Implement ParameterPosition et al
2021-12-01 08:51:22 +01:00
Tom Hvitved
bb8f4bb7c1
Ruby: Implement ParameterPosition et al
2021-12-01 08:51:22 +01:00
Tom Hvitved
ae6501d906
Java: Implement ParameterPosition et al
2021-12-01 08:51:22 +01:00
haby0
08be8edbce
Modify according to suggestions
2021-12-01 11:57:57 +08:00
Geoffrey White
4b221bd964
C++: Use guard.controls.
2021-11-30 15:44:48 +00:00
Michael Nebel
186ba428cf
C#: Remove workdir as error message when format fails.
2021-11-30 15:57:53 +01:00
Michael Nebel
1243d40bb2
Revert "C#: Update the stub for Microsoft.NETCore.App by creating as a dependency for NewtonSoft.JSon"
...
This reverts commit 8a6a8fc28a
2021-11-30 15:49:31 +01:00
Tom Hvitved
35a67845cf
C++: Implement ParameterPosition et al
2021-11-30 15:34:16 +01:00
Michael Nebel
59b71df2d6
C#: Use stubs for the CWE-601 testcase.
2021-11-30 15:32:19 +01:00
Michael Nebel
0b4d0d2772
C#: Use stubs for the CWE-838 testcase
2021-11-30 15:32:19 +01:00
Michael Nebel
bab8cfb62a
C# Generate stubs for System.Data.SqlClient
2021-11-30 15:32:19 +01:00
Michael Nebel
a5b6889478
C# Update flow summaries test.
2021-11-30 15:32:19 +01:00
Michael Nebel
5dd2d20176
C#: Remove overlapping declaration of System.Web.HttpUtility
2021-11-30 15:32:18 +01:00
Michael Nebel
7d6664f14d
C#: Use NuGet package generated stubs for dependencies for flow summaries test
2021-11-30 15:32:18 +01:00
Tom Hvitved
540ecf3c21
Data flow: Sync files
2021-11-30 15:20:20 +01:00
Tom Hvitved
755085e9fe
C#: Introduce ParameterPosition and ArgumentPosition
2021-11-30 15:20:20 +01:00
Michael Nebel
2589034242
C#: Execute commands with the tempDir as the working directory
2021-11-30 14:42:21 +01:00
Arthur Baars
830908b5c8
Address comments
2021-11-30 13:57:18 +01:00
Anders Schack-Mulligen
3e914ef2ff
Dataflow: Sync.
2021-11-30 13:52:52 +01:00
Anders Schack-Mulligen
fc05825c73
Dataflow: Make stage 2 equal to stages 3 and 4.
2021-11-30 13:52:31 +01:00
Michael Nebel
8a6a8fc28a
C#: Update the stub for Microsoft.NETCore.App by creating as a dependency for NewtonSoft.JSon
2021-11-30 13:29:35 +01:00
Michael Nebel
0619453c2f
C#: Explicitly set .NET 5.0 as target framework in class lib and hardcode compilation to use version 5.0.402 of the SDK
2021-11-30 13:28:48 +01:00
Paolo Tranquilli
b40c77d419
Merge pull request #7267 from github/redsun82/cpp-overrunning-write-precision-split
...
C++: add some more range analysis tests
2021-11-30 12:54:48 +01:00
Paolo Tranquilli
3f218c903b
C++: add some more range analysis tests
...
Add more covering for integer conversions and some unsigned bit
manipulation.
2021-11-30 11:29:02 +00:00
Geoffrey White
8f270b665c
C++: Fix test comments.
2021-11-30 08:56:24 +00:00
Tony Torralba
c91b6f7ce9
Merge pull request #7266 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-11-30 09:07:09 +01:00
Mathias Vorreiter Pedersen
f4555ed1a2
Merge pull request #7242 from geoffw0/sslquery
2021-11-30 07:01:33 +00:00
github-actions[bot]
66e086f92f
Add changed framework coverage reports
2021-11-30 00:09:58 +00:00
Arthur Baars
1e026ef45e
AST: merge Case and CaseMatch classes
2021-11-29 16:00:17 +01:00
Rasmus Wriedt Larsen
cbd7434a7e
Python: Add modeling of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
b68538376c
Python: Add tests of tempfile module
2021-11-29 15:08:36 +01:00
Rasmus Wriedt Larsen
3bcf6d68ce
Python: Refactor os FileSystemAccess change-note
...
I think it's more readable to have only one to cover all of these
changes, even though they came in through different PRs.
2021-11-29 15:08:18 +01:00
Arthur Baars
f8a62c4c82
Address comments
2021-11-29 15:06:16 +01:00
Rasmus Wriedt Larsen
58f92764f7
Python: Model more file access from os module
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
fd23fa94a5
Python: Remove dubious fstat* modeling
...
These operate on file descriptors, and not on paths. file descriptors
doesn't fit into the rest of our modeling, so I would rather remove them
than to make it look like it's properly handled.
I also did not include any of the functions that work on file
descriptors when looking through all of `os`. So this keeps everything
consistent at least ;)
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
e79b8f3e23
Python: Treat os.exec*, os.spawn*, and os.posix_spawn* as FileSystemAccess
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
d2d5cce787
Python: Recognize keyword arguments for os.*spawn* calls
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
14590436f9
Python: Expand tests for os.exec*, os.spawn*, and os.posix_spawn*
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
50d3592ad3
Python: Add more complete tests of os module
...
I went through https://docs.python.org/3.10/library/os.html in order,
and added all the functions that works on paths.
`lstat` and `statvfs` were already modeled, but did not have any tests.
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
a91208fd2c
Python: Fix kwarg modeling for os.path.isdir
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
36f14b31bc
Python: Add explicit tests for kwargs
...
I also renamed the arguments to match what the keyword argument is
called. It doesn't matter too much for these specific tests, but for the
tests I'm about to add, it makes things a lot easier to get an overview
of.
Oh, and a test failure :O
2021-11-29 14:54:02 +01:00
Rasmus Wriedt Larsen
82602014ad
Python: Minor refactor to use os.path.<func>
...
Since that's the idiomatic way to use this module
2021-11-29 14:54:02 +01:00
Geoffrey White
88fb1a18cb
C++: Correct the doc.
2021-11-29 13:09:12 +00:00
Erik Krogh Kristensen
fdcc144a98
add test for import assertions
2021-11-29 13:51:28 +01:00
Erik Krogh Kristensen
591aeff906
add TypeScript test for new private field syntax
2021-11-29 13:51:28 +01:00
Erik Krogh Kristensen
19bbe6d276
add JavaScript support for new private fields syntax
2021-11-29 13:51:25 +01:00
Erik Krogh Kristensen
d1a7feebc4
disable import resolution on type-only import specifiers
2021-11-29 13:49:10 +01:00
Erik Krogh Kristensen
d946802057
add support for type-only import specifiers
2021-11-29 13:49:10 +01:00
Erik Krogh Kristensen
57399b733e
add test for String types as Discriminants
2021-11-29 13:49:10 +01:00
Erik Krogh Kristensen
0e890fd788
add test for the Awaited type
2021-11-29 13:49:10 +01:00
Erik Krogh Kristensen
eef3905c46
update expected output. The TypeScript compiler now emits types in more cases
2021-11-29 13:49:10 +01:00
Erik Krogh Kristensen
9ce248c829
update to TypeScript 4.5.2
2021-11-29 13:49:10 +01:00
Erik Krogh Kristensen
c13cad7e87
Merge branch 'main' into apiLabel2
2021-11-29 13:43:11 +01:00
Geoffrey White
d79337774d
Update cpp/ql/src/Security/CWE/CWE-295/SSLResultNotChecked.qhelp
...
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com >
2021-11-29 12:33:05 +00:00
Erik Krogh Kristensen
8e1b4e3a58
bump the severity of ql/implicit-this
2021-11-29 10:55:59 +01:00
Erik Krogh Kristensen
da5c2fb415
QL: bump the severity of ql/implicit-this
2021-11-29 10:55:59 +01:00
haby0
db04a0dadf
New model: SQL injection in MyBatis annotations
2021-11-28 14:43:57 +08:00
Pavel Lobashov
6d339e50a3
Fix ruby incorrect version in some readme files
...
There is no `ruby 3.02` version - there is `ruby 3.0.2`
2021-11-27 22:44:27 +03:00
Erik Krogh Kristensen
74158f1e3a
revert explicit-this that caused non-monotonic recursion
2021-11-26 21:37:46 +01:00
Taus
09a11f4166
Python: Update ImpliesDataflow test
...
Turns out that now we can resolve the convoluted imports. Hurray!
2021-11-26 14:47:25 +00:00
Taus
6c3aabe1df
Python: Support flow through import *
...
Adds result for `ModuleVariableNode::getARead` corresponding to reads
that go through (chains of) `import *`.
This required a bit of a change to _which_ module variables we define.
Previously, we only included variables that were accessed elsewhere in
the same file, but now we must ensure to also include variables that may
be accessed through `import *`.
2021-11-26 13:49:08 +00:00
Taus
c3e495efe9
Python: Refactor built-ins and import * logic
...
Moves this from the API graphs implementation into separate files.
2021-11-26 13:49:08 +00:00
Taus
03b6ee3833
Python: Add import * test
...
This test shows off a few things:
- transitive chains of `import *`
- multiple modules exporting the same name (to test for cross-talk)
2021-11-26 13:49:08 +00:00
Erik Krogh Kristensen
6ff8d4de5c
add all remaining explicit this
2021-11-26 13:50:10 +01:00
Geoffrey White
f96968975b
C++: Change note.
2021-11-25 15:49:41 +00:00
Geoffrey White
e98ab5d2c2
C++: Add security-severity tag and provisional precision.
2021-11-25 15:49:40 +00:00
Geoffrey White
e9ce29664e
C++: Qldoc.
2021-11-25 15:48:12 +00:00
Geoffrey White
1d358c5f77
C++: Change note.
2021-11-25 14:04:47 +00:00
Geoffrey White
f5b40731d6
C++: Add security-severity tag and provisional precision.
2021-11-25 13:59:21 +00:00
Arthur Baars
e801d9636a
Ruby: add ruby/ruby to the dataset-measure CI job
2021-11-25 14:10:15 +01:00
Arthur Baars
8b0bc677f4
Remove PatternGuard class
2021-11-25 13:50:19 +01:00
Arthur Baars
dca1e34cd8
Temporarily allow CFG inconsistencies
2021-11-25 13:42:59 +01:00
Arthur Baars
16e1e97ff0
Add test data for case-in expressions
2021-11-25 13:25:33 +01:00
Arthur Baars
af4c3122ca
Test case for **nil parameter
2021-11-25 13:25:00 +01:00
Arthur Baars
078a2aa03b
Update AST library
2021-11-25 13:24:51 +01:00
Arthur Baars
ec0bd24b64
Update diagnostic tests
2021-11-25 12:55:50 +01:00
Arthur Baars
5b560b12e9
Create upgrade script
2021-11-25 12:55:43 +01:00
haby0
04a3f76a8b
Eliminate false positives of Mybatis Configuration Variable
2021-11-25 15:47:37 +08:00
haby0
d36a7ed10e
add test case
2021-11-25 15:47:32 +08:00
haby0
99c8b291b2
add sink
2021-11-25 15:47:32 +08:00
haby0
b8732859de
Add isSanitizerGuard, verify file path
2021-11-25 15:47:31 +08:00
haby0
31400df0d4
Modify sink and improve SQL injection detection
2021-11-25 15:47:30 +08:00
haby0
69690a2509
Modify sinks
2021-11-25 15:47:30 +08:00
haby0
4438f8c58c
Add MyBatis Mapper Sql Injection
2021-11-25 15:47:29 +08:00
Geoffrey White
4c5faaf985
C++: Autoformat result not checked query.
2021-11-24 18:26:39 +00:00
Geoffrey White
8abaf1247a
C++: Clean up result not checked query.
2021-11-24 18:26:39 +00:00
Geoffrey White
5ffbf563b8
C++: Add metadata for result not checked query.
2021-11-24 18:26:38 +00:00
Geoffrey White
72a03257e7
C++: Add qhelp for result not checked query.
2021-11-24 18:26:38 +00:00
Geoffrey White
5eb814fd8b
C++: Prototype SSL result not checked query.
2021-11-24 18:26:37 +00:00
Geoffrey White
7869733ab5
C++: Autoformat result conflation query.
2021-11-24 18:25:58 +00:00
Geoffrey White
88b6bd9478
C++: Switch result conflation query to a slightly simpler dataflow-only approach.
2021-11-24 18:25:57 +00:00
Geoffrey White
ce2b86b9e3
C++: Add metadata for result conflation query.
2021-11-24 18:25:57 +00:00
Geoffrey White
2eae6a3e9a
C++: Add qhelp for result conflation query.
2021-11-24 18:25:56 +00:00
Geoffrey White
6afcbce421
C++: Prototype SSL result conflation query.
2021-11-24 18:22:24 +00:00
Arthur Baars
5d0dfe8c04
Re-generate library and dbscheme
2021-11-24 17:18:04 +01:00
Arthur Baars
e7524dea69
Update tree-sitter-ruby
2021-11-24 17:18:03 +01:00
Rasmus Wriedt Larsen
1411804e58
Python: Allow custom fastapi.APIRouter subclasses
2021-11-24 13:46:38 +01:00
Rasmus Wriedt Larsen
d493cfdf3a
Python: Model FastAPI FileResponse as FileSystemAccess
...
This was an oversight from our initial FastAPI modeling work.
2021-11-24 11:44:51 +01:00
Rasmus Wriedt Larsen
baafd9f8ba
Python: Add an other path injection FP
...
Along with the root cause, which is the `StringConstCompare`
BarrierGuard, that does only allows `in <iterable literal>` and not
`in <variable referencing iterable literal>`
2021-11-23 12:59:15 +01:00
ihsinme
88634b81bf
Update IncorrectPrivilegeAssignment.expected
2021-11-23 10:23:20 +03:00
ihsinme
6e8d56f044
Update IncorrectPrivilegeAssignment.ql
2021-11-23 10:22:26 +03:00
ihsinme
70081defdc
Update FindIncorrectlyUsedExceptions.expected
2021-11-23 09:56:02 +03:00
ihsinme
62ae702e07
Update FindIncorrectlyUsedExceptions.ql
2021-11-23 09:55:43 +03:00
Erik Krogh Kristensen
e9df860431
refactor implementation to make Label implementations private
2021-11-22 12:17:19 +01:00
Erik Krogh Kristensen
6060f2e3e3
remove unused alias edge
2021-11-22 09:03:40 +01:00
Erik Krogh Kristensen
c369b28a2a
optimizations in global data flow
2021-11-22 09:03:40 +01:00
Erik Krogh Kristensen
f39872e649
cache more predicates
2021-11-22 09:03:36 +01:00
Erik Krogh Kristensen
089d030bc2
make ApiLabel into a IPA type, and cache the public API of ApiGraphs
2021-11-22 09:03:33 +01:00
Nick Rolfe
df6ba43cca
Python: treat \A, \Z, \b, \B as special chars, not escapes
2021-11-19 15:49:53 +00:00
Nick Rolfe
f63c768d9f
Ruby: parse \G, \b, and \B anchors as special characters, not escapes
2021-11-19 14:20:51 +00:00
ihsinme
6d27585b92
Update FindIncorrectlyUsedExceptions.ql
2021-11-19 16:59:00 +03:00
ihsinme
418adb824c
Update FindIncorrectlyUsedExceptions.ql
2021-11-19 16:04:04 +03:00
Erik Krogh Kristensen
e25f03fb56
Merge pull request #137 from github/erik-krogh/even-more-consistency
...
even more consistency
2021-11-19 13:39:36 +01:00
Erik Krogh Kristensen
172684ce6e
QL: Merge pull request #137 from github/erik-krogh/even-more-consistency
...
even more consistency
2021-11-19 13:39:36 +01:00
Erik Krogh Kristensen
a86f2c3ed1
Add codeql sources ( 1f3f7e9ccc)
2021-11-19 13:15:06 +01:00
Erik Krogh Kristensen
70f6493d7a
QL: Add codeql sources ( 1f3f7e9ccc)
2021-11-19 13:15:06 +01:00
ihsinme
21ab8b0f63
Update IncorrectPrivilegeAssignment.ql
2021-11-19 13:06:08 +03:00
ihsinme
fd73f4094f
Update FindIncorrectlyUsedExceptions.ql
2021-11-19 10:54:02 +03:00
ihsinme
6168b15bbc
Update cpp/ql/src/experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.ql
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2021-11-19 08:56:21 +03:00
Erik Krogh Kristensen
1a0379a894
introduce type resolution consistency checks
2021-11-18 18:44:34 +01:00
Erik Krogh Kristensen
d89e430db2
QL: introduce type resolution consistency checks
2021-11-18 18:44:34 +01:00
Erik Krogh Kristensen
15b56585f9
update inefficientStringComparison, to avoid underscores
2021-11-18 18:43:54 +01:00
Erik Krogh Kristensen
37c2db240c
QL: update inefficientStringComparison, to avoid underscores
2021-11-18 18:43:54 +01:00
Alex Ford
1ec935dee6
Ruby: make documentation of IOReader and FileReader less ambiguous
2021-11-18 14:35:44 +00:00
Alex Ford
bd940712de
Update ruby/ql/lib/codeql/ruby/frameworks/Files.qll
...
Co-authored-by: Harry Maclean <hmac@github.com >
2021-11-18 14:18:39 +00:00
Erik Krogh Kristensen
036d749378
Merge pull request #126 from github/erik-krogh/update-sources
...
update sources
2021-11-18 14:32:01 +01:00
Erik Krogh Kristensen
44ffc7e155
QL: Merge pull request #126 from github/erik-krogh/update-sources
...
update sources
2021-11-18 14:32:01 +01:00
Erik Krogh Kristensen
a0bf13007c
remove codeql-ruby sources
2021-11-18 14:15:19 +01:00
Erik Krogh Kristensen
9a6c9c4d77
QL: remove codeql-ruby sources
2021-11-18 14:15:19 +01:00
Erik Krogh Kristensen
e3c0e190d9
Add codeql-go sources ( 4cae4b23fc)
2021-11-18 14:14:20 +01:00
Erik Krogh Kristensen
fe097783a7
QL: Add codeql-go sources ( 4cae4b23fc)
2021-11-18 14:14:20 +01:00
Erik Krogh Kristensen
61b71807df
Add codeql sources ( 6c2713dd8b)
2021-11-18 14:14:17 +01:00
Erik Krogh Kristensen
fa54855995
QL: Add codeql sources ( 6c2713dd8b)
2021-11-18 14:14:17 +01:00
Erik Krogh Kristensen
fb40b8a032
update import script
2021-11-18 14:13:47 +01:00
Erik Krogh Kristensen
c07d55325e
QL: update import script
2021-11-18 14:13:47 +01:00
Erik Krogh Kristensen
349b556c26
Merge pull request #129 from github/erik-krogh/cartesian
...
various new improvements and queries
2021-11-18 13:16:53 +01:00
Erik Krogh Kristensen
1b070f1dd8
QL: Merge pull request #129 from github/erik-krogh/cartesian
...
various new improvements and queries
2021-11-18 13:16:53 +01:00
Erik Krogh Kristensen
38b925b19c
rename "use matches" query, and refactor into Query.qll
2021-11-18 13:05:41 +01:00
Erik Krogh Kristensen
d64c7fc638
QL: rename "use matches" query, and refactor into Query.qll
2021-11-18 13:05:41 +01:00
Erik Krogh Kristensen
89604deb8d
add redundant inline cast query
2021-11-18 12:23:55 +01:00
Erik Krogh Kristensen
d8bf7ed6e0
QL: add redundant inline cast query
2021-11-18 12:23:55 +01:00
Erik Krogh Kristensen
97461d1f11
add var unused in disjunct query
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
12a3fa77f6
QL: add var unused in disjunct query
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
112cd9d29c
move use-set-literal implementation to Query.qll file
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
1cbacc41d7
QL: move use-set-literal implementation to Query.qll file
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
33d363eb94
move use-instanceof implementation to Query.qll, and rename the .ql file
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
f320414b1c
QL: move use-instanceof implementation to Query.qll, and rename the .ql file
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
45def1b124
move implementation of implicit-this to Query.qll file
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
28444c7e9c
QL: move implementation of implicit-this to Query.qll file
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
ac4476fa82
performance improvements
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
c3f362876b
QL: performance improvements
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
84d277dc94
add getLeft/getRight helper predicates to disjunction/conjunction
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
0154f4eba4
QL: add getLeft/getRight helper predicates to disjunction/conjunction
2021-11-18 12:23:09 +01:00
Erik Krogh Kristensen
9d308ba0bd
refactor away the ComparisonOp ast class
2021-11-18 12:23:07 +01:00
Erik Krogh Kristensen
7c82c5e378
QL: refactor away the ComparisonOp ast class
2021-11-18 12:23:07 +01:00
Erik Krogh Kristensen
5a76e7d4f8
introduce FieldDecl in the ast
2021-11-18 12:08:28 +01:00
Erik Krogh Kristensen
1b19a3e320
QL: introduce FieldDecl in the ast
2021-11-18 12:08:28 +01:00
Alex Ford
9a74f18ac5
Ruby: take File::try_convert as a potential file instance instantiation
2021-11-17 23:19:13 +00:00
Alex Ford
ce004e9c1e
Ruby: don't interpret File#try_convert as a method that reads from a file/IO
2021-11-17 23:01:19 +00:00
Alex Ford
12a3251649
Ruby: extend FileSystemReadAccess and restructure some Files.qll classes
2021-11-17 23:01:18 +00:00
Erik Krogh Kristensen
cc16fdecbb
Merge pull request #130 from github/erik-krogh/more-types
...
Better type resolution
2021-11-16 17:52:15 +01:00
Erik Krogh Kristensen
f54f70d707
QL: Merge pull request #130 from github/erik-krogh/more-types
...
Better type resolution
2021-11-16 17:52:15 +01:00
ihsinme
7f0a7bbec9
Update IncorrectPrivilegeAssignment.ql
2021-11-16 10:12:50 +03:00
ihsinme
7832e8572b
Update cpp/ql/src/experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.cpp
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2021-11-15 21:08:20 +03:00
ihsinme
0359c381e1
Update cpp/ql/src/experimental/Security/CWE/CWE-266/IncorrectPrivilegeAssignment.cpp
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2021-11-15 21:08:11 +03:00
ihsinme
f102fa1d33
Update IncorrectPrivilegeAssignment.ql
2021-11-14 12:17:01 +03:00
ihsinme
e383e44d36
Update IncorrectPrivilegeAssignment.ql
2021-11-14 11:57:40 +03:00
ihsinme
ea1d18ed60
Update IncorrectPrivilegeAssignment.cpp
2021-11-14 11:36:06 +03:00
ihsinme
41e15cd497
Update IncorrectPrivilegeAssignment.cpp
2021-10-25 22:15:52 +03:00
ihsinme
a33c076f5f
Add files via upload
2021-10-25 14:40:35 +03:00
ihsinme
6173b11274
Add files via upload
2021-10-25 14:39:43 +03:00
Taus
7214d70ee7
Merge pull request #135 from github/winfix
...
Fix create-extractor-pack.ps1
2021-10-20 14:51:06 +02:00
Taus
fff1f1248a
QL: Merge pull request #135 from github/winfix
...
Fix create-extractor-pack.ps1
2021-10-20 14:51:06 +02:00
Geoffrey White
1f2b32fe87
Fix create-extractor-pack.ps1
2021-10-20 13:17:22 +01:00
Geoffrey White
3bc209ded8
QL: Fix create-extractor-pack.ps1
2021-10-20 13:17:22 +01:00
Erik Krogh Kristensen
631a503e55
cleanup
2021-10-19 09:19:31 +02:00
Erik Krogh Kristensen
c00e18f4b0
QL: cleanup
2021-10-19 09:19:31 +02:00
Esben Sparre Andreasen
629605c075
Merge pull request #133 from github/esbena/update-readme
...
Update readme with alerts and actions information
2021-10-19 07:58:59 +02:00
Esben Sparre Andreasen
ac78e26672
QL: Merge pull request #133 from github/esbena/update-readme
...
Update readme with alerts and actions information
2021-10-19 07:58:59 +02:00
Esben Sparre Andreasen
0760c1c13f
Update readme with alerts and actions information
2021-10-19 07:58:22 +02:00
Esben Sparre Andreasen
769f787651
QL: Update readme with alerts and actions information
2021-10-19 07:58:22 +02:00
Esben Sparre Andreasen
3f420c442e
Update bleeding-codeql-analysis.yml
2021-10-18 21:51:56 +02:00
Esben Sparre Andreasen
5fa1c04e2a
QL: Update bleeding-codeql-analysis.yml
2021-10-18 21:51:56 +02:00
Esben Sparre Andreasen
b96ad387ef
Merge pull request #132 from github/esbena/fix-branch
...
change branch name
2021-10-18 21:18:16 +02:00
Esben Sparre Andreasen
032a0dc6ae
QL: Merge pull request #132 from github/esbena/fix-branch
...
change branch name
2021-10-18 21:18:16 +02:00
Esben Sparre Andreasen
e851ba2bfd
change code-scanning branch
2021-10-18 20:58:02 +02:00
Esben Sparre Andreasen
d49db9298c
QL: change code-scanning branch
2021-10-18 20:58:02 +02:00
Esben Sparre Andreasen
a089e0ed3f
change branch name
2021-10-18 12:31:03 +02:00
Esben Sparre Andreasen
6cc14b16ba
QL: change branch name
2021-10-18 12:31:03 +02:00
Esben Sparre Andreasen
a9cef84b90
Merge pull request #131 from github/esbena/workflow-improvements
...
Misc. workflow improvements
2021-10-18 12:21:39 +02:00
Esben Sparre Andreasen
f29813b3f7
QL: Merge pull request #131 from github/esbena/workflow-improvements
...
Misc. workflow improvements
2021-10-18 12:21:39 +02:00
Esben Sparre Andreasen
eded7b8da1
add nightly-changes workflow
2021-10-18 12:03:16 +02:00
Esben Sparre Andreasen
dc715af18b
QL: add nightly-changes workflow
2021-10-18 12:03:16 +02:00
Esben Sparre Andreasen
c200ec38f5
use workflow_call in bleeding-codeql-analysis.yml
2021-10-18 12:03:16 +02:00
Esben Sparre Andreasen
7e2b00e62c
QL: use workflow_call in bleeding-codeql-analysis.yml
2021-10-18 12:03:16 +02:00
Tony Torralba
9d50511ea4
Fix stubs
2021-10-18 09:27:53 +02:00
Tony Torralba
5deb996b33
Merge branch 'main' into atorralba/android_slice_models
2021-10-18 08:41:48 +02:00
Erik Krogh Kristensen
509e77bbdb
add nonTotalGetParent to the list of empty consistency queries
2021-10-17 15:09:30 +02:00
Erik Krogh Kristensen
ef6ea195db
QL: add nonTotalGetParent to the list of empty consistency queries
2021-10-17 15:09:30 +02:00
Erik Krogh Kristensen
9a73c36389
add support for libraryPathDependencies in qlpacks
2021-10-17 14:51:00 +02:00
Erik Krogh Kristensen
9e4e42847b
QL: add support for libraryPathDependencies in qlpacks
2021-10-17 14:51:00 +02:00
Erik Krogh Kristensen
ade206184c
fix broken import in unused file
2021-10-17 14:44:41 +02:00
Erik Krogh Kristensen
b317d73c83
QL: fix broken import in unused file
2021-10-17 14:44:41 +02:00
Erik Krogh Kristensen
09f60f20fc
fix code-scanning alert
2021-10-17 14:00:26 +02:00
Erik Krogh Kristensen
89979890ad
QL: fix code-scanning alert
2021-10-17 14:00:26 +02:00
Erik Krogh Kristensen
18eede5597
fix some inconsistencies related to primitive types
2021-10-17 13:38:40 +02:00
Erik Krogh Kristensen
48d4fcd064
QL: fix some inconsistencies related to primitive types
2021-10-17 13:38:40 +02:00
Erik Krogh Kristensen
9127fa533a
fix predicate resolution
2021-10-17 12:53:49 +02:00
Erik Krogh Kristensen
4db6702caa
QL: fix predicate resolution
2021-10-17 12:53:49 +02:00
Erik Krogh Kristensen
dc354f8fbf
add noResolvePredicateExpr to the list of empty consistency predicates
2021-10-17 11:59:51 +02:00
Erik Krogh Kristensen
9681119f68
QL: add noResolvePredicateExpr to the list of empty consistency predicates
2021-10-17 11:59:51 +02:00
Erik Krogh Kristensen
055937eefb
NewTypeBranches are Predicates
2021-10-17 11:58:00 +02:00
Erik Krogh Kristensen
6cec64466f
QL: NewTypeBranches are Predicates
2021-10-17 11:58:00 +02:00
Erik Krogh Kristensen
2af3fb5cca
add test for predicateExpr
2021-10-17 11:57:07 +02:00
Erik Krogh Kristensen
8ad5b34c07
QL: add test for predicateExpr
2021-10-17 11:57:07 +02:00
Erik Krogh Kristensen
9d9663d842
and consistency query that will highlight new consistency errors
2021-10-16 23:17:42 +02:00
Erik Krogh Kristensen
84d2cb84c1
QL: and consistency query that will highlight new consistency errors
2021-10-16 23:17:42 +02:00
Erik Krogh Kristensen
74b1c19a20
only resolve imports to qll files, and not e.g. dbschemes
2021-10-16 23:09:48 +02:00
Erik Krogh Kristensen
1b9793d928
QL: only resolve imports to qll files, and not e.g. dbschemes
2021-10-16 23:09:48 +02:00
Erik Krogh Kristensen
b31ea30e85
better support for getType on super
2021-10-16 22:22:52 +02:00
Erik Krogh Kristensen
a65289253e
QL: better support for getType on super
2021-10-16 22:22:52 +02:00
Erik Krogh Kristensen
f99ce113cb
resolve super-expressions when the super-type is explicitly mentioned
2021-10-16 21:55:36 +02:00
Erik Krogh Kristensen
928b91d975
QL: resolve super-expressions when the super-type is explicitly mentioned
2021-10-16 21:55:36 +02:00
Erik Krogh Kristensen
c43ff2f9d0
add test for super-types
2021-10-16 21:54:23 +02:00
Erik Krogh Kristensen
4c32b7e480
QL: add test for super-types
2021-10-16 21:54:23 +02:00
Erik Krogh Kristensen
c1b011d47c
better type resolution of add expressions
2021-10-16 21:35:02 +02:00
Erik Krogh Kristensen
34d4e55459
QL: better type resolution of add expressions
2021-10-16 21:35:02 +02:00
Erik Krogh Kristensen
2a5d567041
add test for type resolution
2021-10-16 21:32:25 +02:00
Erik Krogh Kristensen
e528c6ff90
QL: add test for type resolution
2021-10-16 21:32:25 +02:00
Erik Krogh Kristensen
6004ecc3a4
Merge pull request #125 from github/erik-krogh/fix-my-own-mistake
...
fixing the callgraph
2021-10-15 22:15:29 +02:00
Erik Krogh Kristensen
efff86e47b
QL: Merge pull request #125 from github/erik-krogh/fix-my-own-mistake
...
fixing the callgraph
2021-10-15 22:15:29 +02:00
Erik Krogh Kristensen
f19a229e6f
find dbscheme files that are contained within a subfolder
2021-10-15 21:37:23 +02:00
Erik Krogh Kristensen
865e4f0441
QL: find dbscheme files that are contained within a subfolder
2021-10-15 21:37:23 +02:00
Erik Krogh Kristensen
3b1c04b71c
correctly resolve super calls in char preds
2021-10-15 21:28:19 +02:00
Erik Krogh Kristensen
e060708367
QL: correctly resolve super calls in char preds
2021-10-15 21:28:19 +02:00
Erik Krogh Kristensen
145efa4a1a
improve resolution of buildin predicates (and getAQlClass())
2021-10-15 21:23:18 +02:00
Erik Krogh Kristensen
3252c04c38
QL: improve resolution of buildin predicates (and getAQlClass())
2021-10-15 21:23:18 +02:00
Erik Krogh Kristensen
f8138c92c5
fix getEnclosingModule, which broke the callgraph
2021-10-15 19:48:47 +02:00
Erik Krogh Kristensen
1239b1aee1
QL: fix getEnclosingModule, which broke the callgraph
2021-10-15 19:48:47 +02:00
Erik Krogh Kristensen
7ce2750c8a
add missing getChild() relations
2021-10-15 19:48:47 +02:00
Erik Krogh Kristensen
c7aa89b1d8
QL: add missing getChild() relations
2021-10-15 19:48:47 +02:00
Erik Krogh Kristensen
535904e545
add failing callgraph test
2021-10-15 19:48:45 +02:00
Erik Krogh Kristensen
b40e30790a
QL: add failing callgraph test
2021-10-15 19:48:45 +02:00
Erik Krogh Kristensen
d0aa219652
add an consistency test for the totality of getParent()
2021-10-15 19:46:51 +02:00
Erik Krogh Kristensen
8391580301
QL: add an consistency test for the totality of getParent()
2021-10-15 19:46:51 +02:00
Taus
d950b59a4d
Merge pull request #124 from github/erik-krogh/fix-step-performance
...
fix performance of the transitive step query
2021-10-15 19:11:31 +02:00
Taus
9a02a223e3
QL: Merge pull request #124 from github/erik-krogh/fix-step-performance
...
fix performance of the transitive step query
2021-10-15 19:11:31 +02:00
Mathias Vorreiter Pedersen
299500fdaa
Merge pull request #109 from github/missing-nomagic
...
QL: Query for finding missing `nomagic` on cand predicates
2021-10-15 17:59:59 +01:00
Mathias Vorreiter Pedersen
24334e4a3a
QL: Merge pull request #109 from github/missing-nomagic
...
QL: Query for finding missing `nomagic` on cand predicates
2021-10-15 17:59:59 +01:00
Erik Krogh Kristensen
62355f3f0e
fix performance of the transitive step query
2021-10-15 18:47:54 +02:00
Erik Krogh Kristensen
0bfedc74fa
QL: fix performance of the transitive step query
2021-10-15 18:47:54 +02:00
Mathias Vorreiter Pedersen
dbc3b49777
Merge branch 'main' into missing-nomagic
2021-10-15 17:26:09 +01:00
Mathias Vorreiter Pedersen
188a6b19f0
QL: Merge branch 'main' into missing-nomagic
2021-10-15 17:26:09 +01:00
Mathias Vorreiter Pedersen
df3d5aefc7
Merge pull request #119 from github/query-depends-on-tostring
...
Query: Query logic depends on `toString`
2021-10-15 16:15:54 +01:00
Mathias Vorreiter Pedersen
02c26037cb
QL: Merge pull request #119 from github/query-depends-on-tostring
...
Query: Query logic depends on `toString`
2021-10-15 16:15:54 +01:00
Mathias Vorreiter Pedersen
f5bb1d0124
QL: Respond to PR reviews.
2021-10-15 16:02:23 +01:00
Mathias Vorreiter Pedersen
4d5901a421
QL: QL: Respond to PR reviews.
2021-10-15 16:02:23 +01:00
Taus
eb787ae321
Merge pull request #95 from github/tausbn/add-override-test
...
Add test for `override`
2021-10-15 16:00:15 +02:00
Taus
d6dd752764
QL: Merge pull request #95 from github/tausbn/add-override-test
...
Add test for `override`
2021-10-15 16:00:15 +02:00
Mathias Vorreiter Pedersen
ed17bd9106
Merge pull request #123 from github/tausbn/add-instanceof-super-resolution
...
Support `super` with `instanceof`
2021-10-15 14:15:37 +01:00
Mathias Vorreiter Pedersen
5dbeaa17d6
QL: Merge pull request #123 from github/tausbn/add-instanceof-super-resolution
...
Support `super` with `instanceof`
2021-10-15 14:15:37 +01:00
Taus
5b261d88bb
Support super with instanceof
2021-10-15 12:27:24 +00:00
Taus
1375e1d9fc
QL: Support super with instanceof
2021-10-15 12:27:24 +00:00
Anders Schack-Mulligen
684600cc54
Merge pull request #104 from github/bidirectional-import
...
Query for finding missing or unwanted bidirectional imports of abstract classes
2021-10-15 14:02:58 +02:00
Anders Schack-Mulligen
370d75bedc
QL: Merge pull request #104 from github/bidirectional-import
...
Query for finding missing or unwanted bidirectional imports of abstract classes
2021-10-15 14:02:58 +02:00
Taus
8ceeb71c8e
Merge pull request #117 from github/tausbn/update-extractor-generator
...
Upgrade the extractor generator
2021-10-15 13:59:32 +02:00
Taus
7745a13efb
QL: Merge pull request #117 from github/tausbn/update-extractor-generator
...
Upgrade the extractor generator
2021-10-15 13:59:32 +02:00
Mathias Vorreiter Pedersen
1469766994
QL: Reduce precision to 'medium'.
2021-10-15 12:57:32 +01:00
Mathias Vorreiter Pedersen
21caef3d7d
QL: QL: Reduce precision to 'medium'.
2021-10-15 12:57:32 +01:00
Mathias Vorreiter Pedersen
67b65b691e
Merge pull request #122 from github/aschackmull/library-annot
...
New query: Don't use library annotation.
2021-10-15 12:56:22 +01:00
Mathias Vorreiter Pedersen
ed15ee8dfb
QL: Merge pull request #122 from github/aschackmull/library-annot
...
New query: Don't use library annotation.
2021-10-15 12:56:22 +01:00
Mathias Vorreiter Pedersen
30717310e7
Remove the dataflow library.
2021-10-15 12:40:49 +01:00
Mathias Vorreiter Pedersen
1d331fc678
QL: Remove the dataflow library.
2021-10-15 12:40:49 +01:00
Anders Schack-Mulligen
b0bbbc54d0
New query: Don't use library annotation.
2021-10-15 13:35:25 +02:00
Anders Schack-Mulligen
510f8253e5
QL: New query: Don't use library annotation.
2021-10-15 13:35:25 +02:00
Erik Krogh Kristensen
1a79b13bdc
fix performance
2021-10-15 13:32:39 +02:00
Erik Krogh Kristensen
8aa354c4c0
QL: fix performance
2021-10-15 13:32:39 +02:00
Taus
10aeadb889
Fix bad merge
2021-10-15 11:12:52 +00:00
Taus
24959a52d0
QL: Fix bad merge
2021-10-15 11:12:52 +00:00
Taus
e185382c41
Update bleeding-codeql-analysis.yml
2021-10-15 11:06:53 +00:00
Taus
6f4370a684
QL: Update bleeding-codeql-analysis.yml
2021-10-15 11:06:53 +00:00
Taus
1fb8a175f9
Merge branch 'main' into tausbn/add-override-test
2021-10-15 13:03:17 +02:00
Taus
53cbde0c44
QL: Merge branch 'main' into tausbn/add-override-test
2021-10-15 13:03:17 +02:00
Taus
ccaef199bf
Ignore overridden predicates in consistency check
2021-10-15 10:58:38 +00:00
Taus
9c82f72720
QL: Ignore overridden predicates in consistency check
2021-10-15 10:58:38 +00:00
Mathias Vorreiter Pedersen
c9f80b1052
QL: Add query for using toString in query logic.
2021-10-15 11:57:55 +01:00
Mathias Vorreiter Pedersen
d90de13bdb
QL: QL: Add query for using toString in query logic.
2021-10-15 11:57:55 +01:00
Mathias Vorreiter Pedersen
5c70c6a19b
QL: Add dataflow library.
2021-10-15 11:57:30 +01:00
Mathias Vorreiter Pedersen
4fe43155c0
QL: QL: Add dataflow library.
2021-10-15 11:57:30 +01:00
Taus
44fff659bd
Fix dataset_measure.yml, hopefully
...
Also I forgot to add `TreeSitter.qll` to the path for the build, whoops.
2021-10-15 10:53:33 +00:00
Taus
85e5b689a3
QL: Fix dataset_measure.yml, hopefully
...
Also I forgot to add `TreeSitter.qll` to the path for the build, whoops.
2021-10-15 10:53:33 +00:00
Taus
2a0c29156f
Update build.yml to supply generator args
2021-10-15 10:43:51 +00:00
Taus
e5dab0185d
QL: Update build.yml to supply generator args
2021-10-15 10:43:51 +00:00
Taus
bd5243884a
Merge pull request #116 from github/erik-krogh/qlpack-test
...
add test for qlpacks
2021-10-15 12:33:34 +02:00
Taus
4238a5be2f
QL: Merge pull request #116 from github/erik-krogh/qlpack-test
...
add test for qlpacks
2021-10-15 12:33:34 +02:00
Taus
89d2f93a16
Merge branch 'main' into tausbn/update-extractor-generator
2021-10-15 12:28:01 +02:00
Taus
b75e19a446
QL: Merge branch 'main' into tausbn/update-extractor-generator
2021-10-15 12:28:01 +02:00
Anders Schack-Mulligen
6c70f5299d
Remove some FPs.
2021-10-15 12:05:02 +02:00
Anders Schack-Mulligen
3fc0bed9b5
QL: Remove some FPs.
2021-10-15 12:05:02 +02:00
Taus
5ef7b9797e
Also update qltest.cmd
2021-10-15 09:34:14 +00:00
Taus
514f8f3344
QL: Also update qltest.cmd
2021-10-15 09:34:14 +00:00
Taus
310ea6b69c
Merge pull request #112 from github/tausbn/import-language-first
...
Query: Noninitial imports of the standard library
2021-10-15 11:30:02 +02:00
Taus
53e362c994
QL: Merge pull request #112 from github/tausbn/import-language-first
...
Query: Noninitial imports of the standard library
2021-10-15 11:30:02 +02:00
Erik Krogh Kristensen
741e4a7a38
add test for qlpacks, and get them to work
2021-10-15 11:24:18 +02:00
Erik Krogh Kristensen
0954584743
QL: add test for qlpacks, and get them to work
2021-10-15 11:24:18 +02:00
Taus
7f80514144
Autoformat
2021-10-15 09:21:24 +00:00
Taus
8020040b4f
QL: Autoformat
2021-10-15 09:21:24 +00:00
Taus
816bfbe4ea
Upgrade the extractor generator
...
For now, the grammar still includes dbscheme and YAML, but with this
change we should be able to separate these out into their own grammars.
2021-10-15 09:16:34 +00:00
Taus
9f4c829b3e
QL: Upgrade the extractor generator
...
For now, the grammar still includes dbscheme and YAML, but with this
change we should be able to separate these out into their own grammars.
2021-10-15 09:16:34 +00:00
Erik Krogh Kristensen
e3d42a1fba
remove leftover test predicate
2021-10-15 10:58:44 +02:00
Erik Krogh Kristensen
6fe7579fc3
QL: remove leftover test predicate
2021-10-15 10:58:44 +02:00
Geoffrey White
ee7ac53bf6
Merge pull request #107 from github/missing-qldoc
...
Add ql/missing-qldoc query.
2021-10-15 09:41:45 +01:00
Geoffrey White
2f77b921a0
QL: Merge pull request #107 from github/missing-qldoc
...
Add ql/missing-qldoc query.
2021-10-15 09:41:45 +01:00
Erik Krogh Kristensen
e6b07070f6
Merge pull request #102 from github/esbena/simple-codeql-action
...
make another codeql-action workflow that uses a published pack
2021-10-15 10:32:19 +02:00
Erik Krogh Kristensen
e862dfd3dc
QL: Merge pull request #102 from github/esbena/simple-codeql-action
...
make another codeql-action workflow that uses a published pack
2021-10-15 10:32:19 +02:00
Taus
fed640b21f
Merge pull request #114 from github/erik-krogh/consistency
...
fix the signature of regexpCapture and regexpFind
2021-10-15 10:12:19 +02:00
Taus
2352cf7a26
QL: Merge pull request #114 from github/erik-krogh/consistency
...
fix the signature of regexpCapture and regexpFind
2021-10-15 10:12:19 +02:00
Mathias Vorreiter Pedersen
e1871a2508
Merge pull request #86 from github/use-set-literal
...
New query: Use set literal
2021-10-15 08:55:30 +01:00
Mathias Vorreiter Pedersen
8e6bc11197
QL: Merge pull request #86 from github/use-set-literal
...
New query: Use set literal
2021-10-15 08:55:30 +01:00
Erik Krogh Kristensen
541dcb365f
hook up consistency query
2021-10-15 09:31:54 +02:00
Erik Krogh Kristensen
ddc0ade28c
QL: hook up consistency query
2021-10-15 09:31:54 +02:00
Erik Krogh Kristensen
29ebe7b13d
add test
2021-10-15 09:31:54 +02:00
Erik Krogh Kristensen
f071da499b
QL: add test
2021-10-15 09:31:54 +02:00
Erik Krogh Kristensen
1641d0fa93
update expected output
2021-10-15 09:31:54 +02:00
Erik Krogh Kristensen
6cd11d2e13
QL: update expected output
2021-10-15 09:31:54 +02:00
Erik Krogh Kristensen
f19dd78d40
fix getArity on PredicateOrBuiltin
2021-10-15 09:31:53 +02:00
Erik Krogh Kristensen
74a7945995
QL: fix getArity on PredicateOrBuiltin
2021-10-15 09:31:53 +02:00
Erik Krogh Kristensen
c31bd7a1e8
fix the signature of regexpCapture and regexpFind
2021-10-15 09:31:31 +02:00
Erik Krogh Kristensen
153f8fec0e
QL: fix the signature of regexpCapture and regexpFind
2021-10-15 09:31:31 +02:00
Mathias Vorreiter Pedersen
50e80dc8b7
Merge pull request #113 from github/erik-krogh/fix-implcit-this
...
fix implicit this
2021-10-15 08:28:19 +01:00
Mathias Vorreiter Pedersen
f29457f4ca
QL: Merge pull request #113 from github/erik-krogh/fix-implcit-this
...
fix implicit this
2021-10-15 08:28:19 +01:00
Erik Krogh Kristensen
016ff2af63
fix implicit this
2021-10-14 22:37:17 +02:00
Erik Krogh Kristensen
f9d8ae588c
QL: fix implicit this
2021-10-14 22:37:17 +02:00
Taus
71f69997e2
Autoformat
2021-10-14 16:06:19 +00:00
Taus
632d42fe68
QL: Autoformat
2021-10-14 16:06:19 +00:00
Taus
c6a52ed2ea
Query: Noninitial imports of the standard library
...
Finds a single result in
```
semmle.code.java.dataflow.internal.rangeanalysis.SignAnalysisSpecific.qll
```
which starts with
```ql
module Private {
import semmle.code.java.dataflow.RangeUtils as RU
private import semmle.code.java.dataflow.SSA as Ssa
private import semmle.code.java.controlflow.Guards as G
private import java as J
private import Sign
...
```
2021-10-14 15:44:23 +00:00
Taus
37e9024343
QL: Query: Noninitial imports of the standard library
...
Finds a single result in
```
semmle.code.java.dataflow.internal.rangeanalysis.SignAnalysisSpecific.qll
```
which starts with
```ql
module Private {
import semmle.code.java.dataflow.RangeUtils as RU
private import semmle.code.java.dataflow.SSA as Ssa
private import semmle.code.java.controlflow.Guards as G
private import java as J
private import Sign
...
```
2021-10-14 15:44:23 +00:00
Mathias Vorreiter Pedersen
4016a8e458
QL: Add query for finding missing nomagic on candidate predicates.
2021-10-14 15:46:22 +01:00
Mathias Vorreiter Pedersen
187c24e260
QL: QL: Add query for finding missing nomagic on candidate predicates.
2021-10-14 15:46:22 +01:00
Geoffrey White
0a3705b7af
Add ql/missing-qldoc query.
2021-10-14 15:45:03 +01:00
Geoffrey White
ecf27ff24b
QL: Add ql/missing-qldoc query.
2021-10-14 15:45:03 +01:00
Mathias Vorreiter Pedersen
3e2fb5a64e
Merge pull request #105 from github/aschackmull/transitive-step
...
New performance query: Transitive step in recursion.
2021-10-14 15:28:33 +01:00
Mathias Vorreiter Pedersen
9330fa0f69
QL: Merge pull request #105 from github/aschackmull/transitive-step
...
New performance query: Transitive step in recursion.
2021-10-14 15:28:33 +01:00
Joe Farebrother
9b786c27c0
Fix isAbstract
2021-10-14 15:03:19 +01:00
Joe Farebrother
be36de9b0a
QL: Fix isAbstract
2021-10-14 15:03:19 +01:00
Joe Farebrother
ec6a8b933c
Query for finding missing or unwanted bidirectional imports of abstract classes
2021-10-14 15:02:08 +01:00
Joe Farebrother
1013cb4ccb
QL: Query for finding missing or unwanted bidirectional imports of abstract classes
2021-10-14 15:02:08 +01:00
Anders Schack-Mulligen
ec292dbffd
New performance query: Transitive step in recursion.
2021-10-14 15:42:40 +02:00
Anders Schack-Mulligen
dfa0e77e39
QL: New performance query: Transitive step in recursion.
2021-10-14 15:42:40 +02:00
Esben Sparre Andreasen
ab11bce776
document usage
2021-10-14 15:34:54 +02:00
Esben Sparre Andreasen
72d1473581
QL: document usage
2021-10-14 15:34:54 +02:00
Geoffrey White
76880e8f93
Autoformat and fix test.
2021-10-14 14:31:42 +01:00
Geoffrey White
e510593aa0
QL: Autoformat and fix test.
2021-10-14 14:31:42 +01:00
Esben Sparre Andreasen
d23de3dcd8
make another codeql-action workflow that uses a published pack
2021-10-14 15:29:06 +02:00
Esben Sparre Andreasen
b611b5100b
QL: make another codeql-action workflow that uses a published pack
2021-10-14 15:29:06 +02:00
Geoffrey White
6af28e37ae
We can use PredicateOrBuiltin now.
2021-10-14 13:59:47 +01:00
Geoffrey White
6d313cfb6b
QL: We can use PredicateOrBuiltin now.
2021-10-14 13:59:47 +01:00
Geoffrey White
9b52ad2d3d
Work around import of internal file.
2021-10-14 13:59:40 +01:00
Geoffrey White
fe8b466ff0
QL: Work around import of internal file.
2021-10-14 13:59:40 +01:00
Geoffrey White
a665e94805
Merge branch 'main' into use-set-literal
2021-10-14 13:55:40 +01:00
Geoffrey White
df972eeb05
QL: Merge branch 'main' into use-set-literal
2021-10-14 13:55:40 +01:00
Mathias Vorreiter Pedersen
78caab4214
Merge pull request #81 from github/doc-style
...
Add some queries for qldoc style
2021-10-14 13:46:48 +01:00
Mathias Vorreiter Pedersen
1762394b9b
QL: Merge pull request #81 from github/doc-style
...
Add some queries for qldoc style
2021-10-14 13:46:48 +01:00
Mathias Vorreiter Pedersen
9a15feae29
Merge pull request #89 from github/esbena/proper-bundle
...
Attempt to use a proper query pack
2021-10-14 13:24:14 +01:00
Mathias Vorreiter Pedersen
4e73b9a30f
QL: Merge pull request #89 from github/esbena/proper-bundle
...
Attempt to use a proper query pack
2021-10-14 13:24:14 +01:00
Esben Sparre Andreasen
a64660aae1
build a query pack separately, with a compilation cache
2021-10-14 14:09:01 +02:00
Esben Sparre Andreasen
aeabe67812
QL: build a query pack separately, with a compilation cache
2021-10-14 14:09:01 +02:00
Anders Schack-Mulligen
d7fd1e0718
Merge pull request #80 from github/aschackmull/calltarget-astnode
...
Refactor Call.getTarget to be an AstNode
2021-10-14 13:35:50 +02:00
Anders Schack-Mulligen
9a500eecb9
QL: Merge pull request #80 from github/aschackmull/calltarget-astnode
...
Refactor Call.getTarget to be an AstNode
2021-10-14 13:35:50 +02:00
Anders Schack-Mulligen
c0f1d365ba
This is slightly faster without magic.
2021-10-14 13:12:26 +02:00
Anders Schack-Mulligen
dfa6f285e5
QL: This is slightly faster without magic.
2021-10-14 13:12:26 +02:00
Anders Schack-Mulligen
cd3839f621
Fix semantic merge conflict
2021-10-14 13:12:11 +02:00
Anders Schack-Mulligen
63b844856d
QL: Fix semantic merge conflict
2021-10-14 13:12:11 +02:00
Joe Farebrother
b4a05804fa
Also allow deprecated headers
2021-10-14 12:09:19 +01:00
Joe Farebrother
97db13beb4
QL: Also allow deprecated headers
2021-10-14 12:09:19 +01:00
Joe Farebrother
0f71066aaa
Allow comments preceded by INTERNAL
2021-10-14 12:09:19 +01:00
Joe Farebrother
896eca684e
QL: Allow comments preceded by INTERNAL
2021-10-14 12:09:19 +01:00
Joe Farebrother
fd3c53da9b
Add query for class docs that don't start with an article.
...
Returns quite a few results, many of which seem to be TPs.
2021-10-14 12:09:18 +01:00
Joe Farebrother
f872ed13e3
QL: Add query for class docs that don't start with an article.
...
Returns quite a few results, many of which seem to be TPs.
2021-10-14 12:09:18 +01:00
Joe Farebrother
323ccc8cea
Add query to find non US spelling
2021-10-14 12:09:18 +01:00
Joe Farebrother
4cb4073dd7
QL: Add query to find non US spelling
2021-10-14 12:09:18 +01:00
Anders Schack-Mulligen
350620d44a
Fix bad magic.
2021-10-14 13:07:53 +02:00
Anders Schack-Mulligen
220f4b373c
QL: Fix bad magic.
2021-10-14 13:07:53 +02:00
Anders Schack-Mulligen
6b4dbc3fe5
Fix compile error.
2021-10-14 13:07:53 +02:00
Anders Schack-Mulligen
2c01b54a49
QL: Fix compile error.
2021-10-14 13:07:53 +02:00
Anders Schack-Mulligen
ff3aba0f5d
Adjust expected output.
2021-10-14 13:07:53 +02:00
Anders Schack-Mulligen
862706f709
QL: Adjust expected output.
2021-10-14 13:07:53 +02:00
Anders Schack-Mulligen
ffc25f8f89
Fix semantic merge conflict.
2021-10-14 13:06:41 +02:00
Anders Schack-Mulligen
744c3447c9
QL: Fix semantic merge conflict.
2021-10-14 13:06:41 +02:00
Anders Schack-Mulligen
41a0bf154f
Move some AstNodes to Ast.qll, fix compilation error.
2021-10-14 13:06:41 +02:00
Anders Schack-Mulligen
946968b37c
QL: Move some AstNodes to Ast.qll, fix compilation error.
2021-10-14 13:06:41 +02:00
Anders Schack-Mulligen
7955a8b6c8
Refactor
2021-10-14 13:06:41 +02:00
Anders Schack-Mulligen
69cf373f21
QL: Refactor
2021-10-14 13:06:41 +02:00
Mathias Vorreiter Pedersen
3d0917e6fc
Merge pull request #96 from github/erik-krogh/dont-use-getaqlclass
...
add query to detect uses of getAQlClass
2021-10-14 12:06:00 +01:00
Mathias Vorreiter Pedersen
09d727f343
QL: Merge pull request #96 from github/erik-krogh/dont-use-getaqlclass
...
add query to detect uses of getAQlClass
2021-10-14 12:06:00 +01:00
Erik Krogh Kristensen
6af27c23ec
lowercase query id
2021-10-14 12:59:27 +02:00
Erik Krogh Kristensen
5fc1b8bb29
QL: lowercase query id
2021-10-14 12:59:27 +02:00
Erik Krogh Kristensen
949ead913f
add query to detect uses of getAQlClass
2021-10-14 12:59:27 +02:00
Erik Krogh Kristensen
e167554ad9
QL: add query to detect uses of getAQlClass
2021-10-14 12:59:27 +02:00
Mathias Vorreiter Pedersen
486fc453e7
Merge pull request #99 from github/missing-noinline
...
Add query: Missing `noinline`
2021-10-14 11:37:16 +01:00
Mathias Vorreiter Pedersen
b46dfc076d
QL: Merge pull request #99 from github/missing-noinline
...
Add query: Missing `noinline`
2021-10-14 11:37:16 +01:00
Mathias Vorreiter Pedersen
626ec4d209
QL: Accept test changes.
2021-10-14 11:28:40 +01:00
Mathias Vorreiter Pedersen
7bcc906d67
QL: QL: Accept test changes.
2021-10-14 11:28:40 +01:00
Mathias Vorreiter Pedersen
3e3ad8e5d4
Merge branch 'main' into missing-noinline
2021-10-14 11:08:05 +01:00
Mathias Vorreiter Pedersen
d4b9c36343
QL: Merge branch 'main' into missing-noinline
2021-10-14 11:08:05 +01:00
Mathias Vorreiter Pedersen
deffeff01c
Merge pull request #97 from github/fix-spurious-exists-mistakes
...
QL: Respond to PR reviews for #87
2021-10-14 11:03:36 +01:00
Mathias Vorreiter Pedersen
8e1494b91a
QL: Merge pull request #97 from github/fix-spurious-exists-mistakes
...
QL: Respond to PR reviews for #87
2021-10-14 11:03:36 +01:00
Mathias Vorreiter Pedersen
2f7272d1ed
QL: Add a query that finds missing noinline or nomagic annotations.
2021-10-14 11:00:26 +01:00
Mathias Vorreiter Pedersen
f4d35f6afe
QL: QL: Add a query that finds missing noinline or nomagic annotations.
2021-10-14 11:00:26 +01:00
Mathias Vorreiter Pedersen
c900118731
QL: Model QL annotations.
2021-10-14 10:59:25 +01:00
Mathias Vorreiter Pedersen
c9bfd85c0d
QL: QL: Model QL annotations.
2021-10-14 10:59:25 +01:00
Joe Farebrother
9749f797c8
Merge pull request #70 from github/dont-mention-this
...
Query to find member predicates that don't depend on `this`
2021-10-14 10:49:49 +01:00
Joe Farebrother
ed87d77bc5
QL: Merge pull request #70 from github/dont-mention-this
...
Query to find member predicates that don't depend on `this`
2021-10-14 10:49:49 +01:00
Mathias Vorreiter Pedersen
ed5960e015
QL: Respond to PR reviews.
2021-10-14 10:48:54 +01:00
Mathias Vorreiter Pedersen
4406065807
QL: QL: Respond to PR reviews.
2021-10-14 10:48:54 +01:00
Mathias Vorreiter Pedersen
7d9c408af4
Merge pull request #87 from github/mathiasvp/superfluous-exists
...
New query: Unnecessary 'exists'
2021-10-14 10:23:53 +01:00
Mathias Vorreiter Pedersen
dd6abdc06b
QL: Merge pull request #87 from github/mathiasvp/superfluous-exists
...
New query: Unnecessary 'exists'
2021-10-14 10:23:53 +01:00
Taus
5a519c5089
Add test for override
...
This test demonstrates that our handling of `override` is incorrect.
Quick-eval'ing the `test` predicate produces the following output:
| f | i | j |
+---+-----+-----+
| 1 | 10 | 10 |
| 1 | 10 | 100 |
| 1 | 100 | 10 |
| 1 | 100 | 100 |
| 2 | 20 | 20 |
| 3 | 3 | 3 |
this demonstrates that `f.bar` and `f.baz` can resolve to all predicates
of that name in the file.
However, at present we only capture the calls to members on `Foo`.
2021-10-14 09:14:59 +00:00
Taus
b5bef24ce2
QL: Add test for override
...
This test demonstrates that our handling of `override` is incorrect.
Quick-eval'ing the `test` predicate produces the following output:
| f | i | j |
+---+-----+-----+
| 1 | 10 | 10 |
| 1 | 10 | 100 |
| 1 | 100 | 10 |
| 1 | 100 | 100 |
| 2 | 20 | 20 |
| 3 | 3 | 3 |
this demonstrates that `f.bar` and `f.baz` can resolve to all predicates
of that name in the file.
However, at present we only capture the calls to members on `Foo`.
2021-10-14 09:14:59 +00:00
Erik Krogh Kristensen
f7ff83c2e7
Merge pull request #93 from github/aschackmull/delete-vscode-file
...
Delete this file that vscode keeps changing for me.
2021-10-14 11:01:33 +02:00
Erik Krogh Kristensen
fb491c392e
QL: Merge pull request #93 from github/aschackmull/delete-vscode-file
...
Delete this file that vscode keeps changing for me.
2021-10-14 11:01:33 +02:00
Anders Schack-Mulligen
11fd4f4997
Delete this file that vscode keeps changing for me.
2021-10-14 10:59:39 +02:00
Anders Schack-Mulligen
56d9c351d5
QL: Delete this file that vscode keeps changing for me.
2021-10-14 10:59:39 +02:00
Mathias Vorreiter Pedersen
bff9665866
Merge branch 'main' into mathiasvp/superfluous-exists
2021-10-14 09:49:40 +01:00
Mathias Vorreiter Pedersen
1762b4fb91
QL: Merge branch 'main' into mathiasvp/superfluous-exists
2021-10-14 09:49:40 +01:00
Taus
f0a8c77095
Merge pull request #91 from github/tausbn/fix-parsing-of-unique
...
Fix parsing of `unique`
2021-10-14 10:21:49 +02:00
Taus
2cedddfce8
QL: Merge pull request #91 from github/tausbn/fix-parsing-of-unique
...
Fix parsing of `unique`
2021-10-14 10:21:49 +02:00
Taus
a5fcc5c15a
Fix parsing of unique
2021-10-14 08:09:13 +00:00
Taus
5d975089c1
QL: Fix parsing of unique
2021-10-14 08:09:13 +00:00
Mathias Vorreiter Pedersen
455a34a1ec
Merge pull request #77 from github/erik-krogh/qlpacks
...
add pretty AST for YAML and a QLPack utility class
2021-10-14 08:42:52 +01:00
Mathias Vorreiter Pedersen
18c427cddc
QL: Merge pull request #77 from github/erik-krogh/qlpacks
...
add pretty AST for YAML and a QLPack utility class
2021-10-14 08:42:52 +01:00
Mathias Vorreiter Pedersen
e46ccc072e
Merge pull request #82 from github/esbena/codeql-action-on-other-repos
2021-10-14 07:44:15 +01:00
Mathias Vorreiter Pedersen
238fba9b6e
QL: Merge pull request #82 from github/esbena/codeql-action-on-other-repos
2021-10-14 07:44:15 +01:00
Esben Sparre Andreasen
0ff2de9b5e
restrict the queries that are run by default
2021-10-14 08:12:04 +02:00
Esben Sparre Andreasen
b0cbb31895
QL: restrict the queries that are run by default
2021-10-14 08:12:04 +02:00
Esben Sparre Andreasen
98b359bd9a
Add codeql-go sources ( abe3f2148b)
2021-10-14 08:09:51 +02:00
Esben Sparre Andreasen
3039206eab
QL: Add codeql-go sources ( abe3f2148b)
2021-10-14 08:09:51 +02:00
Esben Sparre Andreasen
53e17e7835
Add codeql sources ( a2371370ff)
2021-10-14 08:09:51 +02:00
Esben Sparre Andreasen
808fd78d96
QL: Add codeql sources ( a2371370ff)
2021-10-14 08:09:51 +02:00
Esben Sparre Andreasen
9826e7df1d
Add codeql-ruby sources ( 236643fc43)
2021-10-14 08:09:50 +02:00
Esben Sparre Andreasen
946c572413
QL: Add codeql-ruby sources ( 236643fc43)
2021-10-14 08:09:50 +02:00
Esben Sparre Andreasen
d9f38826f7
Implement import-repositories.sh
2021-10-14 08:09:50 +02:00
Esben Sparre Andreasen
d8e1e3e8c0
QL: Implement import-repositories.sh
2021-10-14 08:09:50 +02:00
Mathias Vorreiter Pedersen
c5bcb7999e
QL: Complete the GVN library.
2021-10-13 22:48:45 +01:00
Mathias Vorreiter Pedersen
c21df48bcd
QL: QL: Complete the GVN library.
2021-10-13 22:48:45 +01:00
Erik Krogh Kristensen
5e7adc661f
autoformat
2021-10-13 20:26:40 +02:00
Erik Krogh Kristensen
4958b8ba0d
QL: autoformat
2021-10-13 20:26:40 +02:00
Mathias Vorreiter Pedersen
5b881c2151
Merge pull request #73 from github/tausbn/add-implicit-this-query
...
Add "implicit `this`" query
2021-10-13 17:36:02 +01:00
Mathias Vorreiter Pedersen
ce3a531daf
QL: Merge pull request #73 from github/tausbn/add-implicit-this-query
...
Add "implicit `this`" query
2021-10-13 17:36:02 +01:00
Mathias Vorreiter Pedersen
c3141125af
QL: Add a query that finds unnecessary 'exists'.
2021-10-13 17:31:29 +01:00
Mathias Vorreiter Pedersen
a917f240cf
QL: QL: Add a query that finds unnecessary 'exists'.
2021-10-13 17:31:29 +01:00
Mathias Vorreiter Pedersen
2543b720e6
QL: Add a basic GVN library.
2021-10-13 17:26:26 +01:00
Mathias Vorreiter Pedersen
690b7ef617
QL: QL: Add a basic GVN library.
2021-10-13 17:26:26 +01:00
Mathias Vorreiter Pedersen
c577817882
QL: Add some convenience predicates in 'Ast.qll' and move a couple of the predicates from subclasses of 'BinOpExpr' into 'BinOpExpr'.
2021-10-13 17:26:00 +01:00
Mathias Vorreiter Pedersen
4795cbb849
QL: QL: Add some convenience predicates in 'Ast.qll' and move a couple of the predicates from subclasses of 'BinOpExpr' into 'BinOpExpr'.
2021-10-13 17:26:00 +01:00
Mathias Vorreiter Pedersen
4c4fd52347
QL: Add some more model classes that represent builtin QL classes.
2021-10-13 17:24:27 +01:00
Mathias Vorreiter Pedersen
d7f08703af
QL: QL: Add some more model classes that represent builtin QL classes.
2021-10-13 17:24:27 +01:00
Erik Krogh Kristensen
31394878a2
resolve calls to db relations
2021-10-13 17:03:24 +02:00
Erik Krogh Kristensen
b31f705ffc
QL: resolve calls to db relations
2021-10-13 17:03:24 +02:00
Taus
06ba078ef2
Merge pull request #83 from github/tausbn/fix-missing-override-fps
...
Fix "missing override" FPs
2021-10-13 16:36:18 +02:00
Taus
823c24a7ab
QL: Merge pull request #83 from github/tausbn/fix-missing-override-fps
...
Fix "missing override" FPs
2021-10-13 16:36:18 +02:00
Erik Krogh Kristensen
1a1770fc06
resolve imports across qlpacks
2021-10-13 16:20:07 +02:00
Erik Krogh Kristensen
bc74af7307
QL: resolve imports across qlpacks
2021-10-13 16:20:07 +02:00
Taus
bd01d92500
Fix "missing override" FPs
...
This brings the analysis back to the level it was at before the addition
of `instanceof`.
2021-10-13 14:07:24 +00:00
Taus
cc43230244
QL: Fix "missing override" FPs
...
This brings the analysis back to the level it was at before the addition
of `instanceof`.
2021-10-13 14:07:24 +00:00
Geoffrey White
0704ab7bd3
Add tests.
2021-10-13 15:00:54 +01:00
Geoffrey White
7c02b6a3b2
QL: Add tests.
2021-10-13 15:00:54 +01:00
Geoffrey White
c8c23a6eb4
Support hasName(x) pattern as well.
2021-10-13 15:00:54 +01:00
Geoffrey White
161461eb6f
QL: Support hasName(x) pattern as well.
2021-10-13 15:00:54 +01:00
Geoffrey White
e6242fd349
Add ql/use-set-literal query.
2021-10-13 15:00:54 +01:00
Geoffrey White
d933bf6f24
QL: Add ql/use-set-literal query.
2021-10-13 15:00:54 +01:00
Anders Schack-Mulligen
dd4f6edd62
Merge pull request #75 from github/aschackmull/isclosure
...
Expose transitive closure syntax.
2021-10-13 15:45:20 +02:00
Anders Schack-Mulligen
4b73c99c56
QL: Merge pull request #75 from github/aschackmull/isclosure
...
Expose transitive closure syntax.
2021-10-13 15:45:20 +02:00
Mathias Vorreiter Pedersen
43b1185d82
Merge pull request #79 from github/esbena/fix-1
...
fix getAPrimaryQlClass: SuperAccess -> Super
2021-10-13 14:44:25 +01:00
Mathias Vorreiter Pedersen
366fc23938
QL: Merge pull request #79 from github/esbena/fix-1
...
fix getAPrimaryQlClass: SuperAccess -> Super
2021-10-13 14:44:25 +01:00
Esben Sparre Andreasen
3e7b82a02a
fix getAPrimaryQlClass: SuperAccess -> Super
2021-10-13 15:38:16 +02:00
Esben Sparre Andreasen
64a3ffdca7
QL: fix getAPrimaryQlClass: SuperAccess -> Super
2021-10-13 15:38:16 +02:00
Erik Krogh Kristensen
06f2345bbb
add pretty AST for YAML and a QLPack utility class
2021-10-13 15:35:14 +02:00
Erik Krogh Kristensen
236989f6fd
QL: add pretty AST for YAML and a QLPack utility class
2021-10-13 15:35:14 +02:00
Mathias Vorreiter Pedersen
aef394e2d1
Merge pull request #62 from github/if-with-none
...
QL: Add query that finds 'if p() then q() else none()'
2021-10-13 14:29:15 +01:00
Mathias Vorreiter Pedersen
d2222ee9f2
QL: Merge pull request #62 from github/if-with-none
...
QL: Add query that finds 'if p() then q() else none()'
2021-10-13 14:29:15 +01:00
Esben Sparre Andreasen
b8d26abbc2
Merge pull request #64 from github/esbena/codeql-action-support
...
CodeQL-action to work with QL-for-QL
2021-10-13 15:24:13 +02:00
Esben Sparre Andreasen
d41331b28b
QL: Merge pull request #64 from github/esbena/codeql-action-support
...
CodeQL-action to work with QL-for-QL
2021-10-13 15:24:13 +02:00
Esben Sparre Andreasen
85a35544af
add workflow with codeql-action
2021-10-13 15:21:08 +02:00
Esben Sparre Andreasen
5e1f565b6a
QL: add workflow with codeql-action
2021-10-13 15:21:08 +02:00
Taus
e524076045
Extend the tests slightly
...
Adds a test for when the call is to an outer, non-member predicate.
2021-10-13 13:03:30 +00:00
Taus
d0cb1384a9
QL: Extend the tests slightly
...
Adds a test for when the call is to an outer, non-member predicate.
2021-10-13 13:03:30 +00:00
Anders Schack-Mulligen
94dbf2b7b4
Expose transitive closure syntax.
2021-10-13 12:48:38 +00:00
Anders Schack-Mulligen
7d68020c7b
QL: Expose transitive closure syntax.
2021-10-13 12:48:38 +00:00
Taus
bc5e0924d2
Add tests for "implicit this"
2021-10-13 12:27:20 +00:00
Taus
a0e2bd57a7
QL: Add tests for "implicit this"
2021-10-13 12:27:20 +00:00
Taus
48cfa9665a
Add "implicit this" query
2021-10-13 12:08:19 +00:00
Taus
fb5513c1c8
QL: Add "implicit this" query
2021-10-13 12:08:19 +00:00
Mathias Vorreiter Pedersen
95ea619cc4
Merge pull request #69 from github/erik-krogh/perf
...
fix two bad join orders
2021-10-13 12:53:12 +01:00
Mathias Vorreiter Pedersen
d1721d0bcd
QL: Merge pull request #69 from github/erik-krogh/perf
...
fix two bad join orders
2021-10-13 12:53:12 +01:00
Taus
2d412d63e0
Merge pull request #71 from github/tausbn/more-yaml-hacking
...
"Parse" YAML without errors
2021-10-13 13:51:20 +02:00
Taus
411faca6ef
QL: Merge pull request #71 from github/tausbn/more-yaml-hacking
...
"Parse" YAML without errors
2021-10-13 13:51:20 +02:00
Geoffrey White
3dab87e6ca
Merge pull request #48 from github/extractor-pack
...
Make the create-extractor-pack.ps1 script more reliable.
2021-10-13 12:38:10 +01:00
Geoffrey White
ca81110e4b
QL: Merge pull request #48 from github/extractor-pack
...
Make the create-extractor-pack.ps1 script more reliable.
2021-10-13 12:38:10 +01:00
Erik Krogh Kristensen
4cb004c0c6
autoformat
2021-10-13 13:34:47 +02:00
Erik Krogh Kristensen
15679dfec6
QL: autoformat
2021-10-13 13:34:47 +02:00
Erik Krogh Kristensen
705e24690f
cache getClassPredicate
2021-10-13 13:26:37 +02:00
Erik Krogh Kristensen
09862b9fe7
QL: cache getClassPredicate
2021-10-13 13:26:37 +02:00
Taus
7034933cee
"Parse" YAML without errors
2021-10-13 11:24:26 +00:00
Taus
30040680ec
QL: "Parse" YAML without errors
2021-10-13 11:24:26 +00:00
Joe Farebrother
1b4130fe97
Add check for predicates with an override annotation
2021-10-13 12:22:46 +01:00
Joe Farebrother
c3493d6fde
QL: Add check for predicates with an override annotation
2021-10-13 12:22:46 +01:00
Erik Krogh Kristensen
584702058d
fix two bad join orders
2021-10-13 13:20:41 +02:00
Erik Krogh Kristensen
932f00b43e
QL: fix two bad join orders
2021-10-13 13:20:41 +02:00
Joe Farebrother
33bd267eb0
"doesn't mention this" query
2021-10-13 12:09:04 +01:00
Joe Farebrother
d474a76cf0
QL: "doesn't mention this" query
2021-10-13 12:09:04 +01:00
Anders Schack-Mulligen
1f6eb6e763
Merge pull request #55 from github/mathiasvp/prefix-or-suffix-in-comparison
...
New query: Find uses of '.prefix' or '.suffix' when comparing against string literals
2021-10-13 12:45:12 +02:00
Anders Schack-Mulligen
3ed7f9664c
QL: Merge pull request #55 from github/mathiasvp/prefix-or-suffix-in-comparison
...
New query: Find uses of '.prefix' or '.suffix' when comparing against string literals
2021-10-13 12:45:12 +02:00
Anders Schack-Mulligen
35f6c598e7
Merge pull request #54 from github/aschackmull/singleton-set
...
New query: Singleton set literal.
2021-10-13 12:43:41 +02:00
Anders Schack-Mulligen
87910e80af
QL: Merge pull request #54 from github/aschackmull/singleton-set
...
New query: Singleton set literal.
2021-10-13 12:43:41 +02:00
Geoffrey White
ddc7794c8d
Merge branch 'main' into extractor-pack
2021-10-13 11:40:26 +01:00
Geoffrey White
1265c3fbed
QL: Merge branch 'main' into extractor-pack
2021-10-13 11:40:26 +01:00
Philip Ginsbach
14fae833cb
Merge pull request #65 from github/ginsbach/SuggestInstanceof
...
Suggest instanceof extensions
2021-10-13 11:33:41 +01:00
Philip Ginsbach
fed3d80a3d
QL: Merge pull request #65 from github/ginsbach/SuggestInstanceof
...
Suggest instanceof extensions
2021-10-13 11:33:41 +01:00
Erik Krogh Kristensen
88c003681b
Merge pull request #61 from github/aschackmull/extends-formula
...
Add missing extends Formula
2021-10-13 12:33:29 +02:00
Erik Krogh Kristensen
6b901429d0
QL: Merge pull request #61 from github/aschackmull/extends-formula
...
Add missing extends Formula
2021-10-13 12:33:29 +02:00
Erik Krogh Kristensen
6e274f640f
Merge pull request #63 from github/erik-krogh/disable-windows
...
disable windows CI
2021-10-13 12:28:13 +02:00
Erik Krogh Kristensen
0060fcbfd7
QL: Merge pull request #63 from github/erik-krogh/disable-windows
...
disable windows CI
2021-10-13 12:28:13 +02:00
Erik Krogh Kristensen
79c51625a8
disable windows part 3
2021-10-13 12:10:02 +02:00
Erik Krogh Kristensen
42bf00f17e
QL: disable windows part 3
2021-10-13 12:10:02 +02:00
Philip Ginsbach
754bf84abe
suggest replacing 'this instanceof ...' in constructor with non-extending subtypes
2021-10-13 11:06:59 +01:00
Philip Ginsbach
9ae0aad46d
QL: suggest replacing 'this instanceof ...' in constructor with non-extending subtypes
2021-10-13 11:06:59 +01:00
Erik Krogh Kristensen
256af31b38
disable windows part 2
2021-10-13 12:05:17 +02:00
Erik Krogh Kristensen
bd6825833d
QL: disable windows part 2
2021-10-13 12:05:17 +02:00
Mathias Vorreiter Pedersen
af3ae3f1fa
QL: Respond to PR comments.
2021-10-13 09:57:05 +00:00
Mathias Vorreiter Pedersen
df20f84ae2
QL: QL: Respond to PR comments.
2021-10-13 09:57:05 +00:00
Erik Krogh Kristensen
825c1c4407
disable windows CI
2021-10-13 11:54:03 +02:00
Erik Krogh Kristensen
9b36fdf9bd
QL: disable windows CI
2021-10-13 11:54:03 +02:00
Mathias Vorreiter Pedersen
c3f9d584a4
QL: Add query that finds 'if p() then q() else none()'.
2021-10-13 09:48:57 +00:00
Mathias Vorreiter Pedersen
6c7d848727
QL: QL: Add query that finds 'if p() then q() else none()'.
2021-10-13 09:48:57 +00:00
Anders Schack-Mulligen
7bd0bf9908
Add missing extends Formula
2021-10-13 09:47:10 +00:00
Anders Schack-Mulligen
01ef4d7060
QL: Add missing extends Formula
2021-10-13 09:47:10 +00:00
Mathias Vorreiter Pedersen
81e88f8d34
QL: Actually use the SuffixPredicateCall class as well. Now the query finds 20 results.
2021-10-13 09:31:45 +00:00
Mathias Vorreiter Pedersen
e927c43222
QL: QL: Actually use the SuffixPredicateCall class as well. Now the query finds 20 results.
2021-10-13 09:31:45 +00:00
Mathias Vorreiter Pedersen
812597505d
QL: Respond to PR reviews.
2021-10-13 09:28:02 +00:00
Mathias Vorreiter Pedersen
b4d710d58f
QL: QL: Respond to PR reviews.
2021-10-13 09:28:02 +00:00
Geoffrey White
d99d02994a
Update README.md
...
I needed the rust-analyzer extension to get anywhere in VSCode.
2021-10-13 10:09:08 +01:00
Geoffrey White
46789aecaa
QL: Update README.md
...
I needed the rust-analyzer extension to get anywhere in VSCode.
2021-10-13 10:09:08 +01:00
Mathias Vorreiter Pedersen
6c55a67f9a
QL: Add query to find uses of .prefix or .suffix when comparing against literals.
2021-10-13 09:06:58 +00:00
Mathias Vorreiter Pedersen
f86a827bb6
QL: QL: Add query to find uses of .prefix or .suffix when comparing against literals.
2021-10-13 09:06:58 +00:00
Anders Schack-Mulligen
79485ec5da
New query: Singleton set literal.
2021-10-13 09:01:54 +00:00
Anders Schack-Mulligen
f71acdf9fe
QL: New query: Singleton set literal.
2021-10-13 09:01:54 +00:00
Erik Krogh Kristensen
ed767b4a54
Merge pull request #51 from github/aschackmull/ignore-work
...
Add work folder to gitignore.
2021-10-13 10:52:49 +02:00
Erik Krogh Kristensen
eb527a5494
QL: Merge pull request #51 from github/aschackmull/ignore-work
...
Add work folder to gitignore.
2021-10-13 10:52:49 +02:00
Anders Schack-Mulligen
f71881ef78
Add work folder to gitignore.
2021-10-13 08:28:27 +00:00
Anders Schack-Mulligen
a8b1ef83f1
QL: Add work folder to gitignore.
2021-10-13 08:28:27 +00:00
Geoffrey White
76144a7f7d
Make the create-extractor-pack.ps1 script more reliable.
2021-10-13 09:17:59 +01:00
Geoffrey White
54b7fa3944
QL: Make the create-extractor-pack.ps1 script more reliable.
2021-10-13 09:17:59 +01:00
Taus
ef538570c8
Merge pull request #37 from github/toUnicodeBuildin
...
add `toUnicode` as a build-in
2021-10-13 10:13:05 +02:00
Taus
352c50c2e5
QL: Merge pull request #37 from github/toUnicodeBuildin
...
add `toUnicode` as a build-in
2021-10-13 10:13:05 +02:00
Erik Krogh Kristensen
bb3e6399a4
Merge pull request #41 from github/tausbn/support-instanceof
...
Support `instanceof`
2021-10-13 09:14:02 +02:00
Erik Krogh Kristensen
fbb58f1954
QL: Merge pull request #41 from github/tausbn/support-instanceof
...
Support `instanceof`
2021-10-13 09:14:02 +02:00
Taus
8c6d139d67
Fix up getASuperType
...
I'm not sure if it's correct to include also the `instanceof`s, but we
can always fix this later.
2021-10-12 19:28:13 +00:00
Taus
db6551c22d
QL: Fix up getASuperType
...
I'm not sure if it's correct to include also the `instanceof`s, but we
can always fix this later.
2021-10-12 19:28:13 +00:00
Taus
d436be7e96
Support instanceof
...
Stills needs to be hooked up correctly to the AST.
2021-10-12 17:40:29 +00:00
Taus
4694ab4773
QL: Support instanceof
...
Stills needs to be hooked up correctly to the AST.
2021-10-12 17:40:29 +00:00
Erik Krogh Kristensen
7b61445f83
Merge pull request #40 from github/erik-krogh/fix-qltest
...
fix qlpack version string
2021-10-12 13:08:40 +02:00
Erik Krogh Kristensen
ca21f5800b
QL: Merge pull request #40 from github/erik-krogh/fix-qltest
...
fix qlpack version string
2021-10-12 13:08:40 +02:00
Erik Krogh Kristensen
b0a237bcc1
fix qlpack version string
2021-10-12 11:01:18 +00:00
Erik Krogh Kristensen
d6d626e932
QL: fix qlpack version string
2021-10-12 11:01:18 +00:00
Tony Torralba
91efb61e97
Use synthetic fields to improve taint precision
2021-10-07 17:03:08 +02:00
Tony Torralba
0325c07bd9
Reorganize fluent models
2021-10-07 17:03:07 +02:00
Tony Torralba
ffa77f0a76
Fix QLDoc
2021-10-07 17:03:07 +02:00
Tony Torralba
588dedc265
Add stubs
2021-10-07 17:03:05 +02:00
Tony Torralba
1a04ad98bc
Add Android Slice models
2021-10-07 17:01:16 +02:00
Taus
9b1836e366
Merge pull request #36 from github/various-small-fixes
...
Various small fixes
2021-09-23 13:42:19 +02:00
Taus
b719faa627
QL: Merge pull request #36 from github/various-small-fixes
...
Various small fixes
2021-09-23 13:42:19 +02:00
Erik Krogh Kristensen
ba40a99ef8
Merge pull request #38 from github/rankOne
...
add a query for finding rank[1]
2021-08-18 23:23:00 +02:00
Erik Krogh Kristensen
b8a368a47f
QL: Merge pull request #38 from github/rankOne
...
add a query for finding rank[1]
2021-08-18 23:23:00 +02:00
Erik Krogh Kristensen
91b8c1c4a0
Update ql/src/queries/style/RankOne.ql
...
Co-authored-by: Taus <tausbn@github.com >
2021-08-18 11:25:36 +02:00
Erik Krogh Kristensen
23b2d43440
QL: Update ql/src/queries/style/RankOne.ql
...
Co-authored-by: Taus <tausbn@github.com >
2021-08-18 11:25:36 +02:00
Erik Krogh Kristensen
feb1ab86f0
add a query for finding rank[1]
2021-08-18 09:19:05 +00:00
Erik Krogh Kristensen
b45a793e28
QL: add a query for finding rank[1]
2021-08-18 09:19:05 +00:00
Erik Krogh Kristensen
23e3062c3b
add toUnicode as a build-in
2021-06-22 12:07:47 +00:00
Erik Krogh Kristensen
b385dfd5a8
QL: add toUnicode as a build-in
2021-06-22 12:07:47 +00:00
Taus
e79ded9046
Add exclusions to Module consistency test
2021-06-19 12:41:16 +00:00
Taus
2515fc0ebc
QL: Add exclusions to Module consistency test
2021-06-19 12:41:16 +00:00
Taus
6d1dc24fa7
Autoformat
2021-06-19 12:36:10 +00:00
Taus
7a117caaea
QL: Autoformat
2021-06-19 12:36:10 +00:00
Taus
6bff0f48a2
Remove SuperAccess::getType()
...
This had a bad effect on our call resolution, so I'm reverting it for
now. We may want to diverge from the language specification here.
2021-06-19 12:17:17 +00:00
Taus
2fa4424f71
QL: Remove SuperAccess::getType()
...
This had a bad effect on our call resolution, so I'm reverting it for
now. We may want to diverge from the language specification here.
2021-06-19 12:17:17 +00:00
Taus
b9238ea436
Update printAst test
...
to reflect the renaming of `Aggregate` to `FullAggregate`.
2021-06-19 12:16:42 +00:00
Taus
4c4a2658fe
QL: Update printAst test
...
to reflect the renaming of `Aggregate` to `FullAggregate`.
2021-06-19 12:16:42 +00:00
Taus
e3a4d3074c
Exclude a few more paths from tests
2021-06-19 11:54:50 +00:00
Taus
fb8f549d93
QL: Exclude a few more paths from tests
2021-06-19 11:54:50 +00:00
Taus
815337dde1
Split up Aggregate properly
...
Previously, we had `Aggregate` and `ExprAggregate` as separate classes,
the latter of which representing aggregates that contain only an
expression.
This was a problem for the `rank` aggregate, as it inherited from
`Aggregate`, but _could_ also contain just an expression (even if this
is rather rare).
To fix this, I renamed `Aggregate` to `FullAggregate` (to make the
division clearer), and added a new type `Aggregate` that represents the
union of these two types. Now `Rank` can inherit from the new class
`Aggregate` and everything is dandy.
2021-06-19 11:50:50 +00:00
Taus
76b55c4a5a
QL: Split up Aggregate properly
...
Previously, we had `Aggregate` and `ExprAggregate` as separate classes,
the latter of which representing aggregates that contain only an
expression.
This was a problem for the `rank` aggregate, as it inherited from
`Aggregate`, but _could_ also contain just an expression (even if this
is rather rare).
To fix this, I renamed `Aggregate` to `FullAggregate` (to make the
division clearer), and added a new type `Aggregate` that represents the
union of these two types. Now `Rank` can inherit from the new class
`Aggregate` and everything is dandy.
2021-06-19 11:50:50 +00:00
Taus
1e973f3681
Fix getType for aggregates
...
We were only including the `strict` variant of `count` and not any of
the other ones (spot the mistake!).
Also, `unique` was added as a recognised aggregate name.
2021-06-19 11:47:45 +00:00
Taus
8d17a95265
QL: Fix getType for aggregates
...
We were only including the `strict` variant of `count` and not any of
the other ones (spot the mistake!).
Also, `unique` was added as a recognised aggregate name.
2021-06-19 11:47:45 +00:00
Taus
0ff0aecb22
Add more getType overrides
...
Mainly adds ones for primitive types.
One peculiarity: the language specification states that the type of
`super` is the same as the type of `this`, and _not_ the type of
the superclass on which the method is actually accessed. This seems a
bit strange to me, so I thought I would highlight it specifically.
Also, I'm not entirely sure that the rules around type coercion for
the various binary operators are 100% correct.
2021-06-19 11:40:12 +00:00
Taus
602c9e720e
QL: Add more getType overrides
...
Mainly adds ones for primitive types.
One peculiarity: the language specification states that the type of
`super` is the same as the type of `this`, and _not_ the type of
the superclass on which the method is actually accessed. This seems a
bit strange to me, so I thought I would highlight it specifically.
Also, I'm not entirely sure that the rules around type coercion for
the various binary operators are 100% correct.
2021-06-19 11:40:12 +00:00
Taus
bc2932383b
Merge pull request #35 from github/downstream-latest-generator
2021-06-02 10:07:09 +02:00
Taus
08dd9477c2
QL: Merge pull request #35 from github/downstream-latest-generator
2021-06-02 10:07:09 +02:00
Taus
35dccb5f3d
Update to latest generator
...
Includes better QLDoc generation and better escaping in the generated
files (the latter has changed the dbscheme, so rebuilding databases will
be required).
2021-06-01 16:43:11 +00:00
Taus
75a959389c
QL: Update to latest generator
...
Includes better QLDoc generation and better escaping in the generated
files (the latter has changed the dbscheme, so rebuilding databases will
be required).
2021-06-01 16:43:11 +00:00
Taus
c2ecad7ddb
Merge pull request #34 from github/dbscheme-and-qlpack-support
...
Add support for dbscheme and qlpack.yml
2021-06-01 18:23:36 +02:00
Taus
22e4606358
QL: Merge pull request #34 from github/dbscheme-and-qlpack-support
...
Add support for dbscheme and qlpack.yml
2021-06-01 18:23:36 +02:00
Taus
9abe340a1f
Fix getQLDoc compilation error
2021-05-31 08:55:27 +00:00
Taus
cbd0caa4ab
QL: Fix getQLDoc compilation error
2021-05-31 08:55:27 +00:00
Taus
3cdc6a18ae
Merge branch 'main' into dbscheme-and-qlpack-support
2021-05-31 10:50:39 +02:00
Taus
ada77a3c8b
QL: Merge branch 'main' into dbscheme-and-qlpack-support
2021-05-31 10:50:39 +02:00
Taus
6b2c96615f
Merge pull request #30 from github/qldoc-nodes
...
Add AST nodes for QLDoc
2021-05-31 10:45:15 +02:00
Taus
17ef056579
QL: Merge pull request #30 from github/qldoc-nodes
...
Add AST nodes for QLDoc
2021-05-31 10:45:15 +02:00
Taus
1cbcf40637
Simplify getAMember
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-05-31 10:26:50 +02:00
Taus
855683e980
QL: Simplify getAMember
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-05-31 10:26:50 +02:00
Erik Krogh Kristensen
4bbd06f51f
improve performance of module resolution
2021-05-31 08:06:49 +00:00
Erik Krogh Kristensen
f2f6d34f21
QL: improve performance of module resolution
2021-05-31 08:06:49 +00:00
Erik Krogh Kristensen
b3e23bcc31
improve performance of type resolution
2021-05-31 07:51:11 +00:00
Erik Krogh Kristensen
3ee642868d
QL: improve performance of type resolution
2021-05-31 07:51:11 +00:00
Erik Krogh Kristensen
a286dc349a
improve scope resolution performance
2021-05-31 07:46:51 +00:00
Erik Krogh Kristensen
12627d19fa
QL: improve scope resolution performance
2021-05-31 07:46:51 +00:00
Erik Krogh Kristensen
18b6216f78
more improvements to printAst performance
2021-05-31 07:33:11 +00:00
Erik Krogh Kristensen
7a4e4134da
QL: more improvements to printAst performance
2021-05-31 07:33:11 +00:00
Erik Krogh Kristensen
7d4611941a
fix printAst performance
2021-05-30 21:42:15 +00:00
Erik Krogh Kristensen
5e89bf99a8
QL: fix printAst performance
2021-05-30 21:42:15 +00:00
Erik Krogh Kristensen
a349fdd367
spaces in folder/file names are underscores in import names
2021-05-30 21:36:01 +00:00
Erik Krogh Kristensen
e47c4ff2ad
QL: spaces in folder/file names are underscores in import names
2021-05-30 21:36:01 +00:00
Erik Krogh Kristensen
6c5e33e3d2
use qlpack existence to determine the root for imports
2021-05-30 21:30:11 +00:00
Erik Krogh Kristensen
1aa7cbb918
QL: use qlpack existence to determine the root for imports
2021-05-30 21:30:11 +00:00
Taus
4e8157e3cb
Autoformat
2021-05-30 17:53:38 +00:00
Taus
676bc5ee2a
QL: Autoformat
2021-05-30 17:53:38 +00:00
Taus
eaf6d8123d
Add support for dbscheme and qlpack.yml
...
Currently the the YAML "parser" fails for some legacy files, but the
actual files appear to be parsed correctly.
2021-05-30 17:38:26 +00:00
Taus
2bbf1e37fc
QL: Add support for dbscheme and qlpack.yml
...
Currently the the YAML "parser" fails for some legacy files, but the
actual files appear to be parsed correctly.
2021-05-30 17:38:26 +00:00
Erik Krogh Kristensen
5c80716724
Merge branch 'main' into qldoc-nodes
2021-05-30 15:51:29 +00:00
Erik Krogh Kristensen
01e420fd02
QL: Merge branch 'main' into qldoc-nodes
2021-05-30 15:51:29 +00:00
Erik Krogh Kristensen
33ed98e8b7
Merge pull request #32 from github/jumpToField
...
get jump to field to work
2021-05-29 22:09:44 +02:00
Erik Krogh Kristensen
63c7b21f4b
QL: Merge pull request #32 from github/jumpToField
...
get jump to field to work
2021-05-29 22:09:44 +02:00
Erik Krogh Kristensen
c2c0a96f40
Merge pull request #33 from github/fixes
...
improve callgraph resolution, and other fixes
2021-05-29 22:09:32 +02:00
Erik Krogh Kristensen
35fe816918
QL: Merge pull request #33 from github/fixes
...
improve callgraph resolution, and other fixes
2021-05-29 22:09:32 +02:00
Erik Krogh Kristensen
48170f5ce0
change multipleResolveCall to ignore aliases
2021-05-29 19:30:40 +00:00
Erik Krogh Kristensen
f1aa5ef804
QL: change multipleResolveCall to ignore aliases
2021-05-29 19:30:40 +00:00
Erik Krogh Kristensen
bd86ffb35b
fix the arity of predicate aliases
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
5b1bab0921
QL: fix the arity of predicate aliases
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
8dc3948221
support more types on aggregates
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
7a33225fd0
QL: support more types on aggregates
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
c8d0384907
add callgraph test
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
04ca858e85
QL: add callgraph test
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
068c57acdd
add super calls to the callgraph
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
c78bae69c8
QL: add super calls to the callgraph
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
2d86b13d44
add super nodes
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
aceab25d9b
QL: add super nodes
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
5dcc161f2d
add getEnclosingPredicate utility predicate
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
3d50a4d254
QL: add getEnclosingPredicate utility predicate
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
fb50ba407d
add test for boolean literals in the ast
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
d9aa3bbdfa
QL: add test for boolean literals in the ast
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
8ad05b778d
add support for boolean literals
2021-05-29 19:23:58 +00:00
Erik Krogh Kristensen
1ba51013a4
QL: add support for boolean literals
2021-05-29 19:23:58 +00:00
Taus
4140ce0f10
Fix misparse of -j - 1
2021-05-29 14:17:21 +00:00
Taus
bb418f9614
QL: Fix misparse of -j - 1
2021-05-29 14:17:21 +00:00
Taus
1345fa982a
Merge pull request #31 from github/autogenerate-qldoc
...
Autogenerate QLDoc for `TreeSitter.qll`
2021-05-29 16:08:22 +02:00
Taus
3f2690c3b3
QL: Merge pull request #31 from github/autogenerate-qldoc
...
Autogenerate QLDoc for `TreeSitter.qll`
2021-05-29 16:08:22 +02:00
Taus
18fc76fdb8
Autoformat
2021-05-29 08:09:35 +00:00
Taus
aae4a1e3f9
QL: Autoformat
2021-05-29 08:09:35 +00:00
Taus
0b74535b4a
Fix test output
2021-05-29 08:07:44 +00:00
Taus
1feb35efb7
QL: Fix test output
2021-05-29 08:07:44 +00:00
Taus
5658abd716
Merge branch 'main' into qldoc-nodes
2021-05-29 00:03:09 +02:00
Taus
4e060ce368
QL: Merge branch 'main' into qldoc-nodes
2021-05-29 00:03:09 +02:00
Taus
010bc39465
Fix tests
...
I'm not really a fan of `toString`s that don't indicate the type of the
object, so I added a reference to `getAPrimaryQlClass`. Hopefully this
should result in less noise in the diff.
2021-05-28 22:00:15 +00:00
Taus
23e4281ddb
QL: Fix tests
...
I'm not really a fan of `toString`s that don't indicate the type of the
object, so I added a reference to `getAPrimaryQlClass`. Hopefully this
should result in less noise in the diff.
2021-05-28 22:00:15 +00:00
Erik Krogh Kristensen
7fa3645e5d
get jump to field to work
2021-05-28 23:47:41 +02:00
Erik Krogh Kristensen
3cd7594247
QL: get jump to field to work
2021-05-28 23:47:41 +02:00
Taus
9b0b4df181
Add getAModule and getANewType
...
Also removes `getAQLDocComment`, as those were already dangling off of
their respective successors in the file (and so should not dangle off
of the top level as well).
2021-05-28 21:44:41 +00:00
Taus
109f938968
QL: Add getAModule and getANewType
...
Also removes `getAQLDocComment`, as those were already dangling off of
their respective successors in the file (and so should not dangle off
of the top level as well).
2021-05-28 21:44:41 +00:00
Taus
3280f02d6a
Remove getAMember from getAChild
...
Adds `getAQLDocComment` for accessing those module members that are
simply QLDoc comments (apart from the one that applies to the module
itself, which is still accessed through `getQLDoc`.)
2021-05-28 21:12:02 +00:00
Taus
24230dc205
QL: Remove getAMember from getAChild
...
Adds `getAQLDocComment` for accessing those module members that are
simply QLDoc comments (apart from the one that applies to the module
itself, which is still accessed through `getQLDoc`.)
2021-05-28 21:12:02 +00:00
Taus
3a045ef4e5
Autogenerate QLDoc for TreeSitter.qll
2021-05-28 21:06:51 +00:00
Taus
7d597782b8
QL: Autogenerate QLDoc for TreeSitter.qll
2021-05-28 21:06:51 +00:00
shati-patel
e57f9e9a1b
autoformat
2021-05-28 18:59:41 +01:00
shati-patel
1d4f6e0564
QL: autoformat
2021-05-28 18:59:41 +01:00
shati-patel
e401364fa1
fix space in test
2021-05-28 18:53:45 +01:00
shati-patel
03fcfdd53a
QL: fix space in test
2021-05-28 18:53:45 +01:00
shati-patel
9e6b085e81
Link to hackathon issue from README
2021-05-28 18:38:12 +01:00
shati-patel
33fcfdef3d
QL: Link to hackathon issue from README
2021-05-28 18:38:12 +01:00
shati-patel
dd598f8aa5
Add missing space
2021-05-28 18:36:40 +01:00
shati-patel
5a7f349bfa
QL: Add missing space
2021-05-28 18:36:40 +01:00
Taus
64a53f8ba0
Add AST nodes for QLDoc
2021-05-28 17:11:02 +00:00
Taus
51fbee69c2
QL: Add AST nodes for QLDoc
2021-05-28 17:11:02 +00:00
Shati Patel
764a5d1457
Remove codeql-action placeholder file
...
(Didn't get code scanning set up, so this file doesn't do anything useful)
2021-05-28 18:03:13 +01:00
Shati Patel
64d24c744a
QL: Remove codeql-action placeholder file
...
(Didn't get code scanning set up, so this file doesn't do anything useful)
2021-05-28 18:03:13 +01:00
Erik Krogh Kristensen
333e18a1da
Merge pull request #29 from github/fourth-query
...
add `ql/override-parameter-name`
2021-05-28 18:00:48 +02:00
Erik Krogh Kristensen
2736b0149c
QL: Merge pull request #29 from github/fourth-query
...
add `ql/override-parameter-name`
2021-05-28 18:00:48 +02:00
Erik Krogh Kristensen
fd8fd0b70e
add ql/override-parameter-name
2021-05-28 14:59:44 +00:00
Erik Krogh Kristensen
775a0eebaa
QL: add ql/override-parameter-name
2021-05-28 14:59:44 +00:00
Erik Krogh Kristensen
0c61c9d2b2
adjust qldoc on printAst
2021-05-28 14:35:01 +00:00
Erik Krogh Kristensen
fe6e7a8ed8
QL: adjust qldoc on printAst
2021-05-28 14:35:01 +00:00
Tom Hvitved
074ea79b9a
Merge pull request #28 from github/caching
...
Cache some predicates
2021-05-28 15:25:12 +02:00
Tom Hvitved
5dec75abf3
QL: Merge pull request #28 from github/caching
...
Cache some predicates
2021-05-28 15:25:12 +02:00
Tom Hvitved
05d1788c1f
Cache some predicates
2021-05-28 15:20:55 +02:00
Tom Hvitved
ce13360f9b
QL: Cache some predicates
2021-05-28 15:20:55 +02:00
Tom Hvitved
42df07c23a
Merge pull request #27 from github/newtype-call
...
Resolve `newtype` constructor calls
2021-05-28 15:14:52 +02:00
Tom Hvitved
27d0af917a
QL: Merge pull request #27 from github/newtype-call
...
Resolve `newtype` constructor calls
2021-05-28 15:14:52 +02:00
Erik Krogh Kristensen
51230f6ee3
Merge pull request #25 from github/cleanup
...
cleanup
2021-05-28 15:07:16 +02:00
Erik Krogh Kristensen
7e69931455
QL: Merge pull request #25 from github/cleanup
...
cleanup
2021-05-28 15:07:16 +02:00
Tom Hvitved
8d245e6bc2
Resolve newtype constructor calls
2021-05-28 15:06:37 +02:00
Tom Hvitved
22cd2844d3
QL: Resolve newtype constructor calls
2021-05-28 15:06:37 +02:00
Erik Krogh Kristensen
f15ad39181
format
2021-05-28 13:02:01 +00:00
Erik Krogh Kristensen
3515580889
QL: format
2021-05-28 13:02:01 +00:00
Erik Krogh Kristensen
d171ace902
fix
2021-05-28 12:58:02 +00:00
Erik Krogh Kristensen
249d209f45
QL: fix
2021-05-28 12:58:02 +00:00
Erik Krogh Kristensen
c3344d0734
cleanup
2021-05-28 12:50:33 +00:00
Erik Krogh Kristensen
e456098a35
QL: cleanup
2021-05-28 12:50:33 +00:00
Taus
e89ed8a1f9
Reuse defined predicate arity
2021-05-28 12:40:45 +00:00
Taus
e62e72edfd
QL: Reuse defined predicate arity
2021-05-28 12:40:45 +00:00
Taus
fa8efb6ca9
Make getParameter 0-indexed
2021-05-28 12:22:14 +00:00
Taus
45ae088fd8
QL: Make getParameter 0-indexed
2021-05-28 12:22:14 +00:00
Joe Farebrother
3f133a7e84
Merge pull request #26 from github/builtins
...
Built in predicates
2021-05-28 13:01:14 +01:00
Joe Farebrother
236f413e01
QL: Merge pull request #26 from github/builtins
...
Built in predicates
2021-05-28 13:01:14 +01:00
Joe Farebrother
3945dbfa54
Support builtin predicates
2021-05-28 12:57:36 +01:00
Joe Farebrother
87e39c7f23
QL: Support builtin predicates
2021-05-28 12:57:36 +01:00
Tom Hvitved
671628484b
Merge pull request #24 from github/types
...
Resolve calls
2021-05-28 13:50:22 +02:00
Tom Hvitved
28d2daea3f
QL: Merge pull request #24 from github/types
...
Resolve calls
2021-05-28 13:50:22 +02:00
Tom Hvitved
41a2e020bd
Update expected test output
2021-05-28 13:49:31 +02:00
Tom Hvitved
17f6cad0e9
QL: Update expected test output
2021-05-28 13:49:31 +02:00
Tom Hvitved
5112b49b94
Remove compilation warnings
2021-05-28 13:44:31 +02:00
Tom Hvitved
4110810431
QL: Remove compilation warnings
2021-05-28 13:44:31 +02:00
Joe Farebrother
cee5dd0cba
Merge pull request #20 from github/missing-override-query
...
Add Missing Override query
2021-05-28 12:40:17 +01:00
Joe Farebrother
c33e0a5f30
QL: Merge pull request #20 from github/missing-override-query
...
Add Missing Override query
2021-05-28 12:40:17 +01:00
Joe Farebrother
26d0e9df5d
Add Missing Override query
2021-05-28 12:39:59 +01:00
Joe Farebrother
933593223f
QL: Add Missing Override query
2021-05-28 12:39:59 +01:00
Tom Hvitved
5975ee4932
Resolve calls
2021-05-28 13:39:21 +02:00
Tom Hvitved
99a3a09033
QL: Resolve calls
2021-05-28 13:39:21 +02:00
Taus
ac35f348c4
printAst edge labels and a bit of consistency
2021-05-28 11:33:06 +00:00
Taus
f46dab6c84
QL: printAst edge labels and a bit of consistency
2021-05-28 11:33:06 +00:00
Taus
c8de28c0a0
Get rid of getParent overrides
2021-05-28 11:11:33 +00:00
Taus
d65e0a9181
QL: Get rid of getParent overrides
2021-05-28 11:11:33 +00:00
Tom Hvitved
535fd73cc9
Merge pull request #23 from github/as-expr
...
Only generate `AsExpr`s when there is an `as` keyword
2021-05-28 12:16:11 +02:00
Tom Hvitved
752194b19e
QL: Merge pull request #23 from github/as-expr
...
Only generate `AsExpr`s when there is an `as` keyword
2021-05-28 12:16:11 +02:00
Tom Hvitved
cbcc4ead36
Only generate AsExprs when there is an as keyword
2021-05-28 12:12:34 +02:00
Tom Hvitved
bac0e02fae
QL: Only generate AsExprs when there is an as keyword
2021-05-28 12:12:34 +02:00
Erik Krogh Kristensen
2e02e15875
Merge pull request #22 from github/third-query
...
add ql/rexexp-pattern
2021-05-28 12:00:32 +02:00
Erik Krogh Kristensen
f0bb846345
QL: Merge pull request #22 from github/third-query
...
add ql/rexexp-pattern
2021-05-28 12:00:32 +02:00
Erik Krogh Kristensen
9113469d9d
add ql/rexexp-pattern
2021-05-28 09:55:09 +00:00
Erik Krogh Kristensen
de57b2bc9f
QL: add ql/rexexp-pattern
2021-05-28 09:55:09 +00:00
Erik Krogh Kristensen
cc60ddde1c
Merge pull request #18 from github/second-query
...
implement `ql/override-swapped-name`
2021-05-28 11:19:33 +02:00
Erik Krogh Kristensen
a5f5fed695
QL: Merge pull request #18 from github/second-query
...
implement `ql/override-swapped-name`
2021-05-28 11:19:33 +02:00
Erik Krogh Kristensen
2430dbfd04
update expected output
2021-05-28 09:16:54 +00:00
Erik Krogh Kristensen
e40d713878
QL: update expected output
2021-05-28 09:16:54 +00:00
shati-patel
d1c6660c32
add codeql to path
2021-05-28 10:16:16 +01:00
shati-patel
96a9c3446f
QL: add codeql to path
2021-05-28 10:16:16 +01:00
Erik Krogh Kristensen
75d77b70cc
implement ql/override-swapped-name
2021-05-28 09:14:57 +00:00
Erik Krogh Kristensen
50f5c83cf2
QL: implement ql/override-swapped-name
2021-05-28 09:14:57 +00:00
Erik Krogh Kristensen
19e33b2e29
bump precision
2021-05-28 09:14:57 +00:00
Erik Krogh Kristensen
d8b6579f59
QL: bump precision
2021-05-28 09:14:57 +00:00
shati-patel
ebcd27e1b3
Placeholder codeql workflow (wip)
2021-05-28 10:14:21 +01:00
shati-patel
da6a915779
QL: Placeholder codeql workflow (wip)
2021-05-28 10:14:21 +01:00
Tom Hvitved
c2c1a9200e
Merge pull request #19 from github/more-variables
...
More variable resolution
2021-05-28 11:12:03 +02:00
Tom Hvitved
fac92ef2d0
QL: Merge pull request #19 from github/more-variables
...
More variable resolution
2021-05-28 11:12:03 +02:00
Tom Hvitved
dc5080c61d
More variable resolution
2021-05-28 11:05:46 +02:00
Tom Hvitved
3e87a05de8
QL: More variable resolution
2021-05-28 11:05:46 +02:00
Tom Hvitved
e5a9bcd786
Merge pull request #15 from github/inheritance
...
Resolve inheritable members (fields and member predicates)
2021-05-28 11:05:28 +02:00
Tom Hvitved
36248cc803
QL: Merge pull request #15 from github/inheritance
...
Resolve inheritable members (fields and member predicates)
2021-05-28 11:05:28 +02:00
Joe Farebrother
0b1d109460
Resolution of inherited members
2021-05-28 11:00:01 +02:00
Joe Farebrother
d4d7c6de64
QL: Resolution of inherited members
2021-05-28 11:00:01 +02:00
Tom Hvitved
6d6c1f343d
Merge pull request #16 from github/var-resolution
...
Variable resolution
2021-05-28 09:51:15 +02:00
Tom Hvitved
3a3f8096e7
QL: Merge pull request #16 from github/var-resolution
...
Variable resolution
2021-05-28 09:51:15 +02:00
Tom Hvitved
b20aa3fb07
Add variables to jump-to-def queries
2021-05-28 09:46:03 +02:00
Tom Hvitved
ef69a46f00
QL: Add variables to jump-to-def queries
2021-05-28 09:46:03 +02:00
Tom Hvitved
f99dc7b266
Variable resolution
2021-05-28 09:34:53 +02:00
Tom Hvitved
43ec1a77cf
QL: Variable resolution
2021-05-28 09:34:53 +02:00
Erik Krogh Kristensen
28f2527f86
Merge pull request #17 from github/first-query
...
Add the `ql/primary-ql-class-consistency` query
2021-05-28 00:31:43 +02:00
Erik Krogh Kristensen
bf98e9636c
QL: Merge pull request #17 from github/first-query
...
Add the `ql/primary-ql-class-consistency` query
2021-05-28 00:31:43 +02:00
Erik Krogh Kristensen
391c8150f5
make the test pass an auto-format check
2021-05-27 22:26:14 +00:00
Erik Krogh Kristensen
6f7cbf7194
QL: make the test pass an auto-format check
2021-05-27 22:26:14 +00:00
Erik Krogh Kristensen
d59f0df23f
space
2021-05-27 22:21:14 +00:00
Erik Krogh Kristensen
09463f4e72
QL: space
2021-05-27 22:21:14 +00:00
Erik Krogh Kristensen
16cf439f6b
run the query on our on code, and fix an error
2021-05-27 22:21:09 +00:00
Erik Krogh Kristensen
cb991fbf14
QL: run the query on our on code, and fix an error
2021-05-27 22:21:09 +00:00
Taus
9103e2697f
Add getAChild
...
Joint work with: REDACTED
2021-05-27 22:17:10 +00:00
Taus
77758e5ba6
QL: Add getAChild
...
Joint work with: REDACTED
2021-05-27 22:17:10 +00:00
Erik Krogh Kristensen
497f0cd48b
autoformat
2021-05-27 22:16:57 +00:00
Erik Krogh Kristensen
913cf53617
QL: autoformat
2021-05-27 22:16:57 +00:00
Erik Krogh Kristensen
79c99b0c61
update expected output after the introduction of a TopLevel ast node
2021-05-27 22:13:35 +00:00
Erik Krogh Kristensen
136b046b38
QL: update expected output after the introduction of a TopLevel ast node
2021-05-27 22:13:35 +00:00
Erik Krogh Kristensen
e8cc0ee453
Add the ql/primary-ql-class-consistency query
2021-05-27 22:08:18 +00:00
Erik Krogh Kristensen
d88cc79736
QL: Add the ql/primary-ql-class-consistency query
2021-05-27 22:08:18 +00:00
Tom Hvitved
967553d582
Merge pull request #14 from github/predicate-expr-resolution
...
Resolve predicate expressions
2021-05-27 20:39:39 +02:00
Tom Hvitved
4f410f53b8
QL: Merge pull request #14 from github/predicate-expr-resolution
...
Resolve predicate expressions
2021-05-27 20:39:39 +02:00
Tom Hvitved
8c59edefb2
Restrict resolvePredicateExpr to ClasslessPredicates
2021-05-27 20:28:46 +02:00
Tom Hvitved
0eabd4fcd9
QL: Restrict resolvePredicateExpr to ClasslessPredicates
2021-05-27 20:28:46 +02:00
Tom Hvitved
f713d8b13e
Resolve predicate expressions
2021-05-27 20:26:19 +02:00
Tom Hvitved
2f74e3e765
QL: Resolve predicate expressions
2021-05-27 20:26:19 +02:00
Taus
e01fe66519
Add missing parents for ModuleExpr
2021-05-27 17:28:00 +00:00
Taus
93fa56fe79
QL: Add missing parents for ModuleExpr
2021-05-27 17:28:00 +00:00
Taus
c8cb81d1f9
missed a spot...
2021-05-27 17:20:01 +00:00
Taus
cdac3f9726
QL: missed a spot...
2021-05-27 17:20:01 +00:00
Taus
44c8e78873
super and aggregates containing expressions
2021-05-27 17:19:35 +00:00
Taus
dc11ec418b
QL: super and aggregates containing expressions
2021-05-27 17:19:35 +00:00
shati-patel
1e9d8d0ca1
A bit more documentation
2021-05-27 18:07:49 +01:00
shati-patel
05e2ec3f82
QL: A bit more documentation
2021-05-27 18:07:49 +01:00
Taus
a4de52d135
Add unique as known aggregate name to treesitter
2021-05-27 16:48:59 +00:00
Taus
0e38056a3a
QL: Add unique as known aggregate name to treesitter
2021-05-27 16:48:59 +00:00
Taus
2abb79cd57
Orphan fixes for aggregates
2021-05-27 16:48:38 +00:00
Taus
219b123271
QL: Orphan fixes for aggregates
2021-05-27 16:48:38 +00:00
shati-patel
fd3abe42bf
Fix multiplication operator
2021-05-27 16:55:39 +01:00
shati-patel
625b9563bf
QL: Fix multiplication operator
2021-05-27 16:55:39 +01:00
Taus
0337a0dc18
AST: range, in, set, and files
2021-05-27 15:47:46 +00:00
Taus
b9ea00c372
QL: AST: range, in, set, and files
2021-05-27 15:47:46 +00:00
shati-patel
59e85abe9e
Merge branch 'main' of github.com:github/codeql-ql
2021-05-27 15:51:56 +01:00
shati-patel
e36915b0ef
QL: Merge branch 'main' of github.com:github/codeql-ql
2021-05-27 15:51:56 +01:00
shati-patel
da65f75372
Add some more documentation
2021-05-27 15:51:40 +01:00
shati-patel
8ce59ff073
QL: Add some more documentation
2021-05-27 15:51:40 +01:00
Joe Farebrother
c66e7de6a8
Merge pull request #13 from github/type-expr-resolution
...
Type expression resolution
2021-05-27 15:48:20 +01:00
Joe Farebrother
0aa936d2d2
QL: Merge pull request #13 from github/type-expr-resolution
...
Type expression resolution
2021-05-27 15:48:20 +01:00
Joe Farebrother
45e6af2d14
Add jump-to-def support
2021-05-27 15:45:00 +01:00
Joe Farebrother
c6b5130ad5
QL: Add jump-to-def support
2021-05-27 15:45:00 +01:00
Taus
fe631a5eaf
Add AST support for HOPs
2021-05-27 14:37:15 +00:00
Taus
f61471c451
QL: Add AST support for HOPs
2021-05-27 14:37:15 +00:00
Joe Farebrother
16005fa6cf
Support aliases and unions
2021-05-27 15:25:37 +01:00
Joe Farebrother
cb3e971ebc
QL: Support aliases and unions
2021-05-27 15:25:37 +01:00
Joe Farebrother
719ef68aeb
`Merge branch 'main' into type-expr-resolution
2021-05-27 15:12:49 +01:00
Joe Farebrother
3a8e1779d9
QL: `Merge branch 'main' into type-expr-resolution
2021-05-27 15:12:49 +01:00
Taus
2882f6d37c
Link up ModuleExpr with PredicateCall
2021-05-27 14:11:20 +00:00
Taus
69b4d577d5
QL: Link up ModuleExpr with PredicateCall
2021-05-27 14:11:20 +00:00
Joe Farebrother
9580362332
Fixes for resolution and consistency query
2021-05-27 15:05:42 +01:00
Joe Farebrother
5ec1068230
QL: Fixes for resolution and consistency query
2021-05-27 15:05:42 +01:00
Taus
e09a012064
Support class unions
2021-05-27 14:01:21 +00:00
Taus
a1fc6391d7
QL: Support class unions
2021-05-27 14:01:21 +00:00
Joe Farebrother
fc2f9b5ab6
Add type expression resolution
2021-05-27 14:48:26 +01:00
Joe Farebrother
d5bf0cb33f
QL: Add type expression resolution
2021-05-27 14:48:26 +01:00
Taus
97468a3935
Support predicate foo = bar/5;
2021-05-27 13:18:31 +00:00
Taus
158b50f482
QL: Support predicate foo = bar/5;
2021-05-27 13:18:31 +00:00
Taus
359b7d6b39
Add support for class Foo = Bar;
2021-05-27 13:08:30 +00:00
Taus
192ac4cae3
QL: Add support for class Foo = Bar;
2021-05-27 13:08:30 +00:00
Taus
59c4e170a8
Make all calls formulas
2021-05-27 12:57:39 +00:00
Taus
bb50f90a64
QL: Make all calls formulas
2021-05-27 12:57:39 +00:00
Taus
20e72d3304
Add AST node for expression annotations
2021-05-27 12:52:37 +00:00
Taus
59c0c06a8e
QL: Add AST node for expression annotations
2021-05-27 12:52:37 +00:00
Taus
6aa64ba2cc
Fix up NoneCall
...
In some contexts, `none()` is a formula. This means in general we cannot
assume `Call` is an `Expr`, but only know that it's an `AstNode`.
2021-05-27 12:41:22 +00:00
Taus
b79e295c71
QL: Fix up NoneCall
...
In some contexts, `none()` is a formula. This means in general we cannot
assume `Call` is an `Expr`, but only know that it's an `AstNode`.
2021-05-27 12:41:22 +00:00
Taus
a99a6a4721
Add use of parentheses to printAst test
2021-05-27 12:25:29 +00:00
Taus
3211545a63
QL: Add use of parentheses to printAst test
2021-05-27 12:25:29 +00:00
Taus
21e8993c71
Hide parentheses in AST
...
Joint work with erik-krogh
2021-05-27 12:17:40 +00:00
Taus
b4f67c9d5f
QL: Hide parentheses in AST
...
Joint work with erik-krogh
2021-05-27 12:17:40 +00:00
Tom Hvitved
80761ba069
Make jump-to-def queries work for module references
2021-05-27 12:58:52 +02:00
Tom Hvitved
aa23ec0714
QL: Make jump-to-def queries work for module references
2021-05-27 12:58:52 +02:00
shati-patel
65bdb1722c
More QLDoc
2021-05-27 11:52:48 +01:00
shati-patel
b4a03fe3f0
QL: More QLDoc
2021-05-27 11:52:48 +01:00
Tom Hvitved
871f4b1be8
Merge pull request #8 from github/module-resolution
...
Module resolution
2021-05-27 12:45:07 +02:00
Tom Hvitved
e1501dc830
QL: Merge pull request #8 from github/module-resolution
...
Module resolution
2021-05-27 12:45:07 +02:00
Tom Hvitved
ebb1cd3f8f
Module resolution
2021-05-27 12:42:46 +02:00
Tom Hvitved
f3cae6bb25
QL: Module resolution
2021-05-27 12:42:46 +02:00
Taus
0aa7127e47
link up NewType correctly
2021-05-27 10:41:43 +00:00
Taus
b3844cb715
QL: link up NewType correctly
2021-05-27 10:41:43 +00:00
Taus
c89e924b67
regenerate TreeSitter.ql
2021-05-27 10:24:00 +00:00
Taus
5a3da4b9eb
QL: regenerate TreeSitter.ql
2021-05-27 10:24:00 +00:00
Erik Krogh Kristensen
c449e45b72
Merge pull request #11 from github/greenbar
...
Trying to get a green bar
2021-05-27 12:16:43 +02:00
Erik Krogh Kristensen
ae164a6049
QL: Merge pull request #11 from github/greenbar
...
Trying to get a green bar
2021-05-27 12:16:43 +02:00
Erik Krogh Kristensen
1d7f43206e
update the printAst test
2021-05-27 10:13:42 +00:00
Erik Krogh Kristensen
ef83783d11
QL: update the printAst test
2021-05-27 10:13:42 +00:00
Erik Krogh Kristensen
4921b6cf56
switch to having the pretty AST by default in printAst
2021-05-27 10:13:33 +00:00
Erik Krogh Kristensen
58fb239cf0
QL: switch to having the pretty AST by default in printAst
2021-05-27 10:13:33 +00:00
Taus
cdd9978c30
ifs, implications, instanceof
2021-05-27 10:12:41 +00:00
Taus
3ac7fa8369
QL: ifs, implications, instanceof
2021-05-27 10:12:41 +00:00
Erik Krogh Kristensen
be495b28da
add cases to the getParent relation
2021-05-27 10:12:03 +00:00
Erik Krogh Kristensen
3aebdcce7b
QL: add cases to the getParent relation
2021-05-27 10:12:03 +00:00
Erik Krogh Kristensen
79789e28a1
calls and inline casts
2021-05-27 10:04:20 +00:00
Erik Krogh Kristensen
a38d9a3cbf
QL: calls and inline casts
2021-05-27 10:04:20 +00:00
shati-patel
d9a7f10cfe
Add more QLDoc
2021-05-27 10:56:40 +01:00
shati-patel
83a38eebab
QL: Add more QLDoc
2021-05-27 10:56:40 +01:00
Shati Patel
14ee979bbe
Merge pull request #10 from github/more-expressions
...
Add more expressions
2021-05-27 10:44:49 +01:00
Shati Patel
1aecd5738b
QL: Merge pull request #10 from github/more-expressions
...
Add more expressions
2021-05-27 10:44:49 +01:00
shati-patel
8f031cda5f
Add more expressions
2021-05-27 10:41:29 +01:00
shati-patel
fb30a1c893
QL: Add more expressions
2021-05-27 10:41:29 +01:00
Erik Krogh Kristensen
c4c0a63104
use moduleExpr in Type
2021-05-27 09:31:47 +00:00
Erik Krogh Kristensen
01ae97bf22
QL: use moduleExpr in Type
2021-05-27 09:31:47 +00:00
Tom Hvitved
01d4b8a41c
Add module expressions and module aliases
2021-05-27 11:28:37 +02:00
Tom Hvitved
7b64df51ab
QL: Add module expressions and module aliases
2021-05-27 11:28:37 +02:00
Tom Hvitved
509e789510
Merge pull request #9 from github/dataset-measure
...
Update dataset_measure.yml
2021-05-27 10:48:09 +02:00
Tom Hvitved
9f68fdfb61
QL: Merge pull request #9 from github/dataset-measure
...
Update dataset_measure.yml
2021-05-27 10:48:09 +02:00
Tom Hvitved
aaa7973906
Update dataset_measure.yml
2021-05-27 10:39:51 +02:00
Tom Hvitved
ff591a0c57
QL: Update dataset_measure.yml
2021-05-27 10:39:51 +02:00
Erik Krogh Kristensen
48c9e5f3b8
Merge pull request #7 from github/ast
...
AST layer
2021-05-27 10:39:04 +02:00
Erik Krogh Kristensen
d941e7cdb8
QL: Merge pull request #7 from github/ast
...
AST layer
2021-05-27 10:39:04 +02:00
Tom Hvitved
09d0cdbaf8
Add ModuleMember::isPrivate()
2021-05-27 10:27:57 +02:00
Tom Hvitved
197a36daf6
QL: Add ModuleMember::isPrivate()
2021-05-27 10:27:57 +02:00
Erik Krogh Kristensen
ab20f8f74e
add support for aggregates
2021-05-27 08:23:15 +00:00
Erik Krogh Kristensen
b83c19f27b
QL: add support for aggregates
2021-05-27 08:23:15 +00:00
Erik Krogh Kristensen
fec3d745ca
make sure Literal is an Expr
2021-05-27 07:31:44 +00:00
Erik Krogh Kristensen
abec79cb0f
QL: make sure Literal is an Expr
2021-05-27 07:31:44 +00:00
Erik Krogh Kristensen
ee9e1914b0
literals and fixes
2021-05-26 21:35:01 +00:00
Erik Krogh Kristensen
6f5499eefe
QL: literals and fixes
2021-05-26 21:35:01 +00:00
Erik Krogh Kristensen
a692794178
add types
2021-05-26 21:35:01 +00:00
Erik Krogh Kristensen
c075f370c7
QL: add types
2021-05-26 21:35:01 +00:00
Taus
ec98e8a82d
Add convenience methods for aggregates
2021-05-26 21:25:42 +00:00
Taus
9536e591fb
QL: Add convenience methods for aggregates
2021-05-26 21:25:42 +00:00
Taus
4eb836ca9b
AST for quantifiers, negation
2021-05-26 21:06:04 +00:00
Taus
d4782e67fe
QL: AST for quantifiers, negation
2021-05-26 21:06:04 +00:00
Erik Krogh Kristensen
3057790071
ast for imports, modules, and various fixes
2021-05-26 19:39:54 +00:00
Erik Krogh Kristensen
ad7d35df2a
QL: ast for imports, modules, and various fixes
2021-05-26 19:39:54 +00:00
Taus
2addbfabd0
More work on ComparisonFormula
2021-05-26 18:12:06 +00:00
Taus
0ddac5bcee
QL: More work on ComparisonFormula
2021-05-26 18:12:06 +00:00
Taus
eafbd15da0
Merge branch 'main' into ast
2021-05-26 17:38:44 +00:00
Taus
cd15cec629
QL: Merge branch 'main' into ast
2021-05-26 17:38:44 +00:00
Taus
2443ad3314
Add body as a field of charpred
2021-05-26 17:26:15 +00:00
Taus
e554fa8277
QL: Add body as a field of charpred
2021-05-26 17:26:15 +00:00
Taus
94c1321e43
WIP formulas and expressions
...
Joint work with shati-patel.
2021-05-26 16:21:01 +00:00
Taus
29c32a924f
QL: WIP formulas and expressions
...
Joint work with shati-patel.
2021-05-26 16:21:01 +00:00
Erik Krogh Kristensen
28968163e0
Merge remote-tracking branch 'origin/main' into ast
2021-05-26 15:02:23 +00:00
Erik Krogh Kristensen
20f495dfbf
QL: Merge remote-tracking branch 'origin/main' into ast
2021-05-26 15:02:23 +00:00
Erik Krogh Kristensen
7a4a4e9cdd
implement more AST cases
2021-05-26 15:01:55 +00:00
Erik Krogh Kristensen
a453c32e71
QL: implement more AST cases
2021-05-26 15:01:55 +00:00
Taus
9b8acdb37f
Don't printAst ReservedWords
2021-05-26 14:28:33 +00:00
Taus
88972f04f4
QL: Don't printAst ReservedWords
2021-05-26 14:28:33 +00:00
Erik Krogh Kristensen
8fa3a425a5
slightly more AST stuff
2021-05-26 14:18:25 +00:00
Erik Krogh Kristensen
9a9b6f71c2
QL: slightly more AST stuff
2021-05-26 14:18:25 +00:00
Erik Krogh Kristensen
cb49c1ec24
switch printAst query to use new pretty AST layer
2021-05-26 14:04:23 +00:00
Erik Krogh Kristensen
407a3b5d3d
QL: switch printAst query to use new pretty AST layer
2021-05-26 14:04:23 +00:00
Erik Krogh Kristensen
a4603a49a1
fix format (again)
2021-05-26 13:53:15 +00:00
Erik Krogh Kristensen
7f2c999b8e
QL: fix format (again)
2021-05-26 13:53:15 +00:00
Erik Krogh Kristensen
00b33acfe9
fix format
2021-05-26 13:50:19 +00:00
Erik Krogh Kristensen
e820a5a1e2
QL: fix format
2021-05-26 13:50:19 +00:00
Erik Krogh Kristensen
344c19f049
extremely minimal AST layer
2021-05-26 13:48:02 +00:00
Erik Krogh Kristensen
e35ab675ba
QL: extremely minimal AST layer
2021-05-26 13:48:02 +00:00
Taus
f2edd7724c
Record annotation names in the AST
2021-05-26 13:14:52 +00:00
Taus
c91a2b88fd
QL: Record annotation names in the AST
2021-05-26 13:14:52 +00:00
Erik Krogh Kristensen
e469ce171d
don't print LineComment (they were disconnected from the root), and a bit of printAst performance
2021-05-26 13:12:44 +00:00
Erik Krogh Kristensen
955f4d4d24
QL: don't print LineComment (they were disconnected from the root), and a bit of printAst performance
2021-05-26 13:12:44 +00:00
shati-patel
80b508aa03
de-ruby some more things
2021-05-26 14:09:09 +01:00
shati-patel
bae0c260d9
QL: de-ruby some more things
2021-05-26 14:09:09 +01:00
Erik Krogh Kristensen
44311e2ace
Merge pull request #5 from github/qltest-testing
...
Get qlTest to work
2021-05-26 14:48:20 +02:00
Erik Krogh Kristensen
54e449f3c6
QL: Merge pull request #5 from github/qltest-testing
...
Get qlTest to work
2021-05-26 14:48:20 +02:00
Erik Krogh Kristensen
f916aa9a37
better printAst test
2021-05-26 12:44:50 +00:00
Erik Krogh Kristensen
9772f35984
QL: better printAst test
2021-05-26 12:44:50 +00:00
Erik Krogh Kristensen
a015b9499a
add test for the printAst query
2021-05-26 12:38:21 +00:00
Erik Krogh Kristensen
5494db9b33
QL: add test for the printAst query
2021-05-26 12:38:21 +00:00
Erik Krogh Kristensen
4ca756ddf9
insert placeholder (that compiles) in localDefinitions.ql
2021-05-26 12:29:12 +00:00
Erik Krogh Kristensen
571b949a06
QL: insert placeholder (that compiles) in localDefinitions.ql
2021-05-26 12:29:12 +00:00
Erik Krogh Kristensen
3addd03c29
insert placeholder (that compiles) in localReferences.ql
2021-05-26 12:29:12 +00:00
Erik Krogh Kristensen
fe6595ec02
QL: insert placeholder (that compiles) in localReferences.ql
2021-05-26 12:29:12 +00:00
Taus
f351100f86
Merge pull request #6 from github/support-expr-annotations
...
Support expression annotations
2021-05-26 14:25:25 +02:00
Taus
36497ad50a
QL: Merge pull request #6 from github/support-expr-annotations
...
Support expression annotations
2021-05-26 14:25:25 +02:00
Taus
0f6d6df745
Support expression annotations
2021-05-26 12:21:19 +00:00
Taus
6f8f0bb749
QL: Support expression annotations
2021-05-26 12:21:19 +00:00
Tom Hvitved
0c3ce12520
Update ql.qll
2021-05-26 14:00:36 +02:00
Tom Hvitved
8493f515ee
QL: Update ql.qll
2021-05-26 14:00:36 +02:00
Erik Krogh Kristensen
9e5a4b9fbb
get printAst to work
2021-05-26 11:58:14 +00:00
Erik Krogh Kristensen
530df51e8f
QL: get printAst to work
2021-05-26 11:58:14 +00:00
shati-patel
041c07463f
another bit of cleanup
2021-05-26 12:38:40 +01:00
shati-patel
1b8f702ec6
QL: another bit of cleanup
2021-05-26 12:38:40 +01:00
Tom Hvitved
419e69b2b5
More cleanup
2021-05-26 13:25:43 +02:00
Tom Hvitved
68e9f9657b
QL: More cleanup
2021-05-26 13:25:43 +02:00
shati-patel
5b830fdcd1
Fix commands on Windows (take 2)
2021-05-26 12:24:54 +01:00
shati-patel
f9f8dfb619
QL: Fix commands on Windows (take 2)
2021-05-26 12:24:54 +01:00
Erik Krogh Kristensen
f04005e4ca
update dbscheme to fix capitalization
2021-05-26 11:23:22 +00:00
Erik Krogh Kristensen
2df49aaae8
QL: update dbscheme to fix capitalization
2021-05-26 11:23:22 +00:00
Erik Krogh Kristensen
ecde34fdf4
Merge pull request #4 from github/fixCap
...
fix snake_casing of generated ql identifiers
2021-05-26 13:18:30 +02:00
Erik Krogh Kristensen
786f756591
QL: Merge pull request #4 from github/fixCap
...
fix snake_casing of generated ql identifiers
2021-05-26 13:18:30 +02:00
shati-patel
d7e53bfdb3
Fix Windows commands
2021-05-26 12:12:36 +01:00
shati-patel
407f63b7d2
QL: Fix Windows commands
2021-05-26 12:12:36 +01:00
Erik Krogh Kristensen
02e1d424b2
fix snake_casing of generated ql identifiers
2021-05-26 11:12:05 +00:00
Erik Krogh Kristensen
b0d86d466f
QL: fix snake_casing of generated ql identifiers
2021-05-26 11:12:05 +00:00
Shati Patel
021c0a03b4
Update devcontainer files
2021-05-26 10:22:53 +00:00
Shati Patel
6bb91f4080
QL: Update devcontainer files
2021-05-26 10:22:53 +00:00
Tom Hvitved
815bd4fb92
Update workflow files
2021-05-26 11:50:37 +02:00
Tom Hvitved
cacefbe075
QL: Update workflow files
2021-05-26 11:50:37 +02:00
Tom Hvitved
ec15ba8e9c
Update Readme
2021-05-26 11:46:34 +02:00
Tom Hvitved
f5c1b2e645
QL: Update Readme
2021-05-26 11:46:34 +02:00
Tom Hvitved
6d04ef46f4
Change more Ruby to QL
2021-05-26 11:43:18 +02:00
Tom Hvitved
823ab1076a
QL: Change more Ruby to QL
2021-05-26 11:43:18 +02:00
Tom Hvitved
7bac6a07b6
Initial commit
2021-05-26 11:32:30 +02:00
