github
/
codeql
зеркало из https://github.com/github/codeql.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
6 587 коммитов 1 542 Ветки 132 Теги 495 MiB
Граф коммитов

341 Коммитов

Автор SHA1 Сообщение Дата
Pavel Avgustinov cc854dd937 Merge branch 'master' of github.com:Semmle/ql into attribute 2019-08-23 09:55:35 +01:00
Calum Grant ff20a2ceb9
Merge pull request #1761 from hvitved/csharp/dataflow/fields 
C#: Data flow through fields
 2019-08-22 20:46:00 +01:00
Tom Hvitved 0801e51175
Merge pull request #1790 from jbj/tainttracking-cross-language 
C++/C#/Java: Shared TaintTrackingImpl.qll
 2019-08-22 14:17:23 +02:00
Jonas Jensen ad9ee54b65 C++/C#/Java: defaultAdditionalTaintStep 2019-08-22 11:14:06 +02:00
yh-semmle 9012c3240f
Merge pull request #1789 from aschackmull/java/autoformat 
Java: Autoformat.
 2019-08-21 12:36:55 -04:00
Tom Hvitved a2ffddec5f
Merge pull request #1785 from jbj/dataflow-recursion-prevention-shared 
C++/C#/Java: Pyrameterize ConfigurationRecursionPrevention
 2019-08-21 15:56:50 +02:00
Jonas Jensen 25701f203d C++/C#/Java: Shared TaintTrackingImpl.qll 
This file is now identical in all languages. Unifying this file led to
the following changes:
- The documentation spelling fixes and example from the C++ version
  were copied to the other versions and updated.
- The steps through `NonLocalJumpNode` from C# were abstracted into a
  `globalAdditionalTaintStep` predicate that's empty for C++ and Java.
- The `defaultTaintBarrier` predicate from Java is now present but empty
  on C++ and C#.
- The C++ `isAdditionalFlowStep` predicate on
  `TaintTracking::Configuration` no longer includes `localFlowStep`.
  That should avoid some unnecessary tuple copying.
 2019-08-21 14:55:54 +02:00
Anders Schack-Mulligen 629c19e719 Java: Autoformat. 2019-08-21 14:38:17 +02:00
Pavel Avgustinov cb3551b4d6 Merge commit '76982404' into attribute 2019-08-21 12:44:07 +01:00
Jonas Jensen 863bf523d6 C++/C#/Java: Autoformat 2019-08-21 13:24:01 +02:00
Jonas Jensen fdd3b901f7 C/C#/Java: Share ConfigurationRecursionPrevention 
This class was copy-pasted in all `DataFlowN.qll` files without using
the identical-files system to keep the copies in sync. The class is now
moved to the `DataFlowImplN.qll` files.

This also has the effect of preventing recursion through first data flow
library copy for C/C++. Such recursion has been deprecated for over a
year, and some forms of recursions are already ruled out by the library
implementation.
 2019-08-21 13:04:10 +02:00
Jonas Jensen 6fc3a62edb C++/C#/Java: Change another caller of localFlow 
There was also a use of `localFlowStep` in `DataFlowImplCommon` that
should now be `simpleLocalFlowStep`.
 2019-08-21 10:20:15 +02:00
Jonas Jensen c9ea5ad9a3 C#/Java: Remove `cached` from wrapper predicate 2019-08-21 09:43:13 +02:00
Jonas Jensen 4b7813b98e C++/C#/Java: Split localFlowStep predicate in two 
There's now a `localFlowStep` predicate for use directly in queries and
other libraries and a `simpleLocalFlowStep` for use only by the global
data flow library. The former predicate is intended to include field
flow, but the latter may not.

This will let Java and C# (and possibly C++ IR) avoid getting two kinds
of field flow at the same time, both from SSA and from the global data
flow library. It should let C++ AST add some form of field flow to
`localFlowStep` without making it an input to the global data flow
library.
 2019-08-21 09:27:01 +02:00
Pavel Avgustinov 7176b438c4 Merge commit '7bfed6e517cbcabfe06cf614981baee8cbde5342' into attribute 2019-08-20 14:08:57 +01:00
Tom Hvitved 7ab9c8b90d Java/C++/C#: `flowCandFwdRead()` refactor 2019-08-20 14:44:04 +02:00
Tom Hvitved 14378ee41a Java/C++/C#: Remove some `unbind()` calls from shared data flow implementation 2019-08-20 13:59:01 +02:00
Jonas Jensen f1e6e36ce6 Java: Remove wrong definition of taint tracking 
This explanation, taken from C/C++, was not correct for Java.
 2019-08-20 13:45:38 +02:00
Jonas Jensen 9ac0cdd2a2 Java: Don't use the deprecated Configuration2 2019-08-20 13:45:37 +02:00
Jonas Jensen aeb2323128 Java: Use pyrameterized modules for TaintTracking 2019-08-20 13:45:37 +02:00
Tom Hvitved a0c834c83d Java/C++/C#: Improve data flow join orders for field flow 2019-08-20 10:14:08 +02:00
Anders Schack-Mulligen 6ff4fe38ec Java/C++/C#: Add field flow support for stores in nested fields. 2019-08-19 14:41:06 +02:00
yh-semmle 73d8e16cd0 Java: remove obsolete `VCS.qll` and associated queries 2019-08-18 14:53:46 -04:00
Pavel Avgustinov 127c33700c Add Java stubs readme 2019-08-17 18:57:50 +01:00
Pavel Avgustinov c92eb58300 Add j2objc license 2019-08-17 16:31:18 +01:00
Pavel Avgustinov b52ea1e21b Add Apache Shiro third-party notice 2019-08-17 16:31:18 +01:00
Anders Schack-Mulligen 9e4f2f8594 Java: Don't use default dataflow in libs imported by default. 2019-08-16 13:27:53 +02:00
Anders Schack-Mulligen 1938ac4937 Java/C++/C#: Sync. 2019-08-14 10:32:15 +02:00
Anders Schack-Mulligen 0c56f955e8 Java: Fix bad join order. 2019-08-14 10:10:19 +02:00
Anders Schack-Mulligen 411bc16f44 Java/C++/C#: Address review comment. 2019-08-13 16:57:48 +02:00
Anders Schack-Mulligen 9e902066ad Java/C++/C#: Elaborate qldoc. 2019-08-13 16:57:48 +02:00
Anders Schack-Mulligen 4550175b16 Java/C++/C#: Add support for BarrierGuards. 2019-08-13 16:57:48 +02:00
yh-semmle 5e910a4808
Merge pull request #1724 from aschackmull/java/google-xmlreader 
Java: Treat SecureJDKXercesXMLReader as a secure XMLReader.
 2019-08-13 09:52:32 -04:00
Tom Hvitved 36043d04bd
Merge pull request #1729 from xiemaisi/data-flow-nodes-location 
Java/C++/C#: Provide path-node locations via `hasLocationInfo`, not `getLocation`.
 2019-08-13 12:22:59 +02:00
Max Schaefer eb8087f4ea Java/C++/C#: Provide path-node locations via `hasLocationInfo`, not `getLocation`. 2019-08-12 12:52:30 +01:00
Anders Schack-Mulligen 41763e6025 Java: Treat SecureJDKXercesXMLReader as a secure XMLReader. 2019-08-09 16:00:41 +02:00
Anders Schack-Mulligen a50ea54ff6 Java: Fix tests. 2019-08-08 12:03:01 +02:00
Anders Schack-Mulligen b3e56d5b04 Java: Fix copy-paste typo. 2019-08-08 11:44:44 +02:00
Anders Schack-Mulligen 20e6f5594f Java: Improve barriers for the CWE-190 Arithmetic* queries. 2019-08-07 15:22:23 +02:00
yh-semmle 033879f5a6
Merge pull request #1639 from aschackmull/java/in-out-barriers 
Java/C++/C# DataFlow: Add support for in/out barriers on sources and sinks.
 2019-08-07 01:07:19 -04:00
yh-semmle 9e4405f385
Merge pull request #1688 from aschackmull/java-cookbook/int-literal-value 
Java Cookbook: Slight improvement to the IntegerLiteral pattern.
 2019-08-05 20:37:58 -04:00
yh-semmle 7e90728c67
Merge pull request #1679 from aschackmull/java/reader-taint 
Java: Adjust taint steps for Reader::read.
 2019-08-05 12:46:12 -04:00
Anders Schack-Mulligen a80cb262fc Java/C++/C#: Elaborate qldoc. 2019-08-05 16:28:25 +02:00
Anders Schack-Mulligen 9ebb83497d Java/C++/C#: Fix small mistake. 2019-08-05 15:34:12 +02:00
Anders Schack-Mulligen 2dc83c539c Java/C++/C#: Sync dataflow. 2019-08-05 12:07:32 +02:00
Anders Schack-Mulligen f8804943ee Java: Change in/out barriers to be explicit in the configuration. 2019-08-05 12:05:12 +02:00
Anders Schack-Mulligen 15c61b57f7 Java Cookbook: Slight improvement to the IntegerLiteral pattern. 2019-08-05 11:03:30 +02:00
Jonas Jensen 73d8bf38a9
Merge pull request #1680 from aschackmull/cookbook/autoformat 
Cookbook examples: Autoformat
 2019-08-05 10:24:56 +02:00
Anders Schack-Mulligen b1b1ede6b0 Java: Improve the precision of java/hardcoded-credential-api-call. 2019-08-02 16:50:58 +02:00
Anders Schack-Mulligen 9b74e9c4a4 Java: Autoformat cookbook examples. 2019-08-02 15:27:28 +02:00