Skip to content

Commit 45146bc

Browse files
jorgectfjorgectf
committed
Merge branch 'main' into jorgectf/python/headerInjection
2 parents bf76d9c + b2e4276 commit 45146bc

File tree

1,988 files changed

+125868
-19954
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,988 files changed

+125868
-19954
lines changed

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ on:
66
- '.github/workflows/csv-coverage-pr-comment.yml'
77
- '*/ql/src/**/*.ql'
88
- '*/ql/src/**/*.qll'
9+
- '*/ql/lib/**/*.ql'
10+
- '*/ql/lib/**/*.qll'
911
- 'misc/scripts/library-coverage/*.py'
1012
# input data files
1113
- '*/documentation/library-coverage/cwe-sink.csv'

‎.github/workflows/csv-coverage-update.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ on:
88
jobs:
99
update:
1010
name: Update framework coverage report
11-
if: github.event.repository.fork == false
11+
if: github.repository == 'github/codeql'
1212
runs-on: ubuntu-latest
1313

1414
steps:

‎.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,6 @@
2424
/codeql/
2525

2626
csharp/extractor/Semmle.Extraction.CSharp.Driver/Properties/launchSettings.json
27+
28+
# Avoid committing cached package components
29+
.codeql

‎README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ This open source repository contains the standard CodeQL libraries and queries t
44

55
## How do I learn CodeQL and run queries?
66

7-
There is [extensive documentation](https://help.semmle.com/QL/learn-ql/) on getting started with writing CodeQL.
8-
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://help.semmle.com/codeql/codeql-for-vscode.html) extension to try out your queries on any open source project that's currently being analyzed.
7+
There is [extensive documentation](https://codeql.github.com/docs/) on getting started with writing CodeQL.
8+
You can use the [interactive query console](https://lgtm.com/help/lgtm/using-query-console) on LGTM.com or the [CodeQL for Visual Studio Code](https://codeql.github.com/docs/codeql-for-visual-studio-code/) extension to try out your queries on any open source project that's currently being analyzed.
99

1010
## Contributing
1111

‎config/identical-files.json

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -367,6 +367,7 @@
367367
],
368368
"Inline Test Expectations": [
369369
"cpp/ql/test/TestUtilities/InlineExpectationsTest.qll",
370+
"csharp/ql/test/TestUtilities/InlineExpectationsTest.qll",
370371
"java/ql/test/TestUtilities/InlineExpectationsTest.qll",
371372
"python/ql/test/TestUtilities/InlineExpectationsTest.qll"
372373
],
@@ -461,5 +462,12 @@
461462
"ReDoS Polynomial Python/JS": [
462463
"javascript/ql/lib/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
463464
"python/ql/lib/semmle/python/security/performance/SuperlinearBackTracking.qll"
465+
],
466+
"CodeQL Tutorial": [
467+
"cpp/ql/lib/tutorial.qll",
468+
"csharp/ql/lib/tutorial.qll",
469+
"java/ql/lib/tutorial.qll",
470+
"javascript/ql/lib/tutorial.qll",
471+
"python/ql/lib/tutorial.qll"
464472
]
465473
}

‎cpp/change-notes/2021-06-10-cleartext-transmission.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* A new query (`cpp/cleartext-transmission`) has been added. This is similar to the `cpp/cleartext-storage-file`, `cpp/cleartext-storage-buffer` and `cpp/cleartext-storage-database` queries but looks for cases where sensitive information is most likely transmitted over a network.

‎cpp/change-notes/2021-06-22-sql-tainted.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Uncontrolled data in SQL query' (cpp/sql-injection) query now supports the `libpqxx` library.

‎cpp/change-notes/2021-09-13-overflow-static.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
lgtm,codescanning
2+
* The `memberMayBeVarSize` predicate considers more fields to be variable size.
3+
As a result, the "Static buffer overflow" query (cpp/static-buffer-overflow)
4+
produces fewer false positives.

‎cpp/change-notes/2021-09-27-command-line-injection.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The "Uncontrolled data used in OS command" (`cpp/command-line-injection`) query has been enhanced to reduce false positive results and its `@precision` increased to `high`

‎cpp/change-notes/2021-09-27-overflow-static.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
lgtm,codescanning
2+
* Increase precision to high for the "Static buffer overflow" query
3+
(`cpp/static-buffer-overflow`). This means the query is run and displayed by default on Code Scanning and LGTM.

0 commit comments

Comments
 (0)