Skip to content

Commit eee9b3f

Browse files
jorgectfjorgectf
committed
Merge remote-tracking branch 'origin/main' into jorgectf/python/headerInjection
2 parents 352eab0 + 0e9d36b commit eee9b3f

File tree

2,262 files changed

+206613
-30272
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,262 files changed

+206613
-30272
lines changed

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Check framework coverage changes
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '.github/workflows/csv-coverage-pr-comment.yml'
7+
- '*/ql/src/**/*.ql'
8+
- '*/ql/src/**/*.qll'
9+
- 'misc/scripts/library-coverage/*.py'
10+
# input data files
11+
- '*/documentation/library-coverage/cwe-sink.csv'
12+
- '*/documentation/library-coverage/frameworks.csv'
13+
branches:
14+
- main
15+
- 'rc/*'
16+
17+
jobs:
18+
generate:
19+
name: Generate framework coverage artifacts
20+
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: Dump GitHub context
25+
env:
26+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
27+
run: echo "$GITHUB_CONTEXT"
28+
- name: Clone self (github/codeql) - MERGE
29+
uses: actions/checkout@v2
30+
with:
31+
path: merge
32+
- name: Clone self (github/codeql) - BASE
33+
uses: actions/checkout@v2
34+
with:
35+
fetch-depth: 2
36+
path: base
37+
- run: |
38+
git checkout HEAD^1
39+
git log -1 --format='%H'
40+
working-directory: base
41+
- name: Set up Python 3.8
42+
uses: actions/setup-python@v2
43+
with:
44+
python-version: 3.8
45+
- name: Download CodeQL CLI
46+
env:
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
run: |
49+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
50+
- name: Unzip CodeQL CLI
51+
run: unzip -d codeql-cli codeql-linux64.zip
52+
- name: Generate CSV files on merge commit of the PR
53+
run: |
54+
echo "Running generator on merge"
55+
PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
56+
mkdir out_merge
57+
cp framework-coverage-*.csv out_merge/
58+
cp framework-coverage-*.rst out_merge/
59+
- name: Generate CSV files on base commit of the PR
60+
run: |
61+
echo "Running generator on base"
62+
PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
63+
mkdir out_base
64+
cp framework-coverage-*.csv out_base/
65+
cp framework-coverage-*.rst out_base/
66+
- name: Generate diff of coverage reports
67+
run: |
68+
python base/misc/scripts/library-coverage/compare-folders.py out_base out_merge comparison.md
69+
- name: Upload CSV package list
70+
uses: actions/upload-artifact@v2
71+
with:
72+
name: csv-framework-coverage-merge
73+
path: |
74+
out_merge/framework-coverage-*.csv
75+
out_merge/framework-coverage-*.rst
76+
- name: Upload CSV package list
77+
uses: actions/upload-artifact@v2
78+
with:
79+
name: csv-framework-coverage-base
80+
path: |
81+
out_base/framework-coverage-*.csv
82+
out_base/framework-coverage-*.rst
83+
- name: Upload comparison results
84+
uses: actions/upload-artifact@v2
85+
with:
86+
name: comparison
87+
path: |
88+
comparison.md
89+
- name: Save PR number
90+
run: |
91+
mkdir -p pr
92+
echo ${{ github.event.pull_request.number }} > pr/NR
93+
- name: Upload PR number
94+
uses: actions/upload-artifact@v2
95+
with:
96+
name: pr
97+
path: pr/

‎.github/workflows/csv-coverage-pr-comment.yml

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Comment on PR with framework coverage changes
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Check framework coverage changes"]
6+
types:
7+
- completed
8+
9+
jobs:
10+
check:
11+
name: Check framework coverage differences and comment
12+
runs-on: ubuntu-latest
13+
if: >
14+
${{ github.event.workflow_run.event == 'pull_request' &&
15+
github.event.workflow_run.conclusion == 'success' }}
16+
17+
steps:
18+
- name: Dump GitHub context
19+
env:
20+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
21+
run: echo "$GITHUB_CONTEXT"
22+
- name: Clone self (github/codeql)
23+
uses: actions/checkout@v2
24+
- name: Set up Python 3.8
25+
uses: actions/setup-python@v2
26+
with:
27+
python-version: 3.8
28+
29+
- name: Check coverage difference file and comment
30+
env:
31+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
32+
RUN_ID: ${{ github.event.workflow_run.id }}
33+
run: |
34+
python misc/scripts/library-coverage/comment-pr.py "$GITHUB_REPOSITORY" "$RUN_ID"

‎.github/workflows/csv-coverage-update.yml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Update framework coverage reports
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "0 0 * * *"
7+
8+
jobs:
9+
update:
10+
name: Update framework coverage report
11+
if: github.event.repository.fork == false
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Dump GitHub context
16+
env:
17+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
18+
run: echo "$GITHUB_CONTEXT"
19+
- name: Clone self (github/codeql)
20+
uses: actions/checkout@v2
21+
with:
22+
path: ql
23+
fetch-depth: 0
24+
- name: Set up Python 3.8
25+
uses: actions/setup-python@v2
26+
with:
27+
python-version: 3.8
28+
- name: Download CodeQL CLI
29+
env:
30+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31+
run: |
32+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
33+
- name: Unzip CodeQL CLI
34+
run: unzip -d codeql-cli codeql-linux64.zip
35+
36+
- name: Generate coverage files
37+
run: |
38+
PATH="$PATH:codeql-cli/codeql" python ql/misc/scripts/library-coverage/generate-report.py ci ql ql
39+
40+
- name: Create pull request with changes
41+
env:
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
run: |
44+
python ql/misc/scripts/library-coverage/create-pr.py ql "$GITHUB_REPOSITORY"

‎CODEOWNERS

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,9 @@
1717
/java/ql/src/semmle/code/java/dataflow/internal/DataFlowImplCommon.qll @github/codeql-java @github/codeql-go
1818
/java/ql/src/semmle/code/java/dataflow/internal/tainttracking1/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
1919
/java/ql/src/semmle/code/java/dataflow/internal/tainttracking2/TaintTrackingImpl.qll @github/codeql-java @github/codeql-go
20+
21+
# CodeQL tools and associated docs
22+
/docs/codeql-cli/ @github/codeql-cli-reviewers
23+
/docs/codeql-for-visual-studio-code/ @github/codeql-vscode-reviewers
24+
/docs/ql-language-reference/ @github/codeql-frontend-reviewers
25+
/docs/query-*-style-guide.md @github/codeql-analysis-reviewers

‎config/identical-files.json

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -448,5 +448,17 @@
448448
"SensitiveDataHeuristics Python/JS": [
449449
"javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
450450
"python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll"
451+
],
452+
"ReDoS Util Python/JS": [
453+
"javascript/ql/src/semmle/javascript/security/performance/ReDoSUtil.qll",
454+
"python/ql/src/semmle/python/security/performance/ReDoSUtil.qll"
455+
],
456+
"ReDoS Exponential Python/JS": [
457+
"javascript/ql/src/semmle/javascript/security/performance/ExponentialBackTracking.qll",
458+
"python/ql/src/semmle/python/security/performance/ExponentialBackTracking.qll"
459+
],
460+
"ReDoS Polynomial Python/JS": [
461+
"javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll",
462+
"python/ql/src/semmle/python/security/performance/SuperlinearBackTracking.qll"
451463
]
452464
}

‎cpp/change-notes/2021-06-21-weak-cryptographic-algorithm.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The "Use of a broken or risky cryptographic algorithm" (`cpp/weak-cryptographic-algorithm`) query has been further improved to reduce false positives and its `@precision` increased to `high`.

‎cpp/change-notes/2021-06-24-dataflow-implicit-reads.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The DataFlow libraries have been augmented with support for `Configuration`-specific in-place read steps at, for example, sinks and custom taint steps. This means that it is now possible to specify sinks that accept flow with non-empty access paths.

‎cpp/change-notes/2021-06-24-uncontrolled-arithmetic.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The 'Uncontrolled data in arithmetic expression' (cpp/uncontrolled-arithmetic) query now recognizes more sources of randomness.

‎cpp/change-notes/2021-06-30-wrong-type-format-argument.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Wrong type of arguments to formatting function' (cpp/wrong-type-format-argument) query is now more accepting of the string and character formatting differences between Microsoft and non-Microsoft platforms. There are now fewer false positive results.

‎cpp/change-notes/2021-07-20-toctou-race-condition.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* Improvements have been made to the `cpp/toctou-race-condition` query, both to find more correct results and fewer false positive results.

0 commit comments

Comments
 (0)