Skip to content

Commit 0c71393

Browse files
atorralbaatorralba
committed
Merge branch 'main' into atorralba/promote-unsafe-android-webview-fetch
2 parents 8553ca1 + 64001cc commit 0c71393

File tree

1,571 files changed

+59857
-14617
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,571 files changed

+59857
-14617
lines changed

‎.codeqlmanifest.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{ "provide": [ "*/ql/src/qlpack.yml",
22
"*/ql/test/qlpack.yml",
3+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
34
"*/ql/examples/qlpack.yml",
45
"*/upgrades/qlpack.yml",
56
"misc/legacy-support/*/qlpack.yml",

‎.github/workflows/check-change-note.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ jobs:
1919
env:
2020
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2121
run: |
22-
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
23-
jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status
22+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
23+
grep true -c

‎.github/workflows/csv-coverage-timeseries.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Build framework coverage timeseries reports
2+
3+
on:
4+
workflow_dispatch:
5+
6+
jobs:
7+
build:
8+
9+
runs-on: ubuntu-latest
10+
11+
steps:
12+
- name: Clone self (github/codeql)
13+
uses: actions/checkout@v2
14+
with:
15+
path: script
16+
- name: Clone self (github/codeql) for analysis
17+
uses: actions/checkout@v2
18+
with:
19+
path: codeqlModels
20+
fetch-depth: 0
21+
- name: Set up Python 3.8
22+
uses: actions/setup-python@v2
23+
with:
24+
python-version: 3.8
25+
- name: Download CodeQL CLI
26+
env:
27+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
28+
run: |
29+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
30+
- name: Unzip CodeQL CLI
31+
run: unzip -d codeql-cli codeql-linux64.zip
32+
- name: Build modeled package list
33+
run: |
34+
CLI=$(realpath "codeql-cli/codeql")
35+
echo $CLI
36+
PATH="$PATH:$CLI" python script/misc/scripts/library-coverage/generate-timeseries.py codeqlModels
37+
- name: Upload timeseries CSV
38+
uses: actions/upload-artifact@v2
39+
with:
40+
name: framework-coverage-timeseries
41+
path: framework-coverage-timeseries-*.csv
42+

‎.github/workflows/csv-coverage.yml

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Build framework coverage reports
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
qlModelShaOverride:
7+
description: 'github/codeql repo SHA used for looking up the CSV models'
8+
required: false
9+
10+
jobs:
11+
build:
12+
13+
runs-on: ubuntu-latest
14+
15+
steps:
16+
- name: Clone self (github/codeql)
17+
uses: actions/checkout@v2
18+
with:
19+
path: script
20+
- name: Clone self (github/codeql) for analysis
21+
uses: actions/checkout@v2
22+
with:
23+
path: codeqlModels
24+
ref: ${{ github.event.inputs.qlModelShaOverride || github.ref }}
25+
- name: Set up Python 3.8
26+
uses: actions/setup-python@v2
27+
with:
28+
python-version: 3.8
29+
- name: Download CodeQL CLI
30+
env:
31+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
32+
run: |
33+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
34+
- name: Unzip CodeQL CLI
35+
run: unzip -d codeql-cli codeql-linux64.zip
36+
- name: Build modeled package list
37+
run: |
38+
PATH="$PATH:codeql-cli/codeql" python script/misc/scripts/library-coverage/generate-report.py ci codeqlModels script
39+
- name: Upload CSV package list
40+
uses: actions/upload-artifact@v2
41+
with:
42+
name: framework-coverage-csv
43+
path: framework-coverage-*.csv
44+
- name: Upload RST package list
45+
uses: actions/upload-artifact@v2
46+
with:
47+
name: framework-coverage-rst
48+
path: framework-coverage-*.rst
49+

‎config/identical-files.json

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,10 @@
250250
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
251251
"csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll"
252252
],
253+
"SSA PrintAliasAnalysis": [
254+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
255+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
256+
],
253257
"C++ SSA AliasAnalysisImports": [
254258
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
255259
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
@@ -439,6 +443,10 @@
439443
],
440444
"CryptoAlgorithms Python/JS": [
441445
"javascript/ql/src/semmle/javascript/security/CryptoAlgorithms.qll",
442-
"python/ql/src/semmle/crypto/Crypto.qll"
446+
"python/ql/src/semmle/python/concepts/CryptoAlgorithms.qll"
447+
],
448+
"SensitiveDataHeuristics Python/JS": [
449+
"javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
450+
"python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll"
443451
]
444-
}
452+
}

‎cpp/change-notes/2021-03-11-overflow-abs.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The `cpp/tainted-arithmetic`, `cpp/arithmetic-with-extreme-values`, and `cpp/uncontrolled-arithmetic` queries now recognize more functions as returning the absolute value of their input. As a result, they produce fewer false positives.

‎cpp/change-notes/2021-04-09-unsigned-difference-expression-compared-zero.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Unsigned difference expression compared to zero' (cpp/unsigned-difference-expression-compared-zero) query has been improved to produce fewer false positive results.

‎cpp/change-notes/2021-26-04-more-sound-expr-might-overflow.md renamed to ‎cpp/change-notes/2021-04-26-more-sound-expr-might-overflow.md

File renamed without changes.

‎cpp/change-notes/2021-05-10-comparison-with-wider-type.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Comparison with wider type' (cpp/comparison-with-wider-type) query has been improved to produce fewer false positives.

‎cpp/change-notes/2021-05-12-uncontrolled-arithmetic.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The query "Uncontrolled arithmetic" (`cpp/uncontrolled-arithmetic`) has been improved to produce fewer false positives.

0 commit comments

Comments
 (0)