Skip to content

Commit 9b94f3a

Browse files
MathiasVPMathiasVP
committed
Merge branch 'main' into improve-tainted-arithmetic
2 parents 3bc6b11 + c096461 commit 9b94f3a

File tree

510 files changed

+6989
-1783
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

510 files changed

+6989
-1783
lines changed

‎.github/workflows/csv-coverage-pr-artifacts.yml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Check framework coverage changes
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- '.github/workflows/csv-coverage-pr-comment.yml'
7+
- '*/ql/src/**/*.ql'
8+
- '*/ql/src/**/*.qll'
9+
- 'misc/scripts/library-coverage/*.py'
10+
# input data files
11+
- '*/documentation/library-coverage/cwe-sink.csv'
12+
- '*/documentation/library-coverage/frameworks.csv'
13+
branches:
14+
- main
15+
- 'rc/*'
16+
17+
jobs:
18+
generate:
19+
name: Generate framework coverage artifacts
20+
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: Dump GitHub context
25+
env:
26+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
27+
run: echo "$GITHUB_CONTEXT"
28+
- name: Clone self (github/codeql) - MERGE
29+
uses: actions/checkout@v2
30+
with:
31+
path: merge
32+
- name: Clone self (github/codeql) - BASE
33+
uses: actions/checkout@v2
34+
with:
35+
fetch-depth: 2
36+
path: base
37+
- run: |
38+
git checkout HEAD^1
39+
git log -1 --format='%H'
40+
working-directory: base
41+
- name: Set up Python 3.8
42+
uses: actions/setup-python@v2
43+
with:
44+
python-version: 3.8
45+
- name: Download CodeQL CLI
46+
env:
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
run: |
49+
gh release download --repo "github/codeql-cli-binaries" --pattern "codeql-linux64.zip"
50+
- name: Unzip CodeQL CLI
51+
run: unzip -d codeql-cli codeql-linux64.zip
52+
- name: Generate CSV files on merge and base of the PR
53+
run: |
54+
echo "Running generator on merge"
55+
PATH="$PATH:codeql-cli/codeql" python merge/misc/scripts/library-coverage/generate-report.py ci merge merge
56+
mkdir out_merge
57+
cp framework-coverage-*.csv out_merge/
58+
cp framework-coverage-*.rst out_merge/
59+
60+
echo "Running generator on base"
61+
PATH="$PATH:codeql-cli/codeql" python base/misc/scripts/library-coverage/generate-report.py ci base base
62+
mkdir out_base
63+
cp framework-coverage-*.csv out_base/
64+
cp framework-coverage-*.rst out_base/
65+
- name: Upload CSV package list
66+
uses: actions/upload-artifact@v2
67+
with:
68+
name: csv-framework-coverage-merge
69+
path: |
70+
out_merge/framework-coverage-*.csv
71+
out_merge/framework-coverage-*.rst
72+
- name: Upload CSV package list
73+
uses: actions/upload-artifact@v2
74+
with:
75+
name: csv-framework-coverage-base
76+
path: |
77+
out_base/framework-coverage-*.csv
78+
out_base/framework-coverage-*.rst
79+
- name: Save PR number
80+
run: |
81+
mkdir -p pr
82+
echo ${{ github.event.pull_request.number }} > pr/NR
83+
- name: Upload PR number
84+
uses: actions/upload-artifact@v2
85+
with:
86+
name: pr
87+
path: pr/

‎.github/workflows/csv-coverage-pr-comment.yml

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: Comment on PR with framework coverage changes
2+
3+
on:
4+
workflow_run:
5+
workflows: ["Check framework coverage changes"]
6+
types:
7+
- completed
8+
9+
jobs:
10+
check:
11+
name: Check framework coverage differences and comment
12+
runs-on: ubuntu-latest
13+
if: >
14+
${{ github.event.workflow_run.event == 'pull_request' &&
15+
github.event.workflow_run.conclusion == 'success' }}
16+
17+
steps:
18+
- name: Dump GitHub context
19+
env:
20+
GITHUB_CONTEXT: ${{ toJSON(github.event) }}
21+
run: echo "$GITHUB_CONTEXT"
22+
- name: Clone self (github/codeql)
23+
uses: actions/checkout@v2
24+
- name: Set up Python 3.8
25+
uses: actions/setup-python@v2
26+
with:
27+
python-version: 3.8
28+
29+
# download artifacts from the PR job:
30+
31+
- name: Download artifact - MERGE
32+
env:
33+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
RUN_ID: ${{ github.event.workflow_run.id }}
35+
run: |
36+
gh run download --name "csv-framework-coverage-merge" --dir "out_merge" "$RUN_ID"
37+
38+
- name: Download artifact - BASE
39+
env:
40+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
41+
RUN_ID: ${{ github.event.workflow_run.id }}
42+
run: |
43+
gh run download --name "csv-framework-coverage-base" --dir "out_base" "$RUN_ID"
44+
45+
- name: Download artifact - PR
46+
env:
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
RUN_ID: ${{ github.event.workflow_run.id }}
49+
run: |
50+
gh run download --name "pr" --dir "pr" "$RUN_ID"
51+
52+
- name: Check coverage files
53+
env:
54+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
RUN_ID: ${{ github.event.workflow_run.id }}
56+
run: |
57+
PR=$(cat "pr/NR")
58+
python misc/scripts/library-coverage/compare-files-comment-pr.py \
59+
out_base out_merge comparison.md "$GITHUB_REPOSITORY" "$PR" "$RUN_ID"
60+
- name: Upload comparison results
61+
uses: actions/upload-artifact@v2
62+
with:
63+
name: comparison
64+
path: |
65+
comparison.md

‎cpp/change-notes/2021-06-21-weak-cryptographic-algorithm.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The "Use of a broken or risky cryptographic algorithm" (`cpp/weak-cryptographic-algorithm`) query has been further improved to reduce false positives and its `@precision` increased to `high`.

‎cpp/ql/src/Best Practices/Likely Errors/OffsetUseBeforeRangeCheck.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
* @kind problem
66
* @id cpp/offset-use-before-range-check
77
* @problem.severity warning
8-
* @security-severity 5.9
8+
* @security-severity 8.2
99
* @precision medium
1010
* @tags reliability
1111
* security

‎cpp/ql/src/Critical/DescriptorMayNotBeClosed.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @kind problem
55
* @id cpp/descriptor-may-not-be-closed
66
* @problem.severity warning
7-
* @security-severity 5.9
7+
* @security-severity 7.8
88
* @tags efficiency
99
* security
1010
* external/cwe/cwe-775

‎cpp/ql/src/Critical/DescriptorNeverClosed.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @kind problem
55
* @id cpp/descriptor-never-closed
66
* @problem.severity warning
7-
* @security-severity 5.9
7+
* @security-severity 7.8
88
* @tags efficiency
99
* security
1010
* external/cwe/cwe-775

‎cpp/ql/src/Critical/FileMayNotBeClosed.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @kind problem
55
* @id cpp/file-may-not-be-closed
66
* @problem.severity warning
7-
* @security-severity 5.9
7+
* @security-severity 7.8
88
* @tags efficiency
99
* security
1010
* external/cwe/cwe-775

‎cpp/ql/src/Critical/FileNeverClosed.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @kind problem
55
* @id cpp/file-never-closed
66
* @problem.severity warning
7-
* @security-severity 5.9
7+
* @security-severity 7.8
88
* @tags efficiency
99
* security
1010
* external/cwe/cwe-775

‎cpp/ql/src/Critical/GlobalUseBeforeInit.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @kind problem
55
* @id cpp/global-use-before-init
66
* @problem.severity warning
7-
* @security-severity 6.9
7+
* @security-severity 7.8
88
* @tags reliability
99
* security
1010
* external/cwe/cwe-457

‎cpp/ql/src/Critical/InconsistentNullnessTesting.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
* @kind problem
55
* @id cpp/inconsistent-nullness-testing
66
* @problem.severity warning
7-
* @security-severity 3.6
7+
* @security-severity 7.5
88
* @tags reliability
99
* security
1010
* external/cwe/cwe-476

0 commit comments

Comments
 (0)