Skip to content

Commit c1ada6d

Browse files
haby0haby0
authored
Merge branch 'main' into java/UnsafeDeserialization
2 parents 9badd7a + 386d88a commit c1ada6d

File tree

2,034 files changed

+74649
-21306
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

2,034 files changed

+74649
-21306
lines changed

‎.codeqlmanifest.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{ "provide": [ "*/ql/src/qlpack.yml",
22
"*/ql/test/qlpack.yml",
3+
"cpp/ql/test/query-tests/Security/CWE/CWE-190/semmle/tainted/qlpack.yml",
34
"*/ql/examples/qlpack.yml",
45
"*/upgrades/qlpack.yml",
56
"misc/legacy-support/*/qlpack.yml",

‎.github/workflows/check-change-note.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ jobs:
1919
env:
2020
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2121
run: |
22-
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate |
23-
jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' --exit-status
22+
gh api 'repos/${{github.repository}}/pulls/${{github.event.number}}/files' --paginate --jq 'any(.[].filename ; test("/change-notes/.*[.]md$"))' |
23+
grep true -c

‎.github/workflows/close-stale.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Mark stale issues
2+
3+
on:
4+
workflow_dispatch:
5+
schedule:
6+
- cron: "30 1 * * *"
7+
8+
jobs:
9+
stale:
10+
if: github.repository == 'github/codeql'
11+
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- uses: actions/stale@v3
16+
with:
17+
repo-token: ${{ secrets.GITHUB_TOKEN }}
18+
stale-issue-message: 'This issue is stale because it has been open 14 days with no activity. Comment or remove the `Stale` label in order to avoid having this issue closed in 7 days.'
19+
close-issue-message: 'This issue was closed because it has been inactive for 7 days.'
20+
days-before-stale: 14
21+
days-before-close: 7
22+
only-labels: awaiting-response
23+
24+
# do not mark PRs as stale
25+
days-before-pr-stale: -1
26+
days-before-pr-close: -1
27+
28+
# Uncomment for dry-run
29+
# debug-only: true
30+
# operations-per-run: 1000

‎.github/workflows/codeql-analysis.yml

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,18 @@ jobs:
1919

2020
runs-on: ubuntu-latest
2121

22+
permissions:
23+
contents: read
24+
security-events: write
25+
pull-requests: read
26+
2227
steps:
2328
- name: Checkout repository
2429
uses: actions/checkout@v2
2530

2631
# Initializes the CodeQL tools for scanning.
2732
- name: Initialize CodeQL
28-
uses: github/codeql-action/init@v1
33+
uses: github/codeql-action/init@main
2934
# Override language selection by uncommenting this and choosing your languages
3035
with:
3136
languages: csharp
@@ -34,7 +39,7 @@ jobs:
3439
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
3540
# If this step fails, then you should remove it and run the build manually (see below)
3641
- name: Autobuild
37-
uses: github/codeql-action/autobuild@v1
42+
uses: github/codeql-action/autobuild@main
3843

3944
# ℹ️ Command-line programs to run using the OS shell.
4045
# 📚 https://git.io/JvXDl
@@ -48,4 +53,4 @@ jobs:
4853
# make release
4954

5055
- name: Perform CodeQL Analysis
51-
uses: github/codeql-action/analyze@v1
56+
uses: github/codeql-action/analyze@main

‎.github/workflows/csv-coverage.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Build/check CSV flow coverage report
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
qlModelShaOverride:
7+
description: 'github/codeql repo SHA used for looking up the CSV models'
8+
required: false
9+
push:
10+
branches:
11+
- main
12+
- 'rc/**'
13+
pull_request:
14+
paths:
15+
- '.github/workflows/csv-coverage.yml'
16+
- '*/ql/src/**/*.ql'
17+
- '*/ql/src/**/*.qll'
18+
- 'misc/scripts/library-coverage/*.py'
19+
# input data files
20+
- '*/documentation/library-coverage/cwe-sink.csv'
21+
- '*/documentation/library-coverage/frameworks.csv'
22+
# coverage report files
23+
- '*/documentation/library-coverage/flow-model-coverage.csv'
24+
- '*/documentation/library-coverage/flow-model-coverage.rst'
25+
26+
jobs:
27+
build:
28+
29+
runs-on: ubuntu-latest
30+
31+
steps:
32+
- name: Clone self (github/codeql)
33+
uses: actions/checkout@v2
34+
with:
35+
path: script
36+
- name: Clone self (github/codeql) at a given SHA for analysis
37+
if: github.event.inputs.qlModelShaOverride != ''
38+
uses: actions/checkout@v2
39+
with:
40+
path: codeqlModels
41+
ref: github.event.inputs.qlModelShaOverride
42+
- name: Clone self (github/codeql) for analysis
43+
if: github.event.inputs.qlModelShaOverride == ''
44+
uses: actions/checkout@v2
45+
with:
46+
path: codeqlModels
47+
- name: Set up Python 3.8
48+
uses: actions/setup-python@v2
49+
with:
50+
python-version: 3.8
51+
- name: Download CodeQL CLI
52+
uses: dsaltares/fetch-gh-release-asset@aa37ae5c44d3c9820bc12fe675e8670ecd93bd1c
53+
with:
54+
repo: "github/codeql-cli-binaries"
55+
version: "latest"
56+
file: "codeql-linux64.zip"
57+
token: ${{ secrets.GITHUB_TOKEN }}
58+
- name: Unzip CodeQL CLI
59+
run: unzip -d codeql-cli codeql-linux64.zip
60+
- name: Build modeled package list
61+
run: |
62+
PATH="$PATH:codeql-cli/codeql" python script/misc/scripts/library-coverage/generate-report.py ci codeqlModels script
63+
- name: Upload CSV package list
64+
uses: actions/upload-artifact@v2
65+
with:
66+
name: csv-flow-model-coverage
67+
path: flow-model-coverage-*.csv
68+
- name: Upload RST package list
69+
uses: actions/upload-artifact@v2
70+
with:
71+
name: rst-flow-model-coverage
72+
path: flow-model-coverage-*.rst
73+
# - name: Check coverage files
74+
# if: github.event.pull_request
75+
# run: |
76+
# python script/misc/scripts/library-coverage/compare-files.py codeqlModels
77+

‎config/identical-files.json

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl3.qll",
66
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl4.qll",
77
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl5.qll",
8+
"java/ql/src/semmle/code/java/dataflow/internal/DataFlowImpl6.qll",
89
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl.qll",
910
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl2.qll",
1011
"cpp/ql/src/semmle/code/cpp/dataflow/internal/DataFlowImpl3.qll",
@@ -56,6 +57,10 @@
5657
"csharp/ql/src/semmle/code/csharp/dataflow/internal/DataFlowImplConsistency.qll",
5758
"python/ql/src/semmle/python/dataflow/new/internal/DataFlowImplConsistency.qll"
5859
],
60+
"DataFlow Java/C# Flow Summaries": [
61+
"java/ql/src/semmle/code/java/dataflow/internal/FlowSummaryImpl.qll",
62+
"csharp/ql/src/semmle/code/csharp/dataflow/internal/FlowSummaryImpl.qll"
63+
],
5964
"SsaReadPosition Java/C#": [
6065
"java/ql/src/semmle/code/java/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll",
6166
"csharp/ql/src/semmle/code/csharp/dataflow/internal/rangeanalysis/SsaReadPositionCommon.qll"
@@ -245,6 +250,10 @@
245250
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysis.qll",
246251
"csharp/ql/src/experimental/ir/implementation/unaliased_ssa/internal/AliasAnalysis.qll"
247252
],
253+
"SSA PrintAliasAnalysis": [
254+
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/PrintAliasAnalysis.qll",
255+
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/PrintAliasAnalysis.qll"
256+
],
248257
"C++ SSA AliasAnalysisImports": [
249258
"cpp/ql/src/semmle/code/cpp/ir/implementation/unaliased_ssa/internal/AliasAnalysisImports.qll",
250259
"cpp/ql/src/semmle/code/cpp/ir/implementation/aliased_ssa/internal/AliasAnalysisImports.qll"
@@ -434,6 +443,10 @@
434443
],
435444
"CryptoAlgorithms Python/JS": [
436445
"javascript/ql/src/semmle/javascript/security/CryptoAlgorithms.qll",
437-
"python/ql/src/semmle/crypto/Crypto.qll"
446+
"python/ql/src/semmle/python/concepts/CryptoAlgorithms.qll"
447+
],
448+
"SensitiveDataHeuristics Python/JS": [
449+
"javascript/ql/src/semmle/javascript/security/internal/SensitiveDataHeuristics.qll",
450+
"python/ql/src/semmle/python/security/internal/SensitiveDataHeuristics.qll"
438451
]
439-
}
452+
}

‎cpp/change-notes/2021-03-11-overflow-abs.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The `cpp/tainted-arithmetic`, `cpp/arithmetic-with-extreme-values`, and `cpp/uncontrolled-arithmetic` queries now recognize more functions as returning the absolute value of their input. As a result, they produce fewer false positives.

‎cpp/change-notes/2021-04-06-assign-where-compare-meant.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Assignment where comparison was intended' (cpp/assign-where-compare-meant) query has been improved to flag fewer benign assignments in conditionals.

‎cpp/change-notes/2021-04-09-unsigned-difference-expression-compared-zero.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm,codescanning
2+
* The 'Unsigned difference expression compared to zero' (cpp/unsigned-difference-expression-compared-zero) query has been improved to produce fewer false positive results.

‎cpp/change-notes/2021-04-13-arithmetic-queries.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
lgtm
2+
* The queries cpp/tainted-arithmetic, cpp/uncontrolled-arithmetic, and cpp/arithmetic-with-extreme-values have been improved to produce fewer false positives.

0 commit comments

Comments
 (0)