Insights: github/codeql

58 Pull requests merged by 20 people

• ATM: add PR check running boosted queries

  #11065 merged Nov 2, 2022

• Revert "SSA: Turn consistency predicates into `query` predicates"

  #11074 merged Nov 2, 2022

• Ruby: Avoid calls to deprecated SSA predicates

  #11075 merged Nov 2, 2022

• Swift: WebView JS-native bridge sources

  #11027 merged Nov 2, 2022

• Kotlin: Fix location (start position) of method calls

  #10951 merged Nov 2, 2022

• SSA: Deprecate `*NoUncertainReads` predicates

  #11066 merged Nov 1, 2022

• Ruby: Call-context sensitivity for singleton method calls

  #10917 merged Nov 1, 2022

• Swift: Rename ECB-Encryption directory

  #11062 merged Nov 1, 2022

• Ruby: update dependencies

  #10668 merged Nov 1, 2022

• SSA: Turn consistency predicates into `query` predicates

  #10576 merged Nov 1, 2022

• Swift: Add and use AbstractFunctionDecl.hasGlobalName predicate.

  #11034 merged Nov 1, 2022

• JS: push more context into load/store steps from the exploratory flow-analysis

  #10986 merged Nov 1, 2022

• QL: prevent some cross-talk between modules

  #11049 merged Oct 31, 2022

• C++: Add `strcpy` test for `cpp/non-constant-format`

  #11048 merged Oct 31, 2022

• Kotlin: Integration tests: Allow \ as a path separator in logs test

  #11037 merged Oct 31, 2022

• Kotlin: Resugar `for` loops

  #11014 merged Oct 31, 2022

• Kotlin: fix method types when an inherited method implements a collection type

  #11040 merged Oct 31, 2022

• Go: exclude protobuf read steps from cleartext-logging query

  #11015 merged Oct 31, 2022

• Swift: Simplify some more QL

  #11035 merged Oct 31, 2022

• Python: Add failing ESSA use-use test

  #10998 merged Oct 31, 2022

• Ruby: Model some ActiveSupport methods

  #10700 merged Oct 30, 2022

• qlpacks: libraryPathDependencies -> dependencies

  #10964 merged Oct 28, 2022

• C++: Don't create `DataFlow::Node`s for `void`-typed instructions

  #11033 merged Oct 28, 2022

• Kotlin: fix wildcard suppression where the annotation applies to a parent type/argument.

  #11017 merged Oct 28, 2022

• Kotlin: specialise extension receivers the same as other function parameters

  #11018 merged Oct 28, 2022

• Kotlin: Get some integration tests running on Windows

  #11019 merged Oct 28, 2022

• C++: repair Adding365DaysPerYear.ql

  #11020 merged Oct 28, 2022

• Kotlin: Remove `javaEquivalent` consistency query

  #11026 merged Oct 28, 2022

• Swift: Simplify queries using MethodDecl.hasQualifiedName

  #11031 merged Oct 28, 2022

• C++: Fix QL-for-QL in #10817

  #11030 merged Oct 28, 2022

• Swift: Fix flow out of summarized callables

  #10967 merged Oct 28, 2022

• Swift: fix remapping

  #11028 merged Oct 28, 2022

• Kotlin: Fix external location in integration test

  #11025 merged Oct 28, 2022

• C++: Fix `asExpr` and `asIndirectExpr` in IR dataflow

  #10995 merged Oct 28, 2022

• InlineExpectationsTest: Fail if missing `getARelevantTag`

  #10999 merged Oct 28, 2022

• C++: Fix printf.qll bug

  #10938 merged Oct 28, 2022

• Misc: Add automatic `DataFlow Library` label

  #11009 merged Oct 28, 2022

• RB: fix rb/code-injection

  #10968 merged Oct 28, 2022

• C++: repair the ReturnCstr query

  #10994 merged Oct 27, 2022

• Swift: Add MethodDecl.hasQualifiedName

  #10996 merged Oct 27, 2022

• Go: Extract locations of successfully extracted files

  #10997 merged Oct 27, 2022

• Kotlin: reintroduce pointless wildcards when a Java declaration explicitly uses them

  #11003 merged Oct 27, 2022

• Kotlin: Ignore tags when comparing versions

  #10976 merged Oct 27, 2022

• Kotlin: Fix integration tests on Mac

  #11012 merged Oct 27, 2022

• JS: fix some more style-guide violations in the alert-messages

  #10727 merged Oct 27, 2022

• Kotlin: Handle /modules/... paths specially too

  #11011 merged Oct 27, 2022

• Swift: use `std::filesystem` and `picoSHA2`

  #10987 merged Oct 27, 2022

• Javascript/Python: Tokens built from predictable UUIDs

  #10943 merged Oct 27, 2022

• Kotlin: Handle /!unknown-binary-location/... paths specially on Windows

  #11000 merged Oct 27, 2022

• Spelling code scanning product

  #10905 merged Oct 27, 2022

• JS: Add Next.js parameters as source

  #10984 merged Oct 27, 2022

• JS: remove some FPs in `js/password-in-configuration-file`

  #10988 merged Oct 27, 2022

• Kotlin: fix test to expect diagnostic

  #11006 merged Oct 27, 2022

• Swift: fix cmake generator on Linux

  #11007 merged Oct 27, 2022

• Kotlin: do not report on unused `object` extension parameters

  #10992 merged Oct 27, 2022

• Ruby: Add Faraday::Connection.new as sink for SSRF query

  #10913 merged Oct 26, 2022

• C++: repair InconsistentLoopDirection

  #10975 merged Oct 26, 2022

• C++: Prepare `Buffer.qll` for IR-based use-use dataflow

  #10833 merged Oct 26, 2022

44 Pull requests opened by 22 people

• Swift: detect the use of constant salts

  #10993 opened Oct 26, 2022

• Swift: Unsafe JS Eval Query

  #11001 opened Oct 26, 2022

• Update go libraries to 55e052a

  #11002 opened Oct 26, 2022

• Use `${workspace}` for intra-workspace dependencies

  #11004 opened Oct 26, 2022

• Swift: rework workflows

  #11008 opened Oct 27, 2022

• Ruby: use flow-insensitive capture flow in flowsTo and type tracking

  #11010 opened Oct 27, 2022

• JS: second-order-command-injection

  #11013 opened Oct 27, 2022

• Java: Check whether there are internal files in the App that can be read and written by any other App

  #11016 opened Oct 27, 2022

• Ruby: try/try! as code execution

  #11022 opened Oct 27, 2022

• Ruby: expand DataFlow API

  #11024 opened Oct 28, 2022

• Swift: add possibility to run the extractor under an env-specified tool

  #11029 opened Oct 28, 2022

• Kotlin: exclude loop variables on ranges from 'unused locals' check

  #11032 opened Oct 28, 2022

• Swift: Add and use ApplyExpr.getArgumentByParamName.

  #11036 opened Oct 28, 2022

• C++: Simplify `buffer.qll` repair

  #11042 opened Oct 30, 2022

• Python: Promote improvements to `py/tarslip`

  #11044 opened Oct 31, 2022

• Kotlin: Excluded compiler generated methods from `java/confusing-method-signature`

  #11045 opened Oct 31, 2022

• Swift: Simplify the API for Decl members

  #11046 opened Oct 31, 2022

• Kotlin: Run compiler_arguments test on all platforms

  #11050 opened Oct 31, 2022

• Kotlin: Run needless-java-wildcards on all platforms

  #11051 opened Oct 31, 2022

• Kotlin: Run default-parameter-mad-flow on all platforms

  #11052 opened Oct 31, 2022

• Kotlin: Run java-interface-redeclares-tostring on all platforms

  #11053 opened Oct 31, 2022

• Kotlin: Reunite the parts of gradle_kotlinx_serialization

  #11054 opened Oct 31, 2022

• Sink endpoint characteristics

  #11055 opened Oct 31, 2022

• Ruby: add an AST reference guide

  #11056 opened Oct 31, 2022

• Ruby: fix whitespace in basic query doc table

  #11057 opened Oct 31, 2022

• Ruby: Model various ActionController methods

  #11058 opened Oct 31, 2022

• Data flow: Restrict public `PathNode`s to those that may reach a sink

  #11060 opened Nov 1, 2022

• ReDoS: add a shared regex pack

  #11061 opened Nov 1, 2022

• Swift: detect the use of constant passwords for password-based encryption

  #11063 opened Nov 1, 2022

• Kotlin: handle default parameter values inherited from an overridden function

  #11064 opened Nov 1, 2022

• ATM: add hello world workflow for development of model integration te…

  #11067 opened Nov 1, 2022

• QL Spec: Add instanceof in classes

  #11068 opened Nov 1, 2022

• Kotlin vararg constructors: don't call a default-parameter constructor just because there are no varargs

  #11069 opened Nov 1, 2022

• Java: Promote regex injection query from experimental

  #11070 opened Nov 1, 2022

• ReDoS: fix canonicalization in NfaUtils

  #11071 opened Nov 1, 2022

• JS: poly-redos: don't sanitize calls through substring calls that just remove the start

  #11072 opened Nov 1, 2022

• Add documentation about the `codeQL.queryHistory.ttl` setting

  #11073 opened Nov 1, 2022

• Revert "Use 'gh codeql' with the nightly release for CI jobs"

  #11076 opened Nov 2, 2022

• Kotlin: Remove code duplication

  #11077 opened Nov 2, 2022

• add workflow that checks compilation of all queries with the latest stable release

  #11078 opened Nov 2, 2022

• Java: Add test for multiply-bounded wildcards

  #11079 opened Nov 2, 2022

• Revert "Revert "SSA: Turn consistency predicates into `query` predicates""

  #11080 opened Nov 2, 2022

• QL4QL: Add DependencyPath.ql query

  #11081 opened Nov 2, 2022

• JS: treat arrays that gets executed with shell:true as a sink for `js/shell-command-constructed-from-input`

  #11082 opened Nov 2, 2022

3 Issues closed by 3 people

• Java: Cannot find class

  #11047 closed Nov 1, 2022

• CatastrophicError for `query compile --fast-compilation`: Primitive directionalBind has more than one unbound field

  #8999 closed Oct 31, 2022

• General issue

  #11039 closed Oct 29, 2022

2 Issues opened by 2 people

• Can't find dataflow for js in Vue module

  #11043 opened Oct 31, 2022

• Code scanning results should be visible to everyone, not only those with write permission on the repository

  #11021 opened Oct 27, 2022

33 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Ruby: data flow docs

  #10932 commented on Nov 2, 2022 • 36 new comments

• Ruby: document API graphs

  #10957 commented on Nov 1, 2022 • 22 new comments

• Swift: detect hash functions with low # of iterations

  #10947 commented on Oct 31, 2022 • 16 new comments

• Add TCP and UDP socket client taint sources

  #9415 commented on Nov 2, 2022 • 13 new comments

• ReDoS: testing a parameterised ReDoS module

  #10604 commented on Nov 1, 2022 • 13 new comments

• C#: Generate data extension files

  #10777 commented on Nov 1, 2022 • 9 new comments

• (java,bug)SpringRequestMappingMethod::getValue does not return when a constant in jar is used

  #10989 commented on Nov 1, 2022 • 7 new comments

• Java: Promote insufficient key size query from experimental

  #10785 commented on Nov 1, 2022 • 6 new comments

• CodeQL analysis hangs up on UnsupportedExternalAPIs.ql

  #10866 commented on Nov 1, 2022 • 4 new comments

• DO NOT MERGE: Replace AST with IR use-use dataflow

  #10817 commented on Oct 31, 2022 • 4 new comments

• Python: Clean up import resolution

  #10861 commented on Nov 1, 2022 • 4 new comments

• CodeQL ships vulnerable version of commons-text (1.6)

  #10990 commented on Nov 2, 2022 • 3 new comments

• Java: Type based summary models.

  #10628 commented on Nov 1, 2022 • 3 new comments

• Ruby: Document flow summary syntax

  #10899 commented on Oct 28, 2022 • 3 new comments

• multiple databases

  #10582 commented on Oct 31, 2022 • 2 new comments

• Ruby: taint-steps for printf calls - and add a `AdditionalTaintStep` class

  #10855 commented on Nov 2, 2022 • 2 new comments

• Ruby: Fix flow steps into phi nodes

  #10931 commented on Nov 1, 2022 • 2 new comments

• Missing data flow

  #10980 commented on Oct 27, 2022 • 1 new comment

• Platform support request: FreeBSD

  #10982 commented on Oct 27, 2022 • 1 new comment

• False positive - Uncontrolled data used in path expression

  #10948 commented on Oct 27, 2022 • 1 new comment

• Python: New call-graph based on type-trackers [still WIP]

  #10148 commented on Nov 2, 2022 • 1 new comment

• Update bazel to v5.3.1

  #10481 commented on Oct 26, 2022 • 1 new comment

• Java: Add query for Sensitive Keyboard Cache

  #10684 commented on Nov 1, 2022 • 1 new comment

• Java: Fix some join-orders.

  #10904 commented on Nov 2, 2022 • 1 new comment

• go SqlInjection ... Ellipsis

  #10979 commented on Oct 26, 2022 • 0 new comments

• CPP: Add query for CWE-297: Improper Validation of Certificate with Host Mismatch

  #9086 commented on Oct 28, 2022 • 0 new comments

• Create a shared implementation for Locations and Files

  #10592 commented on Oct 28, 2022 • 0 new comments

• Ruby: also treat included/prepended modules as subclasses

  #10747 commented on Oct 28, 2022 • 0 new comments

• JS: Move mongodb model to a data-extension (experimental, do not merge)

  #10751 commented on Nov 1, 2022 • 0 new comments

• Run some tests

  #10858 commented on Oct 26, 2022 • 0 new comments

• Java: Add library support for activity-alias elements in AndroidManifest.qll

  #10865 commented on Nov 2, 2022 • 0 new comments

• Ruby: drop beta notice

  #10873 commented on Oct 27, 2022 • 0 new comments

• C#: Fix flow steps into phi/uncertain def nodes

  #10933 commented on Nov 2, 2022 • 0 new comments