Insights: github/codeql

61 Pull requests merged by 22 people

• Ruby: Improve weak crypto query

  #11119 merged Nov 4, 2022

• fix merge-base compilation when running directly on main

  #11117 merged Nov 4, 2022

• Kotlin: Extract extension binary operators

  #11106 merged Nov 4, 2022

• Swift: add possibility to run the extractor under an env-specified tool

  #11029 merged Nov 4, 2022

• C++: Improve `Buffer.qll` performance

  #11112 merged Nov 4, 2022

• add workflow that checks compilation of all queries with the latest stable release

  #11078 merged Nov 4, 2022

• JS: second-order-command-injection

  #11013 merged Nov 4, 2022

• Swift: allow expecting failure in qltest.sh

  #11116 merged Nov 4, 2022

• C#: Fix flow steps into phi/uncertain def nodes

  #10933 merged Nov 4, 2022

• Data flow: Restrict public `PathNode`s to those that may reach a sink

  #11060 merged Nov 4, 2022

• Java: Fix some join-orders.

  #10904 merged Nov 4, 2022

• C++: Fix the IR dataflow configuration for the field flow tests

  #11109 merged Nov 3, 2022

• Release preparation for version 2.11.3

  #11103 merged Nov 3, 2022

• C++: Turn `IndirectArgumentOutNode` into a `PartialDefinitionNode`

  #11108 merged Nov 3, 2022

• Swift: fix bad join order in WebView/JsExportedSource

  #11104 merged Nov 3, 2022

• Summary metrics: Improve consistency of naming

  #11098 merged Nov 3, 2022

• Add ATM to labeler

  #11099 merged Nov 3, 2022

• Fix AV Rule 76

  #11091 merged Nov 3, 2022

• Ruby: drop beta notice

  #10873 merged Nov 3, 2022

• C++: Accept test change

  #11097 merged Nov 3, 2022

• Swift: Move the Unit class to its own file

  #11096 merged Nov 3, 2022

• Kotlin: drop same-file requirement for overridden parameter labels

  #11090 merged Nov 3, 2022

• C++: Simplify `buffer.qll` repair

  #11042 merged Nov 3, 2022

• QL4QL: Add DependencyPath.ql query

  #11081 merged Nov 3, 2022

• Swift: Avoid calls to deprecated SSA predicates

  #11092 merged Nov 3, 2022

• Use `${workspace}` for intra-workspace dependencies

  #11004 merged Nov 3, 2022

• Ruby: Fix flow steps into phi nodes

  #10931 merged Nov 2, 2022

• Kotlin: handle default parameter values inherited from an overridden function

  #11064 merged Nov 2, 2022

• Kotlin vararg constructors: don't call a default-parameter constructor just because there are no varargs

  #11069 merged Nov 2, 2022

• Ruby: fix whitespace in basic query doc table

  #11057 merged Nov 2, 2022

• Kotlin: Remove code duplication

  #11077 merged Nov 2, 2022

• Kotlin: Run compiler_arguments test on all platforms

  #11050 merged Nov 2, 2022

• Kotlin: Run default-parameter-mad-flow on all platforms

  #11052 merged Nov 2, 2022

• Kotlin: Reunite the parts of gradle_kotlinx_serialization

  #11054 merged Nov 2, 2022

• ATM: add hello world workflow for development of model integration te…

  #11067 merged Nov 2, 2022

• ATM: add PR check running boosted queries

  #11065 merged Nov 2, 2022

• Revert "SSA: Turn consistency predicates into `query` predicates"

  #11074 merged Nov 2, 2022

• Ruby: Avoid calls to deprecated SSA predicates

  #11075 merged Nov 2, 2022

• Swift: WebView JS-native bridge sources

  #11027 merged Nov 2, 2022

• Kotlin: Fix location (start position) of method calls

  #10951 merged Nov 2, 2022

• SSA: Deprecate `*NoUncertainReads` predicates

  #11066 merged Nov 1, 2022

• Ruby: Call-context sensitivity for singleton method calls

  #10917 merged Nov 1, 2022

• Swift: Rename ECB-Encryption directory

  #11062 merged Nov 1, 2022

• Ruby: update dependencies

  #10668 merged Nov 1, 2022

• SSA: Turn consistency predicates into `query` predicates

  #10576 merged Nov 1, 2022

• Swift: Add and use AbstractFunctionDecl.hasGlobalName predicate.

  #11034 merged Nov 1, 2022

• JS: push more context into load/store steps from the exploratory flow-analysis

  #10986 merged Nov 1, 2022

• QL: prevent some cross-talk between modules

  #11049 merged Oct 31, 2022

• C++: Add `strcpy` test for `cpp/non-constant-format`

  #11048 merged Oct 31, 2022

• Kotlin: Integration tests: Allow \ as a path separator in logs test

  #11037 merged Oct 31, 2022

• Kotlin: Resugar `for` loops

  #11014 merged Oct 31, 2022

• Kotlin: fix method types when an inherited method implements a collection type

  #11040 merged Oct 31, 2022

• Go: exclude protobuf read steps from cleartext-logging query

  #11015 merged Oct 31, 2022

• Swift: Simplify some more QL

  #11035 merged Oct 31, 2022

• Python: Add failing ESSA use-use test

  #10998 merged Oct 31, 2022

• Ruby: Model some ActiveSupport methods

  #10700 merged Oct 30, 2022

• qlpacks: libraryPathDependencies -> dependencies

  #10964 merged Oct 28, 2022

• C++: Don't create `DataFlow::Node`s for `void`-typed instructions

  #11033 merged Oct 28, 2022

• Kotlin: fix wildcard suppression where the annotation applies to a parent type/argument.

  #11017 merged Oct 28, 2022

• Kotlin: specialise extension receivers the same as other function parameters

  #11018 merged Oct 28, 2022

• Kotlin: Get some integration tests running on Windows

  #11019 merged Oct 28, 2022

40 Pull requests opened by 21 people

• Swift: Add and use ApplyExpr.getArgumentByParamName.

  #11036 opened Oct 28, 2022

• Python: Promote improvements to `py/tarslip`

  #11044 opened Oct 31, 2022

• Kotlin: Excluded compiler generated methods from `java/confusing-method-signature`

  #11045 opened Oct 31, 2022

• Swift: Simplify the API for Decl members

  #11046 opened Oct 31, 2022

• Kotlin: Run needless-java-wildcards on all platforms

  #11051 opened Oct 31, 2022

• Kotlin: Run java-interface-redeclares-tostring on all platforms

  #11053 opened Oct 31, 2022

• Sink endpoint characteristics

  #11055 opened Oct 31, 2022

• Ruby: add an AST reference guide

  #11056 opened Oct 31, 2022

• Ruby: Model various ActionController methods

  #11058 opened Oct 31, 2022

• ReDoS: add a shared regex pack

  #11061 opened Nov 1, 2022

• Swift: detect the use of constant passwords for password-based encryption

  #11063 opened Nov 1, 2022

• QL Spec: Add instanceof in classes

  #11068 opened Nov 1, 2022

• Java: Promote regex injection query from experimental

  #11070 opened Nov 1, 2022

• ReDoS: fix canonicalization in NfaUtils

  #11071 opened Nov 1, 2022

• JS: poly-redos: don't sanitize calls through substring calls that just remove the start

  #11072 opened Nov 1, 2022

• Add documentation about the `codeQL.queryHistory.ttl` setting

  #11073 opened Nov 1, 2022

• Java: Add test for multiply-bounded wildcards

  #11079 opened Nov 2, 2022

• Revert "Revert "SSA: Turn consistency predicates into `query` predicates""

  #11080 opened Nov 2, 2022

• JS: treat arrays that gets executed with shell:true as a sink for `js/shell-command-constructed-from-input`

  #11082 opened Nov 2, 2022

• C#: Telemetry query updates.

  #11083 opened Nov 2, 2022

• Swift: detect the use of static initialization vectors

  #11084 opened Nov 2, 2022

• Use latest released bundle for QL-for-QL

  #11085 opened Nov 2, 2022

• Swift: Add new query for XML External Entities (XML) vulnerabilities

  #11086 opened Nov 2, 2022

• Data flow: Add summary/return context to pruning stages 2-4

  #11087 opened Nov 2, 2022

• Python: Inline query tests

  #11088 opened Nov 2, 2022

• Kotlin: Extract missing arguments of enum constructor calls

  #11089 opened Nov 2, 2022

• Swift: refactor visitors to use translations

  #11094 opened Nov 3, 2022

• JS: recognize more re-exported values as exported

  #11095 opened Nov 3, 2022

• Swift: extract diagnostics

  #11101 opened Nov 3, 2022

• Kotlin: use `$default` functions to implement `@JvmOverloads`

  #11105 opened Nov 3, 2022

• Swift: Content flow through tuples

  #11111 opened Nov 3, 2022

• Ruby: Add case string comparison barrier guard

  #11114 opened Nov 3, 2022

• ATM: Miscellaneous improvements for the check queries workflow

  #11118 opened Nov 4, 2022

• Swift: Adds XMLDocument sinks to the XXE query

  #11120 opened Nov 4, 2022

• Kotlin: fix extraction of Java nested wildcards; wildcards in return types

  #11121 opened Nov 4, 2022

• Swift: make sed on macos happy

  #11122 opened Nov 4, 2022

• fix typo in compile-queries workflow

  #11123 opened Nov 4, 2022

• Swift: extract `AwaitExpr`

  #11124 opened Nov 4, 2022

• Use `any()` to stub getCallbackParameter/ReturnType

  #11125 opened Nov 4, 2022

• C++: Let `(Indirect|Direct)Position` be sub classes of `Position`

  #11126 opened Nov 4, 2022

4 Issues closed by 4 people

• [Update Request] support `dotnet 6` for C#

  #7086 closed Nov 3, 2022

• Java: Cannot find class

  #11047 closed Nov 1, 2022

• CatastrophicError for `query compile --fast-compilation`: Primitive directionalBind has more than one unbound field

  #8999 closed Oct 31, 2022

• General issue

  #11039 closed Oct 29, 2022

5 Issues opened by 5 people

• Java: xml extractor ... does not provide file-indexing capabilities

  #11115 opened Nov 4, 2022

• Ruby: Noisiness of rb/weak-cryptographic-algorithm / MD5 detection

  #11107 opened Nov 3, 2022

• Failed to create database from node module

  #11102 opened Nov 3, 2022

• C/C++ question: taintTracking can not identify indirect use of Array pointer in a structure

  #11093 opened Nov 3, 2022

• Can't find dataflow for js in Vue module

  #11043 opened Oct 31, 2022

37 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Ruby: expand DataFlow API

  #11024 commented on Nov 4, 2022 • 50 new comments

• Ruby: data flow docs

  #10932 commented on Nov 4, 2022 • 37 new comments

• Java: Type based summary models.

  #10628 commented on Nov 4, 2022 • 19 new comments

• Ruby: document API graphs

  #10957 commented on Nov 4, 2022 • 18 new comments

• RB: add an unsafe-shell-command-construction query

  #10680 commented on Nov 3, 2022 • 17 new comments

• Add TCP and UDP socket client taint sources

  #9415 commented on Nov 3, 2022 • 13 new comments

• ReDoS: testing a parameterised ReDoS module

  #10604 commented on Nov 1, 2022 • 9 new comments

• Swift: detect hash functions with low # of iterations

  #10947 commented on Oct 31, 2022 • 8 new comments

• Java: Promote insufficient key size query from experimental

  #10785 commented on Nov 4, 2022 • 7 new comments

• Swift: detect the use of constant salts

  #10993 commented on Nov 2, 2022 • 7 new comments

• Ruby: Document flow summary syntax

  #10899 commented on Nov 4, 2022 • 6 new comments

• Swift: Unsafe JS Eval Query

  #11001 commented on Nov 3, 2022 • 5 new comments

• Java: Check whether there are internal files in the App that can be read and written by any other App

  #11016 commented on Oct 31, 2022 • 4 new comments

• CodeQL analysis hangs up on UnsupportedExternalAPIs.ql

  #10866 commented on Nov 1, 2022 • 3 new comments

• C#: Generate data extension files

  #10777 commented on Nov 4, 2022 • 3 new comments

• Python: Clean up import resolution

  #10861 commented on Nov 1, 2022 • 3 new comments

• Kotlin: exclude loop variables on ranges from 'unused locals' check

  #11032 commented on Nov 2, 2022 • 3 new comments

• Code scanning results should be visible to everyone, not only those with write permission on the repository

  #11021 commented on Oct 28, 2022 • 2 new comments

• multiple databases

  #10582 commented on Oct 31, 2022 • 2 new comments

• (java,bug)SpringRequestMappingMethod::getValue does not return when a constant in jar is used

  #10989 commented on Nov 1, 2022 • 2 new comments

• Ruby: taint-steps for printf calls - and add a `AdditionalTaintStep` class

  #10855 commented on Nov 2, 2022 • 2 new comments

• Update go libraries to 55e052a

  #11002 commented on Oct 31, 2022 • 2 new comments

• Swift: rework workflows

  #11008 commented on Nov 3, 2022 • 2 new comments

• CodeQL ships vulnerable version of commons-text (1.6)

  #10990 commented on Nov 2, 2022 • 1 new comment

• Python: New call-graph based on type-trackers [still WIP]

  #10148 commented on Nov 2, 2022 • 1 new comment

• Java: Add query for Sensitive Keyboard Cache

  #10684 commented on Nov 1, 2022 • 1 new comment

• Java: Add flow summaries for startActivities

  #10890 commented on Nov 4, 2022 • 1 new comment

• CPP: Add query for CWE-297: Improper Validation of Certificate with Host Mismatch

  #9086 commented on Oct 28, 2022 • 0 new comments

• Add a test file

  #9967 commented on Nov 3, 2022 • 0 new comments

• Ruby: Model flow through `initialize` constructors

  #10714 commented on Nov 3, 2022 • 0 new comments

• Ruby: also treat included/prepended modules as subclasses

  #10747 commented on Nov 3, 2022 • 0 new comments

• JS: Move mongodb model to a data-extension (experimental, do not merge)

  #10751 commented on Nov 3, 2022 • 0 new comments

• DO NOT MERGE: Replace AST with IR use-use dataflow

  #10817 commented on Nov 4, 2022 • 0 new comments

• Java: Add library support for activity-alias elements in AndroidManifest.qll

  #10865 commented on Nov 2, 2022 • 0 new comments

• Dataflow: Fix a couple of join-orders.

  #10886 commented on Nov 4, 2022 • 0 new comments

• Ruby: use flow-insensitive capture flow in flowsTo and type tracking

  #11010 commented on Oct 28, 2022 • 0 new comments

• Ruby: try/try! as code execution

  #11022 commented on Oct 31, 2022 • 0 new comments