Insights: github/codeql

96 Pull requests merged by 27 people

• Swift: extract remaining `Stmt`s

  #11169 merged Nov 8, 2022

• Swift: extract `PostfixUnaryExpr`

  #11168 merged Nov 8, 2022

• C++: Clearer messages for the format args queries

  #11149 merged Nov 8, 2022

• CI: try only to fill the compilation cache from main in the compile-queries workflow

  #11162 merged Nov 8, 2022

• Swift: Add LocalFlowSource class and a few sources.

  #11161 merged Nov 8, 2022

• Swift: print unextracted entities

  #11164 merged Nov 8, 2022

• C++: Add dataflow test that deliberately omits the return of a non-void function

  #11163 merged Nov 8, 2022

• C++: Also taint the return value dereference in the `strcat` model

  #11159 merged Nov 8, 2022

• JS: expand localFieldStep to use access-paths, and build access-paths in more cases

  #10378 merged Nov 8, 2022

• Swift: deal with incomplete ASTs

  #11131 merged Nov 8, 2022

• Ruby: Avoid stage recomputation

  #11155 merged Nov 8, 2022

• Ruby: Split basic blocks around constant conditionals

  #11153 merged Nov 8, 2022

• Swift: Add `BitwiseOperation.qll`

  #11156 merged Nov 8, 2022

• C++: Fix wrong return types and missing statement in dataflow test

  #11154 merged Nov 8, 2022

• Swift: add bitwise ops to `PrintAst` test

  #11152 merged Nov 8, 2022

• Kotlin: Excluded compiler generated methods from `java/confusing-method-signature`

  #11045 merged Nov 8, 2022

• RB: add an unsafe-shell-command-construction query

  #10680 merged Nov 8, 2022

• Ruby: Cosmetic change

  #11150 merged Nov 7, 2022

• Ruby: try/try! as code execution

  #11022 merged Nov 7, 2022

• Java: Add flow summaries for startActivities

  #10890 merged Nov 7, 2022

• C++: Fix the use-use dataflow configuration in `dataflow/dataflow-tests`

  #11147 merged Nov 7, 2022

• QL Spec: Add instanceof in classes

  #11068 merged Nov 7, 2022

• Ruby: add a couple of missing links to a new article

  #11145 merged Nov 7, 2022

• Merge documentation changes of 2.11.2 into 2.11.3

  #11140 merged Nov 7, 2022

• Kotlin: exclude loop variables on ranges from 'unused locals' check

  #11032 merged Nov 7, 2022

• Swift: detect the use of constant salts

  #10993 merged Nov 7, 2022

• JS: Bump version numbers of ML-powered packs after 0.4.0 release

  #11143 merged Nov 7, 2022

• ReDoS: fix canonicalization in NfaUtils

  #11071 merged Nov 7, 2022

• Ruby: expand explanation of desugaring

  #11141 merged Nov 7, 2022

• Java: Add test for multiply-bounded wildcards

  #11079 merged Nov 7, 2022

• Kotlin: Extract missing arguments of enum constructor calls

  #11089 merged Nov 7, 2022

• Swift: extract `AwaitExpr`

  #11124 merged Nov 7, 2022

• Ruby: docs add missing entry

  #11139 merged Nov 7, 2022

• Swift: refactor visitors to use translations

  #11094 merged Nov 7, 2022

• Ruby: add an AST reference guide

  #11056 merged Nov 7, 2022

• Swift: detect hash functions with low # of iterations

  #10947 merged Nov 7, 2022

• Kotlin: fix extraction of Java nested wildcards; wildcards in return types

  #11121 merged Nov 7, 2022

• Kotlin: always populate the `files` table

  #11130 merged Nov 7, 2022

• C++: Small fixes for the dataflow tests

  #11137 merged Nov 7, 2022

• Dataflow: Fix a couple of join-orders.

  #10886 merged Nov 7, 2022

• Kotlin: use `$default` functions to implement `@JvmOverloads`

  #11105 merged Nov 7, 2022

• Post-release preparation for codeql-cli-2.11.3

  #11134 merged Nov 5, 2022

• Release preparation for version 2.11.3

  #11133 merged Nov 5, 2022

• Swift: Add and use ApplyExpr.getArgumentByParamName.

  #11036 merged Nov 5, 2022

• Sink endpoint characteristics

  #11055 merged Nov 4, 2022

• ATM: Miscellaneous improvements for the check queries workflow

  #11118 merged Nov 4, 2022

• Ruby: data flow docs

  #10932 merged Nov 4, 2022

• ATM: Use `${workspace}` for CodeQL pack workspace references

  #11127 merged Nov 4, 2022

• C++: Do not use the old dataflow library in `additional-flow-to-parameter`

  #11128 merged Nov 4, 2022

• Ruby: document API graphs

  #10957 merged Nov 4, 2022

• Ruby: Improve weak crypto query

  #11129 merged Nov 4, 2022

• fix typo in compile-queries workflow

  #11123 merged Nov 4, 2022

• Swift: make sed on macos happy

  #11122 merged Nov 4, 2022

• Swift: rework workflows

  #11008 merged Nov 4, 2022

• C++: Let `(Indirect|Direct)Position` be sub classes of `Position`

  #11126 merged Nov 4, 2022

• Ruby: Improve weak crypto query

  #11119 merged Nov 4, 2022

• fix merge-base compilation when running directly on main

  #11117 merged Nov 4, 2022

• Kotlin: Extract extension binary operators

  #11106 merged Nov 4, 2022

• Swift: add possibility to run the extractor under an env-specified tool

  #11029 merged Nov 4, 2022

• C++: Improve `Buffer.qll` performance

  #11112 merged Nov 4, 2022

• add workflow that checks compilation of all queries with the latest stable release

  #11078 merged Nov 4, 2022

• JS: second-order-command-injection

  #11013 merged Nov 4, 2022

• Swift: allow expecting failure in qltest.sh

  #11116 merged Nov 4, 2022

• C#: Fix flow steps into phi/uncertain def nodes

  #10933 merged Nov 4, 2022

• Data flow: Restrict public `PathNode`s to those that may reach a sink

  #11060 merged Nov 4, 2022

• Java: Fix some join-orders.

  #10904 merged Nov 4, 2022

• C++: Fix the IR dataflow configuration for the field flow tests

  #11109 merged Nov 3, 2022

• Release preparation for version 2.11.3

  #11103 merged Nov 3, 2022

• C++: Turn `IndirectArgumentOutNode` into a `PartialDefinitionNode`

  #11108 merged Nov 3, 2022

• Swift: fix bad join order in WebView/JsExportedSource

  #11104 merged Nov 3, 2022

• Summary metrics: Improve consistency of naming

  #11098 merged Nov 3, 2022

• Add ATM to labeler

  #11099 merged Nov 3, 2022

• Fix AV Rule 76

  #11091 merged Nov 3, 2022

• Ruby: drop beta notice

  #10873 merged Nov 3, 2022

• C++: Accept test change

  #11097 merged Nov 3, 2022

• Swift: Move the Unit class to its own file

  #11096 merged Nov 3, 2022

• Kotlin: drop same-file requirement for overridden parameter labels

  #11090 merged Nov 3, 2022

• C++: Simplify `buffer.qll` repair

  #11042 merged Nov 3, 2022

• QL4QL: Add DependencyPath.ql query

  #11081 merged Nov 3, 2022

• Swift: Avoid calls to deprecated SSA predicates

  #11092 merged Nov 3, 2022

• Use `${workspace}` for intra-workspace dependencies

  #11004 merged Nov 3, 2022

• Ruby: Fix flow steps into phi nodes

  #10931 merged Nov 2, 2022

• Kotlin: handle default parameter values inherited from an overridden function

  #11064 merged Nov 2, 2022

• Kotlin vararg constructors: don't call a default-parameter constructor just because there are no varargs

  #11069 merged Nov 2, 2022

• Ruby: fix whitespace in basic query doc table

  #11057 merged Nov 2, 2022

• Kotlin: Remove code duplication

  #11077 merged Nov 2, 2022

• Kotlin: Run compiler_arguments test on all platforms

  #11050 merged Nov 2, 2022

• Kotlin: Run default-parameter-mad-flow on all platforms

  #11052 merged Nov 2, 2022

• Kotlin: Reunite the parts of gradle_kotlinx_serialization

  #11054 merged Nov 2, 2022

• ATM: add hello world workflow for development of model integration te…

  #11067 merged Nov 2, 2022

• ATM: add PR check running boosted queries

  #11065 merged Nov 2, 2022

• Revert "SSA: Turn consistency predicates into `query` predicates"

  #11074 merged Nov 2, 2022

• Ruby: Avoid calls to deprecated SSA predicates

  #11075 merged Nov 2, 2022

• Swift: WebView JS-native bridge sources

  #11027 merged Nov 2, 2022

• Kotlin: Fix location (start position) of method calls

  #10951 merged Nov 2, 2022

• SSA: Deprecate `*NoUncertainReads` predicates

  #11066 merged Nov 1, 2022

31 Pull requests opened by 19 people

• Java: Promote regex injection query from experimental

  #11070 opened Nov 1, 2022

• JS: poly-redos: don't sanitize calls through substring calls that just remove the start

  #11072 opened Nov 1, 2022

• Add documentation about the `codeQL.queryHistory.ttl` setting

  #11073 opened Nov 1, 2022

• Revert "Revert "SSA: Turn consistency predicates into `query` predicates""

  #11080 opened Nov 2, 2022

• JS: treat arrays that gets executed with shell:true as a sink for `js/shell-command-constructed-from-input`

  #11082 opened Nov 2, 2022

• C#: Telemetry query updates.

  #11083 opened Nov 2, 2022

• Swift: detect the use of static initialization vectors

  #11084 opened Nov 2, 2022

• Use latest released bundle for QL-for-QL

  #11085 opened Nov 2, 2022

• Swift: Add new query for XML External Entities (XML) vulnerabilities

  #11086 opened Nov 2, 2022

• Data flow: Add summary/return context to pruning stages 2-4

  #11087 opened Nov 2, 2022

• Python: Inline query tests

  #11088 opened Nov 2, 2022

• JS: recognize more re-exported values as exported

  #11095 opened Nov 3, 2022

• Swift: extract diagnostics

  #11101 opened Nov 3, 2022

• Swift: Content flow through tuples

  #11111 opened Nov 3, 2022

• Ruby: Add case string comparison barrier guard

  #11114 opened Nov 3, 2022

• Swift: Adds XMLDocument sinks to the XXE query

  #11120 opened Nov 4, 2022

• Use `any()` to stub getCallbackParameter/ReturnType

  #11125 opened Nov 4, 2022

• QL: fix non-attached annotations for newtype branches

  #11132 opened Nov 4, 2022

• Ruby: JSON flow summaries

  #11136 opened Nov 6, 2022

• Swift: Add AEXML sinks to XXE query

  #11138 opened Nov 7, 2022

• C#: Extend `Constant Condition` query with `String.IsNullOrEmpty`.

  #11142 opened Nov 7, 2022

• C#: Qualifiedname

  #11144 opened Nov 7, 2022

• JS: Improved Hapi support

  #11146 opened Nov 7, 2022

• JS: fix issue with zero-column yaml locations

  #11157 opened Nov 8, 2022

• RB: add a step directly from a store of an instance field to a read

  #11158 opened Nov 8, 2022

• DataFlow: Add read/store stepIsLocal consistency checks

  #11160 opened Nov 8, 2022

• Swift: Add libxml2 sinks to the XXE query

  #11165 opened Nov 8, 2022

• Ruby: generalise summaries for ActiveSupport Hash extensions

  #11166 opened Nov 8, 2022

• Ruby: handle knownOrUnkown in default taint step

  #11170 opened Nov 8, 2022

• C++: Use-use flow through global variables

  #11171 opened Nov 8, 2022

• QL: improve the dead-code query

  #11173 opened Nov 8, 2022

4 Issues closed by 4 people

• Library API Index documentation is incomplete

  #10200 closed Nov 8, 2022

• About SARIF output: originalUriBaseIds property in run object is not generated?

  #10900 closed Nov 8, 2022

• Ruby: Noisiness of rb/weak-cryptographic-algorithm / MD5 detection

  #11107 closed Nov 4, 2022

• [Update Request] support `dotnet 6` for C#

  #7086 closed Nov 3, 2022

4 Issues opened by 4 people

• LGTM.com - false negative

  #11148 opened Nov 7, 2022

• Java: xml extractor ... does not provide file-indexing capabilities

  #11115 opened Nov 4, 2022

• Failed to create database from node module

  #11102 opened Nov 3, 2022

• C/C++ question: taintTracking can not identify indirect use of Array pointer in a structure

  #11093 opened Nov 3, 2022

32 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Ruby: expand DataFlow API

  #11024 commented on Nov 8, 2022 • 52 new comments

• Java: Type based summary models.

  #10628 commented on Nov 7, 2022 • 25 new comments

• C#: Generate data extension files

  #10777 commented on Nov 8, 2022 • 19 new comments

• Swift: Unsafe JS Eval Query

  #11001 commented on Nov 8, 2022 • 15 new comments

• Swift: detect the use of constant passwords for password-based encryption

  #11063 commented on Nov 8, 2022 • 11 new comments

• Add TCP and UDP socket client taint sources

  #9415 commented on Nov 3, 2022 • 10 new comments

• Ruby: Document flow summary syntax

  #10899 commented on Nov 6, 2022 • 10 new comments

• QL: Query for detecting unused parameter in override methods

  #9827 commented on Nov 8, 2022 • 8 new comments

• ReDoS: add a shared regex pack

  #11061 commented on Nov 8, 2022 • 7 new comments

• Java: Add query for Sensitive Keyboard Cache

  #10684 commented on Nov 8, 2022 • 6 new comments

• Java: Promote insufficient key size query from experimental

  #10785 commented on Nov 7, 2022 • 6 new comments

• CPP: Add query for CWE-369: Divide By Zero.

  #10431 commented on Nov 8, 2022 • 2 new comments

• Ruby: taint-steps for printf calls - and add a `AdditionalTaintStep` class

  #10855 commented on Nov 7, 2022 • 2 new comments

• CodeQL ships vulnerable version of commons-text (1.6)

  #10990 commented on Nov 2, 2022 • 1 new comment

• [Draft] Java: Add Android missing certificate pinning query (CWE-295)

  #10971 commented on Nov 8, 2022 • 1 new comment

• Swift: Simplify the API for Decl members

  #11046 commented on Nov 2, 2022 • 1 new comment

• Ruby: Model various ActionController methods

  #11058 commented on Nov 7, 2022 • 1 new comment

• How to filter the result of hasFlowPath API

  #10659 commented on Nov 6, 2022 • 0 new comments

• C++ Function Call to Undefined Function

  #9799 commented on Nov 7, 2022 • 0 new comments

• QL: detect unqueryable code

  #8454 commented on Nov 7, 2022 • 0 new comments

• Add a test file

  #9967 commented on Nov 3, 2022 • 0 new comments

• Python: New call-graph based on type-trackers [still WIP]

  #10148 commented on Nov 4, 2022 • 0 new comments

• ReDoS: testing a parameterised ReDoS module

  #10604 commented on Nov 7, 2022 • 0 new comments

• Ruby: Model flow through `initialize` constructors

  #10714 commented on Nov 3, 2022 • 0 new comments

• Ruby: also treat included/prepended modules as subclasses

  #10747 commented on Nov 8, 2022 • 0 new comments

• JS: Move mongodb model to a data-extension (experimental, do not merge)

  #10751 commented on Nov 8, 2022 • 0 new comments

• DO NOT MERGE: Replace AST with IR use-use dataflow

  #10817 commented on Nov 8, 2022 • 0 new comments

• Ruby: add dataflow for getters/setters defined using `alias_attribute`

  #10820 commented on Nov 8, 2022 • 0 new comments

• Rb: Add an `unsafe-code-construction` query

  #10862 commented on Nov 8, 2022 • 0 new comments

• Java: Add library support for activity-alias elements in AndroidManifest.qll

  #10865 commented on Nov 8, 2022 • 0 new comments

• Data flow: Add synthetic return nodes

  #10906 commented on Nov 7, 2022 • 0 new comments

• C#: Include "phi reads" in `DataFlow::Node`

  #10927 commented on Nov 8, 2022 • 0 new comments