Commit 25a46a8

Dilan

committed

Merge tag 'codeql-cli/latest'

Compatible with the latest released version of the CodeQL CLI

2 parents fee6373 + e27d8c1 commit 25a46a8Copy full SHA for 25a46a8

1,416 files changed

2024-11-25-ts57.md
Cargo.lock
MODULE.bazel
actions/ql
- lib
  - CHANGELOG.md
  - change-notes/released
    - 0.4.1.md
  - codeql-pack.release.yml
  - qlpack.yml
- src
  - CHANGELOG.md
  - change-notes/released
    - 0.4.1.md
  - codeql-pack.release.yml
  - codeql-suites
    - actions-security-experimental.qls
  - qlpack.yml
config
- identical-files.json
cpp
- downgrades
  - 1a4bbe5ded083b9de87911c155fc99ca22ecb0ce
  - 1aa71a4a687fc93f807d4dfeeef70feceeced242
  - 7eeff19bf7c89a350d3e43516a33c98a270cb057
  - a01d8f91b8d49259e509b574962dec90719f69a6
  - dd32242a870867a532bb0b2a88a6a917a5b4c26f
  - f786eb3f5dfddb0ac914ab09551bf1c5c64b47c0
- ql
  - lib
    - CHANGELOG.md
    - DefaultOptions.qll
    - change-notes/released
      - 3.2.0.md
    - codeql-pack.release.yml
    - ext
      - oleauto.model.yml
    - qlpack.yml
    - semmlecode.cpp.dbscheme.stats
    - semmlecode.cpp.dbscheme
    - semmle/code/cpp
      - Class.qll
      - Concept.qll
      - ConfigurationTestFile.qll
      - Declaration.qll
      - Function.qll
      - PrintAST.qll
      - Struct.qll
      - TemplateParameter.qll
      - Type.qll
      - TypedefType.qll
      - Union.qll
      - UserType.qll
      - Variable.qll
      - controlflow
        IRGuards.qll
        internal
        CFG.qll
      - dataflow
        ExternalFlow.qll
        internal
        FlowSummaryImpl.qll
      - internal
        QualifiedName.qll
        ResolveClass.qll
      - ir
        dataflow/internal
        DataFlowPrivate.qll
        DataFlowUtil.qll
        implementation
        aliased_ssa/internal
        AliasedSSA.qll
        raw/internal
        IRConstruction.qll
        InstructionTag.qll
        TranslatedCondition.qll
        TranslatedElement.qll
        TranslatedExpr.qll
        TranslatedStmt.qll
      - rangeanalysis
        RangeAnalysisUtils.qll
        SimpleRangeAnalysis.qll
        new/internal/semantic
        SemanticExpr.qll
        analysis
        FloatDelta.qll
        RangeAnalysisConstantSpecific.qll
        RangeAnalysisImpl.qll
        RangeAnalysisRelativeSpecific.qll
        SignAnalysisCommon.qll
      - stmts
        Stmt.qll
    - upgrades
      - 1a4bbe5ded083b9de87911c155fc99ca22ecb0ce
        old.dbscheme
        semmlecode.cpp.dbscheme
        upgrade.properties
      - 4813509d85b45ae17421c036905199f7324cf228
        old.dbscheme
        semmlecode.cpp.dbscheme
        upgrade.properties
      - 7eeff19bf7c89a350d3e43516a33c98a270cb057
        old.dbscheme
        semmlecode.cpp.dbscheme
        upgrade.properties
      - a01d8f91b8d49259e509b574962dec90719f69a6
        old.dbscheme
        semmlecode.cpp.dbscheme
        upgrade.properties
      - dd32242a870867a532bb0b2a88a6a917a5b4c26f
        old.dbscheme
        semmlecode.cpp.dbscheme
        upgrade.properties
        usertypes.ql
      - f786eb3f5dfddb0ac914ab09551bf1c5c64b47c0
        old.dbscheme
        semmlecode.cpp.dbscheme
        upgrade.properties
  - src
    - Architecture/Refactoring Opportunities
      - ClassesWithManyFields.ql
    - Best Practices
      - SloppyGlobal.ql
    - CHANGELOG.md
    - Critical
      - OverflowStatic.ql
      - ScanfChecks.qll
    - Likely Bugs
      - Arithmetic
        FloatComparison.ql
      - Likely Typos
        ExprHasNoEffect.ql
      - Underspecified Functions
        TooFewArguments.ql
    - Security/CWE
      - CWE-120
        BadlyBoundedWrite.ql
        UnboundedWrite.ql
      - CWE-732
        DoNotCreateWorldWritable.ql
    - change-notes/released
      - 1.3.2.md
    - codeql-pack.release.yml
    - qlpack.yml
  - test
    - experimental
      - library-tests/rangeanalysis/signanalysis
        SignAnalysis.expected
      - query-tests/Security/CWE/CWE-409/DecompressionBombs
        DecompressionBombs.expected
    - library-tests
      - consteval_if
        cfg.expected
        cfg.ql
        stmts.expected
        stmts.ql
        test.cpp
      - controlflow
        guards-ir
        tests.expected
        guards
        Guards.expected
        GuardsCompare.expected
        GuardsControl.expected
        GuardsEnsure.expected
        test.cpp
        test.c
      - dataflow
        dataflow-tests
        dataflow-consistency.expected
        test.cpp
        external-models
        flow.expected
        ir-barrier-guards
        test.cpp
        test.expected
        test.ql
        models-as-data
        FlowSummaryNode.expected
        SummaryCall.expected
        testModels.qll
        tests.cpp
        taint-tests
        localTaint.expected
        taint.cpp
        test_mad-signatures.expected
      - functions/functions
        Functions2.expected
      - ir/ir
        PrintAST.expected
        aliased_ir.expected
        aliased_ssa_consistency.expected
        aliased_ssa_consistency_unsound.expected
        ir-not-microsoft.c
        ir23.cpp
        raw_consistency.expected
        raw_ir.expected
        unaliased_ssa_consistency.expected
        unaliased_ssa_consistency_unsound.expected
      - preprocessor/preprocessor
        pp.cpp
        pp.h
        preproc.expected
      - proxy_class
        locations.expected
      - rangeanalysis/SimpleRangeAnalysis
        lowerBound.expected
        ternaryLower.expected
        ternaryUpper.expected
        test.c
        upperBound.expected
      - syntax-zoo
        aliased_ssa_consistency.expected
        raw_consistency.expected
        unaliased_ssa_consistency.expected
    - query-tests
      - Likely Bugs/Likely Typos/ExprHasNoEffect/CMakeFiles/CMakeScratch/TryCompile-abcdef
        CheckFunctionExists.c
        ExprHasNoEffect.expected
        ExprHasNoEffect.qlref
      - Security/CWE/CWE-119/semmle/tests
        UnboundedWrite.expected
      - jsf/4.13 Functions/AV Rule 114
        test.cpp
        test.c
csharp
- documentation/library-coverage
  - coverage.csv
  - coverage.rst
- extractor
  - Semmle.Extraction.CSharp.DependencyFetching
    - DependabotProxy.cs
    - DotNetCliInvoker.cs
    - SourceGenerators/DotnetSourceGeneratorWrapper
      - Razor.cs
  - Semmle.Extraction.CSharp
    - CodeAnalysisExtensions
      - SymbolExtensions.cs
    - Entities
      - Expression.cs
      - ExpressionNodeInfo.cs
      - Expressions
        Binary.cs
        ImplicitCast.cs
        ImplicitToString.cs
        InterpolatedString.cs
      - Types
        TypeParameterConstraints.cs
- ql
  - campaigns/Solorigate
    - lib
      - CHANGELOG.md
      - change-notes/released
        1.7.32.md
      - codeql-pack.release.yml
      - qlpack.yml
    - src
      - CHANGELOG.md
      - change-notes/released
        1.7.32.md
      - codeql-pack.release.yml
      - qlpack.yml
  - examples/snippets
    - ternary_conditional.ql
  - integration-tests/all-platforms
    - blazor_net_8
      - BlazorTest
        BlazorTest.csproj
        Components
        App.razor
        Layout
        MainLayout.razor.css
        MainLayout.razor
        NavMenu.razor.css
        NavMenu.razor
        MyInput.razor
        MyOutput.razor
        Pages
        Error.razor
        TestPage.razor
        Routes.razor
        _Imports.razor
        Program.cs
        Properties
        launchSettings.json
        appsettings.json
        global.json
        wwwroot
        app.css
        bootstrap
        bootstrap.min.css.map
        bootstrap.min.css
        favicon.png
      - Files.expected
      - Files.ql
      - htmlSinks.expected
      - htmlSinks.ql
      - test.py
    - blazor
      - BlazorTest
        BlazorTest.csproj
        Components
        App.razor
        Layout
        MainLayout.razor.css
        MainLayout.razor
        NavMenu.razor.css
        NavMenu.razor
        MyInput.razor
        MyOutput.razor
        Pages
        Error.razor
        TestPage.razor
        Routes.razor
        _Imports.razor
        Program.cs
        Properties
        launchSettings.json
        appsettings.json
        global.json
        wwwroot
        app.css
        bootstrap
        bootstrap.min.css.map
        bootstrap.min.css
        favicon.png
      - Files.expected
      - Files.ql
      - htmlSinks.expected
      - htmlSinks.ql
      - test.py
    - cshtml_standalone_net6
      - Files.expected
      - Files.ql
    - cshtml_standalone
      - Files.expected
      - Files.ql
  - lib
    - CHANGELOG.md
    - change-notes/released
      - 4.0.2.md
    - codeql-pack.release.yml
    - ext
      - Microsoft.AspNetCore.Http.model.yml
    - qlpack.yml
    - semmle/code/csharp
      - Conversion.qll
      - Generics.qll
      - PrintAst.qll
      - Type.qll
      - Unification.qll
      - commons
        Constants.qll
        Strings.qll
      - dataflow
        Nullness.qll
        internal
        DataFlowPrivate.qll
        FlowSummaryImpl.qll
      - dispatch
        Dispatch.qll
      - exprs
        Call.qll
        Expr.qll
  - src
    - Bad Practices
      - VirtualCallInConstructorOrDestructor.ql
    - CHANGELOG.md
    - Likely Bugs
      - Dynamic
        BadDynamicCall.ql
      - ObjectComparison.ql
    - change-notes/released
      - 1.0.15.md
    - codeql-pack.release.yml
    - qlpack.yml
  - test
    - library-tests
      - async
        Async.expected
        Await.expected
        async.cs
      - conversion/boxing
        Boxing.cs
      - csharp11
        PrintAst.expected
      - csharp7.2
        PrintAst.expected
        RefStructs.ql
      - dataflow
        global
        GetAnOutNode.expected
        TaintTrackingPath.expected
        implicittostring
        PrintAst.expected
        PrintAst.qlref
        implicitToString.cs
        implicitToString.expected
        implicitToString.ql
        library
        FlowSummaries.expected
        FlowSummariesFiltered.expected
      - dispatch
        CallContext.expected
        CallGraph.expected
        GetADynamicTarget.expected
        ViableCallable.cs
      - implements
        Implements.cs
        Implements.expected
        Implements.ql
      - implicittostring
        implicitToString.cs
        implicitToString.expected
        implicitToString.ql
      - iterators
        iterators.cs
        iterators.expected
        iterators.ql
      - security/dataflow/flowsources
        StoredFlowSources.expected
      - typeparameterconstraints
        TypeParameterConstraints.cs
        typeParameterConstraints.expected
        typeParameterConstraints.ql
      - unification
        Unification.cs
        Unification.expected
    - query-tests
      - Bad Practices/VirtualCallInConstructorOrDestructor
        VirtualCallInConstructorOrDestructor.cs
        VirtualCallInConstructorOrDestructor.expected
      - Nullness
        Implications.expected
        ImplicitToString.cs
      - Useless Code/RedundantToStringCall
        RedundantToStringCall.cs
        RedundantToStringCall.expected
docs/codeql
- codeql-language-guides
- ql-language-reference
  - modules.rst
- reusables
  - supported-versions-compilers.rst
go
- documentation/library-coverage
  - coverage.csv
  - coverage.rst
- extractor
  - go.mod
  - go.sum
- ql
  - consistency-queries
    - CHANGELOG.md
    - change-notes/released
      - 1.0.15.md
    - codeql-pack.release.yml
    - qlpack.yml
  - lib
    - CHANGELOG.md
    - change-notes/released
      - 3.0.2.md
    - codeql-pack.release.yml
    - ext
    - qlpack.yml
    - semmle/go/dataflow
      - ExternalFlow.qll
      - internal
        FlowSummaryImpl.qll
  - src
    - CHANGELOG.md
    - change-notes/released
      - 1.1.6.md
    - codeql-pack.release.yml
    - qlpack.yml
  - test
    - library-tests/semmle/go
      - dataflow/flowsources/local/database
        go.mod
        sink.go
        source.expected
        source.ext.yml
        source.ql
        test.expected
        test.ext.yml
        test.ql
        test_beego_orm.go
        test_database_sql.go
        test_database_sql_driver.go
        test_gorm.go
        test_jmoiron_sqlx.go
        user.go
        vendor
        github.com
        astaxie/beego/orm
        stub.go
        beego/beego/v2/client/orm
        stub.go
        jmoiron/sqlx
        conn.go
        db.go
        namedstmt.go
        row.go
        rows.go
        stmt.go
        stub.go
        tx.go
        gorm.io/gorm
        stub.go
        modules.txt
      - frameworks/BeegoOrm
        StoredXss.expected
    - query-tests/Security
      - CWE-078
        StoredCommand.expected
      - CWE-079
        StoredXss.expected
        StoredXss.qlref
javascript
- extractor/src/com/semmle
  - js/extractor
    - HTMLExtractor.java
    - Main.java
  - ts/extractor
    - TypeScriptASTConverter.java
- ql
  - examples/queries/dataflow
    - BackendIdor
      - BackendIdor.ql
    - DecodingAfterSanitization
      - DecodingAfterSanitization.ql
      - DecodingAfterSanitizationGeneralized.ql
    - EvalTaint
      - EvalTaint.ql
      - EvalTaintPath.ql
    - InformationDisclosure
      - InformationDisclosure.ql
    - StoredXss
      - StoredXss.ql
      - StoredXssTypeTracking.ql
    - TemplateInjection
      - TemplateInjection.ql
  - lib
  - src
    - CHANGELOG.md
    - Performance
      - PolynomialReDoS.ql
    - Security
      - CWE-020
        UntrustedDataToExternalAPI.ql
      - CWE-022
        TaintedPath.ql
        ZipSlip.ql
      - CWE-073
        TemplateObjectInjection.ql
      - CWE-078
        CommandInjection.ql
        IndirectCommandInjection.ql
        SecondOrderCommandInjection.ql
        ShellCommandInjectionFromEnvironment.ql
        UnsafeShellCommandConstruction.ql
      - CWE-079
        ExceptionXss.ql
        ReflectedXss.ql
        StoredXss.ql
        UnsafeHtmlConstruction.ql
        UnsafeJQueryPlugin.ql
        Xss.ql
        XssThroughDom.ql
      - CWE-089
        SqlInjection.ql
      - CWE-094
        CodeInjection.ql
        ImproperCodeSanitization.ql
        UnsafeCodeConstruction.ql
        UnsafeDynamicMethodAccess.ql
      - CWE-116
        IncompleteHtmlAttributeSanitization.ql
      - CWE-117
        LogInjection.ql
      - CWE-134
        TaintedFormatString.ql
      - CWE-200
        FileAccessToHttp.ql
      - CWE-201
        PostMessageStar.ql
      - CWE-209
        StackTraceExposure.ql
      - CWE-312
        BuildArtifactLeak.ql
        CleartextLogging.ql
        CleartextStorage.ql
      - CWE-327
        BrokenCryptoAlgorithm.ql
      - CWE-338
        InsecureRandomness.ql
      - CWE-346
        CorsMisconfigurationForCredentials.ql
      - CWE-377
        InsecureTemporaryFile.ql
      - CWE-400
        DeepObjectResourceExhaustion.ql
        RemotePropertyInjection.ql
      - CWE-502
        UnsafeDeserialization.ql
      - CWE-506
        HardcodedDataInterpretedAsCode.ql
      - CWE-601
        ClientSideUrlRedirect.ql
        ServerSideUrlRedirect.ql
      - CWE-611
        Xxe.ql
      - CWE-640
        HostHeaderPoisoningInEmailGeneration.ql
      - CWE-643
        XpathInjection.ql
      - CWE-730
        RegExpInjection.ql
      - CWE-754
        UnvalidatedDynamicMethodCall.ql
      - CWE-770
        ResourceExhaustion.ql
      - CWE-776
        XmlBomb.ql
      - CWE-798
        HardcodedCredentials.ql
      - CWE-807
        ConditionalBypass.ql
      - CWE-829
        InsecureDownload.ql
      - CWE-834
        LoopBoundInjection.ql
      - CWE-843
        TypeConfusionThroughParameterTampering.ql
      - CWE-912
        HttpToFileAccess.ql
      - CWE-915
        PrototypePollutingAssignment.ql
        PrototypePollutingFunction.ql
        PrototypePollutingMergeCall.ql
      - CWE-916
        InsufficientPasswordHash.ql
      - CWE-918
        ClientSideRequestForgery.ql
        RequestForgery.ql
    - change-notes/released
      - 1.3.0.md
    - codeql-pack.release.yml
    - experimental
      - Security
        CWE-094-dataURL
        CodeInjection.ql
        CWE-099
        EnvValueAndKeyInjection.ql
        EnvValueInjection.ql
        CWE-340
        TokenBuiltFromUUID.ql
        CWE-347
        decodeJwtWithoutVerification.ql
        decodeJwtWithoutVerificationLocalSource.ql
        CWE-522-DecompressionBombs
        DecompressionBombs.qll
        DecompressionBombs.ql
        CWE-918
        SSRF.qll
        SSRF.ql
        CWE-942
        CorsPermissiveConfiguration.ql
        CorsPermissiveConfigurationCustomizations.qll
        CorsPermissiveConfigurationQuery.qll
      - heuristics/ql/src/Security
        CWE-020
        UntrustedDataToExternalAPI.ql
        CWE-078
        CommandInjection.ql
        CWE-079
        Xss.ql
        CWE-089
        SqlInjection.ql
        CWE-094
        CodeInjection.ql
        CWE-117
        LogInjection.ql
        CWE-134
        TaintedFormatString.ql
        CWE-346
        CorsMisconfigurationForCredentials.ql
        CWE-400
        RemotePropertyInjection.ql
        CWE-502
        UnsafeDeserialization.ql
        CWE-611
        Xxe.ql
        CWE-643
        XpathInjection.ql
        CWE-730
        RegExpInjection.ql
        CWE-770
        ResourceExhaustion.ql
        CWE-776
        XmlBomb.ql
        CWE-807
        ConditionalBypass.ql
        CWE-915
        PrototypePollutingAssignment.ql
      - poi
        PoI.qll
    - meta
      - alerts
        TaintedNodes.ql
      - analysis-quality
        SanitizersReachableFromSource.ql
        SinksReachableFromSanitizer.ql
        TaintSteps.ql
        TaintedNodes.ql
        UnmodelledSteps.ql
    - qlpack.yml
  - test
    - experimental
      - FormParsers
        RemoteFlowSource.expected
        RemoteFlowSource.ql
      - PoI
        CommandInjectionPoIConfiguration.expected
        CommandInjectionPoIConfiguration.ql
        TaintedPathPoIConfiguration.expected
        TaintedPathPoIConfiguration.ql
        XssPoIConfiguration.expected
        XssPoIConfiguration.ql
      - Security
        CWE-094-dataURL
        CodeInjection.expected
        CWE-099
        EnvValueAndKeyInjection
        EnvValueAndKeyInjection.expected
        EnvValueInjection
        EnvValueInjection.expected
        CWE-347
        localsource
        decodeJwtWithoutVerificationLocalSource.expected
        remotesource
        decodeJwtWithoutVerification.expected
        CWE-918
        SSRF.expected
        CWE-942
        CorsPermissiveConfiguration.expected
    - library-tests
      - Arrays
        DataFlow.expected
        DataFlow.ql
        TaintFlow.expected
        TaintFlow.ql
        arrays.js
        printAst.expected
      - Barriers
        SimpleBarrierGuard.expected
        SimpleBarrierGuard.ql
      - Classes
        tests.expected
        tests.ql
      - CustomLoadStoreSteps
        test.ql
      - DataFlow
        tests.expected
        tests.ql
      - FlowLabels
        DefaultFlowLabels.ql
      - FlowSummary
        CaptureConsistency.expected
        CaptureConsistency.ql
        DataFlowConsistency.expected
        DataFlowConsistency.ql
        test.expected
        test.ql
        tst.js
      - Generators
        DataFlow.expected
        DataFlow.ql
        generators.js
      - InterProceduralFlow
        DataFlowConfig.qll
        async.js
        global.js
        global2.js
        properties2.js
        tests.expected
        tests.ql
      - LabelledBarrierGuards
        LabelledBarrierGuards.expected
        LabelledBarrierGuards.ql
      - Modules
        arbitrarySpecifier.ts
        tests.expected
      - Promises
        flow.js
        flow.qll
        flow2.js
        tests.expected
      - PropWrite
        tests.expected
      - Routing
        test.expected
        test.ql
      - Security/heuristics
        HeuristicSource.expected
        HeuristicSource.ql
      - TaintBarriers
        ExampleConfiguration.qll
        tests.expected
        tests.ql
      - TaintTracking
        BasicTaintTracking.expected
        BasicTaintTracking.ql
        DataFlowTracking.expected
        DataFlowTracking.ql
        arrays-init.js
        booleanOps.js
        bound-function.js
        call-apply.js
        callbacks.js
        capture-flow.js
        constructor-calls.js
        exceptions.js
        export-taint.js
        getters-and-setters.js
        implied-receiver.js
        import-taint.js
        nested-props.js
        object-bypass-sanitizer.js
        partialCalls.js
        promise.js
        sanitizer-guards.js
        spread.js
        stringification-read-steps.js
        tst.js
        use-use-after-implicit-read.js
      - TaintedUrlSuffix
        test.expected
        test.ql
        tst.js
      - TripleDot
        arrays.js
        exceptions.js
        iife.js
        test.expected
        test.ql
        tst.js
        useuse.js
      - TypeScript/ImportEquals
        tests.expected
        tests.ql
      - TypeTracking2
        DependencyRestriction.expected
        DependencyRestriction.ql
        summaries.js
        test.expected
        test.ql
      - frameworks
        Angular2
        test.expected
        test.ql
        AsyncPackage
        AsyncTaintTracking.expected
        AsyncTaintTracking.ql
        Collections
        test.expected
        test.ql
        ComposedFunctions
        compose.expected
        compose.ql
        Immutable
        immutable.js
        tests.expected
        tests.ql
        Nest
        Consistency.ql
        Next
        tests.expected
        tests.ql
        PropertyProjection
        PropertyInjectionTaint.expected
        PropertyInjectionTaint.ql
        ReactJS
        tests.expected
        Redux
        test.expected
        test.ql
        Restify2
        tests.ql
        Spife
        tests.ql
        Templating
        CodeInjection.expected
        Xss.qlref
        XssDiff.expected
        XssDiff.ql
        Vuex
        test.expected
        test.ql
        data
        test.expected
        test.ql
      - threat-models/sources
        TestSources.expected
        TestSources.ql
    - query-tests
      - Security
        CWE-020
        IncompleteHostnameRegExp
        IncompleteHostnameRegExp.expected
        IncompleteHostnameRegExp.qlref
        tst-IncompleteHostnameRegExp.js
        IncompleteUrlSchemeCheck
        IncompleteUrlSchemeCheck.expected
        IncompleteUrlSchemeCheck.js
        IncompleteUrlSchemeCheck.qlref
        IncompleteUrlSubstringSanitization
        IncompleteUrlSubstringSanitization.qlref
        tst-IncompleteUrlSubstringSanitization.js
        UntrustedDataToExternalAPI
        UntrustedDataToExternalAPI.expected
        CWE-022
        TaintedPath
        Consistency.ql
        TaintedPath.expected
        other-fs-libraries.js
        sharedlib-repro.js
        tainted-promise-steps.js
        ZipSlip
        ZipSlip.expected
        CWE-073
        Consistency.ql
        TemplateObjectInjection.expected
        CWE-078
        CommandInjection
        CommandInjection.expected
        Consistency.ql
        IndirectCommandInjection
        IndirectCommandInjection.expected
        SecondOrderCommandInjection
        SecondOrderCommandInjection.expected
        ShellCommandInjectionFromEnvironment
        ShellCommandInjectionFromEnvironment.expected
        UnsafeShellCommandConstruction
        UnsafeShellCommandConstruction.expected
        lib
        lib.js
        CWE-079
        DomBasedXss
        ConsistencyDomBasedXss.ql
        Xss.expected
        XssWithAdditionalSources.expected
        XssWithAdditionalSources.ql
        tainted-url-suffix-arguments.js
        tst.js
        ExceptionXss
        ConsistencyExceptionXss.ql
        ExceptionXss.expected
        ReflectedXss
        ConsistencyReflectedXss.ql
        ReflectedXss.expected
        ReflectedXss.js
        ReflectedXssWithCustomSanitizer.expected
        ReflectedXssWithCustomSanitizer.ql
        StoredXss
        ConsistencyStoredXss.ql
        StoredXss.expected
        UnsafeHtmlConstruction
        ConsistencyUnsafeHtmlConstruction.ql
        UnsafeHtmlConstruction.expected
        UnsafeJQueryPlugin
        ConsistencyUnsafeJQueryPlugin.ql
        UnsafeJQueryPlugin.expected
        XssThroughDom
        ConsistencyXssThroughDom.ql
        XssThroughDom.expected
        angular.ts
        CWE-089
        local-threat-source
        SqlInjection.expected
        typed
        SqlInjection.expected
        untyped
        Consistency.ql
        SqlInjection.expected
        CWE-094
        CodeInjection
        CodeInjection.expected
        HeuristicSourceCodeInjection.expected
        HeuristicSourceCodeInjection.ql
        ImproperCodeSanitization.expected
        UnsafeCodeConstruction.expected
        UnsafeDynamicMethodAccess
        UnsafeDynamicMethodAccess.expected
        CWE-116/IncompleteSanitization
        IncompleteHtmlAttributeSanitization.expected
        CWE-117
        LogInjection.expected
        CWE-134
        TaintedFormatString.expected
        CWE-200
        FileAccessToHttp.expected
        CWE-201
        PostMessageStar.expected
        CWE-209
        StackTraceExposure.expected
        CWE-312
        BuildArtifactLeak.expected
        CleartextLogging.expected
        CleartextStorage.expected
        passwords.js
        CWE-327
        BrokenCryptoAlgorithm.expected
        CWE-338
        InsecureRandomness.expected
        foo.test.js
        library1.js
        library2.js
        CWE-346
        CorsMisconfigurationForCredentials.expected
        CWE-377
        InsecureTemporaryFile.expected
        CWE-400
        DeepObjectResourceExhaustion
        DeepObjectResourceExhaustion.expected
        ReDoS
        PolynomialReDoS.expected
        RemovePropertyInjection
        RemotePropertyInjection.expected
        CWE-502
        Consistency.ql
        UnsafeDeserialization.expected
        CWE-506
        HardcodedDataInterpretedAsCode.expected
        CWE-522-DecompressionBombs
        DecompressionBombs.expected
        CWE-601
        ClientSideUrlRedirect
        ClientSideUrlRedirect.expected
        Consistency.expected
        Consistency.ql
        react.js
        regexp-exec.js
        tst.js
        tst10.js
        tst12.js
        tst13.js
        tst15.js
        tst7.js
        typed.ts
        ServerSideUrlRedirect
        ServerSideUrlRedirect.expected
        CWE-611
        Xxe.expected
        CWE-640
        HostHeaderPoisoningInEmailGeneration.expected
        CWE-643
        XpathInjection.expected
        CWE-730
        RegExpInjection.expected
        CWE-754
        UnvalidatedDynamicMethodCall.expected
        CWE-770/ResourceExhaustion
        Consistency.ql
        ResourceExhaustion.expected
        CWE-776
        XmlBomb.expected
        CWE-798
        HardcodedCredentials.expected
        CWE-807
        ConditionalBypass.expected
        CWE-829
        InsecureDownload.expected
        insecure-download.js
        CWE-834
        LoopBoundInjection.expected
        CWE-843
        TypeConfusionThroughParameterTampering.expected
        CWE-912
        HttpToFileAccess.expected
        CWE-915
        PrototypePollutingAssignment
        Consistency.expected
        Consistency.ql
        PrototypePollutingAssignment.expected
        PrototypePollutingFunction
        PrototypePollutingFunction.expected
        tests.js
        PrototypePollutingMergeCall
        PrototypePollutingMergeCall.expected
        CWE-916
        InsufficientPasswordHash.expected
        CWE-918
        ClientSideRequestForgery.expected
        Consistency.ql
        RequestForgery.expected
      - filters/ClassifyFiles
        ClassifyFiles.expected
        something.test.js
    - tutorials
      - Analyzing data flow in JavaScript/Global data flow
        query1.ql
        query2.ql
        query3.ql
        query4.ql
        query5.ql
      - Introducing the JavaScript libraries
        query17.qll
java
- kotlin-extractor/src/main/java/com/semmle/util
  - process
    - Env.java
  - trap/pathtransformers
    - PathTransformer.java
- ql
  - integration-tests/java
    - android-8-sample
      - source_archive.expected
    - android-sample-kotlin-build-script-no-wrapper
      - source_archive.expected
    - android-sample-kotlin-build-script
      - source_archive.expected
    - android-sample-no-wrapper
      - source_archive.expected
    - android-sample-old-style-kotlin-build-script-no-wrapper
      - source_archive.expected
    - android-sample-old-style-kotlin-build-script
      - source_archive.expected
    - android-sample-old-style-no-wrapper
      - source_archive.expected
    - android-sample-old-style
      - source_archive.expected
    - android-sample
      - source_archive.expected
    - buildless-erroneous
      - ExtractorInformation.expected
    - buildless-gradle-classifiers
      - source_archive.expected
    - buildless-gradle-timeout
      - source_archive.expected
    - buildless-gradle
      - source_archive.expected
    - buildless-maven-executable-war
      - source_archive.expected
    - buildless-maven-existing-settings-xml
      - source_archive.expected
    - buildless-maven-multimodule
      - source_archive.expected
    - buildless-maven-timeout
      - source_archive.expected
    - buildless-maven
      - source_archive.expected
    - buildless-proxy-gradle
      - source_archive.expected
    - buildless-proxy-maven
      - source_archive.expected
    - buildless-sibling-projects
      - source_archive.expected
    - buildless
      - source_archive.expected
    - ecj-sample-noexit
      - source_archive.expected
    - ecj-sample
      - source_archive.expected
    - gradle-sample-kotlin-script
      - source_archive.expected
    - gradle-sample
      - source_archive.expected
    - javac-tool-custom-file
      - Compiler.java
      - test.expected
      - test.py
      - test.ql
    - maven-enforcer
      - source_archive.expected
    - maven-sample-extract-properties
      - source_archive.expected
    - maven-sample-large-xml-files
      - source_archive.expected
    - maven-sample-small-xml-files
      - source_archive.expected
    - maven-sample-xml-mode-all
      - source_archive.expected
    - maven-sample-xml-mode-byname
      - source_archive.expected
    - maven-sample-xml-mode-disabled
      - source_archive.expected
    - maven-sample-xml-mode-smart
      - source_archive.expected
    - maven-sample
      - source_archive.expected
    - maven-wrapper-script-only
      - source_archive.expected
    - maven-wrapper-source-only
      - source_archive.expected
    - maven-wrapper
      - source_archive.expected
    - multi-release-jar-java11
      - ExtractorInformation.expected
    - multi-release-jar-java17
      - ExtractorInformation.expected
    - partial-gradle-sample-without-gradle
      - source_archive.expected
    - partial-gradle-sample
      - source_archive.expected
    - spring-boot-sample
      - source_archive.expected
  - lib
    - CHANGELOG.md
    - change-notes/released
      - 6.1.0.md
    - codeql-pack.release.yml
    - qlpack.yml
    - semmle/code/java
      - dataflow
        RangeAnalysis.qll
        RangeUtils.qll
        internal
        FlowSummaryImpl.qll
      - dispatch
        DispatchFlow.qll
      - security
        Encryption.qll
  - src
    - CHANGELOG.md
    - Likely Bugs/Serialization
      - MissingVoidConstructorsOnSerializable.qhelp
      - MissingVoidConstructorsOnSerializable.ql
    - Security/CWE/CWE-327
      - BrokenCryptoAlgorithm.ql
    - change-notes/released
      - 1.1.12.md
    - codeql-pack.release.yml
    - qlpack.yml
  - test
    - library-tests/Encryption
    - query-tests
      - MissingVoidConstructorsOnSerializable
        MissingVoidConstructorsOnSerializable.expected
        MissingVoidConstructorsOnSerializable.qlref
        Test.java
      - security/CWE-327/semmle/tests
        BrokenCryptoAlgorithm.expected
misc
python/ql
- lib
  - CHANGELOG.md
  - change-notes/released
    - 3.1.1.md
  - codeql-pack.release.yml
  - qlpack.yml
  - semmle/python
    - dataflow/new
      - TypeTracking.qll
      - internal
        FlowSummaryImpl.qll
        TypeTrackingImpl.qll
    - frameworks
      - Lxml.qll
    - security/internal
      - SensitiveDataHeuristics.qll
- src
  - CHANGELOG.md
  - change-notes/released
    - 1.4.1.md
  - codeql-pack.release.yml
  - qlpack.yml
- test
  - library-tests/frameworks/lxml
  - query-tests
    - Functions/return_values
      - ConsistentReturns.expected
      - functions_test.py
    - Statements/unreachable
      - UnreachableCode.expected
      - test.py
ruby
- extractor
  - Cargo.toml
- ql
  - consistency-queries
    - DataFlowConsistency.ql
  - lib
  - src
    - CHANGELOG.md
    - change-notes/released
      - 1.1.10.md
    - codeql-pack.release.yml
    - experimental
      - CWE-522-DecompressionBombs
        DecompressionBombs.ql
      - decompression-api
        DecompressionApi.ql
      - manually-check-http-verb
        ManuallyCheckHttpVerb.ql
      - weak-params
        WeakParams.ql
    - qlpack.yml
    - queries
      - meta
        TaintedNodes.ql
      - security
        cwe-611
        Xxe.ql
        cwe-732
        WeakFilePermissions.ql
        cwe-798
        HardcodedCredentials.ql
  - test
    - library-tests
      - dataflow
        array-flow
        array-flow.expected
        call-sensitivity
        call-sensitivity.expected
        erb
        erb.expected
        main.rb
        view1.rb
        flow-summaries
        semantics.expected
        global
        Flow.expected
        hash-flow
        hash-flow.expected
        params
        params-flow.expected
        ssa-flow
        ssa-flow.expected
        summaries
        Summaries.expected
        type-flow
        Flow.expected
        Flow.ql
        types.rb
      - frameworks
        action_controller
        params-flow.expected
        active_support
        ActiveSupportDataFlow.expected
        pathname
        Pathname.expected
        sinatra
        Flow.expected
    - query-tests
      - experimental/TemplateInjection
        TemplateInjection.expected
      - security
        cwe-022
        PathInjection.expected
        cwe-078/UnsafeShellCommandConstruction
        UnsafeShellCommandConstruction.expected
        cwe-079
        ReflectedXSS.expected
        StoredXSS.expected
        cwe-089
        SqlInjection.expected
        cwe-094
        CodeInjection
        CodeInjection.expected
        UnsafeCodeConstruction
        UnsafeCodeConstruction.expected
        cwe-117
        LogInjection.expected
        cwe-312
        CleartextLogging.expected
        CleartextStorage.expected
        cwe-506
        HardcodedDataInterpretedAsCode.expected
        cwe-732
        WeakFilePermissions.expected
        cwe-798
        HardcodedCredentials.expected
        cwe-829
        InsecureDownload.expected
rust
- ast-generator
  - BUILD.bazel
  - Cargo.toml
  - patches
    - rust.ungram.patch
  - src
    - main.rs
    - templates
      - extractor.mustache
      - schema.mustache
- extractor
  - Cargo.toml
  - macros
    - Cargo.toml
  - src
    - config.rs
    - diagnostics.rs
    - generated
      - .generated.list
      - top.rs
    - main.rs
    - qltest.rs
    - rust_analyzer.rs
    - translate
      - base.rs
      - generated.rs
- ql
  - .generated.list
  - .gitattributes
  - integration-tests
    - hello-project
    - hello-workspace
    - options
      - cfg
        functions.ql
      - features
        functions.ql
      - target
        functions.ql
  - lib
    - CHANGELOG.md
    - change-notes/released
      - 0.1.0.md
    - codeql-pack.release.yml
    - codeql/rust
      - AstConsistency.qll
      - Frameworks.qll
      - controlflow
        CfgNodes.qll
      - dataflow
        FlowSink.qll
        FlowSource.qll
        FlowSummary.qll
        internal
        DataFlowImpl.qll
        FlowSummaryImpl.qll
        ModelsAsData.qll
      - elements/internal
        ExtractorStepImpl.qll
        FormatImpl.qll
        VariableImpl.qll
        generated
        ExtractorStep.qll
        Format.qll
        ParentChild.qll
        Raw.qll
      - frameworks/rustcrypto
        RustCrypto.qll
        rustcrypto.model.yml
      - security
        SensitiveData.qll
        SqlInjectionExtensions.qll
        WeakSensitiveDataHashingExtensions.qll
        internal
        SensitiveDataHeuristics.qll
    - qlpack.yml
    - rust.dbscheme
    - utils/test
      - InlineFlowTest.qll
  - src
    - CHANGELOG.md
    - change-notes/released
      - 0.1.0.md
    - codeql-pack.release.yml
    - qlpack.yml
    - queries
      - security/CWE-328
        WeakSensitiveDataHashing.qhelp
        WeakSensitiveDataHashing.ql
        WeakSensitiveDataHashingBad.rs
        WeakSensitiveDataHashingGood.rs
      - summary
        CryptographicOperations.ql
        QuerySinkCounts.ql
        QuerySinks.ql
        SensitiveData.ql
        Stats.qll
        SummaryStats.ql
        TaintReach.qll
  - test
    - extractor-tests
      - File
        File.expected
        nested.rs
        nested
        file.rs
      - generated
        .generated_tests.list
        FormatArgsExpr
        Format.expected
        Format.ql
        FormatArgsArg.expected
        FormatArgsArg_getExpr.expected
        FormatArgsExpr.expected
        FormatArgsExpr_getArg.expected
        FormatArgsExpr_getFormat.expected
        FormatArgsExpr_getTemplate.expected
        FormatArgument.expected
        FormatArgument_getVariable.expected
        FormatTemplateVariableAccess.expected
        Format_getArgument.expected
        Format_getArgumentRef.expected
        Format_getArgumentRef.ql
        Format_getPrecisionArgument.expected
        Format_getPrecisionArgument.ql
        Format_getWidthArgument.expected
        Format_getWidthArgument.ql
        gen_format.rs
    - library-tests
      - dataflow
        models
        main.rs
        models.expected
        models.ext.yml
        models.ql
        strings
        inline-taint-flow.expected
        main.rs
        taint
        TaintFlowStep.expected
      - sensitivedata
        SensitiveData.expected
        SensitiveData.ql
        test.rs
      - variables
        Cfg.expected
        Ssa.expected
        main.rs
        variables.expected
        variables.ql
    - query-tests
      - diagnostics
        AstConsistencyCounts.expected
        SummaryStats.expected
      - security/CWE-328
        WeakSensitiveDataHashing.expected
        WeakSensitiveDataHashing.qlref
        options.yml
        test.rs
      - unusedentities
        UnusedValue.expected
        main.rs
- schema
shared
- controlflow
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- dataflow
  - CHANGELOG.md
  - change-notes/released
    - 1.1.9.md
  - codeql-pack.release.yml
  - codeql/dataflow/internal
  - qlpack.yml
- mad
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- rangeanalysis
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - codeql/rangeanalysis
    - ModulusAnalysis.qll
    - RangeAnalysis.qll
    - internal
      - RangeUtils.qll
  - qlpack.yml
- regex
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- ssa
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- threat-models
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- tree-sitter-extractor
  - Cargo.toml
- tutorial
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- typeflow
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- typetracking
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - codeql/typetracking
    - TypeTracking.qll
    - internal
      - TypeTrackingImpl.qll
  - qlpack.yml
- typos
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- util
  - CHANGELOG.md
  - change-notes/released
    - 2.0.2.md
  - codeql-pack.release.yml
  - codeql/util/test
    - InlineExpectationsTest.qll
  - qlpack.yml
- xml
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
- yaml
  - CHANGELOG.md
  - change-notes/released
    - 1.0.15.md
  - codeql-pack.release.yml
  - qlpack.yml
swift
- extractor
  - main.cpp
- ql
  - lib
    - CHANGELOG.md
    - change-notes/released
      - 3.1.1.md
    - codeql-pack.release.yml
    - codeql/swift
      - dataflow/internal
        FlowSummaryImpl.qll
      - security
        SensitiveExprs.qll
        internal
        SensitiveDataHeuristics.qll
    - qlpack.yml
  - src
    - CHANGELOG.md
    - change-notes/released
      - 1.0.15.md
    - codeql-pack.release.yml
    - qlpack.yml

`‎2024-11-25-ts57.md‎`

This file was deleted.

Comments

(0)