Repository navigation

Brodes/nested sizeof or operation in sizeof audit fixes - #21052

Closed

bdrodes wants to merge 1199 commits into

github:mainfrom

microsoft:brodes/nested_sizeof_or_operation_in_sizeof_audit_fixes

This pull request is big! We're only showing the most recent 250 commits

Commits on Jun 12, 2025
- update to invokesink
  chanel-y
  committed
  f882af9
Commits on Jun 16, 2025
- PS: Add 'Node.getCallee' predicate on DataFlow::CallNode.
  MathiasVP
  committed
  229914f
- Merge pull request #247 from microsoft/add-get-callee-on-call-nodes
  MathiasVP
  authored
  56977c7
Commits on Jun 19, 2025
- PS: Prevent magic on 'getParent'.
  MathiasVP
  committed
  3ba3b11
- PS: Add some QLDoc.
  MathiasVP
  committed
  9ed32b1
- PS: Autoformat.
  MathiasVP
  committed
  f69cfdc
- PS: Rename predicate.
  MathiasVP
  committed
  ae83d56
- PS: Fix join in 'count'.
  MathiasVP
  committed
  ebc167c
- PS: Replace a 'forex' with explicit recursion.
  MathiasVP
  committed
  b79f366
- PS: Remove two more 'forex's.
  MathiasVP
  committed
  8664842
- PS: Replace another 'forex' with explicit recursion.
  MathiasVP
  committed
  9be1f2d
- PS: Format, add a helper predicate and add an explicit 'this' to silence a warning.
  MathiasVP
  committed
  f513259
- PS: Fix cartesian product.
  MathiasVP
  committed
  a38d57f
- PS: Prevent join on boolean.
  MathiasVP
  committed
  c50b0c6
- PS: Prevent join on integer.
  MathiasVP
  committed
  2d045ea
- PS: Prevent bad magic by calling a HOP to compute the transitive closure.
  MathiasVP
  committed
  31fbb6f
- PS: Start with a SCAN of 'getProcessBlock' as this ensures we start with a small pipeline.
  MathiasVP
  committed
  86cc09b
Commits on Jun 20, 2025
- PS: Add false positive to 'ps/sql-injection'.
  MathiasVP
  committed
  b82bd2c
- PS: Model 'inputfile' as a sink for SQL injections.
  MathiasVP
  committed
  c18db91
- PS: Accept test changes.
  MathiasVP
  committed
  0912cc3
- PS: Add false positive to 'ps/sql-injection'.
  MathiasVP
  committed
  25d94fa
- PS: Don't implicitly read any element. Instead, only read positional contents.
  MathiasVP
  committed
  05a7cfd
- PS: Accept test changes.
  MathiasVP
  committed
  72178f0
- PS: Add new false negative.
  MathiasVP
  committed
  1ff04d9
- PS: Allow for implicit reads at sinks in 'ps/sql-injection'.
  MathiasVP
  committed
  1486200
- PS: Accept test changes.
  MathiasVP
  committed
  9032d86
- PS: Improve alert message.
  MathiasVP
  committed
  cb89695
- Merge pull request #249 from microsoft/fix-fps-on-sql-injection
  LWSimpkins
  authored
  6ab05cd
Commits on Jun 21, 2025
- Merge branch 'main' into fix-ps-performance
  LWSimpkins
  authored
  52f5ac5
- Merge pull request #248 from microsoft/fix-ps-performance
  LWSimpkins
  authored
  849e0b4
Commits on Jul 1, 2025
- Manual merge
  ropwareJB
  committed
  4122283
Commits on Jul 4, 2025
- PS: Gets back the previously-lost false negative by making the variable property name expression the sink when there is a call to 'Invoke'.
  MathiasVP
  committed
  0585c2f
- PS: Accept test changes.
  MathiasVP
  committed
  7d07773
- PS: Mark the BAD results in the test appropriately.
  MathiasVP
  committed
  eec092c
- PS: Cleanup a few manually generated models.
  MathiasVP
  committed
  2a26c43
- Merge branch 'main' into powershell-commandinjection-invokesinkfix
  chanel-y
  authored
  8aa8dde
- PS: Add test with missing remote flow source.
  MathiasVP
  committed
  bd90435
- PS: Add more models and accept test changes.
  MathiasVP
  committed
  766cf82
- random newline to reset git latest pusher
  chanel-y
  committed
  654bf2f
- Merge pull request #246 from microsoft/powershell-commandinjection-invokesinkfix
  MathiasVP
  authored
  52ff5d3
- PS: Add query for insecure uses of 'Set-ExecutionPolicy'.
  MathiasVP
  committed
  2731983
- PS: Add documentation.
  MathiasVP
  committed
  f7c9899
- PS: Add tests.
  MathiasVP
  committed
  4e524a1
- PS: Implement 'localExprTaint' instead of leaving it as 'none()'.
  MathiasVP
  committed
  b6b4df5
Commits on Jul 7, 2025
Commits on Jul 9, 2025
- PS: Add test with missing remote flow.
  MathiasVP
  committed
  1816356
- PS: Add more flow sources and accept test changes.
  MathiasVP
  committed
  d198877
- Merge pull request #255 from microsoft/add-iwr-as-flow-source
  MathiasVP
  authored
  8cd58aa
Commits on Jul 10, 2025
- run add-overlay-annotations.py
  ropwareJB
  committed
  81f9e88
- Merge branch 'main' into jb1/upstream-zipslip
  ropwareJB
  authored
  87e0b08
- Merge pull request #251 from microsoft/jb1/upstream-zipslip
  ropwareJB
  authored
  4dfa5d2
- Terminate p tag
  ropwareJB
  committed
  3606679
- Merge pull request #256 from microsoft/jb1/qhelpfix
  chanel-y
  authored
  866977b
- Revert "Merge pull request #251 from microsoft/jb1/upstream-zipslip"
  ropwareJB
  committed
  5fb45c8
- Manual merge
  ropwareJB
  committed
  4c5945f
- Merge branch 'main' into jb1/reapply-22.1-tmp
  ropwareJB
  authored
  b1b0892
- Merge pull request #257 from microsoft/jb1/reapply-22.1-tmp
  ropwareJB
  authored
  6d496ee
Commits on Jul 16, 2025
- PS: Fix spelling.
  MathiasVP
  committed
  f39d08e
- PS: Add false positive.
  MathiasVP
  committed
  75d37dc
- PS: Fix false positive by fixing the 'getCommand' predicates in 'CallOperatorCfgNode' and 'CallOperator'. Also fix 'DotSourcingOperator::getPath' while here.
  MathiasVP
  committed
  5f07641
- PS: Add false negative.
  MathiasVP
  committed
  670ad74
- PS: Add dot sourcing as a sink.
  MathiasVP
  committed
  205d2e5
- PS: Accept test changes.
  MathiasVP
  committed
  72af800
- Merge pull request #258 from microsoft/fix-call-operator-bug
  chanel-y
  authored
  5fde177
- PS: Small cleanup.
  MathiasVP
  committed
  ef3654f
- added queries, tests, docs
  chanel-y
  committed
  cb8496b
Commits on Jul 17, 2025
Commits on Jul 22, 2025
Commits on Jul 23, 2025
- add query, tests
  chanel-y
  committed
  4e0ea04
- formatting
  chanel-y
  committed
  482fda7
- Update powershell/ql/src/queries/security/cwe-319/UnsafeSMBSettings.ql
  
  chanel-y
  and
  MathiasVP
  authored
  a0dbf93
- Merge pull request #262 from microsoft/powershell-smb-settings
  MathiasVP
  authored
  7c83d9d
- PS: Remove environment variables as flow sources from 'powershell/microsoft/public/sql-injection'.
  MathiasVP
  committed
  95926cb
- PS: Unhide some dataflow nodes to make paths more explicit.
  MathiasVP
  committed
  3ba8799
- PS: Accept test changes.
  MathiasVP
  committed
  7991eb4
Commits on Jul 24, 2025
- Merge pull request #263 from microsoft/remove-env-reads-from-sql-injection
  MathiasVP
  authored
  ae4b3e8
- PS: Add false positive.
  MathiasVP
  committed
  e795630
- PS: Fix false positive by adding a type-based sanitizer.
  MathiasVP
  committed
  f9c3bde
- PS: Lower case all parameter types.
  MathiasVP
  committed
  71fec26
- PS: More consistent lower casing in the AST classes.
  MathiasVP
  committed
  3880d9f
- PS: Consistent lower casing in api graphs, control-flow graph, and dataflow nodes.
  MathiasVP
  committed
  e3b3f0b
- PS: Lower casing in frameworks.
  MathiasVP
  committed
  b66c99b
- PS: Lower casing in command-line injection query.
  MathiasVP
  committed
  7b4d2a9
- PS: Accept test changes.
  MathiasVP
  committed
  ffc53d7
- Add codeql-extractor-iac as submodule in iac/
  Dilan Bhalla
  committed
  eb15e3b
- Add 'iac' language support to CodeQL workflow
  dilanbhalla
  authored
  cb63c6a
Commits on Jul 25, 2025
- Merge pull request #265 from microsoft/dilan/iac-setup
  MathiasVP
  authored
  b0d6192
- Merge pull request #264 from microsoft/simple-type-sanitizers
  MathiasVP
  authored
  f8bdfa4
Commits on Aug 8, 2025
- PS: Delete stuff we don't actually need.
  MathiasVP
  committed
  3829528
- PS: Add missing dataflow predicates related to models.
  MathiasVP
  committed
  1bd93b9
Commits on Aug 11, 2025
- PS: Improve api graphs.
  MathiasVP
  committed
  9b5897c
- PS: Accept test changes.
  MathiasVP
  committed
  e96e464
- Merge pull request #270 from microsoft/better-api-graphs
  chanel-y
  authored
  337132b
- Revert "Merge pull request #257 from microsoft/jb1/reapply-22.1-tmp"
  ropwareJB
  committed
  f39c114
- merge upstream v2.22.2
  ropwareJB
  committed
  0936531
- Merge tag 'codeql-cli/v2.22.3' into jb1/2.22.3
  ropwareJB
  committed
  c6ab941
Commits on Aug 12, 2025
- PS: Port changes from #20132 to PowerShell.
  MathiasVP
  committed
  627ee85
- Merge pull request #272 from microsoft/jb1/2.22.3
  MathiasVP
  authored
  214ca2a
Commits on Aug 21, 2025
- Merge tag 'codeql-cli/latest' into auto/sync-main-pr
  dilanbhalla
  committed
  05dbec6
Commits on Aug 22, 2025
Commits on Aug 25, 2025
- Remove unused code
  ropwareJB
  committed
  1bdd366
Commits on Sep 2, 2025
- Merge pull request #273 from microsoft/auto/sync-main-pr
  dilanbhalla
  authored
  218f79f
- PS: Add false positive.
  MathiasVP
  committed
  6501d12
- PS: Fix FP by also considering -q and -i parameters.
  MathiasVP
  committed
  b5fb6b5
- PS: Accept test changes.
  MathiasVP
  committed
  cfbde9a
- Merge branch 'main' into powershell-sql-injection-alias-parameter-fp
  chanel-y
  authored
  b475871
- Merge pull request #276 from microsoft/powershell-sql-injection-alias-parameter-fp
  MathiasVP
  authored
  97170ee
Commits on Sep 3, 2025
- added cmdletbinding case to tests
  chanel-y
  committed
  a5a632f
- adding powershell cmd injection critical query, updated unit test results
  chanel-y
  committed
  b3dbe20
- adding Start-Process as sink
  chanel-y
  committed
  5e0ef92
- Merge branch 'main' into jb1/AB#13038-fp
  ropwareJB
  authored
  9b6eddb
- Merge pull request #275 from microsoft/jb1/AB#13038-fp
  ropwareJB
  authored
  bf7ebcc
Commits on Sep 4, 2025
- Merge tag 'codeql-cli/latest' into auto/sync-main-pr
  dilanbhalla
  committed
  5a90fc4
- add ValidateAttribute case
  chanel-y
  committed
  e66ae68
- remove Invoke-WebRequest as source
  chanel-y
  committed
  72f8680
Commits on Sep 5, 2025
- Merge branch 'main' into powershell-cmd-injection-updates
  MathiasVP
  authored
  44ed048
- Merge pull request #278 from microsoft/powershell-cmd-injection-updates
  MathiasVP
  authored
  c8b2fda
- PS: Add case insensitive naming to Attributes.
  MathiasVP
  committed
  2403ce6
- PS: Fixup queries.
  MathiasVP
  committed
  0a06da0
- PS: Accept test changes.
  MathiasVP
  committed
  04872b7
- Merge branch 'main' of https://github.com/microsoft/codeql into auto/sync-main-pr
  dilanbhalla
  committed
  bd3f774
- Merge pull request #279 from microsoft/case-insensitive-attribute-name-matching
  chanel-y
  authored
  42104ec
- Merge branch 'main' of https://github.com/microsoft/codeql into auto/sync-main-pr
  dilanbhalla
  committed
  f2f18fe
Commits on Sep 9, 2025
- PS: Add false positive
  MathiasVP
  committed
  2e290d2
- PS: Remove 'inputfile' as an SQL injection sink.
  MathiasVP
  committed
  f87f720
- PS: Accept test changes.
  MathiasVP
  committed
  84c3df2
- Merge pull request #281 from microsoft/do-not-warn-on-inputfile
  MathiasVP
  authored
  7a96fec
- Merge branch 'main' of https://github.com/microsoft/codeql into auto/sync-main-pr
  dilanbhalla
  committed
  bc99894
Commits on Sep 10, 2025
- PS: Fixup libraries after github/codeql#20253.
  MathiasVP
  committed
  bce32b4
- Merge pull request #277 from microsoft/auto/sync-main-pr
  dilanbhalla
  authored
  6df032d
Commits on Sep 11, 2025
- PS: Add a FP to the sql-injection query.
  MathiasVP
  committed
  b85c176
- PS: Add a barrier to block flow on validated parameters.
  MathiasVP
  committed
  7f9930e
- PS: Accept test changes.
  MathiasVP
  committed
  9af1306
- PS: Add another FP test.
  MathiasVP
  committed
  e8df3cc
- PS: Also use the 'query' predicate for implicit reads.
  MathiasVP
  committed
  a512b5a
- PS: Accept test changes.
  MathiasVP
  committed
  6a95515
- Merge pull request #282 from microsoft/sql-injection-powershell-more-barriers
  chanel-y
  authored
  9681711
- PS: Add another SQL injection FP.
  MathiasVP
  committed
  e1efae5
- PS: Use the same sinks for '&sqlcmd' as we do for 'Invoke-SqlCmd'.
  MathiasVP
  committed
  e566145
- PS: Accept test changes.
  MathiasVP
  committed
  c8eb734
- Merge pull request #283 from microsoft/fix-sqlcmd-sink-ps
  MathiasVP
  authored
  90999b3
- Migrate wilsonLib dir to public
  ropwareJB
  committed
  3ab33c7
- Merge branch 'main' into jb1/ab13144-migration
  ropwareJB
  authored
  2cb9f80
Commits on Sep 22, 2025
- qhelp guidance update for java xss
  5idg5
  committed
  1990cf8
- Merge pull request #285 from microsoft/java-xss-guidance-update
  MathiasVP
  authored
  d1f1807
- PS: Add QLDoc to a bunch of public AST classes.
  MathiasVP
  committed
  805e6c6
Commits on Sep 23, 2025
- PS: Add 'fieldEdge' to ApiGraphs.
  MathiasVP
  committed
  1f775b9
- PS: Add ZipSlip query.
  MathiasVP
  committed
  9916bbb
- PS: Add tests.
  MathiasVP
  committed
  8d3f6b8
- PS: Add tests for the new summary models.
  MathiasVP
  committed
  869c613
- PS: Add some more summary models.
  MathiasVP
  committed
  ca2cf5e
- PS: Add test for forEach.
  MathiasVP
  committed
  831f25d
- PS: Fix 'getIterableExpr' on 'ForEachStmtCfgNode'.
  MathiasVP
  committed
  2ec78ed
- PS: Add a testcase for the new read step.
  MathiasVP
  committed
  4276405
- PS: Add some comments to 'readStep'.
  MathiasVP
  committed
  e39d9f9
- PS: Add read step for 'foreach' statements.
  MathiasVP
  committed
  5692eb0
- PS: Accept query test changes.
  MathiasVP
  committed
  93a3833
- PS: Drive-by improvement: Make ObjectCreationNode a CallNode.
  MathiasVP
  committed
  ca20eb5
- PS: Accept test change to internal MAD ids.
  MathiasVP
  committed
  54226ec
- Merge tag 'codeql-cli/latest' into auto/sync-main-pr
  MathiasVP
  committed
  c83268f
- PS: Mirror the changes from github/codeql#20300.
  MathiasVP
  committed
  3332f70
- PS: Accept library test changes.
  MathiasVP
  committed
  6530fac
- Merge pull request #288 from microsoft/auto/sync-main-pr
  dilanbhalla
  authored
  4e690b7
Commits on Sep 24, 2025
- Merge branch 'main' into powershell-add-qldoc
  chanel-y
  authored
  4f21586
- Merge pull request #286 from microsoft/powershell-add-qldoc
  MathiasVP
  authored
  7d9a77a
- PS: Respond to review comments.
  MathiasVP
  committed
  d7a4063
- Merge branch 'main' into add-zipslip-query-ps
  MathiasVP
  authored
  abf320b
- Merge pull request #287 from microsoft/add-zipslip-query-ps
  MathiasVP
  authored
  a130224
Commits on Sep 30, 2025
- Merge remote-tracking branch 'ms/main' into jb1/ab13144-migration
  ropwareJB
  committed
  12107ec
- Merge branch 'jb1/ab13144-migration' of github.com:microsoft/codeql into jb1/ab13144-migration
  ropwareJB
  committed
  5e8514f
Commits on Oct 1, 2025
Commits on Oct 2, 2025
- Merge tag 'codeql-cli/latest' into auto/sync-main-pr
  dilanbhalla
  committed
  a0ab6c4
- Merge pull request #290 from microsoft/require-string-ops-in-sql-injection
  chanel-y
  authored
  4ab6f5c
- Merge branch 'main' of https://github.com/microsoft/codeql into auto/sync-main-pr
  dilanbhalla
  committed
  8ab8e67
- PS: Mirror the changes from github/codeql#20452.
  MathiasVP
  committed
  9bc74bd
- Merge pull request #291 from microsoft/auto/sync-main-pr
  dilanbhalla
  authored
  aa81060
Commits on Oct 8, 2025
- Merge branch 'main' into jb1/ab13144-migration
  ropwareJB
  authored
  97f11a1
- Merge pull request #284 from microsoft/jb1/ab13144-migration
  ropwareJB
  authored
  3759158
Commits on Oct 15, 2025
- PS: Prettify.
  MathiasVP
  committed
  1e1e4c6
- PS: Add a test demonstrating missing a variable.
  MathiasVP
  committed
  2fba40f
- PS: Autoformat.
  MathiasVP
  committed
  294af54
- PS: Ensure that variables whose only assignment is behind a conversion also generate AST variables.
  MathiasVP
  committed
  6a7c1e9
- PS: Accept test changes.
  MathiasVP
  committed
  0e39139
Commits on Oct 17, 2025
- Merge tag 'codeql-cli/latest' into auto/sync-main-pr
  dilanbhalla
  committed
  76ddb40
Commits on Oct 20, 2025
- Merge pull request #292 from microsoft/fix-missing-variables
  MathiasVP
  authored
  83b8f89
- Merge branch 'main' of https://github.com/microsoft/codeql into auto/sync-main-pr
  dilanbhalla
  committed
  13ef779
- Merge pull request #293 from microsoft/auto/sync-main-pr
  dilanbhalla
  authored
  2a0a312
Commits on Oct 29, 2025
- Reduce Type reference complexity using aliases
  ropwareJB
  committed
  ab8130e
- indendation
  ropwareJB
  committed
  641d379
Commits on Oct 30, 2025
- All types matching up
  ropwareJB
  committed
  a20e093
- Remove code commented out
  ropwareJB
  committed
  d6adad8
- Removed commented code
  ropwareJB
  committed
  ced775a
Commits on Nov 4, 2025
- Parameterize TaintTrackingStack over Global Dataflow implementation
  ropwareJB
  committed
  18ff8d2
- Merge pull request #294 from microsoft/jb1/dataflowstack-overlay
  dilanbhalla
  authored
  7eef5ba
Commits on Nov 5, 2025
- csharp taintrackingstack update to interface
  ropwareJB
  committed
  cfa09c6
- Merge pull request #295 from microsoft/jb1/dataflowstack-overlay2
  dilanbhalla
  authored
  635b32d
Commits on Nov 7, 2025
- DataFlowStack updated
  ropwareJB
  committed
  f0ffcd0
- Merge pull request #296 from microsoft/jb1/dataflowstack-java
  ropwareJB
  authored
  12969dd
Commits on Nov 13, 2025
- Generic FlowStack module covering both DataFlowStack and TaintTrackingStack
  ropwareJB
  committed
  b179734
- Refactor {Data,TaintTracking}FlowStack
  ropwareJB
  committed
  4bf4363
Commits on Nov 14, 2025
- Merge pull request #297 from microsoft/jb1/flowstack-refactor
  ropwareJB
  authored
  5087c8d
- resolved merge conflicts, accepting incoming change
  chanel-y
  committed
  a26da74
Commits on Nov 16, 2025
- Merge pull request #298 from microsoft/resolve-2.23.5-conflict
  dilanbhalla
  authored
  fe4dc76
Commits on Nov 21, 2025
Commits on Dec 2, 2025
Commits on Dec 5, 2025
Commits on Dec 8, 2025
- Merge pull request #306 from microsoft/macro-flow-partial-expr
  MathiasVP
  authored
  1ad548b
Commits on Dec 15, 2025
- Manual merge javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowPrivate.qll
  ropwareJB
  committed
  cffde88
- Merge pull request #308 from microsoft/jb1/sync-upstream-2-23-8
  ropwareJB
  authored
  1dd488b
Commits on Dec 16, 2025
- False positive fix regarding common type check idioms.
  bdrodes
  committed
  d2cefd2
- Simplifying sizeof query output messages, and making both consistent with each other.
  bdrodes
  committed
  a412b91

Commits

Commits on Jun 12, 2025

Commits on Jun 16, 2025

Commits on Jun 19, 2025

Commits on Jun 20, 2025

Commits on Jun 21, 2025

Commits on Jul 1, 2025

Commits on Jul 4, 2025

Commits on Jul 7, 2025

Commits on Jul 9, 2025

Commits on Jul 10, 2025

Commits on Jul 16, 2025

Commits on Jul 17, 2025

Commits on Jul 22, 2025

Commits on Jul 23, 2025

Commits on Jul 24, 2025

Commits on Jul 25, 2025

Commits on Aug 8, 2025

Commits on Aug 11, 2025

Commits on Aug 12, 2025

Commits on Aug 21, 2025

Commits on Aug 22, 2025

Commits on Aug 25, 2025

Commits on Sep 2, 2025