Skip to content

Commit 91a1d61

Browse files
jeongsoolee09jeongsoolee09
authored
Merge pull request #119 from advanced-security/mbaluda-fixed-codeql
CodeQL version from `qlt.conf.json`
2 parents dde1bde + 33ba6ea commit 91a1d61

File tree

28 files changed

+2609
-17305
lines changed

28 files changed

+2609
-17305
lines changed

‎.github/workflows/code_scanning.yml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,18 @@ jobs:
5656
done
5757
5858
# Initializes the CodeQL tools for scanning.
59+
- name: Extract version from qlt.conf.json
60+
uses: sergeysova/jq-action@v2
61+
id: version
62+
with:
63+
cmd: 'jq .CodeQLCLIBundle qlt.conf.json -r'
64+
5965
- name: Initialize CodeQL
6066
uses: github/codeql-action/init@v3
6167
with:
6268
languages: javascript
6369
config-file: ./.github/codeql/codeql-config.yaml
70+
tools: https://github.com/github/codeql-action/releases/download/${{steps.version.outputs.value}}/codeql-bundle-linux64.tar.gz
6471
debug: true
6572

6673
- name: Perform CodeQL Analysis

‎.github/workflows/javascript.sarif.expected

Lines changed: 2436 additions & 17183 deletions
Large diffs are not rendered by default.

‎javascript/frameworks/cap/ext/qlpack.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ library: true
33
name: advanced-security/javascript-sap-cap-models
44
version: 0.2.0
55
extensionTargets:
6-
codeql/javascript-all: "^0.8.7"
7-
codeql/javascript-queries: "^0.8.7"
6+
codeql/javascript-all: "^0.9.1"
7+
codeql/javascript-queries: "^0.8.16"
88
dataExtensions:
9-
- "*.model.yml"
9+
- "*.model.yml"

‎javascript/frameworks/cap/lib/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/cap/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ version: 0.2.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-cap-models: "^0.2.0"

‎javascript/frameworks/cap/src/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/cap/src/qlpack.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ version: 0.2.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-cap-models: "^0.2.0"
1010
advanced-security/javascript-sap-cap-all: "^0.2.0"
11-
default-suite-file: codeql-suites/javascript-code-scanning.qls
11+
default-suite-file: codeql-suites/javascript-code-scanning.qls

‎javascript/frameworks/cap/test/codeql-pack.lock.yml

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/javascript-queries:
9-
version: 0.8.7
9+
version: 0.8.16
1010
codeql/mad:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/regex:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/ssa:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/suite-helpers:
17-
version: 0.7.7
17+
version: 0.7.16
1818
codeql/tutorial:
19-
version: 0.2.7
19+
version: 0.2.16
2020
codeql/typetracking:
21-
version: 0.2.7
21+
version: 0.2.16
2222
codeql/typos:
23-
version: 0.2.7
23+
version: 0.2.16
2424
codeql/util:
25-
version: 0.2.7
25+
version: 0.2.16
26+
codeql/xml:
27+
version: 0.0.3
2628
codeql/yaml:
27-
version: 0.2.7
29+
version: 0.2.16
2830
compiled: false

‎javascript/frameworks/cap/test/qlpack.yml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
name: advanced-security/javascript-sap-cap-queries-tests
3-
version: 0.1.0
3+
version: 0.2.0
44
extractor: javascript
55
dependencies:
6-
codeql/javascript-all: "^0.8.7"
7-
codeql/javascript-queries: "^0.8.7"
8-
advanced-security/javascript-sap-cap-queries: "^0.1.0"
9-
advanced-security/javascript-sap-cap-models: "^0.1.0"
10-
advanced-security/javascript-sap-cap-all: "^0.1.0"
6+
codeql/javascript-all: "^0.9.1"
7+
codeql/javascript-queries: "^0.8.16"
8+
advanced-security/javascript-sap-cap-queries: "^0.2.0"
9+
advanced-security/javascript-sap-cap-models: "^0.2.0"
10+
advanced-security/javascript-sap-cap-all: "^0.2.0"

‎javascript/frameworks/ui5/ext/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,6 @@ library: true
33
name: advanced-security/javascript-sap-ui5-models
44
version: 0.6.0
55
extensionTargets:
6-
codeql/javascript-all: "^0.8.7"
6+
codeql/javascript-all: "^0.9.1"
77
dataExtensions:
88
- "*.model.yml"

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/BindingStringParser.qll

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@ import javascript as stdlib
22

33
signature class BindingStringReaderSig {
44
string getBindingString();
5-
stdlib::Location getLocation();
5+
6+
stdlib::DbLocation getLocation();
67

78
// Get a dataflow node associated with the binding string, if any.
89
// Note that not all location from which we can obtain a binding string
@@ -51,7 +52,8 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
5152
value = ":"
5253
} or
5354
MkNumberToken(int begin, int end, string value, BindingStringReader reader) {
54-
value = reader.getBindingString().regexpFind("-?[1-9]\\d*(\\.\\d+)?((e|E)?(\\+|-)?\\d+)?", _, begin) and
55+
value =
56+
reader.getBindingString().regexpFind("-?[1-9]\\d*(\\.\\d+)?((e|E)?(\\+|-)?\\d+)?", _, begin) and
5557
begin + value.length() - 1 = end
5658
} or
5759
MkStringToken(int begin, int end, string value, BindingStringReader reader) {
@@ -95,9 +97,9 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
9597
.getBindingString()
9698
.regexpFind("(?:#|#@)?(?:[a-zA-Z][a-zA-Z0-9_]*|[a-zA-Z0-9][a-zA-Z0-9_]:[a-zA-Z0-9_]+)(?:\\([^\\)]*\\))?",
9799
_, begin) and
98-
begin + value.length() - 1 = end
100+
begin + value.length() - 1 = end and
99101
// exclude keyword
100-
and not value in ["true", "false", "null"]
102+
not value in ["true", "false", "null"]
101103
} or
102104
MkGreaterThanToken(int begin, int end, string value, BindingStringReader reader) {
103105
begin = reader.getBindingString().indexOf(">") and

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Bindings.qll

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ private class BindingStringReader extends TBindingString {
6060
)
6161
}
6262

63-
Location getLocation() {
63+
DbLocation getLocation() {
6464
exists(StringLiteral stringLiteral |
6565
this = TBindingStringFromLiteral(stringLiteral) and
6666
result = stringLiteral.getLocation()
@@ -221,10 +221,10 @@ private predicate earlyPropertyBinding(
221221
or
222222
// Composite binding https://ui5.sap.com/#/topic/a2fe8e763014477e87990ff50657a0d0
223223
exists(
224-
DataFlow::ObjectLiteralNode objectLiteral,
225-
DataFlow::ObjectLiteralNode valueLiteral, DataFlow::PropWrite partWrite,
226-
DataFlow::ArrayLiteralNode partsArray, DataFlow::ObjectLiteralNode partsElement,
227-
DataFlow::PropWrite pathWrite, DataFlow::ValueNode pathValue
224+
DataFlow::ObjectLiteralNode objectLiteral, DataFlow::ObjectLiteralNode valueLiteral,
225+
DataFlow::PropWrite partWrite, DataFlow::ArrayLiteralNode partsArray,
226+
DataFlow::ObjectLiteralNode partsElement, DataFlow::PropWrite pathWrite,
227+
DataFlow::ValueNode pathValue
228228
|
229229
objectLiteral.getAPropertyWrite() = bindingTarget and
230230
bindingTarget.writes(_, "value", binding) and

‎javascript/frameworks/ui5/lib/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/ui5/lib/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ version: 0.6.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-ui5-models: "^0.6.0"

‎javascript/frameworks/ui5/src/codeql-pack.lock.yml

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,23 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/mad:
9-
version: 0.2.7
9+
version: 0.2.16
1010
codeql/regex:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/ssa:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/tutorial:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/typetracking:
17-
version: 0.2.7
17+
version: 0.2.16
1818
codeql/util:
19-
version: 0.2.7
19+
version: 0.2.16
20+
codeql/xml:
21+
version: 0.0.3
2022
codeql/yaml:
21-
version: 0.2.7
23+
version: 0.2.16
2224
compiled: false

‎javascript/frameworks/ui5/src/qlpack.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ version: 0.6.0
55
suites: codeql-suites
66
extractor: javascript
77
dependencies:
8-
codeql/javascript-all: "^0.8.7"
8+
codeql/javascript-all: "^0.9.1"
99
advanced-security/javascript-sap-ui5-models: "^0.6.0"
1010
advanced-security/javascript-sap-ui5-all: "^0.6.0"
1111
default-suite-file: codeql-suites/javascript-code-scanning.qls

‎javascript/frameworks/ui5/test/codeql-pack.lock.yml

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,27 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/dataflow:
5-
version: 0.1.7
5+
version: 0.2.7
66
codeql/javascript-all:
7-
version: 0.8.7
7+
version: 0.9.1
88
codeql/javascript-queries:
9-
version: 0.8.7
9+
version: 0.8.16
1010
codeql/mad:
11-
version: 0.2.7
11+
version: 0.2.16
1212
codeql/regex:
13-
version: 0.2.7
13+
version: 0.2.16
1414
codeql/ssa:
15-
version: 0.2.7
15+
version: 0.2.16
1616
codeql/suite-helpers:
17-
version: 0.7.7
17+
version: 0.7.16
1818
codeql/tutorial:
19-
version: 0.2.7
19+
version: 0.2.16
2020
codeql/typetracking:
21-
version: 0.2.7
21+
version: 0.2.16
2222
codeql/typos:
23-
version: 0.2.7
23+
version: 0.2.16
2424
codeql/util:
25-
version: 0.2.7
25+
version: 0.2.16
26+
codeql/xml:
27+
version: 0.0.3
2628
codeql/yaml:
27-
version: 0.2.7
29+
version: 0.2.16
2830
compiled: false

‎javascript/frameworks/ui5/test/lib/BindingStringParser/BindingStringParser.ql

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,14 @@ import advanced_security.javascript.frameworks.ui5.Bindings
33
import advanced_security.javascript.frameworks.ui5.BindingStringParser as Make
44

55
class BindingStringReader extends StringLiteral {
6-
BindingStringReader() {
7-
this.getValue().matches("{%}")
8-
}
6+
BindingStringReader() { this.getValue().matches("{%}") }
97

10-
string getBindingString() {
11-
result = this.getValue()
12-
}
13-
14-
DataFlow::Node getANode() {
15-
result.asExpr() = this
16-
}
8+
string getBindingString() { result = this.getValue() }
9+
10+
DataFlow::Node getANode() { result.asExpr() = this }
1711
}
1812

1913
module BindingStringParser = Make::BindingStringParser<BindingStringReader>;
2014

2115
from BindingStringParser::Binding binding
2216
select binding
23-
24-

‎javascript/frameworks/ui5/test/lib/Bindings/Bindings.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
import javascript
22
import advanced_security.javascript.frameworks.ui5.Bindings
33

4-
select any(Binding b)
4+
select any(Binding b)

0 commit comments

Comments
 (0)