Anders Schack-Mulligen
1432519cc2
Dataflow: Add totalorder predicates to all languages.
2024-05-27 11:01:52 +02:00
Anders Schack-Mulligen
bc8ca1af86
Dataflow: Introduce NodeRegions for use in isUnreachableInCall.
2024-05-27 11:01:51 +02:00
Dave Bartolomeo
613ccaac1d
Add change note to all v1.0.0 packs
2024-05-23 13:01:22 -04:00
Owen Mansel-Chan
b2deea4606
Avoid duplicate additional flow steps in configs
...
`localTaintStep` includes a lot of steps which are already part of value
flow. Instead use `defaultAdditionalTaintStep`, which is just the extra
steps that are added for taint tracking.
2024-05-23 11:13:35 +01:00
Owen Mansel-Chan
cf997fddf6
Trivial: improve parameter names
...
These names make more sense and match everywhere
else that this function signature is used.
2024-05-23 11:04:09 +01:00
Dave Bartolomeo
ffe4c8c87b
Update all pack versions to 1.0.0
2024-05-22 13:39:08 -04:00
Tom Hvitved
454687d583
Data flow: Synthesize parameter return nodes
2024-05-21 14:47:42 +02:00
Erik Krogh Kristensen
bfc95c6f13
Merge pull request #16510 from erik-krogh/go-command
...
Go: Update the QHelp for `go/command-injection`.
2024-05-17 17:45:10 +02:00
erik-krogh
384649b336
changes based on review, and improve the new command-injection test
2024-05-17 08:38:54 +02:00
Owen Mansel-Chan
2dd42f7aa5
Merge pull request #16509 from owen-mc/go/fix-missing-underlying-types
...
Go: make two barriers recognise named types whose underlying types are integer types
2024-05-16 12:41:42 +01:00
Owen Mansel-Chan
8cc118f781
Add change note
2024-05-16 11:16:54 +01:00
Owen Mansel-Chan
b008f98782
Fix missing getUnderlyingType() calls
...
In both cases we also care about named types whose underlying type is
an integer type.
2024-05-16 11:10:15 +01:00
Owen Mansel-Chan
e71cf0ff1d
Use value flow instead of taint flow
2024-05-16 10:10:18 +01:00
Owen Mansel-Chan
5dbb91f508
Merge pull request #16504 from owen-mc/go/allow-array-reads-from-named-types
...
Go: allow read and store steps from named types
2024-05-16 09:47:54 +01:00
erik-krogh
ea2b73bda2
add a sanitizer that checks that the string does not start with "--"
2024-05-16 09:25:19 +02:00
erik-krogh
b9a7f6a8f7
add regexp check as a sanitizer for command-injection
2024-05-16 08:55:03 +02:00
Owen Mansel-Chan
6ffa821aa3
Add change note
2024-05-16 00:41:28 +01:00
Owen Mansel-Chan
21ff705b73
Fix bug with read/store steps and named types
2024-05-16 00:35:45 +01:00
Dave Bartolomeo
b49a61705c
Merge pull request #16491 from github/post-release-prep/codeql-cli-2.17.3
...
Post-release preparation for codeql-cli-2.17.3
2024-05-14 19:33:20 -04:00
github-actions[bot]
32e8b5c667
Post-release preparation for codeql-cli-2.17.3
2024-05-14 21:14:08 +00:00
Owen Mansel-Chan
145873f562
Merge pull request #16413 from owen-mc/go/fix-builtin-models
...
Go: fix models for built-in functions
2024-05-14 21:03:05 +01:00
github-actions[bot]
100166fa53
Release preparation for version 2.17.3
2024-05-14 19:23:18 +00:00
Owen Mansel-Chan
ab5e1f8a69
Fix models for min and max and improve tests
...
Although the documentation makes them look variadic (and generic), they
are actually special-cased in the compiler. Like all built-in functions
they don't have a signature type, but the type of `min(a, b, c)` is
`func(int, int, int) int` and not `func(int, ...int) int`.
Go doesn't allow open-ended ranges for argument indices in
models-as-data specifications (though Ruby and Python do), so I've used
`1..1000`.
2024-05-14 14:40:56 +01:00
Chuan-kai Lin
9456eaf5d3
Merge pull request #16420 from github/cklin/go-entities-reorder
...
Go: Use entities in reorder directives
2024-05-13 10:26:04 -07:00
Owen Mansel-Chan
e1c85e3581
Fix elementWrite to include flow summaries
2024-05-10 23:40:58 +01:00
Owen Mansel-Chan
8cc9838628
Add change note
2024-05-10 23:40:57 +01:00
Owen Mansel-Chan
f95ccd242f
Remove old-style models of built-in functions
2024-05-10 23:40:54 +01:00
Owen Mansel-Chan
fcdac0aeb0
Add models for min and max built-in functions
2024-05-10 23:40:53 +01:00
Owen Mansel-Chan
1322ce35d6
Add model for built-in function copy
2024-05-10 23:40:53 +01:00
Owen Mansel-Chan
e857eedd4a
Fix model for append - it is variadic
2024-05-10 23:40:52 +01:00
Owen Mansel-Chan
526204dc43
Merge pull request #16458 from owen-mc/go/fix-mad-for-builtin-functions
...
Go: fix `hasQualifiedName` and models-as-data for built-in functions
2024-05-09 15:06:07 +01:00
Owen Mansel-Chan
1ccea884ff
Add change note
2024-05-08 15:37:25 +01:00
Owen Mansel-Chan
f6f594e4b5
parse empty string as package name
2024-05-08 15:33:19 +01:00
Owen Mansel-Chan
fb74a2a170
Use "" in qualified name for entities without a package
2024-05-08 15:33:19 +01:00
Owen Mansel-Chan
4d42a88c3c
Add change note
2024-05-08 15:31:22 +01:00
Owen Mansel-Chan
9842445b52
Fix getType on ImplicitVarArgsSlice
...
It was not defined for built-in functions or for functions called via
a function variable.
2024-05-08 15:22:27 +01:00
Chuan-kai Lin
1dd3a0fd76
Go: Use entities in reorder directives
2024-05-03 11:16:08 -07:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Owen Mansel-Chan
09e59ccf44
Name files with empty definitions of MaD extensible predicates to erowdmpty.model.yml
2024-05-01 21:39:38 +01:00
github-actions[bot]
99928b82ed
Post-release preparation for codeql-cli-2.17.2
2024-04-30 12:15:35 +00:00
github-actions[bot]
5228d94d42
Release preparation for version 2.17.2
2024-04-30 10:25:51 +00:00
erik-krogh
800d7546fa
change all the change-notes to breaking
2024-04-26 17:17:23 +02:00
erik-krogh
14d88eb3ce
add change-notes
2024-04-26 12:56:28 +02:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Owen Mansel-Chan
f828f8ea65
Merge pull request #16250 from owen-mc/go/rename-untrusted-flow-source
...
Go: Rename `UntrustedFlowSource` to `RemoteFlowSource` to match other language libraries
2024-04-24 11:37:00 +01:00
Owen Mansel-Chan
0311888fd4
Update change note
...
Co-authored-by: Michael B. Gale <mbg@github.com >
2024-04-23 19:07:02 +01:00
Anders Schack-Mulligen
b2f09949df
Merge pull request #15599 from aschackmull/dataflow/fieldflowbranchlimit-v2
...
Dataflow: update fieldFlowBranchLimit semantics
2024-04-23 10:08:05 +02:00
Owen Mansel-Chan
dc985c2c98
Add change note
2024-04-18 12:55:59 +01:00
Owen Mansel-Chan
b6f6bdc6f4
Make RemoteFlowAsSource private
...
`UntrustedFlowAsSource` should have been private. Since we are deprecating them anyway
we may as well make the replacement private (and make it use `instanceof`). The deprecation
comments have been updated.
2024-04-18 12:31:38 +01:00
