Tony Torralba
fc7c66dab2
Remove now unnecessary additional taint step in UnsafeJsEval
2022-11-24 12:35:52 +01:00
Tony Torralba
e67b72d954
Update test expectations
2022-11-24 12:35:51 +01:00
Tony Torralba
25354d2dd8
Apply code review suggestions
2022-11-24 12:35:51 +01:00
Tony Torralba
6a8b9fde78
Add data flowsources test
2022-11-24 12:35:51 +01:00
Tony Torralba
d6b14a1395
Update test expectations
2022-11-24 12:35:50 +01:00
Tony Torralba
2284127650
Add MaD rows for the Data class
2022-11-24 12:35:50 +01:00
Geoffrey White
c6835cd270
Swift: Update .generated.list.
2022-11-24 11:16:56 +00:00
Tony Torralba
4f8ef13cd8
Fix expectation in NSData tests
2022-11-24 12:13:46 +01:00
Tony Torralba
04450c5173
Merge pull request #11378 from atorralba/atorralba/swift/nsdata-models
...
Swift: Add models for NSData and NSMutableData
2022-11-24 11:19:14 +01:00
Tony Torralba
2ac06b8db9
Turns out lambda flow is already supported
2022-11-24 10:52:27 +01:00
Nora Dimitrijević
8f065e9483
Merge pull request #11001 from d10c/swift/js-injection
2022-11-24 10:52:05 +01:00
Geoffrey White
2b52a44024
Merge pull request #11210 from geoffw0/alamofire2
...
Swift: Add Alamofire model to swift/cleartext-transmission
2022-11-23 18:23:44 +00:00
Geoffrey White
ef837f72e4
Swift: Test .expected changes resulting from merge.
2022-11-23 14:57:08 +00:00
Paolo Tranquilli
876add5214
Swift: reject uppercase acronyms in schema
...
This was causing hardly debuggable errors because names are transformed
to underscored lowercase names in the dbscheme and back to camelcase
for trap emission classes, which is not a noop in case uppercase
acronyms (like SIL or ABI) are in the name.
This makes the error be surfaced early with a helpful message.
2022-11-23 13:56:03 +01:00
AlexDenisov
1c17d854d8
Merge pull request #11391 from github/redsun82/swift-package-downgrades
...
Swift: add downgrades script to extractor pack
2022-11-23 12:46:28 +01:00
Paolo Tranquilli
a1bffff0b0
Swift: add downgrades script to extractor pack
2022-11-23 12:15:29 +01:00
Geoffrey White
556d68aeed
Update swift/ql/src/queries/Security/CWE-311/CleartextTransmission.ql
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-11-23 09:17:18 +00:00
Paolo Tranquilli
545c2f67e9
Merge pull request #11382 from github/alexdenisov/swift-relax-file-archiving
...
Swift: do not abort if cannot archive a source file
2022-11-23 06:56:26 +01:00
Geoffrey White
7d45ca6293
Merge branch 'main' into optionals2
2022-11-22 17:35:27 +00:00
Alex Denisov
8f02463411
Swift: fix remapping bug
...
This issue has slipped during a recent refactoring:
https://github.com/github/codeql/pull/10987/files#diff-c5ab26a06a93c4507a834859a6a56878d5bfe16c4d7cbac4afc4f081d46f461aL63-R64
2022-11-22 17:25:07 +01:00
Alex Denisov
a2ac1384cb
Swift: do not abort if cannot archive a source file
2022-11-22 17:18:40 +01:00
Tony Torralba
2e1a78e1bf
Add models for NSData and NSMutableData
2022-11-22 15:48:58 +01:00
Paolo Tranquilli
414f18fc97
Swift: fix extractor tests pack
...
This allows `codeql query compile` to run on integration test queries.
2022-11-22 10:58:57 +01:00
Geoffrey White
949cfb758d
Merge branch 'main' into alamofire2
2022-11-22 09:29:53 +00:00
Tony Torralba
16a76853f4
Add libxml2 sinks
2022-11-21 16:25:51 +01:00
Tom Hvitved
d189ba52c0
Merge pull request #11341 from hvitved/cfg/multi-edge-workaround
...
CFG: Workaround in test output for origin/target pairs with multiple edges
2022-11-21 14:34:17 +01:00
Tom Hvitved
0d89f57680
Swift: Update expected test output
2022-11-21 12:55:40 +01:00
Tom Hvitved
e7ed056b6f
Sync files
2022-11-21 12:00:36 +01:00
Tom Hvitved
99e70e9a50
Data flow: Sync files
2022-11-20 10:19:23 +01:00
Paolo Tranquilli
aaa96b20ed
Swift: fix python compatibility with CI
2022-11-18 17:51:20 +01:00
Paolo Tranquilli
6dcdf8c71f
Swift: fix bazel setup
2022-11-18 17:22:44 +01:00
Paolo Tranquilli
aeb7b0d050
Swift: remove ModifiedStubMarkedAsGeneratedError
2022-11-18 17:13:12 +01:00
Nora Dimitrijević
8f5af3fca6
Merge branch 'main' into swift/js-injection
2022-11-18 17:07:20 +01:00
Paolo Tranquilli
2cd58817d7
Swift: skip QL code generation on untouched files
...
This is a developer QoL improvement, where running codegen will skip
writing (and especially formatting) any files that were not changed.
**Why?** While code generation in itself was pretty much instant, QL
formatting of generated code was starting to take a long time. This made
unconditionally running codegen quite annoying, for example before each
test run as part of an IDE workflow or as part of the pre-commit hook.
**How?** This was not completely straightforward as we could not work
with the contents of the file prior to code generation as that was
already post-processed by the QL formatting, so we had no chance of
comparing the output of template rendering with that. We therefore store
the hashes of the files _prior_ to QL formatting in a checked-in file
(`swift/ql/.generated.list`). We can therefore load those hashes at
the beginning of code generation, use them to compare the template
rendering output and update them in this special registry file.
**What else?** We also extend this mechanism to detect accidental
modification of generated files in a more robust way. Before this patch,
we were doing it with a rough regexp based heuristic. Now, we just store
the hashes of the files _after_ QL formatting in the same checked file,
so we can check that and stop generation if a generated file was
modified, or a stub was modified without removing the `// generated`
header.
2022-11-18 16:56:01 +01:00
Geoffrey White
16a84bd94a
Merge branch 'main' into alamofire2
2022-11-18 09:28:46 +00:00
Geoffrey White
2780d9a9a3
Merge branch 'main' into optionals2
2022-11-17 18:16:46 +00:00
Nora Dimitrijević
8b332778e3
Swift: update @security-severity
2022-11-17 18:08:06 +01:00
Mathias Vorreiter Pedersen
2796c46598
Merge pull request #11292 from github/redsun82/swift-remove-ipa-from-dbscheme-cpp
...
Swift: remove synthesized classes from the dbscheme
2022-11-16 16:00:58 +00:00
Paolo Tranquilli
1c69a1f012
Swift: fix typo in docstring
2022-11-16 16:36:48 +01:00
Paolo Tranquilli
27df44f5ad
Swift: replace empty IpaInfo() with a clearer True value
2022-11-16 16:35:17 +01:00
Tom Hvitved
67b6a82cf1
Merge pull request #11198 from hvitved/ssa/expose-phi-reads
...
SSA: Expose phi-read nodes
2022-11-16 15:11:58 +01:00
Geoffrey White
127888f3c1
Merge branch 'main' into alamofire2
2022-11-16 13:32:13 +00:00
Geoffrey White
c8630bbe4f
Merge branch 'main' into optionals2
2022-11-16 13:31:08 +00:00
Tom Hvitved
67e8ec1a5f
Swift: Update expected test output
2022-11-16 13:36:03 +01:00
Anders Schack-Mulligen
94bca4399a
Merge pull request #11183 from aschackmull/dataflow/groupflow
...
Dataflow: Introduce support for src/sink grouping in path results.
2022-11-16 12:59:01 +01:00
Paolo Tranquilli
bafb9ae020
Swift: add upgrade/downgrade scripts
2022-11-16 12:00:26 +01:00
Paolo Tranquilli
a3d33e27e2
Swift: ignore IPA classes in dbscheme
2022-11-16 11:39:10 +01:00
Paolo Tranquilli
88a0c4053b
Swift: move hierarchy IPA logic to schema.py
2022-11-16 11:14:17 +01:00
Nora Dimitrijević
09b669a584
Swift: Add direct call to remote source to a test
...
Strangely, there are two separate paths to each of the JSEvaluateScript
sinks: one passing through the JSString constructor, one omitting this
step.
2022-11-15 21:57:46 +01:00
Nora Dimitrijević
52e5d541ef
Update swift/ql/src/queries/Security/CWE-094/UnsafeJsEval.qhelp
...
Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com >
2022-11-15 21:15:04 +01:00
