Simon Friis Vindum
b50834aee8
Rust: Add data flow tests for question mark operator
2024-12-03 16:21:26 +01:00
Paolo Tranquilli
277c9f4087
Rust: add back getAttr to ArrayExpr
2024-12-03 16:12:56 +01:00
Anders Schack-Mulligen
8ea973f838
C++: Update use of deleted api.
2024-12-03 15:20:07 +01:00
Paolo Tranquilli
c113503b41
Rust: fix doc typo
2024-12-03 15:18:17 +01:00
Paolo Tranquilli
353f1cafe6
Rust: distinguish [a, b] from [a; b]
...
This splits the `ArrayExpr` class into `ArrayListExpr` and `ArrayRepeatExpr`.
This uses the `synth.from_class` machinery to integrate seamlessly into the
generated code, by hiding the extracted `ArrayExpr` behind an internal class
and replacing it with a hierarchy of those two classes under a new
`ArrayExpr` class.
2024-12-03 15:09:20 +01:00
Anders Schack-Mulligen
c654a05998
Dataflow: Remove identical-files entries for deleted api.
2024-12-03 14:52:30 +01:00
Anders Schack-Mulligen
371a11e6da
C++: Delete deprecated data flow api.
2024-12-03 14:52:14 +01:00
Anders Schack-Mulligen
0d9e578857
C#: Delete deprecated data flow api.
2024-12-03 14:42:34 +01:00
Anders Schack-Mulligen
fbff4b6e21
Go: Delete deprecated data flow api.
2024-12-03 14:42:14 +01:00
Anders Schack-Mulligen
acc260cc3c
Python: Delete deprecated data flow api.
2024-12-03 14:41:49 +01:00
Anders Schack-Mulligen
20f06abe6f
Ruby: Delete deprecated data flow api.
2024-12-03 14:41:14 +01:00
Anders Schack-Mulligen
f07f2b0f4a
Swift: Delete deprecated data flow api.
2024-12-03 14:40:43 +01:00
Asger F
3f0d0e3a05
JS: Deprecate DataFlow::BarrierGuardNode
2024-12-03 14:30:50 +01:00
Asger F
b3461989b1
JS: Remove use of SanitizerGuardNode in experimental SSRF query
...
Makes a quick effort attempt to restore the original behaviour, though
it is not exactly the same due to lack of recursion.
2024-12-03 14:30:36 +01:00
Asger F
0d79c7141c
JS: Update two more uses of SanitizerGuardNode
2024-12-03 14:30:35 +01:00
Asger F
62c17d3f4e
JS: Update SanitizerGuardNode use in BasicTaintTracking test
2024-12-03 14:30:34 +01:00
Asger F
f620191da4
JS: Deprecate SanitizerGuardNode
2024-12-03 14:30:33 +01:00
Asger F
2ae7386775
JS: Also apply new BarrierGuardLegacy pattern in Xss.qll
2024-12-03 14:30:32 +01:00
Asger F
2ef652da2c
JS: Add more deprecation annotations in tests
2024-12-03 14:30:31 +01:00
Asger F
21494fbdff
JS: Refactor BarrierGuardLegacy pattern to not depend on SanitizerGuardNode
...
Previously our barrier guard classes were direct descendents of SanitizerGuardNode which made it hard to deprecate that class.
Now our barrier guards are not descending from any shared class. Instead they are contributed to SanitizerGuardNode via a private helper class we can remove in the future.
2024-12-03 14:30:29 +01:00
Asger F
a574ff1669
JS: Remove use of MakeLegacyBarrierGuard in experimental SSRF
2024-12-03 14:30:28 +01:00
Asger F
08d25c122d
JS: Deprecate more uses of ConsistencyConfiguration
2024-12-03 14:30:27 +01:00
Asger F
75ab4856b8
Remove unsupported features from PoI
2024-12-03 14:30:25 +01:00
Asger F
e6680dec8f
JS: Avoid use of LabeledSanitizerGuardNode in TaintedObject
...
Drive-by bugfix: Rename sanitizes -> blocksExpr.
This fixes a bug that caused the sanitizer guard not to work in df2.
The test output reflects the fact that the barrier guard works now.
2024-12-03 14:30:24 +01:00
Asger F
0ce1fe767d
JS: Deprecate ConsistencyChecking to avoid deprecation warnings
2024-12-03 14:30:23 +01:00
Asger F
04a3a6707f
JS: Update a reference to AdditionalSanitizerGuardNode
...
Unlike most other references to this class, we're not subclassing it here, we're
just trying to reuse some standard barrier guards but with a different flow state.
2024-12-03 14:30:22 +01:00
Asger F
834d35bc42
JS: Port experimental DecompressionBombs to ConfigSig
2024-12-03 14:30:21 +01:00
Asger F
871bc3b84a
JS: Port experimental CorsPermissiveConfiguration to ConfigSig
...
The tests show a new (source, sink) pair for an already-flagged sink.
Not sure why it was not flagged originally since the data flow path seems valid, given the steps provided by our models.
2024-12-03 14:30:20 +01:00
Asger F
f5a6485ef2
JS: Port experimental decodeJwtWithoutVerificationLocalSource
2024-12-03 14:30:19 +01:00
Asger F
72e522631d
JS: Port experimental jwtDecodeWithoutVerification to ConfigSig
2024-12-03 14:30:18 +01:00
Asger F
7e162f5451
JS: Port experimental EnvValueInjection to ConfigSig
2024-12-03 14:30:17 +01:00
Asger F
4f839070a0
JS: Port experimental EnvValueAndKeyInjection to ConfigSig
2024-12-03 14:30:16 +01:00
Asger F
8887ca1722
JS: Port an experimental CodeInjection variant to ConfigSig
2024-12-03 14:30:15 +01:00
Asger F
1832e93766
JS: Port FormParsers test to ConfigSig
2024-12-03 14:30:14 +01:00
Asger F
4d7401a074
JS: Deprecate tests for deprecated APIs
...
Mainly adds 'deprecated' in front of a bunch of tests for deprecated APIs.
2024-12-03 14:30:12 +01:00
Asger F
3548544970
JS: Avoid some uses of deprecated guard classes in tests
2024-12-03 14:30:11 +01:00
Asger F
a568d8c086
JS: Port threat-model test to ConfigSig
2024-12-03 14:30:10 +01:00
Asger F
f758b67d30
JS: Openly recommend SummarizedCallable
2024-12-03 14:30:09 +01:00
Asger F
249104b8ae
JS: Update comments referring to old Configuration style
...
Also avoid the term "analysis-specific" because it's not a term we use anywhere else.
2024-12-03 14:30:08 +01:00
Asger F
13ee597848
JS: Add some proper documentation to SummarizedCallable
2024-12-03 14:30:07 +01:00
Asger F
988fa9c0ef
JS: Deprecate AdditionalSanitizerGuardNode
...
We're deprecating the class through an alias, but it is still the base class for a non-deprecated class, for backwards compatibility. For this reason we're also deprecating all of its member predicates so we can remove those in the future.
2024-12-03 14:30:06 +01:00
Asger F
0b1e859e70
JS: Remove uses of AdditionalSanitizerGuardNode
2024-12-03 14:30:05 +01:00
Asger F
c2abb0fbd0
JS: Remove reference to AdditionalSanitizerGuard from CachedStages
2024-12-03 14:30:04 +01:00
Asger F
82682d9a62
JS: Remove a non-deprecated reference to SanitizerGuardNode
2024-12-03 14:30:03 +01:00
Asger F
bc7753de29
JS: Remove non-deprecated reference to AdditionalBarrierGuardNode
2024-12-03 14:30:02 +01:00
Asger F
0cd2e3f9eb
JS: Deprecate old data flow library, except some guard-related nodes
2024-12-03 14:30:01 +01:00
Asger F
071189a9e9
Merge pull request #18175 from asgerf/jss/documentation
...
JS: Update data flow documentation and tutorials for JavaScript
2024-12-03 14:23:29 +01:00
Simon Friis Vindum
cac4514eae
Rust: Add basic data flow through arrays
2024-12-03 14:15:54 +01:00
Simon Friis Vindum
3346b64e96
Rust: Add variables and data flow array tests
2024-12-03 14:14:41 +01:00
Anders Schack-Mulligen
2c0baff76a
Java: Delete deprecated data flow api.
2024-12-03 14:13:03 +01:00
