Matt Rothenberg
95f994a82b
Update RequestForgeryBad.js
2022-12-02 14:17:37 +01:00
Matt Rothenberg
7d674e7cdc
set base URL
2022-12-02 14:17:17 +01:00
Matt Rothenberg
c49e9e8503
fix: use let for subdomain assignment
2022-12-02 14:07:39 +01:00
Matt Rothenberg
a453405365
Update RequestForgeryBad.js
2022-12-02 14:03:37 +01:00
Matt Rothenberg
2ae0c7e115
Update RequestForgeryGood.js
2022-12-02 14:02:54 +01:00
github-actions[bot]
5e35785fd0
Post-release preparation for codeql-cli-2.11.5
2022-12-02 11:37:44 +00:00
Asger F
ef72e222b0
Merge pull request #11513 from asgerf/js/api-graph-async-result-node
...
JS: Remove MkAsyncFunctionResult
2022-12-02 11:29:03 +01:00
Asger F
2d578c1a73
Merge branch 'main' into merge-package-type-columns
2022-12-02 10:00:44 +01:00
github-actions[bot]
31ab22e3a0
Release preparation for version 2.11.5
2022-12-01 20:05:14 +00:00
Jean Helie
352d1a7e8c
ATM: update tests
2022-12-01 19:01:30 +01:00
Jean Helie
98923cee94
ATM: update missing .qll
2022-12-01 18:47:36 +01:00
Jean Helie
ae0d82efd8
ATM: update predicate name
2022-12-01 18:22:33 +01:00
Jean Helie
880548bafc
Merge branch 'main' into tiferet/boost-xss-through-dom
2022-12-01 18:13:27 +01:00
Jean Helie
50a3c0d725
ATM: update expected ML test values
2022-12-01 17:53:09 +01:00
Jean Helie
f388703a3d
ATM: update further files following the addition of XssThroughDom query
2022-12-01 17:45:07 +01:00
erik-krogh
6289ae329b
fix a race-condition
2022-12-01 15:27:41 +01:00
Asger F
eb9bee23a0
JS: Remove MkAsyncFunctionResult
2022-12-01 15:15:27 +01:00
tiferet
4a6de3e444
Apply suggestion from code review
2022-11-30 17:25:19 -08:00
tiferet
a0a742eb82
Rename predicates to fit style guide:
...
- `getEndpoints` → `appliesToEndpoint`
- `getImplications` → `hasImplications`
- `getAlerts` → `hasAlert`
2022-11-30 17:01:56 -08:00
erik-krogh
cddc9db690
change back to the old order of extracting externs before Xml
2022-11-30 15:46:46 +01:00
erik-krogh
6620ba8cc8
Merge branch 'main' into exit-code
2022-11-30 15:26:31 +01:00
tiferet
b885249d9d
Add a boosted version of XssThroughDOM
2022-11-29 17:40:20 -08:00
tiferet
c5184d37e7
Suggestion from code review:
...
Name the query configuration e.g. `NosqlInjectionATMConfig` rather than `Configuration`.
2022-11-29 15:46:05 -08:00
tiferet
6f807e9d43
Doc suggestion from code review
2022-11-29 13:20:47 -08:00
tiferet
75cd7a9ebc
Remove code duplication in query .ql files:
...
Define the query for finding ATM alerts in the base class `AtmConfig`, and call it from each query's .ql file.
2022-11-29 13:20:47 -08:00
tiferet
a710b723d1
Move the definition of isSink to the base class:
...
Holds if `sink` is a known taint sink or an "effective" sink.
2022-11-29 13:20:47 -08:00
tiferet
cd24ec88d6
Move the definition of isSource to the base class:
...
A long as we're not boosting sources, `isSource` is identical to `isKnownSource`.
2022-11-29 13:20:47 -08:00
tiferet
50291c7b7c
AtmConfig inherits from TaintTracking::Configuration.
...
That way the specific configs which inherit from `AtmConfig` also inherit from `TaintTracking::Configuration`.
This removes the need for two separate config classes for each query.
2022-11-29 13:20:47 -08:00
tiferet
05a943c9b5
Delete StandardEndpointFilters.
...
All remaining functionality in `StandardEndpointFilters` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-29 13:20:47 -08:00
tiferet
5402f047bf
Delete CoreKnowledge.
...
All remaining functionality in `CoreKnowledge` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-29 13:20:47 -08:00
tiferet
1d4b2ccab4
Merge branch 'main' into tiferet/complexity-reduction
2022-11-29 12:47:18 -08:00
Tiferet Gazit
f375b0cc1b
Merge pull request #11281 from github/tiferet/endpoint-filters
...
ATM: Implement the current endpoint filters as EndpointCharacteristics
2022-11-29 12:38:12 -08:00
erik-krogh
de5ffd5cfa
bump extractor version
2022-11-29 21:32:43 +01:00
Erik Krogh Kristensen
d0cf709d2e
use proper path construction
...
Co-authored-by: Asger F <asgerf@github.com >
2022-11-29 21:30:50 +01:00
erik-krogh
63a5f8965e
fix tests
2022-11-29 14:08:21 +01:00
erik-krogh
136b6db2ad
only delete the src/ folder if it was empty
2022-11-29 13:42:27 +01:00
erik-krogh
f3f7a89ef8
make the JS autobuilder consistent with Ruby when no JS code was detected
2022-11-29 13:42:27 +01:00
tiferet
4580b55673
Oops -- forgot to stage one file in the previous commit :)
2022-11-28 11:34:34 -08:00
tiferet
210644e87d
Delete StandardEndpointFilters.
...
All remaining functionality in `StandardEndpointFilters` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-28 11:34:34 -08:00
tiferet
15121931b4
Delete CoreKnowledge.
...
All remaining functionality in `CoreKnowledge` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-28 11:34:34 -08:00
tiferet
1c679378e7
FilteringReason is no longer being used and can be deleted
2022-11-28 11:34:33 -08:00
tiferet
99de397a5f
Remove redundant code
...
`isOtherModeledArgument` and `isArgumentToBuiltinFunction` contained the old logic for selecting negative endpoints for training.
These can now be deleted, and replaced by a single base class that collects all EndpointCharacteristics that are currently used to indicate negative training samples: `OtherModeledArgumentCharacteristic`.
This in turn lets us delete code from `StandardEndpointFilters` that effectively said that endpoints that are high-confidence non-sinks shouldn't be scored at inference time, either.
2022-11-28 11:34:33 -08:00
tiferet
7b0269c999
Fix British spelling that code scanning didn't like.
...
I've been working with Brits for too long :)
2022-11-28 11:28:08 -08:00
tiferet
963407de4c
Update the documentation
2022-11-28 11:16:06 -08:00
Asger F
76afc2dcc3
JS: Fix formatting and rephrase comment
2022-11-28 14:00:43 +01:00
Erik Krogh Kristensen
7a3898168f
Update README.md
2022-11-28 12:12:36 +01:00
Asger F
e99571baae
Update javascript/ql/lib/semmle/javascript/frameworks/data/internal/ApiGraphModelsSpecific.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2022-11-28 11:45:08 +01:00
Henry Mercer
56e5f01ce0
Merge branch 'main' into codeql-ci/atm/release-0.4.2
2022-11-24 14:41:49 +00:00
github-actions[bot]
78d49e44b1
JS: Bump version of ML-powered library and query packs to 0.4.3
2022-11-24 14:22:14 +00:00
github-actions[bot]
8d96bfe973
JS: Bump patch version of ML-powered library and query packs
2022-11-24 14:18:13 +00:00
