Anders Schack-Mulligen
dfa79f6119
Dataflow: Sync.
2022-01-18 10:30:09 +01:00
Anders Schack-Mulligen
46736a137c
Dataflow: Don't include subpaths that can't reach a sink.
2022-01-18 10:30:09 +01:00
Chris Smowton
2c37885f6e
Sync dataflow
2022-01-18 10:30:09 +01:00
Chris Smowton
7c9b44b4cb
Don't include arg -> param edges in PathGraph::edges whose arg is not reachable
...
This avoids lots of missing-node warnings from `codeql bqrs interpret` as it discards the nodes that occur in the `edges` relation but not `nodes`. The problem arises because subpaths introduced two variants of `reach`, one of which is more restrictive than simply `reach(succ) and succ = pred.getASuccessor()`, so it no longer suffices to just check that the successor is reachable.
2022-01-18 10:30:09 +01:00
Owen Mansel-Chan
065043b311
Merge pull request #7588 from owen-mc/add-specific-needs-reference-predicates
...
Dataflow: Add language-specific NeedsReference predicates
2022-01-17 15:51:34 +00:00
Tony Torralba
e967b8a9be
Merge pull request #6576 from atorralba/atorralba/android-cleartext-storage-filesystem
...
Java: Create new query Cleartext storage of sensitive information in Android filesystem
2022-01-17 14:02:38 +01:00
Tony Torralba
227929508f
Merge pull request #6923 from atorralba/atorralba/android-fragment-injection
...
Java: CWE-470 - Queries to detect Fragment Injection in Android applications
2022-01-17 14:02:15 +01:00
Tony Torralba
7beab7cb59
Apply code review suggestions
2022-01-17 12:02:27 +01:00
Tony Torralba
ba3a4fb717
Rename filesystemStore predicate after d9e6e5aa04
2022-01-17 11:13:41 +01:00
Tony Torralba
d9e6e5aa04
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-01-17 11:11:05 +01:00
Tony Torralba
79ddbd6fe4
Fix QLDoc and the qhelp example
2022-01-17 11:11:03 +01:00
Tony Torralba
c1ac09a063
Added query for Cleartext Storage in Android Filesystem
2022-01-17 11:11:00 +01:00
Andrew Eisenberg
fbb5d7196f
Merge branch 'main' into post-release-prep/codeql-cli-2.7.5
2022-01-14 08:23:43 -08:00
Ian Lynagh
22dc24629f
Fix a couple of typos: clases / clasess
2022-01-14 14:28:29 +00:00
luchua-bc
877c52981f
Remove the deprecated library keyword
2022-01-14 12:13:41 +00:00
Tony Torralba
cde7a35c1f
QLDoc
2022-01-14 13:12:30 +01:00
Tony Torralba
6aac848015
Fix imports
2022-01-14 12:43:08 +01:00
Tony Torralba
9f616e7cbe
Refactor to use FlowState
...
Remove the auxiliary DataFlow configuration
2022-01-14 12:24:35 +01:00
Benjamin Muskalla
a4429d01a3
Add tests for writer models
2022-01-14 11:12:35 +01:00
Benjamin Muskalla
37ca6a5e41
Model Appenable and Writer
...
This allows us to track taint carried through all kind of writers.
2022-01-14 11:12:35 +01:00
Tony Torralba
bd4abf4fd0
Additional Notification models
2022-01-14 10:32:38 +01:00
Tony Torralba
a9757fbc83
Setting null Components is not a sanitizer
2022-01-14 10:32:37 +01:00
Tony Torralba
a59a4024a5
Update stubs
2022-01-14 10:32:36 +01:00
Tony Torralba
66794665f3
Remove unneeded implicit read step
2022-01-14 10:32:36 +01:00
Tony Torralba
9c12c5f8b8
Remove duplicated models
2022-01-14 10:32:01 +01:00
Tony Torralba
f963887c58
Change test to avoid collision with SensitiveCommunication.ql
2022-01-14 10:32:01 +01:00
Tony Torralba
48acff9262
Remove unneeded code
2022-01-14 10:32:00 +01:00
Tony Torralba
9e3594fcf1
Added more sinks
2022-01-14 10:32:00 +01:00
Tony Torralba
47c851efaf
Consider more startService methods
2022-01-14 10:31:59 +01:00
Tony Torralba
12059a8a50
Update models to use synthetic fields
2022-01-14 10:31:58 +01:00
Tony Torralba
d49e52fb73
Add support for PendingIntents in Notifications
2022-01-14 10:31:58 +01:00
Tony Torralba
c73e4ebc48
Remove models after rebase
2022-01-14 10:31:58 +01:00
Tony Torralba
7f85dae63b
Add support for implicit field read flows
2022-01-14 10:31:57 +01:00
Tony Torralba
e58a8587db
Add support for Slices
2022-01-14 10:31:56 +01:00
Tony Torralba
d0077b8c12
Added query ImplicitPendingIntents
2022-01-14 10:31:53 +01:00
Anders Schack-Mulligen
0b24af901d
Merge pull request #7349 from aschackmull/dataflow/state
...
Dataflow: Add support for flow state
2022-01-14 09:12:38 +01:00
Andrew Eisenberg
4ffd8c62ac
Merge pull request #7579 from github/aeisenberg/changenote-upgrades-removal
...
Changenotes: Add changenotes for upgrades refactoring
2022-01-13 09:09:06 -08:00
Owen Mansel-Chan
83a25698bb
Allow adding inputs and outputs needing reference
2022-01-13 15:09:17 +00:00
Anders Schack-Mulligen
c44cf29992
Merge pull request #7587 from owen-mc/add-default-taint-sanitizer-guard
...
Dataflow: Add default taint sanitizer guard
2022-01-13 14:44:55 +01:00
Anders Schack-Mulligen
61490e74d8
Merge pull request #7561 from aschackmull/java/misc-perf
...
Java: A few perf fixes for getASupertype*().
2022-01-13 14:43:28 +01:00
Anders Schack-Mulligen
f7cf327e71
Dataflow: Sync
2022-01-13 13:28:43 +01:00
Anders Schack-Mulligen
a34c981209
Dataflow: Address comments.
2022-01-13 13:28:24 +01:00
Anders Schack-Mulligen
69973dadb3
Merge pull request #7548 from zbazztian/spring-taint-summaries
...
Java: Add Spring and Apache Common Langs taint flow steps
2022-01-13 13:00:41 +01:00
Owen Mansel-Chan
7e42ccfbf1
Don't cache defaultTaintSanitizerGuard for java
2022-01-13 11:36:20 +00:00
Sebastian Bauersfeld
a6e4f29560
Java: Use the interface instead of the abstract class
2022-01-13 14:13:36 +07:00
Andrew Eisenberg
e435a3e9c3
Changenotes: Add changenotes for upgrades refactoring
2022-01-12 11:36:31 -08:00
Owen Mansel-Chan
c112980b81
Sync TaintTrackingImpl.qll
...
Done automatically using sync-files.py
2022-01-12 14:44:55 +00:00
Owen Mansel-Chan
9ec3d7787c
Add option for default taint sanitizer guard
...
This allows languages to specify A sanitizer guard in all
global taint flow configurations but not in local taint.
2022-01-12 14:44:55 +00:00
github-actions[bot]
8a2d92badc
Post-release preparation for codeql-cli-2.7.5
2022-01-12 13:28:43 +00:00
Tamás Vajk
9065a7f320
Merge pull request #7573 from tamasvajk/fix/java-field-decl-tostr
...
Java: Fix toString on field declarations with single field
2022-01-12 13:03:16 +01:00
