Asger Feldthaus
2907d53e17
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
2022-02-21 08:21:52 +01:00
Asger Feldthaus
c189df2341
Revert "JS: Add support for " of " syntax to help during transition"
...
This reverts commit 9bf522b3048c3b11f7e6d734ed797a613614a095.
2022-02-21 08:21:51 +01:00
Asger Feldthaus
753c557dbe
Java: use AccessPathSyntax.qll to parse input/output summary specs
2022-02-21 08:16:54 +01:00
Asger Feldthaus
53935db6c6
JS: Add support for " of " syntax to help during transition
2022-02-21 08:16:54 +01:00
Asger Feldthaus
30254686d8
JS: Move ".."-parsing trick into AccessPathSyntax.qll
2022-02-21 08:16:54 +01:00
Asger Feldthaus
7c2cff3227
JS: Factor out AccessPathSyntax.qll
2022-02-21 08:16:54 +01:00
Asger Feldthaus
e2cbf47b16
JS: Fix accidental recursion
2022-02-21 08:16:53 +01:00
Asger Feldthaus
260638c68b
JS: Add ClientSideRequestForgery and split request-forgery results between the two
2022-02-16 13:35:01 +01:00
Esben Sparre Andreasen
816d79692b
ignore deliberately hardcoded password strings
2022-02-16 09:47:01 +01:00
Arthur Baars
ebb87c4b36
Merge pull request #7975 from github/post-release-prep/codeql-cli-2.8.1
...
Post-release preparation for codeql-cli-2.8.1
2022-02-15 20:17:35 +01:00
CodeQL CI
8f8621f82c
Merge pull request #8022 from asgerf/js/url-parse-qs
...
Approved by esbena
2022-02-15 09:34:21 +01:00
Asger Feldthaus
8b55a24e7c
JS: Add url-parse.qs as an alias for the querystringify library
2022-02-14 15:29:50 +01:00
Chuan-kai Lin
9b4dbb9dd8
Merge pull request #7895 from github/cklin/upgrades-initial-dbscheme
...
Upgrade scripts testing: set initial dbschemes
2022-02-11 11:06:12 -08:00
Erik Krogh Kristensen
a1c5724be7
fix most ql-for-ql warnings in JS
2022-02-11 17:57:37 +01:00
github-actions[bot]
21bf29353f
Post-release preparation for codeql-cli-2.8.1
2022-02-11 11:07:31 +00:00
Taus
327e0dad72
Merge pull request #7674 from erik-krogh/dbTypeInNonLib
...
QL: Use of db-type outside language core.
2022-02-11 12:00:14 +01:00
Erik Krogh Kristensen
36e02ae9ac
Merge pull request #7912 from erik-krogh/moarApi
...
JS: convert more type-trackers to API-graphs
2022-02-11 10:32:45 +01:00
Erik Krogh Kristensen
3791b159fb
Merge pull request #7892 from erik-krogh/nanSan
...
JS: Add a `isNaN` sanitizer, and use it in queries that already had a typeof check
2022-02-11 10:13:06 +01:00
Erik Krogh Kristensen
2ffd79d451
Merge pull request #7921 from erik-krogh/snapdragon
...
JS: add model for the snapdragon library
2022-02-11 10:10:55 +01:00
Esben Sparre Andreasen
a4447ce372
Update javascript/ql/lib/semmle/javascript/frameworks/Snapdragon.qll
2022-02-11 08:20:02 +01:00
github-actions[bot]
f25fc70b7c
Release preparation for version 2.8.1
2022-02-10 22:08:24 +00:00
Arthur Baars
61ba896343
Javascript: move change note
2022-02-10 20:58:49 +01:00
Erik Krogh Kristensen
eb56a5aef3
support more patterns that recognize valid numbers
2022-02-10 19:50:35 +01:00
CodeQL CI
9ebbd9efa1
Merge pull request #7591 from asgerf/js/mysql-sinks
...
Approved by esbena
2022-02-10 12:50:36 +00:00
CodeQL CI
1a91a79b5b
Merge pull request #5841 from erik-krogh/libCode
...
Approved by esbena, ethanpalm
2022-02-10 11:36:45 +00:00
Erik Krogh Kristensen
d55920ad27
add model for the snapdragon library
2022-02-10 11:32:59 +01:00
Erik Krogh Kristensen
12d31d750a
convert more type-trackers to API-graphs
2022-02-10 09:54:52 +01:00
Stephan Brandauer
a73cdf3527
Merge pull request #7911 from kaeluka/javascript/add-getFlowLabel-to-PathNode
...
JS: add a getFlowLabel method to the PathNode class
2022-02-10 09:10:08 +01:00
Stephan Brandauer
3e88d46e0f
add a getFlowLabel method to the PathNode class
2022-02-09 17:28:25 +01:00
Erik Krogh Kristensen
5340530cb7
use the number guard in existing queries that contained typeof checks
2022-02-09 09:51:57 +01:00
Erik Krogh Kristensen
d6721ec574
implement a isNaN guard for unsafe-shell-command-construction
2022-02-09 09:51:57 +01:00
Tom Hvitved
9440a45015
Merge branch 'main' into post-release-prep/codeql-cli-2.8.0
2022-02-09 09:40:33 +01:00
Chuan-kai Lin
a7f1ee574c
Upgrade scripts testing: set initial dbschemes
...
This commit sets initial dbschemes for cpp, csharp, java, javascript, and
python so that automated testing for upgrade scripts would also cover legacy
upgrades.
2022-02-08 11:11:41 -08:00
Erik Krogh Kristensen
4bbb7ad320
Merge pull request #7876 from erik-krogh/zipRelative
...
JS: recognize more startswith sanitizers for path-injection queries
2022-02-08 15:22:39 +01:00
Erik Krogh Kristensen
28ba78cb76
add explicit this
2022-02-08 12:20:21 +01:00
Erik Krogh Kristensen
d73b2effa0
rename maybeGetJoinArg maybeGetPathSuffix
2022-02-08 10:42:06 +01:00
Erik Krogh Kristensen
cc3f9bf2a8
fix performance issue by inlining a simpler version of getASourceProp
2022-02-08 00:22:01 +01:00
Erik Krogh Kristensen
ca5f91e587
recognize more startswith sanitizers for path-injection queries
2022-02-07 14:19:13 +01:00
Erik Krogh Kristensen
d1d4ebb3b5
add values written to the global scope as exports
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
91b03f56ad
move .qll files from src to lib
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
955ad8c458
add JSON.stringify as a code-injection sanitizer
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
68a5c1f5b5
add code-injection sink for calls to node
2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen
0584a6acaf
recognize a nodejs re-exports in a loop
2022-02-07 10:12:38 +01:00
github-actions[bot]
b4ab86c020
Post-release preparation for codeql-cli-2.8.0
2022-02-06 23:34:07 +00:00
Erik Krogh Kristensen
ab2d3a7ca0
Merge pull request #7828 from Naman-ntc/main
...
JS: Adding model for `.get` function of `Map` in Unvalidated Dynamic Method Call
2022-02-04 20:19:02 +01:00
Erik Krogh Kristensen
edcb3ba902
add file sources from jszip to js/zip-slip
2022-02-04 14:39:49 +01:00
Erik Krogh Kristensen
35999a7f8f
add support for fs-extra methods in insecure-temporary-file
2022-02-02 15:14:43 +01:00
Naman Jain
aea7054938
modified query and added tests
2022-02-02 19:39:08 +05:30
Erik Krogh Kristensen
573f17dc63
fix typos in documentation
...
Co-authored-by: Stephan Brandauer <kaeluka@github.com >
2022-02-02 15:00:38 +01:00
Arthur Baars
33b97f3e0c
Update synchronized files
2022-02-02 13:30:45 +01:00
