Commit Graph

3121 Commits

Author SHA1 Message Date
Owen Mansel-Chan
00ea023fdb Make ConditionalBypass use new API 2023-08-10 15:49:37 +01:00
Owen Mansel-Chan
1b4fef9c21 Make HTMLTemplateEscapingPassthrough use new API
Removed edges and nodes are mostly duplicates. They were only there
originally due to multiple configurations being in scope.
`DataFlow::PathNode` has union semantics for configurations. Nodes are
only generated if they are reachable from a source, but this includes
sources from other configurations.

No alerts are lost.
2023-08-10 15:49:36 +01:00
Owen Mansel-Chan
ea1f39683d Make DivideByZero use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:35 +01:00
Owen Mansel-Chan
045936b1fd Make PamAuthBypass use new API 2023-08-10 15:49:33 +01:00
Owen Mansel-Chan
cfc4a6a6b7 Make Timing use new API 2023-08-10 15:49:32 +01:00
Owen Mansel-Chan
39762da5e0 Make DsnInjection use new API 2023-08-10 15:49:31 +01:00
Owen Mansel-Chan
a53da376d1 Make LDAPInjection use new API 2023-08-10 15:49:29 +01:00
Owen Mansel-Chan
f60ca76eb2 Make EmailInjection use new API 2023-08-10 15:49:28 +01:00
Owen Mansel-Chan
1962aa3de4 Make SSRF use new API 2023-08-10 15:49:27 +01:00
Owen Mansel-Chan
71735c86c2 Make WeakCryptoAlgorithm use new API 2023-08-10 15:49:25 +01:00
Owen Mansel-Chan
46185e3a02 Make HardcodedKeys use new API 2023-08-10 15:49:24 +01:00
Owen Mansel-Chan
b5ac0c94c6 Make ZipSlip use new API 2023-08-10 15:49:23 +01:00
Owen Mansel-Chan
7341b6156d Make XPathInjection use new API 2023-08-10 15:49:21 +01:00
Owen Mansel-Chan
a6177b3c92 Make UnsafeUnzipSymlink use new API 2023-08-10 15:49:20 +01:00
Owen Mansel-Chan
7db1daba6e Make TaintedPath use new API 2023-08-10 15:49:19 +01:00
Owen Mansel-Chan
6c91f77776 Make StringBreak use new API 2023-08-10 15:49:17 +01:00
Owen Mansel-Chan
30ae34352b Make StoredXss use new API 2023-08-10 15:49:16 +01:00
Owen Mansel-Chan
4334a51cf3 Make StoredCommand use new API 2023-08-10 15:49:15 +01:00
Owen Mansel-Chan
ac1670c0af Make SqlInjection use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:13 +01:00
Owen Mansel-Chan
646e158813 Make tests use config from InlineFlowTest
For InterProceduralDataFlow, it's hard to get it to use InlineFlowTest
because you need to show both the source and the sink, and there are
problems with quoting when the source is already surrounded by quotes.
2023-08-10 15:49:12 +01:00
Owen Mansel-Chan
81854279bd Make tests use InlineFlowTest 2023-08-10 15:49:11 +01:00
Owen Mansel-Chan
d385113e11 Make InsufficientKeySize use new API 2023-08-10 15:49:09 +01:00
Owen Mansel-Chan
16ef11a3c3 Make ConstantOauth2State use new API
Removed edges were only there originally due to multiple configurations
being in scope. `DataFlow::PathNode` has union semantics for
configurations. Nodes are only generated if they are reachable from a
source, but this includes sources from other configurations.

No alerts are lost.
2023-08-10 15:49:08 +01:00
Owen Mansel-Chan
fbd0c4edd0 Make HostKeyCallbackAssignment use new API 2023-08-10 15:49:07 +01:00
Owen Mansel-Chan
a1a31bfd62 Make SuspiciousCharacterInRegexp use new API 2023-08-10 15:49:05 +01:00
Owen Mansel-Chan
8f644af769 Make MissingRegexpAnchor use new API 2023-08-10 15:49:04 +01:00
Owen Mansel-Chan
442f6875f5 Make IncompleteHostNameRegexp use new API 2023-08-10 15:49:03 +01:00
Owen Mansel-Chan
0e1383ddd7 Make UnhandledFileCloseWritableHandle use new API 2023-08-10 15:49:01 +01:00
Owen Mansel-Chan
00cc78dfe6 Make CookieWithoutHttpOnly use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:00 +01:00
Owen Mansel-Chan
a7382e06c2 Make ClearTextLogging use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:48:59 +01:00
Owen Mansel-Chan
653563fcbc Make StringsNewReplacer use new API
We don't have to keep a deprecated copy as this is private. This allows
us to delete a copy of the DataFlow library!
2023-08-10 15:48:57 +01:00
Owen Mansel-Chan
1f6cdc7eda Make OpenURLRedirect use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.

Removed nodes and edges were only there originally due to multiple
configurations being in scope. `DataFlow::PathNode` has union semantics
for configurations. Nodes are only generated if they are reachable from
a source, but this includes sources from other configurations.
2023-08-10 15:48:55 +01:00
Owen Mansel-Chan
d2a5d19439 Make SafeUrlFlow use new API 2023-08-10 15:48:54 +01:00
Owen Mansel-Chan
97c32970a0 Make RequestForgery use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:48:53 +01:00
Owen Mansel-Chan
1c2536321c Make ReflectedXss use new API 2023-08-10 15:48:51 +01:00
Owen Mansel-Chan
3d9f8d50bc Make InsecureRandomness use new API 2023-08-10 15:48:50 +01:00
Michael B. Gale
87c089e0a8 Make CommandInjection.qll use new API
The new `edges` and `nodes` sections in the .expected files are because
the PathGraph module was not imported in the tests before, and thus
these query predicates were not in scope.
2023-08-10 15:48:48 +01:00
Michael B. Gale
957757c271 Make UntrustedDataToUnknownExternalAPI use new API 2023-08-10 15:48:47 +01:00
Michael B. Gale
d6919dd57b Make UntrustedDataToExternalAPI use new API 2023-08-10 15:48:46 +01:00
Michael B. Gale
82a1b15d11 Make AllocationSizeOverflow use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:48:44 +01:00
github-actions[bot]
432c21d4fb Post-release preparation for codeql-cli-2.14.2 2023-08-09 18:45:18 +00:00
Michael B. Gale
9da749ad77 Bump Go extractor dependencies 2023-08-08 22:23:47 +01:00
github-actions[bot]
79c90fa36a Release preparation for version 2.14.2 2023-08-07 18:08:52 +00:00
Jeroen Ketema
8b6a7985db Refactor the traint-tracking library to follow the dataflow library refactoring 2023-08-07 15:23:15 +02:00
Jeroen Ketema
5d2984b7a5 Merge branch 'main' into shared-taint-tracking 2023-08-07 15:22:29 +02:00
Tom Hvitved
56e19411d0 Go: Adjust to data flow refactor 2023-08-07 11:35:22 +02:00
amammad
f79bd2a071 added remote flow sources related to multipart upload, added flag package command line source 2023-08-06 06:49:35 +10:00
Jeroen Ketema
747cd1745a Update all languages to use the shared taint-tracking library 2023-08-04 22:53:25 +02:00
Mathias Vorreiter Pedersen
abe3a816ce Merge pull request #13851 from MathiasVP/sink-without-states
DataFlow: Support stateless `isSink` in `StateConfigSig`s
2023-08-04 18:01:42 +02:00
Chris Smowton
8702efda1e Merge pull request #13835 from github/smowton/fix/logrus-with-context
Don't treat logrus' WithContext method as a logging function
2023-08-03 09:57:30 +01:00