Owen Mansel-Chan
3ff6d033d3
Rename to neverSkipInPathGraph
2023-06-14 15:29:54 +01:00
Owen Mansel-Chan
5f72ce0935
Add stub implementations of flowCheckNodeSpecific
2023-06-14 14:46:35 +01:00
Owen Mansel-Chan
e0f7437d40
Sync dataflow library
2023-06-14 14:29:56 +01:00
Jami
35591113c2
Merge branch 'main' into jcogs33/shared-sink-kind-validation
2023-06-14 08:06:34 -04:00
Michael Nebel
afec9b05e9
Merge pull request #13147 from michaelnebel/csharp/entityframeworkrefactor
...
C#: Use synthetic global in the EntityFramework code instead of jump steps.
2023-06-14 13:47:56 +02:00
Tony Torralba
5e3d9d8136
Java: Model the Stapler framework
2023-06-14 12:34:52 +02:00
Tony Torralba
182513a981
Merge pull request #13235 from atorralba/atorralba/java/hudson-models
...
Java: Add Hudson models
2023-06-14 12:33:18 +02:00
Anders Schack-Mulligen
2d616d494e
C#/Ruby: Add fields as per review comments.
2023-06-13 11:26:30 +02:00
Tony Torralba
ffe67689ec
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-13 09:27:33 +02:00
Tony Torralba
29d4b6fadc
Re-add public classes that shouldn't be removed yet
2023-06-13 09:24:27 +02:00
Jami Cogswell
9abe3e3da4
Shared: use a module as input to 'KindValidation'
2023-06-09 14:35:37 -04:00
Anders Schack-Mulligen
97b2bdaa9f
Java: Fix types of summary parameter nodes.
2023-06-09 15:39:28 +02:00
Anders Schack-Mulligen
254d60c826
Dataflow: Refactor FlowSummaryImpl to synthesize nodes independently from DataFlow::Node.
2023-06-09 15:27:17 +02:00
Anders Schack-Mulligen
59636c43ca
Dataflow: Rename two private predicates.
2023-06-09 15:27:17 +02:00
Anders Schack-Mulligen
1b7bbf6320
Merge pull request #13083 from aschackmull/dataflow/typestrengthen
...
Dataflow: Strengthen tracked types.
2023-06-09 13:23:30 +02:00
Anders Schack-Mulligen
44b09507ab
Merge pull request #13408 from aschackmull/java/loginjection-perf
...
Java: Add more negation context to reduce string ops and improve perf.
2023-06-09 08:44:27 +02:00
Anders Schack-Mulligen
d230509905
Dataflow: Address review comments.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
4399138c82
Dataflow: Fix QL4QL alert.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
8a584b78ac
Dataflow: Enable type strengthening in partial flow.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
441ccef6c4
Dataflow: Bugfix, use arg type rather than strengthened param type.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
4633abe19e
Java: Autoformat
2023-06-09 08:37:35 +02:00
Anders Schack-Mulligen
ad461a87b4
Dataflow: Strengthen tracked types.
2023-06-09 08:37:35 +02:00
Anders Schack-Mulligen
1d87f0793b
Dataflow: Minor refactor.
2023-06-09 08:37:35 +02:00
Jami Cogswell
da58b2afc8
Shared: move shared file to 'shared' folder and add parameterized module for 'getInvalidModelKind'
2023-06-08 20:05:27 -04:00
Anders Schack-Mulligen
5a2ac1b5ca
Java: Add more negation context to reduce string ops and improve perf.
2023-06-08 14:04:57 +02:00
Anders Schack-Mulligen
dabb4dd643
Java: Improve join-order for FunctionalInterface.
2023-06-08 13:02:54 +02:00
Tony Torralba
6d7234f8ed
Merge pull request #13225 from atorralba/atorralba/java/path-injection-mad-sinks-2
...
Java: Migrate path injection sinks to models-as-data (simplified)
2023-06-07 14:27:36 +02:00
Erik Krogh Kristensen
6ba7f9a238
Merge pull request #13352 from erik-krogh/once-again-deps-not-py-cpp
...
delete old deprecations
2023-06-07 13:00:57 +02:00
Tony Torralba
27763d6bbe
Improve ZipSlip exclusion to take varargs into account
2023-06-07 09:25:56 +02:00
Tony Torralba
8001ae9669
Update java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll
...
Co-authored-by: Jami <57204504+jcogs33@users.noreply.github.com >
2023-06-07 09:08:24 +02:00
Tony Torralba
1601846478
Add exclusion to the ZipSlip query to avoid FPs
2023-06-06 10:28:49 +02:00
Jami Cogswell
5a23421d9a
Shared: minor updates to comments
2023-06-05 13:46:56 -04:00
Jami Cogswell
6c46cd9c21
Java/C#/Go/Swift: move 'SharedModelValidation.qll' to internal folder
2023-06-05 13:11:08 -04:00
Jami Cogswell
9d5972acc2
Shared: update qldocs
2023-06-05 12:18:34 -04:00
Jami Cogswell
3f1dc8e5c7
Shared: add outdated Swift sink kinds
2023-06-05 12:18:34 -04:00
Jami Cogswell
76f5dca861
Shared: move 'OutdatedSinkKind' to shared file and add outdated JS and C# sink kinds
2023-06-05 12:18:33 -04:00
Jami Cogswell
7b629f5d63
Shared: include 'qltest%' and 'test-%'
2023-06-05 12:18:33 -04:00
Jami Cogswell
615f2a573b
Java/C#/Go/Swift: remove commented-out code
2023-06-05 12:18:33 -04:00
Jami Cogswell
7317c29eea
Shared: update kind information
2023-06-05 12:18:33 -04:00
Jami Cogswell
79f61cc645
Java/C#/Go/Swift: use 'SharedModelValidation' file
2023-06-05 12:18:33 -04:00
Jami Cogswell
ddb5d92ef8
Shared: add source, summary, and neutral shared valid kinds
2023-06-05 12:18:33 -04:00
Jami Cogswell
869f820fcf
Shared: add 'SharedModelValidation' file as experiment
2023-06-05 12:18:33 -04:00
Jami
64830809a6
Merge pull request #13228 from jcogs33/jcogs33/deprecated-sink-error-message
...
Java: add error message for outdated sink kinds in `getInvalidModelKind`
2023-06-02 13:44:18 -04:00
erik-krogh
44b6366586
delete old deprecations
2023-06-02 11:58:08 +02:00
Tony Torralba
ad2f558002
Add Hudson models
...
Includes models-as-data rows, flow sources, and XSS sanitizers.
Tests for models-as-data rows not included.
2023-06-02 11:06:24 +02:00
Tony Torralba
527fe523a8
Add PathCreation.qll sinks to models-as-data
...
The old PathCreation sinks can't be removed because doing so would cause alert wobble in the path injection queries. See their getReportingNode predicates.
2023-06-02 09:14:35 +02:00
Tony Torralba
c3b1ef2cdf
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-02 08:57:24 +02:00
Jami
1a82e21fdb
Merge pull request #13136 from jcogs33/jcogs33/revamp-java-source-kinds
...
Java: change `android-widget` MaD source kind to `remote`
2023-06-01 14:18:02 -04:00
Jami Cogswell
b8cedfa817
Java: switch 'deprecated' to 'outdated'
2023-06-01 13:30:27 -04:00
Jami Cogswell
d10857fbdb
Java: fix typo blank qldoc
2023-06-01 12:57:06 -04:00
