jorgectf
ed198709b4
Refactor MyBatisAbstractSQLMethodsStep
...
Set output to `Argument[-1]` instead of `ReturnValue` to be able to get rid of `MyBatisAbstractSQLAnonymousClassStep`.
Thanks @pwntester!
2022-03-15 13:46:06 +01:00
jorgectf
9aa440e5b6
Refactor MyBatisAbstractSQLMethodsStep and MyBatisAbstractSQLMethod
...
See https://github.com/github/codeql/pull/8345\#discussion_r826734537
2022-03-15 13:23:23 +01:00
Chris Smowton
451661dd20
Improve guard class names
2022-03-15 11:46:54 +00:00
Jeroen Ketema
157a36bc4f
Use node variable in all disjuncts
2022-03-15 11:55:35 +01:00
Jeroen Ketema
9a0e94f389
Add flow state versions of isBarrierIn, isBarrierOut, and isBarrierGuard
2022-03-15 11:55:34 +01:00
Erik Krogh Kristensen
c7509c4dd3
Merge branch 'main' into deadCode
2022-03-15 09:19:14 +01:00
jorgectf
b62b8c8d28
Use SummaryModelCsv for the toString taint step
2022-03-14 21:47:06 +01:00
jorgectf
c683b48af7
Add MyBatisInjectionSink's QLDoc
2022-03-14 21:41:36 +01:00
jorgectf
8482c01959
Make MyBatisProviderStep an AdditionalValueStep
2022-03-14 21:35:26 +01:00
jorgectf
32f494eba1
Use SummaryModelCsv in MyBatisAbstractSQLMethodsStep
2022-03-14 21:32:55 +01:00
Jorge
158366ab46
Apply suggestions from code review
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-03-14 21:27:37 +01:00
Arthur Baars
6a74e761c8
Merge pull request #8398 from github/post-release-prep/codeql-cli-2.8.3
...
Post-release preparation for codeql-cli-2.8.3
2022-03-14 21:05:09 +01:00
Michael Nebel
bcdbfefb2b
Merge pull request #8329 from michaelnebel/csharp/model-generator
...
C#: Capture Summary models.
2022-03-14 16:10:05 +01:00
Joe Farebrother
d4b5eed3e4
Merge pull request #8410 from joefarebrother/sensitive-logging
...
Java: Promote Sensitive Logging query
2022-03-14 14:50:26 +00:00
Chris Smowton
9f02ca0db2
Merge pull request #8357 from p0wn4j/jdbc-url-ssrf-sink
...
Java: Add JDBC connection SSRF sinks
2022-03-14 13:27:34 +00:00
Chris Smowton
ca8237b9de
Make comment into qldoc
2022-03-14 13:14:31 +00:00
Joe Farebrother
e4b762b5c5
Improve qldoc; make taint tracking
2022-03-14 13:10:34 +00:00
Michael Nebel
48dc9d7057
C#/Java: Move containerContent to DataFlowPrivate.
2022-03-14 13:50:55 +01:00
Michael Nebel
665e3c9326
C#: Re-factor containerContent into standalone predicate in DataFlow library.
2022-03-14 13:49:51 +01:00
Chris Smowton
b351d5bc2f
Autoformat
2022-03-14 12:44:40 +00:00
jorgectf
a0bf68f7cd
Generally extend TaintTracking::AdditionalTaintStep
2022-03-14 13:39:20 +01:00
Chris Smowton
f83ea25ead
Add change note
2022-03-14 12:14:37 +00:00
Erik Krogh Kristensen
3bf5e06d53
delete all dead code
2022-03-14 13:03:31 +01:00
Chris Smowton
aada8d3af9
Merge pull request #8405 from smowton/smowton/fix/range-analysis-use-ranked-phi-nodes
...
C#/Java: Range analysis: use ranked phi nodes
2022-03-14 11:55:55 +00:00
Jeroen Ketema
4c2081b7fc
Merge pull request #8401 from jketema/taint-flow
...
Extend taint tracking interface with flow states
2022-03-14 12:06:10 +01:00
Erik Krogh Kristensen
bbb2847ec1
Merge pull request #8323 from erik-krogh/acronyms
...
Enforcing consistent casing of acronyms
2022-03-14 11:38:25 +01:00
Jeroen Ketema
c832b21fbe
Add change notes for changes to the taint tracking library
2022-03-14 10:38:48 +01:00
jorgectf
ded9663f2b
Finish taint steps
2022-03-13 13:59:03 +01:00
p0wn4j
ee67d27b56
Java: Add JDBC connection SSRF sinks
2022-03-12 16:35:32 +04:00
Joe Farebrother
594d51e84d
Exclude constants
2022-03-11 17:45:42 +00:00
Jonathan Leitschuh
50ff2c2c68
Code cleanup from code review
2022-03-11 11:44:15 -05:00
Chris Smowton
58d4513d84
Change note
2022-03-11 12:51:13 +00:00
Chris Smowton
496cae7742
Revert 8325, Add CharacterLiteral to CompileTimeConstantExpr.getStringValue
...
As pointed out in 8325's thread, this breaks the corner case of char-literal addition and the convention that getStringValue only applies to String-typed constants.
2022-03-11 12:45:53 +00:00
Chris Smowton
579b57cf67
Range analysis: use ranked phi nodes
...
This borrows a technique (and the implementing code) off Modulus analysis.
2022-03-11 12:32:12 +00:00
Erik Krogh Kristensen
1e365611fc
fix all other implicit-this warnings introduced by the acronym patch
2022-03-11 13:22:07 +01:00
Erik Krogh Kristensen
2e2970128e
fix typo in change-note
2022-03-11 13:16:34 +01:00
Jeroen Ketema
93a0da75b6
Fix taint tracking configurations that broke due to interface change
2022-03-11 12:18:04 +01:00
Chris Smowton
46cd85c70b
Revert #8360 , "Add CompileTimeConstantExpr.getStringified method"
2022-03-11 11:13:21 +00:00
Jeroen Ketema
cd28f09ae0
Extend taint tracking interface with flow states
2022-03-11 11:50:35 +01:00
Chris Smowton
f006cd0e37
Merge pull request #8360 from JLLeitschuh/feat/JLL/compile_time_constant_getStringified
...
[Java] Add CompileTimeConstantExpr.getStringified method
2022-03-11 10:34:52 +00:00
Erik Krogh Kristensen
1a275a32f7
add change-notes
2022-03-11 11:18:14 +01:00
Erik Krogh Kristensen
bb32c79f0c
Java: add missing qldoc
2022-03-11 11:17:38 +01:00
Erik Krogh Kristensen
69353bb014
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
Tony Torralba
c99bad4047
Recover old change note
2022-03-11 10:35:04 +01:00
github-actions[bot]
3a5ebbb861
Post-release preparation for codeql-cli-2.8.3
2022-03-11 09:23:34 +00:00
Jonathan Leitschuh
1c9864286d
Remove SystemProperty from FlowSources
2022-03-10 18:29:29 -05:00
github-actions[bot]
6b194bc55f
Release preparation for version 2.8.3
2022-03-10 19:43:58 +00:00
Jonathan Leitschuh
ecb8911756
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-03-10 11:48:16 -05:00
Joe Farebrother
4bf6c10896
Split configs into Query.qll library
2022-03-10 13:23:40 +00:00
Chris Smowton
3113b27606
Fix style
2022-03-10 10:03:14 +00:00
