Michael Nebel
132b8baa57
C#: Delete summarized callable implementation for record flow and update expected output.
2024-02-21 10:33:19 +01:00
Michael Nebel
e4d41194b4
C#: Include store steps into readonly properties.
2024-02-20 15:55:19 +01:00
Michael Nebel
d83687125c
C#: Add postupdate nodes for all instance parameter accesses - otherwise we get missing post update nodes to to reverseRead in the data flow consistency queries.
2024-02-19 13:04:13 +01:00
Michael Nebel
28d5c11b6f
C#: Synthesize an empty body for primary constructors.
2024-02-19 13:04:13 +01:00
Erik Krogh Kristensen
7c0557269a
Merge pull request #15596 from erik-krogh/url-san
...
C#: Add a few more sanitizers to `cs/web/unvalidated-url-redirection`
2024-02-15 12:09:06 +01:00
erik-krogh
a2bd45d0cb
apply suggestions from code review
2024-02-14 13:50:27 +01:00
Tom Hvitved
7c59c7b28c
C#: Update QLdoc
2024-02-13 14:00:26 +01:00
Tom Hvitved
7bdc2c57f0
C#: Simplify primaryConstructorParameterStore
2024-02-13 13:59:14 +01:00
Tom Hvitved
3f43f45437
C#: Assume captured variables are live at exit in SSA construction
2024-02-13 13:59:08 +01:00
Michael Nebel
91bbbe262d
C#: Address more review comments.
2024-02-13 13:15:17 +01:00
erik-krogh
d31bfc06c2
add type requirement to the new Uri sanitizers
2024-02-13 13:13:43 +01:00
erik-krogh
4dae8d0bb4
add host comparisons as a sanitizer for url-redirect
2024-02-13 13:13:43 +01:00
erik-krogh
f4dd3e9aa1
treat relative URLs as safe for url-redirects
2024-02-13 13:13:18 +01:00
erik-krogh
3f8de82ea3
add a sanitizer for List.Contains() in url-redirect
2024-02-13 13:13:06 +01:00
Michael Nebel
69c0f0cb6a
C#: Address review comments.
2024-02-13 11:39:21 +01:00
Tom Hvitved
15cf695188
C#: Fix various bad joins
2024-02-12 19:49:53 +01:00
Michael Nebel
42f4656667
C#: Data flow for primary constructors.
2024-02-12 13:27:39 +01:00
Tom Hvitved
b27b89bff7
Merge pull request #15567 from hvitved/csharp/cache-module
...
C#: Actually cache module `Cached`
2024-02-12 09:15:49 +01:00
Tom Hvitved
9634511ac5
Merge pull request #15489 from hvitved/csharp/lambda-field-flow
...
C#: Additional tracking of lambdas through fields and properties
2024-02-12 09:14:21 +01:00
Tom Hvitved
9785ce4936
C#: Actually cache module Cached
2024-02-09 12:29:56 +01:00
Anders Schack-Mulligen
b7d4a6926f
Dataflow: Add empty provenance column to PathGraph.
2024-02-09 11:27:30 +01:00
Anders Schack-Mulligen
dfc9c4d079
C#: Simplify, getASuccessor is pruned now.
2024-02-08 10:36:55 +01:00
Tamas Vajk
c2c7826936
C#: Extract dependency restore telemetry data
2024-02-05 13:09:04 +01:00
Michael Nebel
9191acc412
C#: Prevent flow out of non ref fields in ref structs used as arguments.
2024-02-01 15:04:06 +01:00
Michael Nebel
4a89cbe8ea
C#: Add postupdate nodes for arguments of struct type.
2024-02-01 15:04:06 +01:00
Tom Hvitved
bfe4a4bf0b
C#: Additional tracking of lambdas through fields and properties
2024-02-01 11:51:00 +01:00
Tamas Vajk
fddbb1a722
C#: Extract expanded compiler arguments
2024-01-31 08:32:16 +01:00
Michael Nebel
63c06b72b1
C#: Chop dataflow of spread into smaller steps and make sure to only propagate element flow for the spread operator.
2024-01-29 14:34:57 +01:00
Michael Nebel
168f5b5554
C#: Add dataflow support for collection expressions.
2024-01-26 14:18:16 +01:00
Michael Nebel
74cb1ea584
C#: Add QL library expression support for collection expressions.
2024-01-26 11:50:20 +01:00
Michael Nebel
1252d3ee89
C#: Rename CollectionExpr to EnumerableCollectionExpr.
2024-01-25 19:53:51 +01:00
Michael Nebel
2be1ee8b34
Merge pull request #15394 from michaelnebel/csharp/urlredirect-sanitizer
...
C#: Add more santizers to the `cs/web/unvalidated-url-redirection` query.
2024-01-24 08:42:05 +01:00
Edward Minnix III
0e866a5447
Merge pull request #15359 from egregius313/egregius313/csharp/dataflow/threat-modeling/add-threatmodelflowsource
...
C#: Threat Modeling - Introduce `ThreatModelFlowSource`
2024-01-23 09:02:10 -05:00
Ed Minnix
ff6d4c6ae6
Deprecation message
2024-01-22 11:09:53 -05:00
Ed Minnix
0ff12c07c7
Convert existing mapped-property classes to directly extend DatabaseInputSource
2024-01-22 11:09:51 -05:00
Ed Minnix
51564200a1
Documentation for FlowSources library
2024-01-22 11:09:48 -05:00
Ed Minnix
3c9c07ec40
Rename SourceNode.qll to FlowSources.qll
2024-01-22 11:09:43 -05:00
Ed Minnix
392eac5f9a
Refactor source node classes to use SourceNode superclass
...
Refactor the existing flowsource classes to use the `SourceNode` class
to specify which threat model they support.
2024-01-22 11:09:41 -05:00
Ed Minnix
d29df68c97
Introduce the SourceNode and ThreatModelFlowSource classes
...
1. Introduces the `SourceNode` class which allows dataflow nodes
representing sources to indicate the threat model they are associated
with.
2. Introduces the `ThreatModelFlowSource` class which represents a
source node which respects the threat model configuration
2024-01-22 11:09:39 -05:00
Michael Nebel
1bb6f4962d
C#: Match any {digit} in the format string.
2024-01-22 14:03:37 +01:00
Michael Nebel
5016113a0f
C#: Add a string.Format sanitizer to url redirect and update expected test output.
2024-01-22 11:21:35 +01:00
Michael Nebel
884f3f1505
C#: Add string interpolation expression sanitizer to url redirect and update expected test output.
2024-01-22 11:21:19 +01:00
erik-krogh
8be7eadace
delete outdated deprecations
2024-01-22 09:11:35 +01:00
Joe Farebrother
4de19b3ec9
Merge pull request #15039 from joefarebrother/csharp-razor-flow-page-models
...
C#: Add flow steps from a PageModel to cshtml page.
2024-01-19 10:07:25 +00:00
Michael Nebel
24855ddc64
Merge pull request #15328 from michaelnebel/csharp/inlinearrays
...
C# 12: Inline array support.
2024-01-19 09:11:26 +01:00
Michael Nebel
9460c91c8c
C#: Also consider nullable simple types (and datetime) as simple type sanitizers.
2024-01-18 12:53:29 +01:00
Michael Nebel
8a97c8c28e
C#: Add QL support for InlineArrayType.
2024-01-18 11:09:00 +01:00
Michael Nebel
275822f80d
Merge pull request #15296 from michaelnebel/csharp/getruntimeargument
...
C#: Improve getRuntimeArgumentForParameter to consider named arguments.
2024-01-12 15:57:17 +01:00
Michael Nebel
dcce93ac4c
C#: Address more review comments.
2024-01-12 14:07:27 +01:00
Michael Nebel
c68f9b05cd
C#: Address review comments.
2024-01-12 11:24:37 +01:00
