Chris Smowton
1b7f529949
Restore reverse-flow models
2023-04-12 14:19:00 +01:00
Chris Smowton
de0caf2445
Go: mass-convert taint-flow models to models-as-data format
2023-04-12 14:18:44 +01:00
Chris Smowton
51ebc0bef2
Amend test now that DataFlowCallable != Callable
2023-04-12 14:15:54 +01:00
Chris Smowton
a5e5a5780d
Use FlowSummaryImpl::Private::summaryParameterNodeRange
2023-04-12 14:15:54 +01:00
Chris Smowton
4ea4e0dcca
Go: seperate real and synthetic callables
...
This means that when a function has a real body and a summary (usually because it has a real definition in source, and implements an interface that has a model), two callables are created and dispatch considers both possible paths.
This specifically overcomes the difficulty with ParameterNodes when the real callable, if any, may or may not define an SsaNode, either because the real parameter is unused or because it is anonymous. Now the synthetic callable will always have parameter nodes, while the real one may or may not depending on whether a definition is present and
whether or not it names or uses its parameter.
2023-04-12 14:15:54 +01:00
Chris Smowton
939a025e11
Go: hide summary nodes from path explanations
...
This mirrors behaviours in other languages with MaD summaries
2023-04-06 16:41:44 +01:00
github-actions[bot]
ac426b1302
Post-release preparation for codeql-cli-2.12.6
2023-04-04 16:49:26 +00:00
Owen Mansel-Chan
00fd23d7b9
Merge pull request #12396 from porcupineyhairs/GoJwtSignImprovements
...
Go: Add more JWT sinks
2023-04-04 13:28:38 +01:00
Porcupiney Hairs
e9615c57e9
Go: Add more JWT sinks
...
This pull requests adds modelling for `katras/iris/v12/middleware/jwt`, `katras/jwt` and `gogf/gf-jwt` frameworks.
2023-03-31 23:11:24 +05:30
Owen Mansel-Chan
8e8ffb20a3
Accept test changes caused by alert message change
2023-03-31 16:48:01 +01:00
Owen Mansel-Chan
4fa57bfb2d
Use set literal instead of regex comparison
2023-03-31 16:48:00 +01:00
Owen Mansel-Chan
a9f297c031
Use set literal instead of a conjunction
2023-03-31 16:47:59 +01:00
Owen Mansel-Chan
5d93ed5f52
Remove redundant term
...
It's hard to tell what the original intention was, but I don't think
the location of qs should be the same as the location of q, so this
term is redundant.
2023-03-31 16:47:59 +01:00
Owen Mansel-Chan
34bca0612b
Use _ for exists-variable that is only used once
2023-03-31 16:47:58 +01:00
Owen Mansel-Chan
607e2817e5
Use not A and B instead of if A then none() else B
2023-03-31 16:47:58 +01:00
Owen Mansel-Chan
9ac0c57a3e
Fix alert message to match style guide
2023-03-31 16:47:57 +01:00
Owen Mansel-Chan
cf89b00f47
Fix variable names in QLDocs
2023-03-31 16:47:57 +01:00
Owen Mansel-Chan
513409e082
Fix formatting of QLDocs
2023-03-31 16:47:56 +01:00
Owen Mansel-Chan
7a25200962
Remove fields which are only used in char pred
2023-03-31 16:47:55 +01:00
Owen Mansel-Chan
a113b8e8a4
No need for singleton set
2023-03-31 16:47:55 +01:00
Owen Mansel-Chan
f6dc9e2a35
Fix accidental over-modelling of k8s Secret DeepCopy
2023-03-31 16:47:53 +01:00
github-actions[bot]
0a3218676c
Release preparation for version 2.12.6
2023-03-30 19:25:06 +00:00
github-actions[bot]
e87ce62f95
Post-release preparation for codeql-cli-2.12.5
2023-03-30 13:48:58 +00:00
Jeroen Ketema
0acca2ba76
Merge pull request #12687 from jketema/unit-2
...
Make imports of `codeql.util.Unit` private
2023-03-29 13:07:12 +02:00
Jeroen Ketema
3b8ad087eb
Make imports of codeql.util.Unit private
2023-03-28 14:14:13 +02:00
Anders Schack-Mulligen
47e7aa9566
Dataflow: Add change note.
2023-03-28 13:17:48 +02:00
Anders Schack-Mulligen
d406b051fc
Dataflow: Remove accidentally exposed predicates.
2023-03-28 10:04:21 +02:00
Jeroen Ketema
977f15f8a4
Merge pull request #12649 from jketema/unit
...
Replace all definitions of `Unit` by `import codeql.util.Unit`
2023-03-27 08:49:50 +02:00
Anders Schack-Mulligen
85511ba19d
Dataflow: Sync
2023-03-24 12:42:06 +01:00
Jeroen Ketema
a87a9438c7
Replace all definitions of Unit by import codeql.util.Unit
2023-03-24 10:39:34 +01:00
Anders Schack-Mulligen
9d88f01c82
Merge pull request #12645 from aschackmull/dataflow/renaming
...
Dataflow: Rename Make to Global and hasFlow to flow
2023-03-24 08:48:31 +01:00
Anders Schack-Mulligen
d440bc2d0c
Dataflow: Sync.
2023-03-23 13:40:23 +01:00
Anders Schack-Mulligen
1c1aa7ecdd
Dataflow: Add change notes.
2023-03-23 13:17:36 +01:00
Anders Schack-Mulligen
2761aa73ca
Dataflow: Sync.
2023-03-23 13:06:19 +01:00
Kasper Svendsen
ce6be1f636
Dataflow: Instantiate stage 1 access paths with proper unit type
2023-03-23 08:32:16 +01:00
Anders Schack-Mulligen
0d6dd7d25a
DataFlow: Sync.
2023-03-21 14:27:25 +01:00
Asger F
6d665da4dc
Merge pull request #12570 from github/post-release-prep/codeql-cli-2.12.5
...
Post-release preparation for codeql-cli-2.12.5
2023-03-21 13:06:25 +01:00
Anders Schack-Mulligen
3876e4335f
Merge pull request #12420 from kaspersv/kaspersv/dataflow-remove-alias-preds
...
Dataflow: Remove revFlowAlias and revFlowApAlias predicates
2023-03-20 16:30:15 +01:00
Kasper Svendsen
1d2f1b6ae6
Address comments
2023-03-20 13:34:14 +01:00
Kasper Svendsen
e0e3a1d621
Dataflow: remove revFlowApAlias trick
2023-03-20 13:04:13 +01:00
Michael Nebel
37484a415f
Sync files.
2023-03-20 09:38:40 +01:00
Kasper Svendsen
9630feb5e4
Dataflow: Remove revFlowAlias trick
2023-03-20 09:04:35 +01:00
github-actions[bot]
981e171525
Post-release preparation for codeql-cli-2.12.5
2023-03-17 13:27:00 +00:00
Chris Smowton
0cadf4d94a
Merge pull request #12558 from smowton/smowton/fix/flow-to-external-api-write-only-methods
...
Go: exclude `net/http.Header.Set` and `.Del` from `go/untrusted-data-to-external-api`
2023-03-17 11:52:48 +00:00
Chris Smowton
3e9924fcd2
Add change note
2023-03-16 15:35:00 +00:00
Chris Smowton
647bd44666
Go: exclude net/http.Header.Set and .Del from go/untrusted-data-to-external-api
...
These functions (and doubtless many others) are write-only with respect to their receiver argument, so it doesn't really make sense to flag externally-controlled data flowing there.
2023-03-16 15:31:35 +00:00
Michael Nebel
3fea9e4d0b
Sync files.
2023-03-16 14:12:29 +01:00
github-actions[bot]
fe4d27e8cc
Release preparation for version 2.12.5
2023-03-16 12:58:50 +00:00
Tom Hvitved
bdd56f1b6e
Data flow: Sync files
2023-03-14 10:01:56 +01:00
Tony Torralba
705691b096
Merge pull request #12446 from github/java/update-mad-decls-after-triage-2023-03-08T14-51-59
...
Java: Update MaD Declarations after Triage
2023-03-13 14:07:59 +01:00
