Max Schaefer
d5d0cf5d90
Java: Tag java/non-https-url with CWE-345
2024-07-11 13:37:09 +01:00
Calum Grant
29df3cb5b3
C++: Add test for C++20 implicit array sizes
...
Implement NewArrayExpr.getArraySize()
2024-07-11 12:59:52 +01:00
Ian Lynagh
311799c798
Merge pull request #16899 from igfoo/igfoo/semmle_dist
...
Java/Kotlin: Remove legacy $SEMMLE_DIST support
2024-07-11 12:48:53 +01:00
Erik Krogh Kristensen
de9370ae95
Merge pull request #16540 from aegilops/aegilops/js/insecure-helmet-middleware
...
JS/TS: insecure Helmet middleware (new query)
2024-07-11 13:48:09 +02:00
Owen Mansel-Chan
5bdef38dd9
Merge pull request #16941 from owen-mc/go/mad-package-alias
...
Go: Allow grouping import paths for models-as-data
2024-07-11 12:27:43 +01:00
Angela P Wen
90641a5152
Remove CI workaround for DatabaseQualityDiagnostics.ql
2024-07-11 13:22:06 +02:00
Alvaro Muñoz
7a54170b31
feat(ext): Move regexp delimiters to Config.qll
2024-07-11 12:59:34 +02:00
Jeroen Ketema
87d9218369
Merge pull request #16951 from jketema/builtin-op
...
C++: Support more builtin operations
2024-07-11 12:50:46 +02:00
aegilops
d71be8aeaf
Moved from experimental into default queries
2024-07-11 11:44:01 +01:00
Michael B. Gale
45b782554c
Merge pull request #16925 from github/mbg/go/add-vendor-env-var
...
Go: Add environment variable to include `vendor` directories in extraction
2024-07-11 11:06:31 +01:00
Paul Hodgkinson
412ad177c2
Merge branch 'main' into aegilops/js/insecure-helmet-middleware
2024-07-11 11:01:38 +01:00
Jeroen Ketema
5e0ce7efc4
C++: Fix test
2024-07-11 11:58:25 +02:00
Jeroen Ketema
ed42c3cd6f
C++: Fix class extension
2024-07-11 11:48:01 +02:00
Alvaro Muñoz
f4581d0aa5
Bump qlpack versions
2024-07-11 11:36:18 +02:00
Alvaro Muñoz
eb66114d8b
feat(models): New ArgInj sink
2024-07-11 11:35:44 +02:00
Tom Hvitved
16b142d332
SSA: Make barrier guards a parameterized module
2024-07-11 11:34:56 +02:00
Tom Hvitved
a452eadb33
Merge pull request #16946 from hvitved/csharp/fewer-version-regexps
...
C#: Perform fewer `regexpCapture`s when matching version numbers
2024-07-11 11:22:36 +02:00
Tamás Vajk
fd8cda36e5
Merge pull request #16924 from tamasvajk/feature/winforms-linux
...
C#: Restore Windows dependencies when Windows Forms or WPF usage is detected
2024-07-11 11:01:37 +02:00
Alvaro Muñoz
56af52a729
feat(tests): New tests for Command Injection
...
Injections on a workflow_run triggered protected by a allow branches list should not be reported as critical
2024-07-11 10:46:37 +02:00
Alvaro Muñoz
adbb236465
fix(query): Better identification of argument injection commands
2024-07-11 10:45:49 +02:00
Jeroen Ketema
48bf06f1aa
C++: Fix getAPrimaryQlClass
2024-07-11 10:43:17 +02:00
Jeroen Ketema
0413e0e090
C++: Clean up QLDoc and add change note
2024-07-11 10:37:26 +02:00
Alvaro Muñoz
8d75250da7
Bump qlpack versions
2024-07-11 10:05:29 +02:00
Alvaro Muñoz
732f0dc29f
feat(queries): Argument Injection
...
Make argument injection sinks congigurable with MaD
2024-07-11 10:04:43 +02:00
Alvaro Muñoz
73c77bc93b
Initial implementation
...
Pending work: complete the regular expression
2024-07-11 10:04:43 +02:00
Owen Mansel-Chan
3417605b6d
Tests: update provenance numbering
2024-07-11 06:42:58 +01:00
Jeroen Ketema
3f789bad60
C++: Support more builtin operations
2024-07-10 21:27:09 +02:00
Owen Mansel-Chan
2c7fbda2ec
Accept review suggestion for QLDoc
2024-07-10 16:48:11 +01:00
Owen Mansel-Chan
32acff76c2
Make groupPrefix() private
...
This could be made public in future. But I expect that we will want to
use this logic for QL models as well then we will want to move it into a
different file, which will be much easier if it's all private at the
moment.
2024-07-10 16:48:10 +01:00
Owen Mansel-Chan
b64ef84393
Use prefix() method on string to check for group prefix
2024-07-10 16:48:10 +01:00
Owen Mansel-Chan
3e2ebf436c
Move logic for dealing with groups into a predicate
2024-07-10 16:48:09 +01:00
Owen Mansel-Chan
f6b9195a61
Add validation of package groups
2024-07-10 16:48:08 +01:00
Owen Mansel-Chan
ab991af2a5
Fix package validation errors
2024-07-10 16:48:07 +01:00
Owen Mansel-Chan
f650e3f72b
Update MaD documentation explain "group:" in package column
2024-07-10 16:48:06 +01:00
Owen Mansel-Chan
01afa360d7
Tests: accept model numbering changes
2024-07-10 16:48:05 +01:00
Owen Mansel-Chan
1e448d547d
Rename Beego MaD files using path from current version
2024-07-10 16:48:04 +01:00
Owen Mansel-Chan
fde7d7b969
Use packageGrouping for Beego models
2024-07-10 16:48:03 +01:00
Michael Nebel
4193b7e591
Allow grouping import paths for models-as-data
2024-07-10 16:48:02 +01:00
Tamás Vajk
57efb84b98
Merge pull request #16945 from tamasvajk/feature/buildless-deterministic-file-order
...
C#: Order files in buildless extraction
2024-07-10 16:25:01 +02:00
Tom Hvitved
39b5dbfaf7
C#: Perform fewer regexpCaptures when matching version numbers
2024-07-10 14:50:39 +02:00
Alvaro Muñoz
4ad7c1fc95
Merge pull request #57 from github/workflow_run_branches
...
workflow run branches
2024-07-10 13:09:36 +02:00
Alvaro Muñoz
621ead2266
Fix branches logic
2024-07-10 13:09:23 +02:00
Alvaro Muñoz
090b3d41d1
Fix branches logic
2024-07-10 13:08:54 +02:00
Tom Hvitved
f18338259f
Merge pull request #16884 from hvitved/ssa/dataflow-integration
...
SSA: Add data flow integration layer
2024-07-10 12:47:37 +02:00
Geoffrey White
0344381120
Merge remote-tracking branch 'upstream/main' into docsforautofix
2024-07-10 11:17:52 +01:00
Geoffrey White
74384625f6
C++: Autoformat.
2024-07-10 11:17:44 +01:00
Alvaro Muñoz
53b88627e5
feat(core): Exclude worflow_run#branches#default branch from externally triggerable events
2024-07-10 12:15:49 +02:00
Alvaro Muñoz
f1d1c1e55a
Bump QL versions
2024-07-10 11:49:37 +02:00
Alvaro Muñoz
f4dd771d1c
feat(models): Add models for ssh-action
2024-07-10 11:49:18 +02:00
Alvaro Muñoz
e23054292b
feat(tests): Add new tests
...
Add new tests to verify that even if a job is privileged, if the vulnerability takes place in a different one, it should be considered as non-priveleged and reported as Cache Poisoning instead of Untrusted Checkout
2024-07-10 11:49:02 +02:00
