Chris Smowton
9016997b51
Golang: fix flow from a map value via a range statement
2024-02-14 14:56:24 +00:00
Rasmus Wriedt Larsen
59014787a1
Python: Fix DataflowQueryTest
...
You're only allowed to have `result=OK` if there is a sink on that line...
2024-02-14 15:44:40 +01:00
Rasmus Wriedt Larsen
cd596f5d05
Python: Reformat test-file
...
All those newlines are not good for inline expectations
2024-02-14 15:44:06 +01:00
Asger F
d94d4591da
JS: Name instance methods using API nodes instead of special-casing
2024-02-14 15:08:19 +01:00
Asger F
c4a0f36a08
JS: Fix handling of unknown properties
...
These would shorten the expected distance to a node, but would never be usable as an edge, meaning we failed to pick a preferred predecessor.
2024-02-14 15:08:19 +01:00
Asger F
3ff950660b
JS: Add test with unknown property name
2024-02-14 15:08:19 +01:00
Asger F
9838da5395
JS: Simplify isExported
2024-02-14 15:08:19 +01:00
Asger F
a3dc19fd31
JS: Check privacy earlier
2024-02-14 15:08:19 +01:00
Asger F
5c454944a9
JS: Add test for private fields
2024-02-14 15:08:19 +01:00
Asger F
2a91bb8c54
JS: Add test showing ambiguous predecessor
2024-02-14 15:08:19 +01:00
Jeroen Ketema
33413129a5
C++: For unnamed local variable declaration entries consider the name of the variable
2024-02-14 15:03:04 +01:00
Ian Lynagh
c87b7b5f88
Merge pull request #15606 from igfoo/igfoo/kt2
...
Kotlin: Fix build with latest 2.0.255 snapshots
2024-02-14 14:00:50 +00:00
Rasmus Wriedt Larsen
e5bd633028
Python: Change name/id to Decompression Bomb
...
The old title/id matches how we used to write queries, but I think just
using the normal conversational name is easier for everyone :)
2024-02-14 14:54:25 +01:00
Rasmus Wriedt Larsen
69c8ef9898
Python: Use dataflow instead of taint-tracking
2024-02-14 14:52:37 +01:00
Rasmus Wriedt Larsen
ba7dd38fc9
Python: Delete duplicated file
2024-02-14 14:48:37 +01:00
Rasmus Wriedt Larsen
9ae3ea81ff
Python: Remove spurious results in stdlib
2024-02-14 14:47:28 +01:00
Rasmus Wriedt Larsen
d8fd457310
Python: Use helper predicate
...
Since the helper predicate had nice qldocs
2024-02-14 14:47:28 +01:00
Rasmus Wriedt Larsen
e7772f1062
Python: Use Unit class
2024-02-14 14:47:28 +01:00
Rasmus Wriedt Larsen
ad39b8c68b
Python: Accept .expected changes
2024-02-14 14:46:33 +01:00
Alvaro Muñoz
90d1ae4a05
fix: simplify Ast
2024-02-14 14:06:28 +01:00
Alvaro Muñoz
494fb2470e
fix: refactor local, read and store steps
2024-02-14 14:05:13 +01:00
Alvaro Muñoz
ebaac5f5cb
fix: enforce input,output,env prefixes in MaD
2024-02-14 14:03:11 +01:00
erik-krogh
7c2465e7b7
add change-note
2024-02-14 13:53:43 +01:00
erik-krogh
a2bd45d0cb
apply suggestions from code review
2024-02-14 13:50:27 +01:00
Rasmus Wriedt Larsen
9399258e3b
Merge branch 'main' into amammad-python-bombs
2024-02-14 13:37:59 +01:00
Jeroen Ketema
46bc311111
C++: Support constexpr if in the IR
2024-02-14 13:37:56 +01:00
Tony Torralba
5ce35e47b9
Adjust a test case so that the key isn't considered dummy
...
(len < 4)
2024-02-14 13:06:31 +01:00
Ian Lynagh
48ea94ba23
Kotlin: Handle PsiSourceManager moving
2024-02-14 11:55:54 +00:00
Ian Lynagh
1b40b595fa
Kotlin: Handle forAllMethodsWithBody being removed
...
Per:
commit 28797a31b4d9b7f5c99d162ab19fc6b46f8e529d
Author: Alexander Udalov <alexander.udalov@jetbrains.com >
Date: Thu Feb 1 13:22:48 2024 +0100
JVM: refactor JvmDefaultMode, remove/rename some entries
[...]
- remove forAllMethodsWithBody because its behavior is now equivalent to
isEnabled
[...]
2024-02-14 11:55:54 +00:00
Óscar San José
cd00a4dacd
Merge pull request #15584 from jsoref/github-only
...
Limit xl runner jobs to github org
2024-02-14 12:49:07 +01:00
Asger F
75a95ffcd1
Merge pull request #15602 from asgerf/js/block-logical-and-flow
...
JS: Fix flow through &&
2024-02-14 12:29:40 +01:00
Tony Torralba
458bbb3581
Rename fwk module
2024-02-14 12:23:27 +01:00
Tony Torralba
16284fdd20
Discard sources that are obvious dummy values
2024-02-14 12:21:52 +01:00
Tony Torralba
a76de495e0
Simplify sanitizers
...
Use DataFlow::returnedWithError instead
2024-02-14 12:21:51 +01:00
Tony Torralba
6b74cb7e75
Remove unneeded $ANYVERSION
2024-02-14 12:21:51 +01:00
Tony Torralba
3fb422ca25
Split Jwt.qll into framework libraries, which makes more sense
2024-02-14 12:21:38 +01:00
Tony Torralba
8afaa231ee
Update go/ql/lib/semmle/go/security/Jwt.qll
2024-02-14 12:15:20 +01:00
Tony Torralba
304998d50e
Update go/ql/src/Security/CWE-798/HardcodedCredentials.ql
2024-02-14 12:15:20 +01:00
Tony Torralba
84d1d72497
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2024-02-14 12:15:19 +01:00
Tony Torralba
750c8085cb
Remove duplicated main from tests
2024-02-14 12:15:19 +01:00
Tony Torralba
ba1faea630
Go: Promote go/hardcoded-key from experimental
2024-02-14 12:15:14 +01:00
Jeroen Ketema
337db6b29b
Merge pull request #15609 from jketema/destructors3
...
C++: Output the declaration entries used in range-based for-loops
2024-02-14 11:37:09 +01:00
Alvaro Muñoz
7139d3b6d2
Merge pull request #8 from GitHubSecurityLab/changed-files-sources
...
Add some changed-files sources
2024-02-14 10:56:20 +01:00
Alvaro Muñoz
2b3b3732b9
resolve conflicts
2024-02-14 10:55:31 +01:00
Alvaro Muñoz
6b83afebaa
Merge pull request #9 from GitHubSecurityLab/content_set
...
feat(field-flow): enhance dataflow tracking
2024-02-14 10:49:11 +01:00
Asger F
2172c4863f
Merge pull request #15380 from asgerf/js/endpoint-naming
...
JS: Add library for naming endpoints
2024-02-14 10:48:13 +01:00
Alvaro Muñoz
e6b4676f90
feat(field-flow): enhance dataflow tracking
...
implement field flow to reduce false positives
2024-02-14 10:47:00 +01:00
Asger F
18db769d6d
JS: Update expected output
2024-02-14 10:45:51 +01:00
Asger F
bafe5e3d8e
JS: Add test case (with old expected data)
2024-02-14 10:45:51 +01:00
Anders Schack-Mulligen
393251dde6
Merge pull request #15582 from hvitved/dataflow/cache-viable-callable-ext
...
Data flow: Cache `viableCallableExt`
2024-02-14 10:31:43 +01:00
