github-actions[bot]
4ce8ccc52b
Release preparation for version 2.7.6
2022-01-20 08:21:18 +00:00
github-actions[bot]
1dfcf427aa
Release preparation for version 2.7.5
2022-01-04 14:44:56 +00:00
Erik Krogh Kristensen
b9964799f3
Merge pull request #7458 from erik-krogh/modelling
...
QL: add "modelling/modeling" to `ql/non-us-spelling`
2022-01-04 13:33:54 +01:00
yoff
5ba70ff3b6
Merge pull request #7369 from RasmusWL/filter-tag-cwe
...
JS/Py/Ruby: Add more CWEs to bad-tag-filter queries
2022-01-04 10:11:03 +01:00
Dave Bartolomeo
5f5af4a29e
Move change notes to correct location
...
A few change notes slipped through the cracks of my previous change. These are now in the proper locations: `old-change-notes` for older notes, and `<lang>\ql\[src|lib]\change-notes` for current change notes.
2022-01-03 18:21:16 -05:00
Dave Bartolomeo
ded3c52a34
Merge pull request #7407 from github/post-release-prep/codeql-cli-2.7.4
...
Post-release preparation for codeql-cli-2.7.4
2022-01-03 17:09:58 -05:00
github-actions[bot]
1334d207fa
Post-release version bumps
2022-01-03 20:11:15 +00:00
Alex Ford
3da98ecb73
Bump a date
2021-12-22 16:38:16 +00:00
Alex Ford
a2104de8a0
Move CryptoAlgorithms::AlgorithmsName into a separate internal/CryptoAlgorithmNames.qll
2021-12-22 16:38:15 +00:00
Alex Ford
f16d77615d
Remove unused isStrongBlockMode predicate from CryptoAlgorithms.qll
2021-12-22 16:38:15 +00:00
Alex Ford
d3af687767
Add more encryption algorithms and modes to CryptoAlgorithms::AlgorithmNames
...
Strong encryption algorithms: ARIA, IDEA, SEED, SM4
Strong block modes: CBC, CFB, CTR, OFB
2021-12-22 16:38:15 +00:00
Alex Ford
bdb2d8ba16
Ruby: split OpenSSL parts from CryptoALgorithms.qll and sync with JS/Python version
2021-12-22 16:38:15 +00:00
Erik Krogh Kristensen
8019b52838
run the non-us patch with "modelled/modeled"
2021-12-20 17:47:15 +01:00
Erik Krogh Kristensen
d17879e1f9
run the non-us patch
2021-12-20 16:24:41 +01:00
Nick Rolfe
f18492e39b
Merge pull request #7443 from github/nickrolfe/behavior
...
QL4QL: catch behaviour/behavior in ql/non-us-spelling
2021-12-20 13:23:53 +00:00
Henry Mercer
bebf4ca8fc
Merge pull request #7357 from github/henrymercer/js-atm-only-featurize-with-flow
...
JS: Only featurize endpoints that are part of a flow path
2021-12-17 18:03:40 +00:00
Henry Mercer
055432530f
Bump ATM pack version to 0.0.2
2021-12-17 16:49:59 +00:00
Henry Mercer
c1864531cd
JS: Push FeaturizationConfig context into more predicates
2021-12-17 16:31:56 +00:00
Henry Mercer
383437c571
JS: Only featurize endpoints that are part of a flow path
2021-12-17 16:31:56 +00:00
Nick Rolfe
28912c508f
Fix non-US spelling of 'behavior'
2021-12-17 15:29:31 +00:00
CodeQL CI
de4b655ddb
Merge pull request #7327 from asgerf/js/handlebars-more-raw-interpolation
...
Approved by erik-krogh
2021-12-17 14:07:57 +00:00
CodeQL CI
39ec7132af
Merge pull request #7049 from asgerf/js/routing-trees
...
Approved by erik-krogh
2021-12-17 12:26:38 +00:00
Asger Feldthaus
89775428b4
JS: Autoformat
2021-12-17 10:32:02 +01:00
Asger Feldthaus
e2c6dd7d56
JS: Recognize {{& ... }} as an XSS sink
2021-12-17 10:31:50 +01:00
Asger Feldthaus
61cc84ba69
JS: Recognize leading/trailing ~ and & in mustache-tags
2021-12-17 10:31:50 +01:00
Chris Gavin
4a1e2ed408
Add a severity and select the correct number of columns.
2021-12-16 14:02:36 +00:00
Chris Gavin
407c265daf
Add kind metadata to example query.
2021-12-16 12:12:36 +00:00
Asger Feldthaus
0e9c2377e3
JS: Use a field in RouterHandlerParameter
2021-12-16 10:26:35 +01:00
CodeQL CI
f274f06d9b
Merge pull request #7409 from asgerf/js/track-functions-with-methods
...
Approved by erik-krogh
2021-12-16 09:01:42 +00:00
CodeQL CI
acbf7913b2
Merge pull request #7408 from asgerf/js/trusted-types-sinks
...
Approved by esbena
2021-12-16 08:59:51 +00:00
Asger Feldthaus
53b3581ed0
JS: Add test to stress flow through properties
2021-12-15 17:16:56 +01:00
Asger F
784991cce5
Update javascript/ql/lib/semmle/javascript/Routing.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-15 16:38:38 +01:00
Asger Feldthaus
79e6dcaf68
JS: Rename getValueAtAccessPath->getValueImplicitlyStoredInAccessPath
2021-12-15 16:37:28 +01:00
Asger Feldthaus
8aa4d8227e
JS: Rename RouteHandlerInput->RouteHandlerParameter
2021-12-15 16:32:18 +01:00
Asger Feldthaus
218b746f6f
JS: Rename getAUseSite -> getRouteInstallation
2021-12-15 16:21:41 +01:00
Asger Feldthaus
4d85799fc7
JS: Add test for fastify-rate-limit
2021-12-15 16:18:22 +01:00
Asger Feldthaus
615b2ec539
JS: Fix handling of fastify-plugin
2021-12-15 16:04:46 +01:00
Asger Feldthaus
b226f767ad
JS: Fix tracking of fastify server instance
2021-12-15 16:04:45 +01:00
Asger Feldthaus
0ca9feb854
JS: Always treat routers as resuming dispatch
2021-12-15 16:01:59 +01:00
Asger F
1b20506947
Update javascript/ql/lib/semmle/javascript/frameworks/Fastify.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-15 16:00:19 +01:00
Asger Feldthaus
995e33158f
JS: Add test for res.locals flow to template
2021-12-15 16:00:19 +01:00
Asger Feldthaus
04bdba85ea
JS: Shift line numbers in test expectations
2021-12-15 16:00:19 +01:00
Asger F
c1bb40f439
Update javascript/ql/lib/semmle/javascript/frameworks/Express.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-12-15 16:00:19 +01:00
Asger Feldthaus
b2016bddac
JS: Merge concepts of client/database in MongoDB model
2021-12-15 16:00:19 +01:00
Asger Feldthaus
e64a6dc12a
JS: Add qldoc
2021-12-15 12:47:23 +01:00
Asger Feldthaus
43ec721a87
JS: Add link to MDN docs for trusted types
2021-12-15 11:52:58 +01:00
github-actions[bot]
59da2cdf69
Release preparation for version 2.7.4
2021-12-14 21:35:09 +00:00
Dave Bartolomeo
a62f181d42
Move new change notes to appropriate packs
2021-12-14 12:05:15 -05:00
Asger Feldthaus
7e947b2a65
JS: Use return value of trusted type policy callback as a sink
2021-12-14 13:28:46 +01:00
Ian Wright
1c79d1f985
Merge pull request #7352 from github/esbena/atm-endpoint-polish
...
ATM Endpoint filtering improvements
2021-12-14 08:19:23 +00:00
