Esben Sparre Andreasen
13288be7fc
make ATM anti sink model for dojo.require
2021-12-10 15:07:51 +01:00
Esben Sparre Andreasen
9ffc02944d
add file write model for express-fileupload mv
2021-12-10 15:05:34 +01:00
Esben Sparre Andreasen
cfd2dcffa0
recognize more modelled database accesses
2021-12-10 14:54:59 +01:00
Esben Sparre Andreasen
b0f6cf1491
expose more marsdb calls as database accesses
2021-12-10 13:46:19 +01:00
Esben Sparre Andreasen
9df1ac7f75
treat redis and ioredis usage as database access
2021-12-10 13:26:26 +01:00
Esben Sparre Andreasen
10498c3643
treat jQuery as fully modelled
2021-12-10 12:51:45 +01:00
Nick Rolfe
a4da528812
Ruby: query to find user-controlled bypass of sensitive actions
2021-12-10 11:41:09 +00:00
Esben Sparre Andreasen
a1ee900f50
treat Base64 manipulations as non-sinks
2021-12-10 12:37:44 +01:00
Henry Mercer
6e167040f5
Merge pull request #7307 from adityasharad/atm/perf-debugging
...
JS/ATM: Various compilation fixes and performance improvements
2021-12-10 11:00:27 +00:00
Tom Hvitved
657cd89286
Merge pull request #7347 from hvitved/cfg/more-consistency-tests
...
Shared CFG: Add two more consistency queries
2021-12-10 10:50:39 +01:00
Tamas Vajk
d2822c2acc
Rework semantic model caching
2021-12-10 10:42:30 +01:00
Tamas Vajk
704a5e4bbf
Revert "C#: Avoid NPE in Parameter.Populate"
...
This reverts commit 08eb7e207d1e12c9578e07ee0a1d79bf6b62f60f.
2021-12-10 10:42:30 +01:00
Tom Hvitved
8ccbcf1bf8
C#: Avoid NPE in Parameter.Populate
2021-12-10 10:42:29 +01:00
Tom Hvitved
563b771163
C#: Update expected test output
2021-12-10 10:42:29 +01:00
Tom Hvitved
0a0657ada1
C#: Adapt to new Roslyn representation of implicit Main methods
2021-12-10 10:42:29 +01:00
Tom Hvitved
1c230d0888
C#: Update nuget packages
2021-12-10 10:42:29 +01:00
Michael Nebel
afa58f5676
C#: Ensure bi-directional importing of external flow for System.Text.
2021-12-10 10:28:35 +01:00
Arthur Baars
13f7fd88f1
Merge pull request #7283 from aibaars/ruby-pattern-matching-cfg
...
Ruby: pattern matching: CFG
2021-12-10 10:24:38 +01:00
Anders Schack-Mulligen
634ed91904
Merge pull request #7346 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-12-10 10:12:23 +01:00
Tom Hvitved
cf42427f54
Merge pull request #7321 from hvitved/csharp/cil/unique-type
...
C#: Avoid CIL instructions with multiple types
2021-12-10 09:58:06 +01:00
Tom Hvitved
f7f3890b40
Merge pull request #7320 from hvitved/csharp/unknown-type
...
C#: Populate `UnknownType`
2021-12-10 09:57:55 +01:00
Tom Hvitved
70f76d06c7
Shared CFG: Add two more consistency queries
2021-12-10 09:56:50 +01:00
Tom Hvitved
45c0d4a3b2
Merge pull request #7343 from hvitved/cfg/consistency-test
...
Shared CFG: Add another consistency test
2021-12-10 09:49:05 +01:00
Asger Feldthaus
b336c29283
JS: Track functions with methods
2021-12-10 09:38:29 +01:00
Asger Feldthaus
4ef2a5f4f1
JS: Add test
2021-12-10 09:38:29 +01:00
github-actions[bot]
7e5bfa5aa0
Add changed framework coverage reports
2021-12-10 00:09:34 +00:00
Aditya Sharad
271b23ba8f
JS: Expand explanatory comment about version placeholders
2021-12-09 13:43:08 -08:00
Aditya Sharad
0c3daabc51
JS: Fix broken regex matching predicate
...
The receiver string and the regex were in the wrong order,
leading to test failures when looking for matching comments.
2021-12-09 13:42:33 -08:00
Chris Smowton
753d886b0d
Merge pull request #6319 from haby0/java/MyBatisSqlInjection
...
[Java] CWE-089 MyBatis Mapper Sql Injection
2021-12-09 19:57:18 +00:00
Taus
6d247bfdf9
Merge pull request #7330 from tausbn/python-fix-bad-adjacentuseuse-join
...
Python: Fix bad join in SSA
2021-12-09 20:55:45 +01:00
Erik Krogh Kristensen
e7209d1ee1
Merge pull request #7216 from erik-krogh/ts45
...
JS: Add support for TypeScript 4.5
2021-12-09 20:33:52 +01:00
Geoffrey White
23d4d035e5
C++: Different approach to sensitive exprs.
2021-12-09 18:33:50 +00:00
Geoffrey White
65f4ccce28
C++: Another test case.
2021-12-09 18:20:52 +00:00
Chris Smowton
75f3ebf051
Fix OTHER XML tag
2021-12-09 17:55:03 +00:00
Chris Smowton
9f69c75c50
Fix XML tag
2021-12-09 17:44:49 +00:00
Chris Smowton
2cd70b96cd
Fix doctype
2021-12-09 17:44:08 +00:00
JrXnm
1a1a7413c2
JS: Improv inter-procedural type inference for FunctionExpr
2021-12-10 01:09:49 +08:00
Michael Nebel
d60b90acd3
C#: Manual update of System.String and System.Convert flow summaries.
2021-12-09 16:34:42 +01:00
Michael Nebel
e879ca7a3b
C#: Convert System.Convert flow to CSV format.
2021-12-09 16:34:42 +01:00
Michael Nebel
15b4b218c8
C#: Convert System.Nullable<> flow to CSV format.
2021-12-09 16:34:42 +01:00
Michael Nebel
bbab0e582a
C#: Convert System.Lazy<> flow to CSV format.
2021-12-09 16:34:42 +01:00
Michael Nebel
9e61dfb41f
C#: Convert System.Text.StringBuilder flow to CSV format.
2021-12-09 16:34:41 +01:00
Michael Nebel
5a26346ba5
C#: Allow the use of pointer types in CSV validation.
2021-12-09 16:34:41 +01:00
Michael Nebel
5376eb89b3
C#: Convert System.String flow to CSV format.
2021-12-09 16:34:41 +01:00
Michael Nebel
df482a9603
Merge pull request #7314 from michaelnebel/csharp-stubs-dataflow-global
...
C#: Update tests dataflow/global tests to use stubs.
2021-12-09 16:31:39 +01:00
Chris Smowton
470256da85
Copyedit
2021-12-09 15:10:07 +00:00
Tony Torralba
8bba3eb2b6
Merge pull request #6823 from atorralba/atorralba/android-notification-models
...
Android: Add models for `android.app.Notification` builders
2021-12-09 16:01:44 +01:00
Henry Mercer
f08f07e19e
JS: Improve handling of heuristic sinks in endpoint filters
...
Previously heuristic sinks were always included, to avoid us filtering
them out due to not being an argument to an external library call.
In this commit we move the argument to an external library call
filtering to the query-specific endpoint filters.
This lets us filter out heuristic sinks if they match one of the other
endpoint filters, reducing FPs.
2021-12-09 15:00:54 +00:00
Chris Smowton
d0a19fffee
Copyedit
2021-12-09 14:58:29 +00:00
Tom Hvitved
7e99426141
C#: Address review comments
2021-12-09 15:51:54 +01:00
