Mathias Vorreiter Pedersen
|
23d4a9762d
|
Fix id in experimental JsonpInjection.ql query
The invalid id broke CI here: https://github.com/github/codeql/pull/5703 (see https://github.slack.com/archives/CPSEA0G22/p1618602834224600)
|
2021-04-17 09:45:52 +02:00 |
|
Shati Patel
|
5c2bf68a05
|
Merge pull request #5692 from tamasvajk/feature/doc-cs9
Update supported C#/.NET versions
|
2021-04-16 16:22:06 +01:00 |
|
Rasmus Wriedt Larsen
|
3c8ea167c4
|
Merge pull request #5668 from tausbn/python-use-api-graphs-in-fabric
Python: Use API graphs in Fabric model
|
2021-04-16 14:27:55 +02:00 |
|
Rasmus Wriedt Larsen
|
6ed1016bb8
|
Merge pull request #5669 from tausbn/python-use-api-graphs-for-invoke
Python: Use API graphs for Invoke
|
2021-04-16 14:27:19 +02:00 |
|
Geoffrey White
|
e1028a2765
|
Merge pull request #5667 from MathiasVP/use-range-analysis-in-overflow
C++: Use range analysis in Overflow.qll
|
2021-04-16 12:00:28 +01:00 |
|
Taus
|
5c79ad2412
|
Python: Apply suggestions from code review
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
|
2021-04-16 11:38:29 +02:00 |
|
Taus
|
af0c32c01d
|
Python: Apply suggestions from code review
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
|
2021-04-16 11:35:12 +02:00 |
|
Anders Schack-Mulligen
|
605f28f741
|
Merge pull request #5686 from smowton/haby0/JsonHijacking
Java: JSONP Injection w/cleanups
|
2021-04-16 11:09:17 +02:00 |
|
Tamas Vajk
|
b0975bb3ea
|
Update supported C#/.NET versions
|
2021-04-16 09:15:43 +02:00 |
|
Chris Smowton
|
c37994089c
|
Revert changes to unrelated query
|
2021-04-15 16:24:29 +01:00 |
|
Chris Smowton
|
254de76078
|
Remove unnecessary stubs
|
2021-04-15 16:20:27 +01:00 |
|
haby0
|
dedf765542
|
Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
Co-authored-by: Chris Smowton <smowton@github.com>
|
2021-04-15 22:59:22 +08:00 |
|
CodeQL CI
|
578ce1e512
|
Merge pull request #5683 from asgerf/js/typescript-template-literal-type-crash
Approved by erik-krogh
|
2021-04-15 05:11:11 -07:00 |
|
Mathias Vorreiter Pedersen
|
7fbc62358e
|
C++: Accept test changes after making the exprMightOverFlow predicates more sound.
|
2021-04-15 13:57:44 +02:00 |
|
haby0
|
0e183ab4a4
|
Finish comment
|
2021-04-15 19:49:06 +08:00 |
|
Chris Smowton
|
fa36ba901a
|
Merge pull request #5471 from artem-smotrakov/el-injection
Java: Query for detecting Jakarta Expression Language injections
|
2021-04-15 12:39:34 +01:00 |
|
haby0
|
d269a7e717
|
CWE-598 reduction
|
2021-04-15 19:33:15 +08:00 |
|
haby0
|
216f204438
|
delete FilterClass
|
2021-04-15 19:28:25 +08:00 |
|
haby0
|
583d0889e2
|
delete tomcat-embed-core stub, update the ServletGetMethod class
|
2021-04-15 17:40:51 +08:00 |
|
haby0
|
5d05e4d224
|
Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
Co-authored-by: Chris Smowton <smowton@github.com>
|
2021-04-15 17:28:53 +08:00 |
|
Asger Feldthaus
|
f8570bb293
|
JS: Update TRAP
|
2021-04-15 10:16:46 +01:00 |
|
Asger Feldthaus
|
cb736c8c82
|
JS: Change note
|
2021-04-15 09:37:57 +01:00 |
|
Tom Hvitved
|
972cc47f67
|
Merge pull request #5673 from hvitved/csharp/customizations
C#: Add `Customizations.qll`
|
2021-04-15 10:24:29 +02:00 |
|
Asger Feldthaus
|
b4a2a9db25
|
JS: Fix extraction of non-substitution template literal types
|
2021-04-15 09:23:45 +01:00 |
|
haby0
|
b3bdf89fc2
|
rm VerificationMethodFlowConfig, use springframework-5.2.3 stub
|
2021-04-15 10:25:40 +08:00 |
|
CodeQL CI
|
4be183c7f6
|
Merge pull request #5675 from erik-krogh/libXss
Approved by esbena
|
2021-04-14 14:34:23 -07:00 |
|
Robert Marsh
|
fe57876fd8
|
Merge pull request #5643 from dbartol/smart-pointers/side-effect-refactor
C++: Refactor some side effect generation code
|
2021-04-14 09:59:41 -07:00 |
|
Artem Smotrakov
|
97186b3d30
|
Added comments for tests
|
2021-04-14 19:30:58 +03:00 |
|
Andrew Eisenberg
|
56ba0f080a
|
Merge pull request #5659 from github/aeisenberg/mark-as-stale
Actions: Add workflow for marking stale questions
|
2021-04-14 08:37:55 -07:00 |
|
Andrew Eisenberg
|
392adf2a25
|
Workflows: Remove dry-run flag for labeller
|
2021-04-14 08:25:34 -07:00 |
|
Dave Bartolomeo
|
b29f35f564
|
Fix formatting
|
2021-04-14 11:15:16 -04:00 |
|
Geoffrey White
|
64fed4cb10
|
Merge pull request #5677 from MathiasVP/fix-duplicate-ids-in-experimental
C++: Fix duplicate names in experimental queries
|
2021-04-14 15:58:49 +01:00 |
|
Jonas Jensen
|
b4f01c9afa
|
Merge pull request #5578 from MathiasVP/ast-flow-smart-pointers
C++: AST dataflow through smart pointers
|
2021-04-14 16:39:05 +02:00 |
|
Mathias Vorreiter Pedersen
|
53a320a810
|
C++: Fix duplicate names.
|
2021-04-14 16:33:18 +02:00 |
|
Mathias Vorreiter Pedersen
|
bb447d7174
|
C++: Make sure missingGuardAgainstOverflow (and underflow) holds when range analysis fails to deduce a bound.
|
2021-04-14 16:30:43 +02:00 |
|
yoff
|
447f339857
|
Merge pull request #5641 from tausbn/python-use-localsourcenode-in-typetrackers
Python: Use API graphs in PEP249 support
|
2021-04-14 15:39:49 +02:00 |
|
Mathias Vorreiter Pedersen
|
92508beb82
|
Merge pull request #5600 from ihsinme/ihsinme-patch-258
CPP: Add query for CWE-691 Insufficient Control Flow Management When Using Bit Operations
|
2021-04-14 14:55:30 +02:00 |
|
Anders Schack-Mulligen
|
f43d427875
|
Merge pull request #5645 from Marcono1234/marcono1234/primary-ql-class
Java: Override getAPrimaryQlClass() for more classes
|
2021-04-14 14:51:29 +02:00 |
|
Mathias Vorreiter Pedersen
|
bc7cc2f7ce
|
C++: Remove rule that wasn't needed.
|
2021-04-14 14:50:27 +02:00 |
|
Mathias Vorreiter Pedersen
|
da36508714
|
Revert "C++: As response to the review comments this commit adds a reference-to-pointer state to AddressFlow. A call to an unwrapper function now adds a pointer -> reference-to-pointer transition, and a ReferenceDereference adds a reference-to-pointer -> pointer transition."
This reverts commit 5aeaab7c6d.
|
2021-04-14 14:41:22 +02:00 |
|
Chris Smowton
|
591ac38c31
|
Merge pull request #5591 from Marcono1234/marcono1234/member-nested-type
Java: Add MemberType
|
2021-04-14 12:29:54 +01:00 |
|
Taus
|
54c79bff74
|
Merge pull request #5666 from RasmusWL/django-refactor
Python: Refactoring and exposing of Django views/fields/forms
|
2021-04-14 13:07:20 +02:00 |
|
Mathias Vorreiter Pedersen
|
2e40d01397
|
Update cpp/ql/src/semmle/code/cpp/security/Overflow.qll
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
|
2021-04-14 13:01:31 +02:00 |
|
Rasmus Wriedt Larsen
|
44d2bf42d7
|
Merge pull request #5671 from tausbn/python-use-api-graphs-in-werkzeug
Python: Use API graphs in Werkzeug
|
2021-04-14 12:57:58 +02:00 |
|
Erik Krogh Kristensen
|
fd23e0bdda
|
use more API nodes in XmlParsers, and recognize more results from parsing XML
|
2021-04-14 11:48:31 +02:00 |
|
Anders Schack-Mulligen
|
3b6cd0f681
|
Merge pull request #5661 from smowton/smowton/cleanup/call-is-exprparent
Make Call a subclass of ExprParent.
|
2021-04-14 10:49:33 +02:00 |
|
Rasmus Wriedt Larsen
|
9de8085571
|
Merge pull request #5665 from tausbn/python-use-api-graphs-in-tornado
Python: Tornado cleanup using API graphs
|
2021-04-14 10:22:21 +02:00 |
|
Rasmus Wriedt Larsen
|
2d0c9b6bf2
|
Merge pull request #5670 from tausbn/python-use-api-graphs-in-dill
Python: Use API graphs in Dill model
|
2021-04-14 10:08:02 +02:00 |
|
Rasmus Wriedt Larsen
|
55723618a9
|
Python: Apply suggestions from code review
Co-authored-by: Taus <tausbn@github.com>
|
2021-04-14 10:05:50 +02:00 |
|
Chris Smowton
|
2965a1f204
|
Use Thread$State as an inner-class example
Map<>$Entry currently has odd generic notation that may be about to change.
|
2021-04-14 08:43:05 +01:00 |
|