Owen Mansel-Chan
133983678c
Merge pull request #16619 from owen-mc/go/fix/response-writer-variadic
...
Go: Fix bug in ResponseWriter for variadic MaD
2024-06-04 05:36:58 +01:00
Chuan-kai Lin
8d5bb21643
Merge pull request #16642 from github/post-release-prep/codeql-cli-2.17.4
...
Post-release preparation for codeql-cli-2.17.4
2024-05-31 09:08:03 -07:00
github-actions[bot]
a19149032f
Post-release preparation for codeql-cli-2.17.4
2024-05-31 14:49:11 +00:00
github-actions[bot]
a22e70373a
Release preparation for version 2.17.4
2024-05-31 13:40:51 +00:00
Owen Mansel-Chan
d112073a13
Edit change note
2024-05-30 21:04:05 +01:00
Owen Mansel-Chan
a5c392ed4b
Add back taint models for append and copy
...
This is needed when they are used with string arguments.
2024-05-30 21:01:03 +01:00
Chuan-kai Lin
b41835a7d9
Revert "Release preparation for version 2.17.4"
2024-05-30 09:25:15 -07:00
Owen Mansel-Chan
1d9a98614a
Fix bug in ResponseWriter for variadic MaD
...
`getSummaryInputOrOutputNode` was giving the summary component stack for
arguments corresponding to variadic parameters. This will be a problem
when the models for variadic functions are converted to models-as-data.
2024-05-29 21:15:49 +01:00
Anders Schack-Mulligen
2f95851537
Merge pull request #16603 from aschackmull/dataflow/location
...
Dataflow/Go: Add getLocation to DataFlowCall and DataFlowCallable for easier debugging.
2024-05-29 08:58:22 +02:00
github-actions[bot]
906b65d09c
Post-release preparation for codeql-cli-2.17.4
2024-05-28 18:02:25 +00:00
github-actions[bot]
33b4ae8bbb
Release preparation for version 2.17.4
2024-05-28 15:44:32 +00:00
Anders Schack-Mulligen
3b12f69dd9
Dataflow/Go: Add getLocation to calls and callables for easier debugging.
2024-05-28 13:47:08 +02:00
Anders Schack-Mulligen
1432519cc2
Dataflow: Add totalorder predicates to all languages.
2024-05-27 11:01:52 +02:00
Anders Schack-Mulligen
bc8ca1af86
Dataflow: Introduce NodeRegions for use in isUnreachableInCall.
2024-05-27 11:01:51 +02:00
Dave Bartolomeo
613ccaac1d
Add change note to all v1.0.0 packs
2024-05-23 13:01:22 -04:00
Owen Mansel-Chan
b2deea4606
Avoid duplicate additional flow steps in configs
...
`localTaintStep` includes a lot of steps which are already part of value
flow. Instead use `defaultAdditionalTaintStep`, which is just the extra
steps that are added for taint tracking.
2024-05-23 11:13:35 +01:00
Owen Mansel-Chan
cf997fddf6
Trivial: improve parameter names
...
These names make more sense and match everywhere
else that this function signature is used.
2024-05-23 11:04:09 +01:00
Dave Bartolomeo
ffe4c8c87b
Update all pack versions to 1.0.0
2024-05-22 13:39:08 -04:00
Tom Hvitved
454687d583
Data flow: Synthesize parameter return nodes
2024-05-21 14:47:42 +02:00
Erik Krogh Kristensen
bfc95c6f13
Merge pull request #16510 from erik-krogh/go-command
...
Go: Update the QHelp for `go/command-injection`.
2024-05-17 17:45:10 +02:00
erik-krogh
384649b336
changes based on review, and improve the new command-injection test
2024-05-17 08:38:54 +02:00
Owen Mansel-Chan
2dd42f7aa5
Merge pull request #16509 from owen-mc/go/fix-missing-underlying-types
...
Go: make two barriers recognise named types whose underlying types are integer types
2024-05-16 12:41:42 +01:00
Owen Mansel-Chan
8cc118f781
Add change note
2024-05-16 11:16:54 +01:00
Owen Mansel-Chan
b008f98782
Fix missing getUnderlyingType() calls
...
In both cases we also care about named types whose underlying type is
an integer type.
2024-05-16 11:10:15 +01:00
Owen Mansel-Chan
e71cf0ff1d
Use value flow instead of taint flow
2024-05-16 10:10:18 +01:00
Owen Mansel-Chan
5dbb91f508
Merge pull request #16504 from owen-mc/go/allow-array-reads-from-named-types
...
Go: allow read and store steps from named types
2024-05-16 09:47:54 +01:00
erik-krogh
ea2b73bda2
add a sanitizer that checks that the string does not start with "--"
2024-05-16 09:25:19 +02:00
erik-krogh
b9a7f6a8f7
add regexp check as a sanitizer for command-injection
2024-05-16 08:55:03 +02:00
Owen Mansel-Chan
6ffa821aa3
Add change note
2024-05-16 00:41:28 +01:00
Owen Mansel-Chan
21ff705b73
Fix bug with read/store steps and named types
2024-05-16 00:35:45 +01:00
Dave Bartolomeo
b49a61705c
Merge pull request #16491 from github/post-release-prep/codeql-cli-2.17.3
...
Post-release preparation for codeql-cli-2.17.3
2024-05-14 19:33:20 -04:00
github-actions[bot]
32e8b5c667
Post-release preparation for codeql-cli-2.17.3
2024-05-14 21:14:08 +00:00
Owen Mansel-Chan
145873f562
Merge pull request #16413 from owen-mc/go/fix-builtin-models
...
Go: fix models for built-in functions
2024-05-14 21:03:05 +01:00
github-actions[bot]
100166fa53
Release preparation for version 2.17.3
2024-05-14 19:23:18 +00:00
Owen Mansel-Chan
ab5e1f8a69
Fix models for min and max and improve tests
...
Although the documentation makes them look variadic (and generic), they
are actually special-cased in the compiler. Like all built-in functions
they don't have a signature type, but the type of `min(a, b, c)` is
`func(int, int, int) int` and not `func(int, ...int) int`.
Go doesn't allow open-ended ranges for argument indices in
models-as-data specifications (though Ruby and Python do), so I've used
`1..1000`.
2024-05-14 14:40:56 +01:00
Chuan-kai Lin
9456eaf5d3
Merge pull request #16420 from github/cklin/go-entities-reorder
...
Go: Use entities in reorder directives
2024-05-13 10:26:04 -07:00
Owen Mansel-Chan
e1c85e3581
Fix elementWrite to include flow summaries
2024-05-10 23:40:58 +01:00
Owen Mansel-Chan
8cc9838628
Add change note
2024-05-10 23:40:57 +01:00
Owen Mansel-Chan
f95ccd242f
Remove old-style models of built-in functions
2024-05-10 23:40:54 +01:00
Owen Mansel-Chan
fcdac0aeb0
Add models for min and max built-in functions
2024-05-10 23:40:53 +01:00
Owen Mansel-Chan
1322ce35d6
Add model for built-in function copy
2024-05-10 23:40:53 +01:00
Owen Mansel-Chan
e857eedd4a
Fix model for append - it is variadic
2024-05-10 23:40:52 +01:00
Owen Mansel-Chan
526204dc43
Merge pull request #16458 from owen-mc/go/fix-mad-for-builtin-functions
...
Go: fix `hasQualifiedName` and models-as-data for built-in functions
2024-05-09 15:06:07 +01:00
Owen Mansel-Chan
1ccea884ff
Add change note
2024-05-08 15:37:25 +01:00
Owen Mansel-Chan
f6f594e4b5
parse empty string as package name
2024-05-08 15:33:19 +01:00
Owen Mansel-Chan
fb74a2a170
Use "" in qualified name for entities without a package
2024-05-08 15:33:19 +01:00
Owen Mansel-Chan
4d42a88c3c
Add change note
2024-05-08 15:31:22 +01:00
Owen Mansel-Chan
9842445b52
Fix getType on ImplicitVarArgsSlice
...
It was not defined for built-in functions or for functions called via
a function variable.
2024-05-08 15:22:27 +01:00
Chuan-kai Lin
1dd3a0fd76
Go: Use entities in reorder directives
2024-05-03 11:16:08 -07:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
