Tom Hvitved
e7acf8c3a8
Ruby: Add test
2023-08-10 08:53:00 +02:00
Maiky
97f8d1fca9
add getValue() method
2023-08-10 00:39:35 +02:00
Maiky
e60fa6f1a7
Remove unnecesary }
2023-08-10 00:25:47 +02:00
Maiky
c5c2df4593
fix Singleton set literal
2023-08-10 00:13:02 +02:00
Brandon Stewart
74567041a7
remove pathgraph
2023-08-09 19:51:07 +00:00
Brandon Stewart
cca4c35cf8
add pathgraph
2023-08-09 19:23:21 +00:00
Brandon Stewart
7f07422a5d
Merge branch 'main' into add-cwe-208
2023-08-09 14:52:51 -04:00
Brandon Stewart
07d5beca34
run format document
2023-08-09 18:51:55 +00:00
github-actions[bot]
432c21d4fb
Post-release preparation for codeql-cli-2.14.2
2023-08-09 18:45:18 +00:00
Brandon Stewart
26401fec70
address PR comments
2023-08-09 18:44:42 +00:00
Harry Maclean
b03f6efa60
Ruby: Refactor
2023-08-09 15:01:40 +01:00
Harry Maclean
142393b599
Ruby: Handle unknown content in splat flow
2023-08-09 15:01:40 +01:00
Harry Maclean
4239268efd
Ruby: Prevent some false flow into splat params
...
In cases where there are positional parameters after a splat parameter,
don't attempt to match the splat parameter to a splat argument. We need
more sophisticated modelling to handle these cases, which is future
work.
2023-08-09 15:01:40 +01:00
Harry Maclean
6f3e2cdde3
Ruby: Add change note
2023-08-09 15:01:40 +01:00
Harry Maclean
c0baa5116f
Ruby: add test for example splat arg/param matches
2023-08-09 15:01:40 +01:00
Harry Maclean
72356d1515
Ruby: track flow from *args to positional params
...
This models flow in the following case:
def foo(x, y)
sink x # 1
sink y # 2
end
args = [source 1, source 2]
foo(*args)
We do this by introducing a SynthSplatParameterNode which accepts
content from the splat argument, if one is given at the callsite.
From this node we add read steps to each positional parameter.
2023-08-09 15:01:40 +01:00
Brandon Stewart
93dd9d0aa4
Update ruby/ql/src/experimental/cwe-208/UnsafeHmacComparison.ql
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-08-08 12:54:54 -04:00
erik-krogh
92db7b047c
escape unicode chars in the output for the ReDoS queries
2023-08-08 00:15:54 +02:00
github-actions[bot]
79c90fa36a
Release preparation for version 2.14.2
2023-08-07 18:08:52 +00:00
Jeroen Ketema
8b6a7985db
Refactor the traint-tracking library to follow the dataflow library refactoring
2023-08-07 15:23:15 +02:00
Jeroen Ketema
5d2984b7a5
Merge branch 'main' into shared-taint-tracking
2023-08-07 15:22:29 +02:00
Tom Hvitved
db88b7da88
Ruby: Adjust to data flow refactor
2023-08-07 11:35:21 +02:00
Jeroen Ketema
747cd1745a
Update all languages to use the shared taint-tracking library
2023-08-04 22:53:25 +02:00
Mathias Vorreiter Pedersen
abe3a816ce
Merge pull request #13851 from MathiasVP/sink-without-states
...
DataFlow: Support stateless `isSink` in `StateConfigSig`s
2023-08-04 18:01:42 +02:00
Maiky
0cd1c1e2e5
Make private
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-08-03 17:08:50 +02:00
Maiky
0dec4876f1
Replace cast to DataFlow::CallNode
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-08-03 17:08:35 +02:00
Maiky
6f1b406b3a
typo
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-08-03 17:08:10 +02:00
Maiky
0237f37842
typo
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-08-03 17:07:58 +02:00
Maiky
c54561e775
Merge branch 'main' into maikypedia/ldap-improper-auth
2023-08-03 16:49:30 +02:00
Maiky
fd649c1702
Fix getHost() (ldap.host = ip is not covered)
2023-08-03 16:37:48 +02:00
Maiky
f7a662814d
simplify usesSsl()
2023-08-03 16:20:20 +02:00
Maiky
2d87489dfa
change useSsl() to usesSsl()
2023-08-03 16:18:44 +02:00
Tom Hvitved
e011480114
Merge pull request #13509 from hvitved/cfg-pack
...
Convert shared CFG construction library to a parameterized module
2023-08-03 14:11:56 +02:00
Tom Hvitved
2ac646770e
Merge ControlFlowTreeBase and AstNode
2023-08-03 10:59:26 +02:00
Tom Hvitved
525ed65b0b
Rename getNode to getAstNode
2023-08-03 10:56:50 +02:00
Asger F
c38cbe859d
Merge pull request #13737 from asgerf/dynamic/fuzzy-models
...
Dynamic: add Fuzzy token
2023-08-03 09:58:24 +02:00
Tom Hvitved
2f3e52646c
Add class wrappers around newtype in Cfg.qll
2023-08-03 09:39:30 +02:00
Tom Hvitved
5d69e14cc1
Rename ControlFlowElement to AstNode
2023-08-03 09:39:30 +02:00
Tom Hvitved
1988397f93
Make shared CFG construction library a parameterized module
2023-08-03 09:39:30 +02:00
Mathias Vorreiter Pedersen
3007fdab5e
Sync identical files.
2023-08-02 14:33:33 +02:00
Anders Schack-Mulligen
7bc8bf616f
Merge pull request #13863 from aschackmull/dataflow/pack4
...
Dataflow: Move the shared library to a properly shared qlpack.
2023-08-02 14:19:49 +02:00
Anders Schack-Mulligen
73d4b126cf
Ruby: Adjust to use the qlpack data-flow api.
2023-08-01 14:02:33 +02:00
Alex Ford
af854749d7
Ruby: update Ldapinjection test output
2023-07-31 16:08:15 +01:00
Alex Ford
f437a6f729
Merge branch 'main' into maikypedia/ldap-injection
2023-07-31 16:00:41 +01:00
Alex Ford
558238a9be
Ruby: update TaintStep test output
2023-07-31 16:00:27 +01:00
Alex Ford
f272b0786a
Ruby: fix qldoc typo
2023-07-31 14:58:05 +01:00
Alex Ford
7f82aba7d4
qlformat
2023-07-31 14:57:14 +01:00
Alex Ford
2240e4bffb
Ruby: fix changenote date format
2023-07-31 14:56:53 +01:00
Maiky
2d88ac1846
Suggested Changes
2023-07-27 23:40:52 +02:00
Maiky
f5e17d7d39
Add additional Filter Methods
2023-07-27 23:04:55 +02:00
