Owen Mansel-Chan
6bc0ffe429
Convert BeegoInputSource to MaD
2024-07-01 16:13:37 +01:00
Owen Mansel-Chan
8d8af320bf
Add in missing summary models for Beego
2024-07-01 16:13:34 +01:00
Owen Mansel-Chan
3e2bbd38d4
Remove "$ANYVERSION" from models
2024-06-26 05:01:09 +01:00
Owen Mansel-Chan
700604a1c2
Convert old-style models for built-ins to MaD
...
These models are to cover the special cases where `append` can be used
with a second argument which is a string followed by `...`, and `copy`
can be used with a second argument which is a string. In this case the
taint is carried by the whole string, rather than in array elements.
2024-06-11 16:16:45 +01:00
Owen Mansel-Chan
18fa454d33
Replace Argument[-1] with Argument[receiver]
2024-06-04 11:45:59 +01:00
Owen Mansel-Chan
a8112ec62e
Add neutralModel to empty.model.yml so it is defined somewhere
2024-06-04 11:45:57 +01:00
Owen Mansel-Chan
ab5e1f8a69
Fix models for min and max and improve tests
...
Although the documentation makes them look variadic (and generic), they
are actually special-cased in the compiler. Like all built-in functions
they don't have a signature type, but the type of `min(a, b, c)` is
`func(int, int, int) int` and not `func(int, ...int) int`.
Go doesn't allow open-ended ranges for argument indices in
models-as-data specifications (though Ruby and Python do), so I've used
`1..1000`.
2024-05-14 14:40:56 +01:00
Owen Mansel-Chan
fcdac0aeb0
Add models for min and max built-in functions
2024-05-10 23:40:53 +01:00
Owen Mansel-Chan
1322ce35d6
Add model for built-in function copy
2024-05-10 23:40:53 +01:00
Owen Mansel-Chan
e857eedd4a
Fix model for append - it is variadic
2024-05-10 23:40:52 +01:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Owen Mansel-Chan
09e59ccf44
Name files with empty definitions of MaD extensible predicates to erowdmpty.model.yml
2024-05-01 21:39:38 +01:00
Tony Torralba
fc12537699
Go: Add Macaron sources
2024-03-04 14:29:56 +01:00
Tony Torralba
f9638760ff
Fix MaD rows
2024-02-14 17:25:08 +01:00
Tony Torralba
5a82d2188a
Fix double quotes in MaD row
2024-02-14 17:25:08 +01:00
Tony Torralba
2a30898af6
Go: Promote go/missing-jwt-signature-check from experimental
2024-02-14 17:25:03 +01:00
Tony Torralba
6b74cb7e75
Remove unneeded $ANYVERSION
2024-02-14 12:21:51 +01:00
Tony Torralba
ba1faea630
Go: Promote go/hardcoded-key from experimental
2024-02-14 12:15:14 +01:00
Owen Mansel-Chan
057ee85cd0
Merge pull request #14123 from am0o0/amammad-go-fastHttp
...
Go: fasthttp
2024-01-14 20:12:31 +00:00
Tony Torralba
dc911c3f28
Apply suggestions from code review
...
co-authored-by: Owen Mansel-Chan <owen-mc@github.com >
2024-01-10 11:53:53 +01:00
Tony Torralba
da4049e25c
Go: Migrate AppenderOrSprinter model to models-as-data
2024-01-09 16:35:47 +01:00
amammad
accc09fd8c
Lists of strings should be in alphabetical order. In a QLDoc, there should be a full stop at the end of each sentence. shorter model summary. change target from getACall() to getACall().getResult(.). better tests
2023-11-25 13:36:06 +01:00
amammad
2ad59a5403
fix SSRF sinks
2023-11-21 18:46:35 +01:00
amammad
9f8871746b
add flow summary instead of additional flow steps
2023-11-02 20:12:50 +01:00
Chris Smowton
0129167cc4
Convert Beego's MapGet method to MaD
2023-04-12 14:19:06 +01:00
Chris Smowton
b86f0cf268
Sort models
2023-04-12 14:19:06 +01:00
Chris Smowton
12527e406b
Remove unnecessary model
...
This referred to a private type
2023-04-12 14:19:05 +01:00
Chris Smowton
3cea01b6c8
Fix functions with multiple models
...
In some cases multiple return value outputs can be coalesced, and in others we had accidentally conflated two independent flows (e.g. Arg1 -> Arg2 | Arg3 -> Arg4 led to accidentally introducing Arg1 -> Arg4 and Arg3 -> Arg2)
2023-04-12 14:19:05 +01:00
Chris Smowton
4a89dbc498
Revert "Remove unnecessary models"
...
This reverts commit 12eaedc188487275e8cd6bed4a4318fed4d4b752.
We can't do this now, because there is nothing to guarantee an interface has actually been extracted, and therefore whether a model will get applied. Therefore explicitly modelling methods that may be interface implementations where the interface is in a different package may still make a difference to behaviour.
2023-04-12 14:19:05 +01:00
Chris Smowton
ed56461ed7
Remove unnecessary models
...
These are inherited from Stringer, Reader, Writer and BinaryMarshaler
2023-04-12 14:19:05 +01:00
Chris Smowton
1a7927d3a1
Fix x/net/html.EscapeString modelling
...
This had never worked due to accidentally extending non-abstract class HtmlEscapeFunction; consequently it was neither a taint propagator in general, nor an HTML escape function. Added tests to ensure it is now behaving as intended.
2023-04-12 14:19:04 +01:00
Chris Smowton
aaa7f34386
Fix mixing of source and summary models
2023-04-12 14:19:04 +01:00
Chris Smowton
9447dfd636
Combine net/http models
2023-04-12 14:19:03 +01:00
Chris Smowton
0d306e6189
Restore versioning to one more protobuf model
2023-04-12 14:19:03 +01:00
Chris Smowton
2658a47f21
Remove another protobuf instance now handled in Protobuf.qll
2023-04-12 14:19:03 +01:00
Chris Smowton
a16d56258f
Clean up protobuf models
2023-04-12 14:19:03 +01:00
Chris Smowton
95a9fcae47
Remove spurious model
...
This referenced a test-specific package; these protobuf models are more than MaD can specify, so they have already moved back into Protobuf.qll.
2023-04-12 14:19:03 +01:00
Chris Smowton
0d66b68a56
Restore more package / subpackage boundaries and alternate package names
...
Note none of these alternate names are apparently tested, either before or afterwards.
2023-04-12 14:19:03 +01:00
Chris Smowton
5e121fb4fd
Restore Couchbase alternate package names
2023-04-12 14:19:03 +01:00
Chris Smowton
fd16c03fcf
Add Beego v2 models
2023-04-12 14:19:02 +01:00
Chris Smowton
172ff082d3
Default to tolerating multiple package versions
...
Subpackages still need to use the $ANYVERSION trick
2023-04-12 14:19:02 +01:00
Chris Smowton
2024747827
Add missing tests for html.Node taint propagators
...
The TaintTracking::FunctionModels for these appeared broken, so I suspect they had never worked.
2023-04-12 14:19:02 +01:00
Chris Smowton
8f4567349d
Add missing NewTokenizerFragment model and test
2023-04-12 14:19:02 +01:00
Chris Smowton
803b9d38cc
Add missing tests and models for json-patch
2023-04-12 14:19:02 +01:00
Chris Smowton
5e74930881
Add missing tests and models for go-pg/pg/orm.Formatter
2023-04-12 14:19:02 +01:00
Chris Smowton
c011e013e1
fixup restoration of variadic models
2023-04-12 14:19:01 +01:00
Chris Smowton
c8407ba323
Revert variadic functions to use non-MaD models
2023-04-12 14:19:01 +01:00
Chris Smowton
9c45192a4e
Remove spurious duplicate models
2023-04-12 14:19:00 +01:00
Chris Smowton
c242c28af9
Use $ANYVERSION to allow applying a model to all versions of a given package
2023-04-12 14:19:00 +01:00
