Nora Dimitrijević
|
8f5af3fca6
|
Merge branch 'main' into swift/js-injection
|
2022-11-18 17:07:20 +01:00 |
|
Geoffrey White
|
127888f3c1
|
Merge branch 'main' into alamofire2
|
2022-11-16 13:32:13 +00:00 |
|
Nora Dimitrijević
|
09b669a584
|
Swift: Add direct call to remote source to a test
Strangely, there are two separate paths to each of the JSEvaluateScript
sinks: one passing through the JSString constructor, one omitting this
step.
|
2022-11-15 21:57:46 +01:00 |
|
Geoffrey White
|
9887e2b53b
|
Merge branch 'main' into alamofire2
|
2022-11-15 12:19:54 +00:00 |
|
Tony Torralba
|
f2888dcb1e
|
Add sinks and tests for the AEXML library.
|
2022-11-14 15:46:44 +01:00 |
|
Geoffrey White
|
3e6eedec30
|
Swift: Fix test output after merge.
|
2022-11-14 14:42:56 +00:00 |
|
Geoffrey White
|
5460004223
|
Merge branch 'main' into HEAD
|
2022-11-14 13:44:39 +00:00 |
|
Tony Torralba
|
52bd140213
|
Fix test expectations
|
2022-11-14 12:41:13 +01:00 |
|
Tony Torralba
|
c03eab2410
|
Add XMLDocument sinks
|
2022-11-14 12:41:13 +01:00 |
|
Tony Torralba
|
a21db3b3c2
|
Merge pull request #11086 from atorralba/atorralba/swift/xxe-query
Swift: Add new query for XML External Entities (XML) vulnerabilities
|
2022-11-14 12:34:30 +01:00 |
|
Nora Dimitrijević
|
16ba5b1bb5
|
Swift: update doctests
|
2022-11-14 12:30:16 +01:00 |
|
Nora Dimitrijević
|
4b7a89e754
|
Merge branch 'main' into swift/js-injection
|
2022-11-11 12:23:26 +01:00 |
|
Geoffrey White
|
d97682991d
|
Swift: Add Alamofire sink for cpp/cleartext-transmission.
|
2022-11-10 15:33:00 +00:00 |
|
Karim Ali
|
b209cac2e2
|
Merge pull request #11063 from karimhamdanali/swift-pbe-constant-password
Swift: detect the use of constant passwords for password-based encryption
|
2022-11-10 16:36:27 +02:00 |
|
Karim Ali
|
e18b2cfa39
|
Merge pull request #11084 from karimhamdanali/swift-static-iv
Swift: detect the use of static initialization vectors
|
2022-11-10 16:35:21 +02:00 |
|
Geoffrey White
|
23ff3769ac
|
Swift: Add Alamofire tests for swift/cleartext-transmission.
|
2022-11-10 14:31:53 +00:00 |
|
Nora Dimitrijević
|
5940f17b83
|
Swift: Docs + doctests
|
2022-11-09 13:10:08 +01:00 |
|
Nora Dimitrijević
|
7585541514
|
Merge branch 'main' into swift/js-injection
|
2022-11-08 11:25:54 +01:00 |
|
Nora Dimitrijević
|
d37ed02e79
|
Swift: basic Data-related taint flow in query
Still TODO: a more comprehensive taint flow model for Data in the libs.
|
2022-11-08 11:24:53 +01:00 |
|
Nora Dimitrijević
|
66291d3575
|
Swift: sync tests pass with additional flow steps
TODO: Convert those flow steps to taint flow models in the library.
|
2022-11-08 11:09:55 +01:00 |
|
Karim Ali
|
5766ff21d0
|
Merge pull request #10993 from karimhamdanali/swift-pbe-constant-salts
Swift: detect the use of constant salts
|
2022-11-07 16:22:41 +02:00 |
|
Karim Ali
|
2a22c69a64
|
remove unused variable from test + updated expected output
|
2022-11-07 13:31:55 +02:00 |
|
Geoffrey White
|
7b62bed9db
|
Merge pull request #10947 from karimhamdanali/swift-pbe-iterations
Swift: detect hash functions with low # of iterations
|
2022-11-07 10:38:29 +00:00 |
|
Tony Torralba
|
3e1819f25d
|
Model XMLParser constructor init(contentsOf:)
|
2022-11-03 12:01:42 +01:00 |
|
Tony Torralba
|
fe138dc0a1
|
Add explicitly safe test cases
|
2022-11-03 12:01:42 +01:00 |
|
Tony Torralba
|
0c6957ea78
|
Adjust test expectations of a query affected by new summaries
|
2022-11-03 12:01:42 +01:00 |
|
Tony Torralba
|
dc6f60a501
|
Add new XXE query
Only XMLParser sinks for the time being
|
2022-11-03 12:01:42 +01:00 |
|
Nora Dimitrijević
|
28b7f0884f
|
Swift: UnsafeJsEval test finally compiles
|
2022-11-03 11:16:48 +01:00 |
|
Karim Ali
|
27d2dc6d9e
|
update expected results
|
2022-11-02 16:13:50 +02:00 |
|
Karim Ali
|
eefda61445
|
add a query that checks for the use of static IVs
|
2022-11-02 16:09:00 +02:00 |
|
Karim Ali
|
fe408cfb41
|
add a query that detects the use of constant passwords
|
2022-11-01 14:03:27 +02:00 |
|
Geoffrey White
|
c3577b2256
|
Swift: Rename test directory.
|
2022-11-01 09:21:50 +00:00 |
|
Geoffrey White
|
7d80c5c7f7
|
Swift: Rename query directory.
|
2022-11-01 09:21:10 +00:00 |
|
Mathias Vorreiter Pedersen
|
062a0abceb
|
Swift: Fix flow out of summarized callables.
|
2022-10-28 12:09:05 +02:00 |
|
Karim Ali
|
420c35d4a2
|
add a query that detects the use of constant salts
|
2022-10-26 15:32:59 +02:00 |
|
Karim Ali
|
18dd0f650c
|
update iterations threshold to most recent OWASP recommendation
which is at least 120,000 iterations for secure password hashing
|
2022-10-25 14:01:40 +02:00 |
|
Karim Ali
|
408c7bebe5
|
fix .expected file
|
2022-10-25 13:24:37 +02:00 |
|
Karim Ali
|
0d2e7d43b9
|
add expected output
|
2022-10-25 13:24:37 +02:00 |
|
Karim Ali
|
5179a99abb
|
fix test cases to use the correct class name
|
2022-10-25 13:24:37 +02:00 |
|
Karim Ali
|
c4b2519e6c
|
initial draft of the Swift query for CWE-916
|
2022-10-25 13:24:37 +02:00 |
|
Paolo Tranquilli
|
408968a417
|
Swift: fix swift compilation in QL tests
|
2022-10-21 15:20:38 +02:00 |
|
Geoffrey White
|
138643519c
|
Merge pull request #10757 from geoffw0/sqlinject
Swift: Query for SQL injection
|
2022-10-20 18:55:38 +01:00 |
|
Geoffrey White
|
027b71381a
|
Swift: annotate all cases.
|
2022-10-18 16:38:02 +01:00 |
|
Geoffrey White
|
0281bfedda
|
Merge pull request #10689 from d10c/swift/cleartext-storage-nsuserdefaults
Swift: Query for CWE-312: Exposure of sensitive information using NSUserDefaults
|
2022-10-17 14:05:17 +01:00 |
|
Geoffrey White
|
9767064310
|
Swift: Fix bug for sqlite3_prepare_v3.
|
2022-10-17 13:40:35 +01:00 |
|
Geoffrey White
|
1221cbaee7
|
Swift: Updated results after merge with main.
|
2022-10-17 13:35:46 +01:00 |
|
Geoffrey White
|
13018150ed
|
Merge branch 'main' into sqlinject
|
2022-10-17 13:30:14 +01:00 |
|
Karim Ali
|
bbc03a1578
|
add false negatives to the test case
|
2022-10-17 12:54:34 +02:00 |
|
Karim Ali
|
d56c82ff75
|
add a query that detects hardcoded keys
|
2022-10-17 12:54:34 +02:00 |
|
Geoffrey White
|
f96e4eb87e
|
Swift: One more go at getting the query message how ql-for-ql wants it.
|
2022-10-14 15:28:14 +01:00 |
|