hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-21 19:26:31 +01:00
Code Issues Packages Projects Releases Wiki Activity
33,347 Commits 1,672 Branches 157 Tags
hmac/command-injection-from-library-inputs
Commit Graph

5325 Commits

Author SHA1 Message Date
ihsinme
36de496d47 Add files via upload 2021-04-07 13:12:29 +03:00
ihsinme
9c3b7e81c7 Add files via upload 2021-04-07 13:10:00 +03:00
Robert Marsh
e22ec50dee Merge pull request #5613 from github/hmakholm/pr/fix-redos 
Fix ReDOS in cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql
 2021-04-06 15:54:27 -07:00
Geoffrey White
a8193dac08 C++: Reintroduce the exprMightOverflowNegatively bit. 2021-04-06 22:36:59 +01:00
Geoffrey White
60e4faba4c C++: Add linear expression logic. 2021-04-06 22:28:36 +01:00
Geoffrey White
48ff8e237c C++: Rewrite the range analysis exclusion to be recursive and more robust. 2021-04-06 22:26:55 +01:00
Geoffrey White
3ecd13531f C++: Improve isGuarded. 2021-04-06 22:21:59 +01:00
Henning Makholm
2d615ef503 Fix ReDOS in cpp/ql/src/Security/CWE/CWE-428/UnsafeCreateProcessCall.ql 
The sub-regex `(\s|.)*` aims to capture arbitrary string content
(in contrast to `.*` which doesn't match newlines), but it is
unsafe, since non-newline whitespace can match both alternatives.

This caused an evaluator crash in the wild.

Replace with `[\s\S]*`, which matches everything in a safe way.
 2021-04-06 20:10:57 +02:00
Mathias Vorreiter Pedersen
8382e85901 C++: Add flow into the source of read step and out of the target of a store step for smart pointers in AST dataflow. 2021-04-06 14:05:55 +02:00
Mathias Vorreiter Pedersen
a5f4d43d61 C++: Fix false positive by adding another allow-list pattern in AssignWhereCompareMeant. 2021-04-06 11:01:38 +02:00
Mathias Vorreiter Pedersen
ecbce88ec7 C++: Fix comment. 2021-03-31 22:23:50 +02:00
Mathias Vorreiter Pedersen
9ff894bf83 C++: Add support for AST dataflow out of functions that take a smart pointer by value. 2021-03-31 13:54:32 +02:00
Mathias Vorreiter Pedersen
e9e93c0eea Merge pull request #5558 from geoffw0/replace-tostring 
Replace toString use
 2021-03-31 13:50:41 +02:00
Geoffrey White
85ecfe2723 Update cpp/ql/src/experimental/Security/CWE/CWE-570/WrongInDetectingAndHandlingMemoryAllocationErrors.ql 
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
 2021-03-31 11:34:56 +01:00
Dave Bartolomeo
0cc8eaf3b4 Merge pull request #5543 from MathiasVP/smart-ptr-like-class 
C++: Add a class that models wrapped pointer types
 2021-03-30 16:00:13 -04:00
ihsinme
3f215d0954 Update OperatorPrecedenceLogicErrorWhenUseBoolType.ql 2021-03-28 23:43:22 +03:00
Geoffrey White
725122decc C++: Replace toString logic. 2021-03-26 17:29:05 +00:00
Mathias Vorreiter Pedersen
b466f0515d C++: Respond to more review comments. (1) Use getClassAndName to ensure a good join order, and (2) unify the two abstract predicates on PointerWrapper. 2021-03-26 16:16:23 +01:00
Mathias Vorreiter Pedersen
0ce08617ba C++: Respond to review comments. 2021-03-26 13:42:18 +01:00
Jonas Jensen
7f16c52217 Merge pull request #3364 from github/rdmarsh/cpp/use-taint-configuration-dtt 
C++: use TaintTracking::Configuration in DefaultTaintTracking
 2021-03-26 12:39:25 +01:00
Mathias Vorreiter Pedersen
d20a0c9e82 C++: Add a class that models wrapped pointer types. 2021-03-26 11:50:06 +01:00
Jonas Jensen
86755c6a98 Merge pull request #5515 from criemen/fix-query-metadata 
C++: Fix query metadata warnings.
 2021-03-26 10:19:46 +01:00
Mathias Vorreiter Pedersen
983b64a05f Merge branch 'main' into rdmarsh/cpp/use-taint-configuration-dtt 2021-03-26 09:11:12 +01:00
Mathias Vorreiter Pedersen
24360d3a4c C++: Fix join order in AV rule 79 by joining with GVN after the recursive call. 2021-03-25 12:00:49 +01:00
Cornelius Riemenschneider
867471b122 C++: Delete old queries. 2021-03-25 10:23:17 +01:00
Cornelius Riemenschneider
47530d7526 C++: Fix query metadata warnings. 2021-03-24 18:01:21 +01:00
Mathias Vorreiter Pedersen
585606a933 C++: Respond to review comments. 2021-03-23 11:14:29 +01:00
Mathias Vorreiter Pedersen
7d0cfc69f1 C++: Don't override getParameterSizeIndex in the model for Accept. This fixes IR construction of calls to accept. 2021-03-23 09:53:09 +01:00
Jonas Jensen
0bfeba5251 Merge pull request #5414 from criemen/diagnostic-queries 
C++: Extractor/database diagnostic errors
 2021-03-22 13:23:24 +01:00
Mathias Vorreiter Pedersen
7ec86b5e7f C++: AdjustedConfiguration should not extend the same dataflow configuration as FromGlobalVarTaintTrackingCfg as this causes multiple configurations to be in scope for dataflow. 2021-03-22 11:35:29 +01:00
Cornelius Riemenschneider
668841cefa C++: Rename diagnostic queries. 2021-03-22 11:13:49 +01:00
ihsinme
26bac9f425 Apply suggestions from code review 
Co-authored-by: Robert Marsh <rdmarsh2@gmail.com>
 2021-03-21 15:25:29 +03:00
Jonas Jensen
98c1aa5298 Merge pull request #5271 from github/files-query 
C++: Summary metrics queries
 2021-03-19 12:56:19 +01:00
Tom Hvitved
09a49e4580 Merge pull request #5311 from hvitved/dataflow/lambda 
Data flow: Move C# lambda flow logic into shared library
 2021-03-19 11:44:15 +01:00
Cornelius Riemenschneider
e482d21949 C++: Make QLdoc check happy. 2021-03-19 11:40:20 +01:00
Cornelius Riemenschneider
63e560e3b4 Fix QL doc. 2021-03-19 11:27:51 +01:00
Cornelius Riemenschneider
39a7d3decc C++: Address review comments. 2021-03-19 11:23:47 +01:00
Cornelius Riemenschneider
783a63a8a8 Update cpp/ql/src/Summary/LinesOfCode.ql 
Co-authored-by: Shati Patel <42641846+shati-patel@users.noreply.github.com>
 2021-03-19 10:54:41 +01:00
Mathias Vorreiter Pedersen
2abf4c068f C++: Use getAnExpr. Also extend the other recursive case similarly. 2021-03-18 08:42:10 +01:00
Mathias Vorreiter Pedersen
a3f806bb1d Use GVN in AV rule 79. 2021-03-17 16:01:49 +01:00
Cornelius Riemenschneider
5e0601fe1f C++: Address review comments. 2021-03-17 12:28:03 +01:00
Mathias Vorreiter Pedersen
3914a93504 C++: Remove commonTaintStep from DefaultTaintTracking. 2021-03-17 11:56:59 +01:00
Cornelius Riemenschneider
144dcf1b5e C++: Include empty message for SuccessfulExtractions.ql. 2021-03-17 11:18:40 +01:00
Cornelius Riemenschneider
5e4e853ffb C++: Add missing QLDoc. 2021-03-17 11:18:40 +01:00
Cornelius Riemenschneider
4c4fc05553 C++: Make toString deterministic for tests. 2021-03-17 11:18:40 +01:00
Cornelius Riemenschneider
9612426680 C++: Initial file-related metric queries. 
This adds a library `FailedExtractions.qll` that classifies extractor errors
and provides a unified interface for both recoverable and irrecoverable
extractor errors.
This interface is then used by the new diagnostic queries to list
successfully extracted files, as well as files that encountered an
extraction error.
 2021-03-17 11:18:34 +01:00
Mathias Vorreiter Pedersen
43fbcc1c8a C++: Convert all the dataflow configurations to taint configurations. 2021-03-16 22:36:17 +01:00
Anders Schack-Mulligen
46bae88181 Merge pull request #5375 from aschackmull/dataflow/unbind 
Dataflow: Switch from unbind to pragma[only_bind_into].
 2021-03-16 14:03:54 +01:00
Tom Hvitved
b11e15154f Data flow: Sync files and add stubs 2021-03-16 13:49:32 +01:00
Cornelius Riemenschneider
755fec466f Apply suggestions from code review 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2021-03-16 13:21:57 +01:00