amammad
45499b03d2
change qury file name same as qhelp name
2023-06-26 21:23:22 +10:00
amammad
21b5571bff
V1.1 add additional steps for read methods which I can summarize every single declared sanitizer on the sink whitin isSink predicate
2023-06-25 00:35:37 +10:00
amammad
7354db873a
V1 Bombs
2023-06-24 08:57:57 +10:00
jorgectf
2dc4f23dbb
Add models for org.apache.commons.lang
2023-06-23 19:34:21 +02:00
Jorge
7d0b880bf7
Merge branch 'main' into jorgectf/deserialization-lookahead
2023-06-23 18:24:39 +02:00
jorgectf
b6e4ba6f9d
Add SerialKiller model
2023-06-23 18:19:43 +02:00
Henry Mercer
5afdaf8fe1
Merge pull request #13525 from github/rc/3.10
...
Merge `rc/3.10` back to `main`
2023-06-21 17:13:36 +01:00
github-actions[bot]
18b678e69e
Post-release preparation for codeql-cli-2.13.4
2023-06-20 10:20:05 +00:00
aegilops
23bf8470ce
Removed .md and made class change
2023-06-19 17:29:17 +01:00
Jeroen Ketema
9c774ac97f
Merge pull request #13426 from jketema/inline-3
...
Update inline flow tests to use parameterized module
2023-06-19 17:39:29 +02:00
Jean Helie
423336310c
Merge pull request #13480 from github/jhelie/clean-up-mad-kinds-use
...
Java: clean up mad kinds use
2023-06-19 16:21:20 +02:00
aegilops
8c9ccab9c9
Autoformat
2023-06-19 11:53:53 +01:00
aegilops
2112d73a6a
Autoformat
2023-06-19 11:50:54 +01:00
aegilops
1a108fb1c9
Changed to for constant string
2023-06-19 11:46:08 +01:00
aegilops
7c235e3786
Fixed linting issues. Will not fix instanceof, that is necessary
2023-06-19 11:41:23 +01:00
Tony Torralba
8f6d2ed2f9
Adjust ZipSlip query description according to review suggestions.
2023-06-19 10:27:41 +02:00
Tony Torralba
3c4d938cf1
Apply code review suggestions.
...
Co-authored-by: Asger F <asgerf@github.com >
2023-06-19 10:20:19 +02:00
Tony Torralba
433fc680ec
Apply suggestions from code review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2023-06-19 10:17:40 +02:00
aegilops
8c73fbeabe
Formatted
2023-06-16 17:33:21 +01:00
aegilops
55eeb00309
Added experimental tag
2023-06-16 17:27:01 +01:00
aegilops
b6c35dd88c
Added experimental version of Java Command Injection query, to be more sensitive to unusual code constructs
2023-06-16 17:12:53 +01:00
Jean Helie
baf6b74945
use new sink mad kinds and simplify isKnownKind predicate
2023-06-16 13:58:23 +02:00
Jean Helie
daf2743143
only use neutral models of kind "sink"
2023-06-16 13:58:23 +02:00
Tony Torralba
c97868f774
Add change notes
2023-06-16 09:01:02 +02:00
Tony Torralba
3e96fe60c5
Go/Java/JS/Python/Ruby: Update the description and qhelp of the ZipSlip query
...
All filesystem operations, not just writes, with paths built from untrusted archive entry names are dangerous
2023-06-16 08:52:44 +02:00
Jeroen Ketema
742eb8dd12
Java: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:10 +02:00
Jean Helie
209f3e26d4
Merge pull request #13239 from github/tausbn/automodel-application-mode
...
Java: Add QL support for automodel application mode
2023-06-14 11:42:26 +02:00
Tony Torralba
ffe67689ec
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-13 09:27:33 +02:00
Stephan Brandauer
b38bc52019
Java: fix bug in ExcludedFromModeling Characteristic
2023-06-09 14:57:56 +02:00
Anders Schack-Mulligen
a0a9d30286
Java: Fix qltests.
2023-06-09 08:37:35 +02:00
github-actions[bot]
e4be303a23
Release preparation for version 2.13.4
2023-06-08 19:57:37 +00:00
Stephan Brandauer
2921df41da
Java: fix import
2023-06-07 15:22:59 +02:00
Stephan Brandauer
ec3a7e39ad
Java: qldoc style
2023-06-07 14:57:38 +02:00
Stephan Brandauer
715b1351f3
Java: share considerSubtypes predicate between Java modes
2023-06-07 14:55:00 +02:00
Stephan Brandauer
7e77e2ea82
Java: comment why we're using erased types in MaD
2023-06-07 14:42:20 +02:00
Stephan Brandauer
a8799fe981
Java: share getCallable interface between automodel extraction modes
2023-06-07 14:38:52 +02:00
Tony Torralba
6d7234f8ed
Merge pull request #13225 from atorralba/atorralba/java/path-injection-mad-sinks-2
...
Java: Migrate path injection sinks to models-as-data (simplified)
2023-06-07 14:27:36 +02:00
Stephan Brandauer
92ad02a752
Java: update getRelatedLocation qldoc
2023-06-07 14:09:07 +02:00
Stephan Brandauer
be6b1d8aaf
Java: remove SkipFrameworkModeling characteristic in favour of later evaluation
2023-06-07 13:58:56 +02:00
Stephan Brandauer
2e16b71215
Java: update qldoc of ClassQualifierCharacteristic
2023-06-07 13:52:57 +02:00
Stephan Brandauer
1bfbfec1bc
Java: use problem.severity in automodel extraction queries
2023-06-07 13:44:52 +02:00
Erik Krogh Kristensen
6ba7f9a238
Merge pull request #13352 from erik-krogh/once-again-deps-not-py-cpp
...
delete old deprecations
2023-06-07 13:00:57 +02:00
Ian Lynagh
f690d150b0
Merge pull request #13373 from igfoo/igfoo/kotlin-loc
...
Java/Kotlin: Split lines of code by language
2023-06-06 11:49:18 +01:00
Nick Rolfe
6c5c338e6b
Merge pull request #13348 from github/nickrolfe/java-location-tostring
...
Java: avoid call to `Location.toString()`
2023-06-06 09:55:42 +01:00
Ian Lynagh
e49b278d61
Java/Kotlin: Add a changenote for the lines-of-code changes.
2023-06-05 16:33:12 +01:00
Ian Lynagh
a4a7ad8f99
Java/Kotlin: Split lines of code by language
...
We were giving the sum of all lines for both languages, but labelling it
as "Total lines of Java code in the database", which was confusing.
Now we give separate sums for Kotlin and Java lines.
2023-06-05 13:57:47 +01:00
erik-krogh
44b6366586
delete old deprecations
2023-06-02 11:58:08 +02:00
Tony Torralba
527fe523a8
Add PathCreation.qll sinks to models-as-data
...
The old PathCreation sinks can't be removed because doing so would cause alert wobble in the path injection queries. See their getReportingNode predicates.
2023-06-02 09:14:35 +02:00
Tony Torralba
c3b1ef2cdf
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-02 08:57:24 +02:00
Jami
617107de35
Merge pull request #12916 from jcogs33/jcogs33/revamp-java-sink-kinds
...
Java: revamp MaD sink kinds
2023-06-01 12:48:30 -04:00
