Owen Mansel-Chan
700604a1c2
Convert old-style models for built-ins to MaD
...
These models are to cover the special cases where `append` can be used
with a second argument which is a string followed by `...`, and `copy`
can be used with a second argument which is a string. In this case the
taint is carried by the whole string, rather than in array elements.
2024-06-11 16:16:45 +01:00
Anders Schack-Mulligen
a26c01d7c7
Go: Add support for pretty-printed provenace in tests. Convert one test.
2024-06-07 11:47:45 +02:00
Owen Mansel-Chan
44a56c420f
Merge pull request #16558 from owen-mc/go/sync-external-flow
...
Go: sync ExternalFlow.qll
2024-06-05 11:31:34 +01:00
Owen Mansel-Chan
60970ff015
Merge pull request #16571 from owen-mc/go/remove-step-duplication-in-config
...
Go: remove flow step duplication in configs
2024-06-04 12:57:26 +01:00
Owen Mansel-Chan
cbbdd01d5a
Reinstate more descriptive QLDoc
2024-06-04 11:46:05 +01:00
Owen Mansel-Chan
6e67e724b4
Update documentation for receiver instead of -1
2024-06-04 11:46:02 +01:00
Owen Mansel-Chan
adfaae02e7
Cache interpretElement
2024-06-04 11:45:55 +01:00
Owen Mansel-Chan
479ea9f82c
Remove unused predicate hasExternalSpecification
2024-06-04 11:45:54 +01:00
Owen Mansel-Chan
174712a472
Delete unused predicate paramsString
...
This is needed for other languages, but in Go you cannot have two
functions which are distinguished only by their parameter types.
2024-06-04 11:45:52 +01:00
Owen Mansel-Chan
40127583fb
Make manual neutral summary models block generated summary models
2024-06-04 11:45:51 +01:00
Owen Mansel-Chan
5b04a71169
Non-trivial implementation of NeutralCallableAdapter
2024-06-04 11:45:49 +01:00
Owen Mansel-Chan
df8e04fcf9
Add predicate neutralElement matching summaryElement
2024-06-04 11:45:48 +01:00
Owen Mansel-Chan
209fe731a6
Change type of c to be more portable
2024-06-04 11:45:47 +01:00
Owen Mansel-Chan
e2008e14e2
Move summaryElement to FlowSummyImpl.qll
2024-06-04 11:45:45 +01:00
Owen Mansel-Chan
7f0f2d3438
Rename interpretSummary to summaryElement
2024-06-04 11:45:44 +01:00
Owen Mansel-Chan
961b09d63c
Use methods of AccessPathToken more
2024-06-04 11:45:42 +01:00
Owen Mansel-Chan
9f7c47509a
Expect "receiver" instead of "-1"
2024-06-04 11:45:41 +01:00
Owen Mansel-Chan
557adaf6f2
Update invalid model predicates
2024-06-04 11:45:40 +01:00
Owen Mansel-Chan
8e2e32742c
Use neutralModel in various places
2024-06-04 11:45:38 +01:00
Owen Mansel-Chan
83672f545f
Add neutralModel extensible predicate
2024-06-04 11:45:36 +01:00
Owen Mansel-Chan
a71e678bb9
Change imports
2024-06-04 11:45:33 +01:00
Owen Mansel-Chan
c3e1592815
Use AccessPath and AccessPathToken more
2024-06-04 11:45:27 +01:00
Owen Mansel-Chan
54a0c03e5d
Rename canonicalPackageHasASubpackage to canonicalPkgLink
2024-06-04 11:45:25 +01:00
Owen Mansel-Chan
e81a98925a
Remove QLDoc
2024-06-04 11:45:20 +01:00
Owen Mansel-Chan
797e5d0c8a
Rename packageHasASubpackage to packageLink
2024-06-04 11:45:17 +01:00
Owen Mansel-Chan
7c94120eb7
Rename packageHasMaDCoverage to relevantPackage
2024-06-04 11:45:13 +01:00
Owen Mansel-Chan
89e7bab0b3
QLDoc
2024-06-04 11:45:06 +01:00
Owen Mansel-Chan
133983678c
Merge pull request #16619 from owen-mc/go/fix/response-writer-variadic
...
Go: Fix bug in ResponseWriter for variadic MaD
2024-06-04 05:36:58 +01:00
Chuan-kai Lin
8d5bb21643
Merge pull request #16642 from github/post-release-prep/codeql-cli-2.17.4
...
Post-release preparation for codeql-cli-2.17.4
2024-05-31 09:08:03 -07:00
Owen Mansel-Chan
a5c392ed4b
Add back taint models for append and copy
...
This is needed when they are used with string arguments.
2024-05-30 21:01:03 +01:00
Owen Mansel-Chan
1d9a98614a
Fix bug in ResponseWriter for variadic MaD
...
`getSummaryInputOrOutputNode` was giving the summary component stack for
arguments corresponding to variadic parameters. This will be a problem
when the models for variadic functions are converted to models-as-data.
2024-05-29 21:15:49 +01:00
Anders Schack-Mulligen
3b12f69dd9
Dataflow/Go: Add getLocation to calls and callables for easier debugging.
2024-05-28 13:47:08 +02:00
Anders Schack-Mulligen
1432519cc2
Dataflow: Add totalorder predicates to all languages.
2024-05-27 11:01:52 +02:00
Anders Schack-Mulligen
bc8ca1af86
Dataflow: Introduce NodeRegions for use in isUnreachableInCall.
2024-05-27 11:01:51 +02:00
Owen Mansel-Chan
b2deea4606
Avoid duplicate additional flow steps in configs
...
`localTaintStep` includes a lot of steps which are already part of value
flow. Instead use `defaultAdditionalTaintStep`, which is just the extra
steps that are added for taint tracking.
2024-05-23 11:13:35 +01:00
Owen Mansel-Chan
cf997fddf6
Trivial: improve parameter names
...
These names make more sense and match everywhere
else that this function signature is used.
2024-05-23 11:04:09 +01:00
Tom Hvitved
454687d583
Data flow: Synthesize parameter return nodes
2024-05-21 14:47:42 +02:00
Erik Krogh Kristensen
bfc95c6f13
Merge pull request #16510 from erik-krogh/go-command
...
Go: Update the QHelp for `go/command-injection`.
2024-05-17 17:45:10 +02:00
erik-krogh
384649b336
changes based on review, and improve the new command-injection test
2024-05-17 08:38:54 +02:00
Owen Mansel-Chan
2dd42f7aa5
Merge pull request #16509 from owen-mc/go/fix-missing-underlying-types
...
Go: make two barriers recognise named types whose underlying types are integer types
2024-05-16 12:41:42 +01:00
Owen Mansel-Chan
b008f98782
Fix missing getUnderlyingType() calls
...
In both cases we also care about named types whose underlying type is
an integer type.
2024-05-16 11:10:15 +01:00
Owen Mansel-Chan
e71cf0ff1d
Use value flow instead of taint flow
2024-05-16 10:10:18 +01:00
erik-krogh
ea2b73bda2
add a sanitizer that checks that the string does not start with "--"
2024-05-16 09:25:19 +02:00
erik-krogh
b9a7f6a8f7
add regexp check as a sanitizer for command-injection
2024-05-16 08:55:03 +02:00
Owen Mansel-Chan
21ff705b73
Fix bug with read/store steps and named types
2024-05-16 00:35:45 +01:00
Owen Mansel-Chan
e1c85e3581
Fix elementWrite to include flow summaries
2024-05-10 23:40:58 +01:00
Owen Mansel-Chan
f95ccd242f
Remove old-style models of built-in functions
2024-05-10 23:40:54 +01:00
Owen Mansel-Chan
526204dc43
Merge pull request #16458 from owen-mc/go/fix-mad-for-builtin-functions
...
Go: fix `hasQualifiedName` and models-as-data for built-in functions
2024-05-09 15:06:07 +01:00
Owen Mansel-Chan
f6f594e4b5
parse empty string as package name
2024-05-08 15:33:19 +01:00
Owen Mansel-Chan
fb74a2a170
Use "" in qualified name for entities without a package
2024-05-08 15:33:19 +01:00
