Owen Mansel-Chan
9842445b52
Fix getType on ImplicitVarArgsSlice
...
It was not defined for built-in functions or for functions called via
a function variable.
2024-05-08 15:22:27 +01:00
erik-krogh
baa31e1469
delete outdated deprecations
2024-04-25 22:19:28 +02:00
Owen Mansel-Chan
f828f8ea65
Merge pull request #16250 from owen-mc/go/rename-untrusted-flow-source
...
Go: Rename `UntrustedFlowSource` to `RemoteFlowSource` to match other language libraries
2024-04-24 11:37:00 +01:00
Anders Schack-Mulligen
b2f09949df
Merge pull request #15599 from aschackmull/dataflow/fieldflowbranchlimit-v2
...
Dataflow: update fieldFlowBranchLimit semantics
2024-04-23 10:08:05 +02:00
Owen Mansel-Chan
b6f6bdc6f4
Make RemoteFlowAsSource private
...
`UntrustedFlowAsSource` should have been private. Since we are deprecating them anyway
we may as well make the replacement private (and make it use `instanceof`). The deprecation
comments have been updated.
2024-04-18 12:31:38 +01:00
Owen Mansel-Chan
a49b43fdf6
Add deprecated version of renamed public classes
2024-04-18 11:49:54 +01:00
Owen Mansel-Chan
a6646021d0
Rename Untrusted Flow to Remote Flow
...
Not matching case but preserving original case.
2024-04-18 11:49:05 +01:00
Owen Mansel-Chan
d967b2baa3
Rename UntrustedFlowAsSource to RemoteFlowAsSource
2024-04-18 11:48:04 +01:00
Owen Mansel-Chan
5fba9895c6
Rename UntrustedFlowSource to RemoteFlowSource
...
Only the whole word. Skipped one instance in an old change note.
2024-04-17 21:27:32 +01:00
Owen Mansel-Chan
2f56ec7fe0
Fix QLDoc
2024-04-17 16:32:49 +01:00
Owen Mansel-Chan
3ad2d90014
Make type switches tranform flow state
2024-04-17 16:32:36 +01:00
Owen Mansel-Chan
611f98bca4
Make type assertions transform the flow state
2024-04-17 16:32:30 +01:00
Owen Mansel-Chan
544660322f
Refactor flow state transforming barriers
2024-04-17 16:32:25 +01:00
Anders Schack-Mulligen
2f0987e980
Dataflow: Add dummy DataFlowSecondLevelScope implementations.
...
These could be an empty type, but Unit was available and it probably
doesn't matter.
2024-04-15 15:16:30 +02:00
Anders Schack-Mulligen
ba6039946b
Go: Add alert provenance plumbing.
2024-04-12 09:19:59 +02:00
Anders Schack-Mulligen
eafc0075fd
Legacy dataflow: Sync.
2024-04-12 09:19:54 +02:00
Owen Mansel-Chan
d4bb4d4faa
Merge pull request #16120 from owen-mc/go/fix/type-switch-control-flow
...
Go: Fix data flow through variable defined in type switch guard
2024-04-11 11:39:40 +01:00
Owen Mansel-Chan
a7c5e849f4
Expand ReplaceAll in sanitizer
2024-04-11 07:35:56 +01:00
Owen Mansel-Chan
c3fefa8f69
Add extra sanitizer Part.FileName()
2024-04-11 07:35:45 +01:00
Owen Mansel-Chan
21189af294
Improve QLDoc and refactor QL
2024-04-11 07:34:58 +01:00
Owen Mansel-Chan
dc3ea6c418
Merge pull request #11703 from Kwstubbs/go-taintedpath-additions
...
Go: Add and Modify Sanitizers For TaintedPath
2024-04-10 15:13:13 +01:00
Owen Mansel-Chan
a18a4fb62e
Avoid magic in TSynthLocation definition
...
This improves performance, because in this case magic is not beneficial.
2024-04-10 11:47:13 +01:00
Owen Mansel-Chan
6ae07a2c43
Add location for implicitly declared variables
2024-04-09 10:58:55 +01:00
Owen Mansel-Chan
ffdb610d93
Add new IR::Instruction MkTypeSwitchImplicitVariable
...
It represents the implicit declaration of a variable at the beginning of a case clause
2024-04-09 10:58:49 +01:00
Owen Mansel-Chan
32ea94e625
Merge pull request #16123 from owen-mc/go/misc-trivial-fixes
...
Go: miscellaneous trivial fixes
2024-04-04 21:09:15 +01:00
Owen Mansel-Chan
720961787b
Improve QLDoc for CaseClause
2024-04-04 10:37:25 +01:00
Owen Mansel-Chan
fe24710c96
Improve QLDoc of Entity.getDeclaration
2024-04-03 14:09:37 +01:00
Owen Mansel-Chan
c7f2e991ed
Improve QLDoc for TypeAssertExpr
...
Include information about the type assert `x.(type)` used in type switches.
2024-04-03 13:59:04 +01:00
Geoffrey White
4a4c77e81d
Remove claims about models-as-data that require you to select a parameter from non-Java languages. We believe this is only possible in Java.
2024-03-25 15:41:00 +00:00
Michael Nebel
6619be3137
Merge pull request #15940 from michaelnebel/csharp/sourcesinktests
...
C#: Source- and sink tests.
2024-03-21 08:12:16 +01:00
Michael Nebel
70c6744944
Java/Go/Swift: Sync changes.
2024-03-19 14:20:43 +01:00
Tom Hvitved
fc55567d90
Merge pull request #15853 from hvitved/dataflow/get-location
...
Data flow: Replace `hasLocationInfo` with `getLocation`
2024-03-18 20:21:46 +01:00
Tony Torralba
d8c0ab8e1f
Go: Consider more strings as hardcoded credentials
2024-03-14 10:11:39 +01:00
Tom Hvitved
e4a4c18166
Go: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Tom Hvitved
dddba3228b
Merge pull request #15867 from hvitved/dataflow/ap-limit
...
Data flow: Add `ConfigSig::accessPathLimit`
2024-03-12 14:57:51 +01:00
Kevin Stubbings
5acc15bfff
fix grammar
2024-03-11 20:13:08 -07:00
Kevin Stubbings
30fe4168e3
Removed filepath.base sanitizer
2024-03-11 15:08:10 -07:00
Kevin Stubbings
c4c0b22bc7
Formattinga and change notes
2024-03-11 14:54:30 -07:00
Kevin Stubbings
c9b49d3760
resolve feedback
2024-03-11 14:54:28 -07:00
Kevin Stubbings
530c76ca8b
Add New Sanitizers and Modify Old Ones
2024-03-11 14:53:29 -07:00
Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
Tony Torralba
7d74125508
Go: Promote go/uncontrolled-allocation-size
2024-03-07 15:17:49 +01:00
Tony Torralba
f4c2e65614
Merge pull request #15812 from atorralba/atorralba/go/squirrel-sinks
...
Go: Add SQLi sinks for Squirrel
2024-03-06 12:09:19 +01:00
Tony Torralba
e78e71c875
List Squirrel builders explicitly
2024-03-05 16:05:22 +01:00
Tony Torralba
a264ea23c6
Go: Add SQLi sinks for Squirrel
2024-03-05 15:35:34 +01:00
Owen Mansel-Chan
4dde1fb117
Only check strings of length <= 100 for dummy password with <= 2 unique characters
2024-03-05 11:45:17 +00:00
Chris Smowton
9f84653283
Merge pull request #15613 from smowton/smowton/fix/golang-map-range-read-dataflow
...
Golang: fix flow from a map value via a range statement
2024-02-27 15:42:43 +00:00
Chris Smowton
d57160db5c
Direct map stores via a post-update node
2024-02-23 16:37:26 +00:00
Tony Torralba
ad7d40f0af
Add missing QLDoc
2024-02-14 17:25:08 +01:00
Tony Torralba
2a30898af6
Go: Promote go/missing-jwt-signature-check from experimental
2024-02-14 17:25:03 +01:00
