hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-08-04 01:13:00 +02:00
Code Issues Packages Projects Releases Wiki Activity
87,866 Commits 1,818 Branches 172 Tags
python/class-instance
Commit Graph

1121 Commits

Author SHA1 Message Date
Owen Mansel-Chan
1c66564ccc address review comments 2023-05-10 14:05:09 +01:00
Michael Nebel
4ac0396b67 Go/Python/Ruby/Swift: Sync files and make dummy implementation. 2023-05-08 16:18:59 +02:00
Kasper Svendsen
e969018f99 Go: Make implicit this receivers explicit 2023-05-03 12:45:42 +02:00
Anders Schack-Mulligen
ca09649679 Dataflow: Forward hasLocationInfo. 2023-05-02 10:48:32 +02:00
Anders Schack-Mulligen
5927bb2030 Dataflow: Replace "extends Node" with "instanceof Node". 2023-05-02 09:48:34 +02:00
Anders Schack-Mulligen
6c8cb0dc5e Merge pull request #12930 from aschackmull/dataflow/split-typedcontent 
Dataflow: Refactor access paths to split TypedContent into an explicit pair
 2023-05-01 14:58:15 +02:00
Michael B. Gale
edfe2d7ab7 Merge pull request #12944 from github/mbg/go/html-template-sanitizers 
Go: Add `html/template` functions as sanitisers for XSS queries
 2023-04-28 12:15:57 +01:00
Owen Mansel-Chan
8415c4a4eb Remove ArgumentNode assumption 2023-04-28 09:23:38 +01:00
Owen Mansel-Chan
c7c0a73b90 Accept review suggestions 2023-04-28 09:23:37 +01:00
Owen Mansel-Chan
52cc61198d Use CallExpr.hasImplicitArgs() 2023-04-28 09:23:37 +01:00
Owen Mansel-Chan
b928f13d94 Add CallExpr.hasImplicitArgs() 2023-04-28 09:23:36 +01:00
Owen Mansel-Chan
f3c1c53b54 Add CallExpr.getCalleeType() 
This avoids using `getTarget()`, so it works even when that doesn't
exist (for example when calling a variable with function type).
 2023-04-28 09:23:36 +01:00
Owen Mansel-Chan
3f095db853 Formatted parameters always a variadic parameter 2023-04-28 06:09:11 +01:00
Owen Mansel-Chan
bc0f9030e3 use CallNode.getSyntacticArgument 2023-04-28 06:09:10 +01:00
Owen Mansel-Chan
17077f3ec5 Update OutParameter.getExitNode for implicit varargs slices 2023-04-28 06:09:10 +01:00
Anders Schack-Mulligen
71ae0909d8 Dataflow: Enforce type pruning in all forward stages. 2023-04-27 14:55:26 +02:00
Anders Schack-Mulligen
9140cbefc0 Dataflow: Sync. 2023-04-27 14:55:23 +02:00
Michael B. Gale
1aa1153ed6 Go: Add html/template as XSS queries sanitizer 2023-04-26 21:21:52 +01:00
Owen Mansel-Chan
39da26e9b5 Update ParameterInput.getEntryNode for implicit varargs slices 2023-04-26 14:35:20 +01:00
Owen Mansel-Chan
1e3d81842e Update CallNode.getArgument for implicit varargs 
It now has one only result corresponding to a variadic parameter. If the
argument is followed by an ellipsis then it is just the argument itself.
Otherwise it is a ImplicitVarargsSlice node.
 2023-04-26 14:35:19 +01:00
Anders Schack-Mulligen
d681671356 Dataflow: Sync. 2023-04-26 14:45:07 +02:00
Owen Mansel-Chan
3e73e02175 Update PostUpdateNodes for implicit varargs slices 
We don't want a post update node for the implicit varargs slice, and we
do want one for each argument which is stored in the implicit varargs
slice.
 2023-04-25 07:33:35 +01:00
Owen Mansel-Chan
73b712a8c9 Allow data flow through varargs parameters 2023-04-25 07:33:34 +01:00
Michael Nebel
656d8d2451 Sync files. 2023-04-20 11:29:51 +02:00
Owen Mansel-Chan
a42dbc5bab Fix formatting again 2023-04-14 12:00:38 +01:00
Owen Mansel-Chan
d407a689fa Fix formatting by deleting spaces no blank line 2023-04-14 12:00:38 +01:00
Owen Mansel-Chan
169bde8671 Fix formatting by deleting blank line 2023-04-14 12:00:38 +01:00
Alvaro Muñoz
8bf4b55309 Partial URLs should not sanitize against SSRF 
As an example:

```go
	urlPath := ctx.Req.URL.Path
	hash := urlPath[strings.LastIndex(urlPath, "/")+1:]
        req, _ := http.NewRequest("GET", source+hash, nil)
```
 2023-04-14 12:00:38 +01:00
Michael Nebel
917cf7bfee Go: Update provenance validation. 2023-04-13 09:21:05 +02:00
Michael Nebel
1d82b09ec1 Sync files. 2023-04-13 09:21:05 +02:00
Chris Smowton
7eefa43f5a Rename and document viableArgParamSpecific to make clear it is a temporary hook. 2023-04-12 14:33:46 +01:00
Chris Smowton
1706367b34 Document DataFlowCallable 2023-04-12 14:24:21 +01:00
Chris Smowton
4d8ca3d759 Add dataflow callback to filter out receiver argument flow to Golang interface dispatch candidates. 
Other langauges stub the callback.
 2023-04-12 14:19:06 +01:00
Chris Smowton
7ffe863ba6 Remove addressed FIXME 
This was addressed by adding `getAPackageWithSummarizedCallables`
 2023-04-12 14:19:06 +01:00
Chris Smowton
985e07d902 pragma[nomagic] hasQualifiedName 
These are cheap and frequently-used, and magicking them with respect to `interpretPackage` was yielding expensive, unnecessary regex operations.
 2023-04-12 14:19:06 +01:00
Chris Smowton
0129167cc4 Convert Beego's MapGet method to MaD 2023-04-12 14:19:06 +01:00
Chris Smowton
3f6ceccbe8 US spelling 2023-04-12 14:19:05 +01:00
Chris Smowton
19e8974766 Fix comment 2023-04-12 14:19:05 +01:00
Chris Smowton
1a7927d3a1 Fix x/net/html.EscapeString modelling 
This had never worked due to accidentally extending non-abstract class HtmlEscapeFunction; consequently it was neither a taint propagator in general, nor an HTML escape function. Added tests to ensure it is now behaving as intended.
 2023-04-12 14:19:04 +01:00
Chris Smowton
fa4145b5e4 Remove dead code 2023-04-12 14:19:04 +01:00
Chris Smowton
8a06ca5a43 Allow $ANYVERSION token in Go package names 2023-04-12 14:19:04 +01:00
Chris Smowton
952bc8458f Use explicit this 2023-04-12 14:19:04 +01:00
Chris Smowton
affe42b079 Use US spelling 2023-04-12 14:19:04 +01:00
Chris Smowton
18d00c1116 Autoformat QL 2023-04-12 14:19:03 +01:00
Chris Smowton
8fb75f412a Consider MaD models ref whether a package should be considered an unknown external. 2023-04-12 14:19:03 +01:00
Chris Smowton
0d66b68a56 Restore more package / subpackage boundaries and alternate package names 
Note none of these alternate names are apparently tested, either before or afterwards.
 2023-04-12 14:19:03 +01:00
Chris Smowton
172ff082d3 Default to tolerating multiple package versions 
Subpackages still need to use the $ANYVERSION trick
 2023-04-12 14:19:02 +01:00
Chris Smowton
e6718322bb Restore query-specific FunctionModels 
MaD can't be used to introduce query-specific sumamries at the moment.
 2023-04-12 14:19:02 +01:00
Chris Smowton
3c8182b521 Format and reorder 2023-04-12 14:19:02 +01:00
Chris Smowton
9e38e8d675 Restore model of builtin copy function. 
This is another with no real signature type.
 2023-04-12 14:19:01 +01:00