Nora Dimitrijević
89f760460b
[DIFF-INFORMED] Go: CommandInjection
...
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-078/CommandInjection.ql#L28
2025-07-17 11:46:30 +02:00
Nora Dimitrijević
e0d16a863b
[DIFF-INFORMED] Go: AllocationSizeOverflow
...
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/Security/CWE-190/AllocationSizeOverflow.ql#L24
2025-07-17 11:46:29 +02:00
Owen Mansel-Chan
53e1939b60
Merge pull request #20053 from owen-mc/go/fix-dataflowconsistency
...
Go: Fix compilation of DataFlowImplConsistency.qll
2025-07-17 09:22:12 +01:00
Kevin Stubbings
f86152d3bd
Add sanitizer changes and fix test
2025-07-16 21:27:33 +00:00
Chris Smowton
b71f9ae240
Fix function qname
2025-07-15 16:37:30 +01:00
Chris Smowton
c8eefb7c5c
Golang: Mark filepath.IsLocal as a tainted-path sanitizer guard
2025-07-15 14:47:17 +01:00
Owen Mansel-Chan
9661ee407f
Fix compilation of DataFlowImplConsistency.qll
2025-07-15 13:51:45 +01:00
Owen Mansel-Chan
990043ce86
Add net/http.Head and net/http.Client.Head as client requests
...
They were previously deliberately excluded.
2025-07-08 14:31:48 +01:00
Owen Mansel-Chan
71703aa497
Improve formatting of some QL
2025-07-08 14:29:11 +01:00
Owen Mansel-Chan
9663ecad21
Avoid using deprecated class
2025-06-26 01:46:14 +01:00
Owen Mansel-Chan
0f07ab58cf
Merge pull request #19654 from owen-mc/go/fix-definedtype-getbasetype
...
Go: fix `DefinedType.getBaseType`
2025-06-26 00:19:19 +01:00
Owen Mansel-Chan
d7b1d7bef4
Merge pull request #19677 from owen-mc/go/better-class-names-and-helpers
...
Go: Improve two class names and add some helper predicates
2025-06-26 00:17:32 +01:00
Chris Smowton
2291e10ce6
Fix typo
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-06-25 21:38:22 +02:00
Nora Dimitrijević
e233501144
Go: mass enable diff-informed data flow
...
An auto-generated patch that enables diff-informed data flow in the obvious cases.
Builds on https://github.com/github/codeql/pull/18345 and https://github.com/github/codeql-patch/pull/88
2025-06-11 18:44:24 +02:00
Owen Mansel-Chan
c4a8ac4980
Add helper predicates for TypeSpec
2025-06-05 10:51:39 +01:00
Owen Mansel-Chan
d9bc165c72
Add helper predicates for FieldDecl
2025-06-05 10:35:25 +01:00
Owen Mansel-Chan
82e8d3af8d
Improve two class names
2025-06-05 10:34:53 +01:00
Owen Mansel-Chan
40000840c1
Fix definition of DefinedType.getBaseType
2025-06-03 14:50:03 +01:00
Owen Mansel-Chan
933e01b3d4
Remove redundant code
...
The case of a CallExpr is actually covered by the next disjunct.
Note that the CallExpr case had a subtle bug: `c.getTarget()` is not
defined when we are calling a variable. Better to use
`c.getCalleeType()`. But in this case we can just delete the code.
2025-05-13 15:55:20 +01:00
Owen Mansel-Chan
1ed8fbd811
Delete commented out code
2025-04-03 11:19:14 +01:00
Owen Mansel-Chan
1687042c3b
Add Bun models and tests
2025-04-02 14:17:39 +01:00
Owen Mansel-Chan
dc242da4be
Merge pull request #19090 from owen-mc/review/egregius313/18902
...
Go: Add `database` source models for the `squirrel` package (#2 )
2025-03-27 15:54:25 +00:00
Owen Mansel-Chan
8bc70be3c7
Address review comments
2025-03-27 13:53:09 +00:00
Owen Mansel-Chan
1de15ec66d
Fix signatures in comments
2025-03-25 10:33:23 +00:00
Ed Minnix
a8c3ef9500
Add squirrel models
2025-03-25 10:33:23 +00:00
Owen Mansel-Chan
bc40a4289c
Do not use full regex match for %T
2025-03-20 15:08:07 +00:00
Owen Mansel-Chan
f944ff4d78
Create getAValueFormattedMessageComponent
2025-03-20 15:08:06 +00:00
Owen Mansel-Chan
05a94807e1
Make comment clearer
2025-03-20 15:08:05 +00:00
Owen Mansel-Chan
009e0e17b2
Don't consider arguments with %T as logger call components
2025-03-20 15:07:26 +00:00
Edward Minnix III
28770c526d
Merge pull request #18863 from egregius313/egregius313/go/mad/database/rqlite
...
Go: Add `database` sources for the `gorqlite` package
2025-02-27 12:41:39 -05:00
Owen Mansel-Chan
f322cb7968
Use getLocation instead of hasLocationInfo
2025-02-27 13:32:45 +00:00
Owen Mansel-Chan
ca0b363be3
Replace DbLocation with Location
2025-02-27 11:44:20 +00:00
Owen Mansel-Chan
91dd9f5d95
Merge pull request #18868 from owen-mc/go/use-more-db-locations
...
Go: Slightly adjust some location info to match locations that are in the database
2025-02-26 16:13:33 +00:00
Owen Mansel-Chan
a11692707e
Use location of basic block for SsaPhiNode
2025-02-26 12:38:08 +00:00
Owen Mansel-Chan
6dad937ce2
Use location of basic block for SsaImplicitDefinition
2025-02-26 12:29:52 +00:00
Owen Mansel-Chan
052792f7c4
Use location of stmt for EvalImplicitTrueInstruction
2025-02-26 12:28:59 +00:00
Owen Mansel-Chan
90ea10e0b7
Use location of elt for ImplicitLiteralElementIndexInstruction
2025-02-26 12:23:34 +00:00
Owen Mansel-Chan
f34c3b16a2
Use location of control flow root for ExitNode
2025-02-26 12:20:41 +00:00
Owen Mansel-Chan
baa4c509ca
Use location of control flow root for EntryNode
2025-02-26 12:16:38 +00:00
Owen Mansel-Chan
561a681e90
Use location of condition for ConditionGuardNode
2025-02-26 12:11:16 +00:00
Owen Mansel-Chan
759f0583cb
Use location of first node for BasicBlock
2025-02-26 12:00:56 +00:00
Ed Minnix
7593def620
Model gorqlite package
2025-02-25 23:15:22 -05:00
Owen Mansel-Chan
0d994c1527
Merge pull request #18831 from owen-mc/go/join-order-fix-2
...
Go: Improve bad join order in guardingCall
2025-02-24 22:16:22 +00:00
Owen Mansel-Chan
d9d909a61e
Address review comments
2025-02-22 02:31:08 +00:00
Owen Mansel-Chan
50d1bc6aa0
Improve bad join order
2025-02-21 10:31:46 +00:00
Owen Mansel-Chan
44c5df5246
Force global value fanout to go last
2025-02-21 01:01:09 +00:00
Owen Mansel-Chan
7b6a91e90e
Fix bad join order in comparesFirstCharacter
2025-02-20 14:49:25 +00:00
Owen Mansel-Chan
a9b9410104
Merge pull request #17759 from Kwstubbs/path-sanitizers
...
Go: Add Tainted Path sanitizers
2025-02-14 13:13:19 +00:00
Kevin Stubbings
74f16ee866
Merge branch 'main' into path-sanitizers
2025-02-14 01:11:39 -08:00
Owen Mansel-Chan
1a52398a29
Address review comments
2025-02-13 21:59:14 +00:00
