Owen Mansel-Chan
024fbf8f3a
Rename "named" to "defined" in dbscheme
2025-02-13 15:55:21 +00:00
Owen Mansel-Chan
09c44616a0
Rename "named type" to "defined type"
2025-02-13 15:22:33 +00:00
Owen Mansel-Chan
04e17ec987
Merge pull request #18565 from owen-mc/go/mad/parameter
...
Go: Fix "Parameter" in models-as-data
2025-01-29 14:13:17 +00:00
Owen Mansel-Chan
168fe4ae20
Merge pull request #18543 from owen-mc/go/misc-improvements-rs-cors
...
Go: miscellaneous improvements rs cors models
2025-01-29 14:12:20 +00:00
erik-krogh
34f5f61a10
all: use my script to delete outdated deprecations
2025-01-27 22:16:48 +01:00
Owen Mansel-Chan
08ea30ea8d
Fix bug in InterpretNode.asCallable
...
It was only working for summarized callables.
2025-01-22 22:59:28 +00:00
Owen Mansel-Chan
d472dfe4a3
Fix QLDocs
2025-01-20 21:36:30 +00:00
Owen Mansel-Chan
489a87fbae
Small QL improvement
2025-01-20 16:22:37 +00:00
Owen Mansel-Chan
4e59ac4819
Merge pull request #14873 from Kwstubbs/go-rs-cors
...
Go: Add Rs Cors Support
2025-01-20 16:16:50 +00:00
Kevin Stubbings
217bc74278
Fix documentation
2025-01-19 22:43:14 -08:00
Chris Smowton
9504f3611f
Restrict text/template modelling to known call targets
...
Otherwise it's too easy to define a common interface to both text/template, which doesn't sanitize, and html/template, which does.
2025-01-14 17:52:02 +00:00
Chris Smowton
016bda04a5
Autoformat
2025-01-14 17:52:01 +00:00
Chris Smowton
9c409f1280
Apply cosmetic review feedback
2025-01-14 17:51:57 +00:00
Chris Smowton
5548662a74
Switch to implementation using a universal read-only ContentSet
2025-01-14 17:51:55 +00:00
Chris Smowton
ae34a9c80e
template/text.Template execution methods: support reading arbitrary content
2025-01-14 17:51:54 +00:00
Tom Hvitved
303b11ec36
Merge pull request #18298 from hvitved/rust/mad-source-sink
...
Rust: Add support for MaD sources and sinks with access paths
2025-01-10 11:49:51 +01:00
Dave Bartolomeo
1323b3f067
Revert "Merge pull request #18235 from owen-mc/go/varargs-out-param"
...
This reverts commit 4f8645b4dd22aaf74184
2025-01-07 14:59:31 -05:00
Dave Bartolomeo
3dcf49cea0
Revert "Merge pull request #18275 from owen-mc/go/mad/variadic-params-sources"
...
This reverts commit 7ab06fca2f0c5e260ae6
2025-01-07 14:55:06 -05:00
Tom Hvitved
1b31c90d26
Implement FlowSummaryImpl stubs
2025-01-06 13:26:51 +01:00
Kevin Stubbings
4b95ea0987
Merge branch 'main' into go-rs-cors
2024-12-17 17:35:29 -08:00
Owen Mansel-Chan
e9dcd69cc0
Add readStep back to local taint flow
2024-12-13 13:30:18 +00:00
Owen Mansel-Chan
3a3e053f12
Only add taint steps for implicit varargs slice post-update nodes
2024-12-13 13:17:44 +00:00
Owen Mansel-Chan
b58e6ebade
Address review comments for localTaintStep
2024-12-12 22:07:15 +00:00
Owen Mansel-Chan
3f7c37e1ed
Treat container flow as taint flow in global taint flow
2024-12-12 11:41:32 +00:00
Owen Mansel-Chan
e13c4b7550
Treat container flow as taint flow in localTaintStep
2024-12-12 10:41:23 +00:00
Owen Mansel-Chan
67572712ea
Fix flow out of varargs param with models-as-data
...
This still doesn't allow for a variadic out parameter to be defined as
a source using MaD. This is due to the lack of an implicit store step
at sources, to match implicit read steps at sinks.
2024-12-06 15:00:40 +00:00
Anders Schack-Mulligen
03fdceb0fd
Merge pull request #18191 from aschackmull/dataflow/remove-deprecated-lib
...
Dataflow: Delete the old configuration-class based api.
2024-12-04 11:31:46 +01:00
Anders Schack-Mulligen
e846855bca
Go: Remove deprecated configuration classes referencing deleted api.
2024-12-03 20:08:44 +01:00
Anders Schack-Mulligen
fbff4b6e21
Go: Delete deprecated data flow api.
2024-12-03 14:42:14 +01:00
Owen Mansel-Chan
0e94ee81ae
Don't getUnderlyingType before looking through pointer type
...
If `T` is the type of an embedded field, it is invalid for `T` to be a
named type defined to be a pointer type (`type T *S`). It is also
invalid for `T` to be a type parameter. So this `getUnderlyingType()` is
redundant.
2024-11-26 22:25:56 +00:00
Owen Mansel-Chan
2cba97e87d
Small stylistic improvement
2024-11-26 22:25:55 +00:00
Owen Mansel-Chan
4990f16ba5
Refactor struct field predicate to remove redundancy
2024-11-26 22:25:48 +00:00
Owen Mansel-Chan
8dc0688b6f
Fix bug
2024-11-26 22:25:47 +00:00
Owen Mansel-Chan
9aede5f433
Merge pull request #17494 from owen-mc/go/reinstate-mad-with-fixes
...
Go: reinstate models-as-data sink conversions with fixes
2024-11-20 14:50:47 +00:00
Owen Mansel-Chan
d9a830e008
Add log function prefix "With" for heuristic logger
2024-11-20 13:50:59 +00:00
Owen Mansel-Chan
dd87b1a9de
Convert os.stdin model to MaD
2024-11-19 16:59:47 +00:00
Owen Mansel-Chan
bf824cac0a
Allow package-level variables in MaD
2024-11-19 16:59:42 +00:00
Owen Mansel-Chan
e57d8983f5
Add heuristic logger calls
2024-11-19 11:41:51 +00:00
Owen Mansel-Chan
9fc0dc5690
Fix typo in unrelated QLDoc
2024-11-19 11:41:40 +00:00
Owen Mansel-Chan
d37c816bd9
Model some Xorm methods in QL
2024-11-19 11:18:17 +00:00
Owen Mansel-Chan
25cd4d4585
Model some squirrel methods in QL
...
We need to put a restriction on the type of the argument.
2024-11-19 11:18:15 +00:00
Owen Mansel-Chan
35cbc162b0
Convert logging sinks to use MaD
2024-11-19 11:18:11 +00:00
Owen Mansel-Chan
85c7e8c221
Convert gocb nosql-injection sinks to MaD
2024-11-19 11:18:09 +00:00
Owen Mansel-Chan
fbaad09179
Convert mongodb nosql-injection sinks to MaD
2024-11-19 11:18:02 +00:00
Owen Mansel-Chan
b4c84be3be
Convert database/sql/driver sql-injection sinks to MaD
2024-11-19 11:15:48 +00:00
Owen Mansel-Chan
e4eef6791a
Convert database/sql sql-injection sinks to MaD
2024-11-19 11:15:42 +00:00
Owen Mansel-Chan
4cca6cff59
Convert Beego orm sql-injection sinks to MaD
2024-11-19 11:13:32 +00:00
Owen Mansel-Chan
2282a8184b
Convert Bun sql-injection sinks to MaD
2024-11-19 11:13:30 +00:00
Owen Mansel-Chan
1c305aa8f3
Convert Xorm sql-injection sinks to MaD
2024-11-19 11:13:28 +00:00
Owen Mansel-Chan
1ab50fc62c
Convert Gorm sql-injection sinks to MaD
2024-11-19 11:13:26 +00:00
