Dave Bartolomeo
a475e5758d
Merge remote-tracking branch 'upstream/main' into dbartol/use-workspace-versions
2022-11-02 12:38:03 -04:00
Karim Ali
f6484e6e6b
cleanup old code comments
2022-11-02 16:21:51 +02:00
Karim Ali
27d2dc6d9e
update expected results
2022-11-02 16:13:50 +02:00
Karim Ali
eefda61445
add a query that checks for the use of static IVs
2022-11-02 16:09:00 +02:00
Paolo Tranquilli
3acd4486a3
Swift: add tests for RUN_UNDER support
...
While I would have preferred to add a proper unit test, this required
more infrastructure for mocking system calls. Instead I made `qltest.sh`
accept a `//codeql-extractor-env` header and used that to write a QL
test exercising the `RUN_UNDER` functionality.
2022-11-02 12:09:13 +01:00
Tony Torralba
759ffc4743
Merge pull request #11027 from atorralba/atorralba/swift/webview-js-native-bridge-sources
...
Swift: WebView JS-native bridge sources
2022-11-02 09:32:57 +01:00
Geoffrey White
85e99feb49
Swift: Have swift/unsafe-webview-fetch use indices instead of parameter names.
2022-11-01 22:58:48 +00:00
Geoffrey White
d87117f623
Swift: Have swift/string-length-conflation use indices instead of parameter names.
2022-11-01 22:51:10 +00:00
Dave Bartolomeo
9d5e5e3ee7
${workspace} all the things
2022-11-01 13:29:05 -04:00
Dave Bartolomeo
49c4c554c4
Merge from main
2022-11-01 13:22:40 -04:00
Karim Ali
8be4d47178
fix typos
2022-11-01 16:03:36 +02:00
Geoffrey White
84c754e007
Merge pull request #11062 from geoffw0/rename
...
Swift: Rename ECB-Encryption directory
2022-11-01 12:59:53 +00:00
Karim Ali
fe408cfb41
add a query that detects the use of constant passwords
2022-11-01 14:03:27 +02:00
Geoffrey White
c3577b2256
Swift: Rename test directory.
2022-11-01 09:21:50 +00:00
Geoffrey White
7d80c5c7f7
Swift: Rename query directory.
2022-11-01 09:21:10 +00:00
Karim Ali
3911f3b202
update query description following docs review
2022-10-31 13:54:35 +02:00
Karim Ali
76a330d4b9
update code example to be OWASP compliant
2022-10-31 13:52:49 +02:00
Karim Ali
723ca8ed88
update documentation following docs review
2022-10-31 13:50:30 +02:00
Tony Torralba
b62ede1544
Fix issue in JsExportedSource
...
Model the source as an access to the tainted field, instead of the field itself (which didn't work)
2022-10-31 12:08:03 +01:00
Geoffrey White
ca586b4f3d
Merge remote-tracking branch 'upstream/main' into global
2022-10-31 10:28:29 +00:00
Geoffrey White
0dd8f574a7
Swift: Redesign as a FreeFunctionDecl class + add some qldoc.
2022-10-31 10:24:12 +00:00
Geoffrey White
840b74dbb5
Swift: Add and use ApplyExpr.getArgumentByParamName.
2022-10-28 17:55:11 +01:00
Geoffrey White
f122005aaf
Swift: Simplify out some variables.
2022-10-28 17:26:17 +01:00
Tony Torralba
2402504a4c
Add missing SummaryPostUpdateNode
2022-10-28 18:24:17 +02:00
Geoffrey White
b4d939a620
Swift: Correct a comment.
2022-10-28 17:11:24 +01:00
Geoffrey White
648c2d09f9
Swift: Simplify InsecureTLS.ql.
2022-10-28 15:56:03 +01:00
Tony Torralba
baf7986cfa
Rework types exported through JSContext
...
Better model the JSExport protocol logic
2022-10-28 15:56:05 +02:00
Geoffrey White
cf9c3afc86
Swift: Add and use AbstractFunctionDecl.hasGlobalName predicate.
2022-10-28 13:57:24 +01:00
Mathias Vorreiter Pedersen
0a3d0c4f56
Merge pull request #11031 from geoffw0/simplify
...
Swift: Simplify queries using MethodDecl.hasQualifiedName
2022-10-28 13:58:08 +02:00
Tony Torralba
48b0cc0229
Add models for JSContext and JSValue
2022-10-28 13:01:25 +02:00
Tony Torralba
81701547b2
Add taint sources for WKScriptMessage
...
This is what contains externally-provided data in Webview JS-native bridges
2022-10-28 12:58:27 +02:00
Mathias Vorreiter Pedersen
142e50008e
Merge pull request #10967 from MathiasVP/fix-swift-summary
...
Swift: Fix flow out of summarized callables
2022-10-28 12:57:52 +02:00
Geoffrey White
368f37a27e
Swift: And another.
2022-10-28 11:46:27 +01:00
Geoffrey White
1f3ed1cec7
Merge remote-tracking branch 'upstream/main' into simplify
2022-10-28 11:42:05 +01:00
Geoffrey White
6fca350714
Use MethodDecl.hasQualifiedName.
2022-10-28 11:41:42 +01:00
Mathias Vorreiter Pedersen
062a0abceb
Swift: Fix flow out of summarized callables.
2022-10-28 12:09:05 +02:00
Rasmus Wriedt Larsen
8628ff5e52
Merge pull request #10999 from RasmusWL/inline-fail-tag
...
InlineExpectationsTest: Fail if missing `getARelevantTag`
2022-10-28 10:35:49 +02:00
Geoffrey White
ca279f4073
Merge pull request #10996 from geoffw0/methods
...
Swift: Add MethodDecl.hasQualifiedName
2022-10-27 19:18:48 +01:00
Geoffrey White
3507ea3f2a
Swift: Autoformat.
2022-10-27 17:37:21 +01:00
Geoffrey White
d0f45180ab
Swift: cache some predicated.
2022-10-27 14:17:51 +01:00
Rasmus Wriedt Larsen
adf109b624
Merge branch 'main' into inline-fail-tag
2022-10-27 13:42:32 +02:00
Rasmus Wriedt Larsen
fc7eb5b4fc
InlineExpectationsTest: sync
2022-10-27 09:02:28 +02:00
Dave Bartolomeo
23b572e9b7
Use ${workspace} for intra-workspace dependencies
...
Now that the released CLI supports replacement variables in dependency version ranges, we can now mark our published library packs as depending on whatever version of their dependency is in our workspace, without having to manually bump the dependency version every release.
Note that when the packs are published, the dependencies in the published pack file are rewritten to have the correct specific version.
2022-10-26 16:40:01 -04:00
Rasmus Wriedt Larsen
5e9897d150
InlineExpectationsTest: sync
2022-10-26 18:21:13 +02:00
Geoffrey White
a32b08f56a
Swift: remove redundant line.
2022-10-26 16:39:33 +01:00
Geoffrey White
e981a28b0f
Swift: autoformat test.
2022-10-26 16:32:52 +01:00
Geoffrey White
0b3408b1f6
Swift: Fix typo.
2022-10-26 16:24:25 +01:00
Geoffrey White
5d21c51deb
Swift: use hasQualifiedName in UnsafeWebViewFetch.ql.
2022-10-26 16:12:29 +01:00
Geoffrey White
0d41d4e90c
Swift: for consistancy, lets have a simple hasName function as well.
2022-10-26 16:11:01 +01:00
Geoffrey White
b24a27d4ae
Swift: Add hasQualifiedName methods and tests.
2022-10-26 16:03:49 +01:00
