Taus Brock-Nannestad
7cdf439b83
Python: Clean up basicStoreStep
...
Moves the `flowsTo` logic into the shared implementation, so that
`TypeTrackingPrivate` only has to define the shape of immediate store
steps.
Also cleans up the documentation to talk a bit more about what
`content` can represent, and what caveats there are.
2021-03-22 18:42:24 +01:00
Taus Brock-Nannestad
0e81fd2624
Python: Move Boolean into TypeTrackerPrivate
...
In general, this may be defined already for other languages, so moving
it in here will avoid potential clashes.
2021-03-22 18:41:22 +01:00
Marcono1234
993999f64f
Java: Add test for negative numeric literals
2021-03-22 17:43:34 +01:00
Asger Feldthaus
6b19e69d30
JS: Fix some join orders
2021-03-22 16:17:19 +00:00
Rasmus Wriedt Larsen
1890e63d4c
Python: Make import private for better auto-complete
...
With the non-private imports, auto-completing on `API::` gave ALL results
available from `import python`, as well as the ones specified in the `API`
module.
The non-private import in Attributes.qll did the same for `DataFlow::`.
2021-03-22 16:45:44 +01:00
Taus Brock-Nannestad
4a6589d0ae
Python: Make API::Node::getACall return a CallCfgNode
...
This should eliminate the need for explicit casting to
`CallCfgNode` (which does not appear in our code as far as I can see,
but was observed in an external contribution).
2021-03-22 16:37:24 +01:00
Asger Feldthaus
42e6c7eb2e
JS: Remove field from InvokeNode
2021-03-22 15:19:31 +00:00
Asger Feldthaus
c03e9d6c75
JS: Address review comments
2021-03-22 15:19:31 +00:00
Asger Feldthaus
5bfdca895b
JS: Remove recursive def of SourceNode::Range
2021-03-22 15:07:38 +00:00
Asger Feldthaus
230b9cf5d3
JS: Avoid recursion in SourceNode::Range
2021-03-22 15:07:38 +00:00
Shati Patel
34e25624e0
Merge pull request #5488 from github/rc/3.1
...
Merge release candidate branch back into main
2021-03-22 14:28:25 +00:00
Rasmus Lerchedahl Petersen
c1e3ccfb6c
Python, doc: Note ephemeral nature of import nodes
2021-03-22 15:07:51 +01:00
Shati Patel
c7a79a51fe
Merge pull request #5479 from github/shati-patel/docs-bump-version
...
Docs: Prepare supported languages/frameworks for 1.27 release
2021-03-22 13:50:53 +00:00
Rasmus Wriedt Larsen
c8a6e837b5
Python: Model QuerySet chains in django
2021-03-22 14:38:54 +01:00
CodeQL CI
119872d8a4
Merge pull request #5461 from erik-krogh/moreOutDir
...
Approved by asgerf
2021-03-22 13:27:14 +00:00
Mathias Vorreiter Pedersen
257fc7459d
Update categories for new the C++ libraries.
2021-03-22 13:28:48 +01:00
yo-h
b495e1efab
Merge pull request #5411 from aschackmull/java/dataflow-lambda-dispatch
...
Java: Bugfix dispatch to lambda in call context.
2021-03-22 08:25:21 -04:00
Jonas Jensen
0bfeba5251
Merge pull request #5414 from criemen/diagnostic-queries
...
C++: Extractor/database diagnostic errors
2021-03-22 13:23:24 +01:00
Anders Schack-Mulligen
f681d584bd
Merge pull request #5474 from Marcono1234/marcono1234/string-building-type
...
Java: Add StringBuildingType
2021-03-22 13:16:54 +01:00
Shati Patel
0f83722767
Revert JS changes and add another Java entry
2021-03-22 12:01:08 +00:00
Anders Schack-Mulligen
58fe81db2e
Merge pull request #5455 from hvitved/dataflow/lambda-doc
...
Data flow: Add section on lambda flow to `dataflow.md`
2021-03-22 12:54:46 +01:00
Shati Patel
c5ef57c408
Update docs/codeql/support/reusables/frameworks.rst
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-03-22 11:40:13 +00:00
Tamas Vajk
7a0bfd1a69
Skip through any stub preamble
2021-03-22 12:29:13 +01:00
Asger Feldthaus
54a91c73b0
JS: Tweak summarizedHigherOrderCall
2021-03-22 10:56:03 +00:00
CodeQL CI
a889316003
Merge pull request #5428 from asgerf/js/cheat-sheet-tweak
...
Approved by esbena
2021-03-22 10:51:26 +00:00
Shati Patel
343f4e442f
Add "TODO"s
2021-03-22 10:46:29 +00:00
Shati Patel
9e84b756f7
Update supported frameworks
2021-03-22 10:40:17 +00:00
Mathias Vorreiter Pedersen
d09458a486
C++: Add another taint tracking copy to identical-files.json
2021-03-22 11:35:59 +01:00
Mathias Vorreiter Pedersen
7ec86b5e7f
C++: AdjustedConfiguration should not extend the same dataflow configuration as FromGlobalVarTaintTrackingCfg as this causes multiple configurations to be in scope for dataflow.
2021-03-22 11:35:29 +01:00
Cornelius Riemenschneider
668841cefa
C++: Rename diagnostic queries.
2021-03-22 11:13:49 +01:00
Shati Patel
b422a972bf
Update conf.py
2021-03-22 10:00:18 +00:00
haby0
fe046ec71e
Merge remote-tracking branch 'upstream/main' into main
2021-03-22 17:25:37 +08:00
Rasmus Wriedt Larsen
3a83ecf067
Python: Add test for taint in django forms/fields
2021-03-22 10:03:32 +01:00
Tom Hvitved
98558c7c59
Update docs/ql-libraries/dataflow/dataflow.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2021-03-22 09:42:27 +01:00
Anders Schack-Mulligen
36962b8438
Merge pull request #5468 from Marcono1234/marcono1234/floating-point-literal-value
...
Java: Add value predicates for float and double literals; improve tests
2021-03-22 09:02:31 +01:00
Rasmus Wriedt Larsen
f800bf243f
Python: Better text for getSourceType in Django
2021-03-22 01:39:19 +01:00
Rasmus Wriedt Larsen
701b935564
Python: Add example of QuerySet chain (django)
2021-03-22 00:57:43 +01:00
Marcono1234
1534b387bb
Java: Improve documentation regarding minus in front of numeric literals
2021-03-22 00:54:14 +01:00
Marcono1234
cd059eb965
Java: Add StringBuildingType
2021-03-22 00:19:23 +01:00
Artem Smotrakov
6c24699403
Cover both javax.el and jakarta.el packages
2021-03-21 21:19:39 +03:00
Artem Smotrakov
adb1ed380a
Added tests for Jakarta expression injection
2021-03-21 21:19:39 +03:00
Artem Smotrakov
73e940de74
Added query for Jakarta EL injections
...
- Added JakartaExpressionInjection.ql
- Added a qhelp file with examples
2021-03-21 21:19:39 +03:00
Marcono1234
fa98443bb7
Java: Add value predicates for float and double literals; improve tests
2021-03-21 18:07:55 +01:00
yo-h
0200aedc2e
Java 16: adjust test options
2021-03-21 12:55:25 -04:00
ihsinme
26bac9f425
Apply suggestions from code review
...
Co-authored-by: Robert Marsh <rdmarsh2@gmail.com >
2021-03-21 15:25:29 +03:00
edvraa
ac29184521
deserialization sinks
2021-03-20 21:50:46 +02:00
Asger Feldthaus
a54e810804
JS: Include accessor-calls in CallGraph.ql
2021-03-20 13:59:38 +00:00
Asger Feldthaus
f4a476ea4e
JS: Change type ValueNode -> Node
2021-03-20 09:05:04 +00:00
Dilan
1385b22642
pr fixes, typo in qhelp file and helper method for queries
2021-03-19 16:43:29 -07:00
Erik Krogh Kristensen
b565e3de91
expand outDir support in tsconfig files
2021-03-19 23:13:51 +01:00
