Owen Mansel-Chan
4990f16ba5
Refactor struct field predicate to remove redundancy
2024-11-26 22:25:48 +00:00
Owen Mansel-Chan
8dc0688b6f
Fix bug
2024-11-26 22:25:47 +00:00
Owen Mansel-Chan
593896b40e
Add test showing promoted field bug
...
NCField should be promoted to EmbedsNameClash. Currently it isn't
because its embedded parent pkg2.NameClash is not a promoted field in
EmbedsNameClash (because of a name clash with pkg1.NameClash), but this
should not make a difference.
2024-11-26 22:25:41 +00:00
Owen Mansel-Chan
553bc8c13d
Merge pull request #18108 from owen-mc/go/mad/model-slices-package
...
Go: model `slices` package (skipping functions that involve iterating over a function)
2024-11-26 21:24:22 +00:00
Edward Minnix III
86c7a49264
Apply suggestions from code review
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2024-11-26 13:12:16 -05:00
Paolo Tranquilli
556774edc7
Rust: do not put extraction steps in the expected diagnostics
2024-11-26 18:00:15 +01:00
Simon Friis Vindum
92427ab0c1
Merge branch 'main' into rust-rename-expr
2024-11-26 17:40:47 +01:00
Paolo Tranquilli
8abd3c4707
Rust: Remove windows difference from diagnostics
2024-11-26 16:48:49 +01:00
Taus
d779ae5c3e
Python: Add change note for CFG pruning fix
...
... And also bump the extractor version.
2024-11-26 15:39:15 +00:00
Paolo Tranquilli
24eb65692f
Rust: add some performance diagnostics
...
This outputs some duration counts for various parts of the extraction
process in the database in the form of telemetry diagnostics.
The diagnostics format was preferred to putting things in the relational
database as that will scale better to code scanning and is more flexible
as for the data we can put into it without passing through the dbscheme.
Also, although it's not the case yet, it will be possible to output
diagnostics even if creation of the database fails.
2024-11-26 16:35:38 +01:00
Asger F
805fd0b46e
JS: Refine speculative step definition
2024-11-26 15:56:56 +01:00
Owen Mansel-Chan
141259c003
Update go/ql/lib/ext/slices.model.yml
...
Co-authored-by: Chris Smowton <smowton@github.com >
2024-11-26 14:48:20 +00:00
Asger F
8818fcc207
JS: Benign test output changes
2024-11-26 15:47:13 +01:00
Simon Friis Vindum
7ab5663fa6
Rust: Address PR feedback
2024-11-26 15:42:19 +01:00
Asger F
c94a01e6b6
JS: Remove reference to argsParseStep
...
This was removed as part of the PR that introduced threat models.
2024-11-26 15:36:47 +01:00
Asger F
bf62582f53
JS: Implement 'speculativeTaintStep'
...
It is a mandatory part of the interface now; just providing a bare-bones implementation for rather than 'none()'
2024-11-26 15:36:46 +01:00
Asger F
82d61e4194
Merge branch 'js/shared-dataflow-branch' into js/shared-dataflow-merge-main
2024-11-26 15:36:16 +01:00
Jeroen Ketema
8d59159691
C++: Fix qlref file
2024-11-26 15:35:52 +01:00
Simon Friis Vindum
d30f3e2822
Rust: Renamed expr on CallExpr and LetExpr
2024-11-26 15:22:14 +01:00
Mathias Vorreiter Pedersen
e42c7452ef
C++: Cleanup conjuncts. This doesn't change any behavior.
2024-11-26 13:57:51 +00:00
Mathias Vorreiter Pedersen
39b61598e9
C++: Accept test changes.
2024-11-26 13:57:38 +00:00
Mathias Vorreiter Pedersen
f7cf5af720
C++: Actually check the function name.
2024-11-26 13:56:22 +00:00
Jami
36acfeb305
Merge pull request #18087 from jcogs33/jcogs33/java-sha2
...
Java: add SHA-384 to list of secure crypto algorithms
2024-11-26 08:51:58 -05:00
yoff
6d6f269e6c
Merge pull request #17997 from yoff/java/inline-range-tests
2024-11-26 14:48:07 +01:00
Tom Hvitved
0c6b4cdb8f
Merge pull request #18078 from hvitved/rust/variant-flow
...
Rust: Data flow through variants
2024-11-26 14:45:00 +01:00
Mathias Vorreiter Pedersen
f65f11b404
C++: Add a test for a somewhat embarrasing bug: MaD didn't check the function name in some cases.
2024-11-26 13:43:42 +00:00
Asger F
c2e9dca1de
Merge pull request #18043 from asgerf/jss/jump-and-test-exclusion
...
JS: Fix jump steps generated by IIFEs and exception flow
2024-11-26 14:33:42 +01:00
Taus
2734377e5d
Python: Add API graph support for parameter annotations
...
Adds API graph support for observing that in
```python
def foo(x : Bar): ...
```
The variable `x` is likely to be an instance of the type `Bar` inside
this function.
In particular, we add `getInstanceFromAnnotation` as a predicate on API
graph nodes that tracks this step (corresponding to a new edge type
labeled with "annotation" in the API graph), and extend the existing
`getAnInstance` predicate to also include instances arising from type
annotations.
A more complete solution would also add support for annotated
assignments (`x : Foo = ...` or just `x : Foo`) as well as track types
through type aliases (`type Foo = Bar`). This turns out to be
non-trivial, however, as these type constructs don't have any CFG nodes
(and so no data-flow nodes by default either). In order to not have
perfect be the enemy of good, this commit is only targeting the type
parameter case (which is also likely to be the most common use case
anyway).
The tests for API graphs have been extended accordingly, including tests
for the kinds of type ascriptions that we _don't_ currently model in API
graphs (marked with `MISSING:` in the inline tests).
2024-11-26 13:03:06 +00:00
Jeroen Ketema
6aa7c93af2
C++: More qlhelp fixes
2024-11-26 13:58:54 +01:00
Jeroen Ketema
fc6c327ab7
C++: Add change note
2024-11-26 13:55:30 +01:00
Taus
047e9742a0
Merge pull request #18086 from github/tausbn/add-vscode-task-for-creating-change-notes
...
Add script and VSCode task for creating change notes
2024-11-26 13:55:21 +01:00
Jeroen Ketema
e1f70a0dec
C++: Add missing </p> to qlhelp
2024-11-26 13:50:09 +01:00
Taus
5279857d06
Fix comment
2024-11-26 12:48:20 +00:00
Asger F
f073f3b791
JS: Rename file to foo.test.js
2024-11-26 13:44:00 +01:00
Asger F
65da9b41b5
JS: Add cross-file test in InsecureRandom
2024-11-26 13:43:24 +01:00
Taus
adbd4d35ed
Add support for both query and library change notes
2024-11-26 12:39:17 +00:00
Anders Schack-Mulligen
a6fc41ec4b
Java: Accept consistency failure.
2024-11-26 13:25:44 +01:00
Anders Schack-Mulligen
38eb3e4952
Java: Adjust expected output.
2024-11-26 13:25:44 +01:00
Anders Schack-Mulligen
2ff2d25784
Java: Cherry-pick test from https://github.com/github/codeql/pull/17051
2024-11-26 13:25:43 +01:00
Anders Schack-Mulligen
408a38d9fb
Java: Address review comment, include addFirst,addLast.
2024-11-26 13:25:43 +01:00
Anders Schack-Mulligen
0d45f0efb2
Java: Accept consistency check result.
2024-11-26 13:25:43 +01:00
Anders Schack-Mulligen
2b1caa8a35
Java: Add test.
2024-11-26 13:25:42 +01:00
Anders Schack-Mulligen
5a4b720322
Java: Add change note.
2024-11-26 13:25:42 +01:00
Anders Schack-Mulligen
6f32c4129d
Java: Add a default taint sanitizer for contains-checks on lists of constants.
2024-11-26 13:25:41 +01:00
Anders Schack-Mulligen
7f86f8cac7
Java: Prepare TypeFlow for separate instantiation of universal flow.
2024-11-26 13:25:41 +01:00
Owen Mansel-Chan
bcc89ecb7c
Add change note
2024-11-26 12:07:32 +00:00
Owen Mansel-Chan
196634ecdb
Model slices package
...
Skipping functions that involve iterators for now.
2024-11-26 12:01:09 +00:00
Tom Hvitved
8c111382ad
Address review comments
2024-11-26 13:00:59 +01:00
Owen Mansel-Chan
47eb407be9
Update Go version in stdlib tests
2024-11-26 12:00:10 +00:00
Paolo Tranquilli
9f09454db9
Merge pull request #18107 from github/redsun82/rust-rename
...
Rust: rename `MatchExpr.expr` to `scrutinee` in all layers
2024-11-26 12:59:06 +01:00
