Erik Krogh Kristensen
d998d06b94
add link to source in alert-message for js/shell-command-constructed-from-input
2021-03-18 13:37:18 +01:00
Mathias Vorreiter Pedersen
c0e1df47a6
Merge pull request #5431 from MathiasVP/av-rule-79-use-gvn
...
C++: Use GVN in AV Rule 79
2021-03-18 12:35:26 +01:00
CodeQL CI
3b34bfd1c6
Merge pull request #5432 from asgerf/js/more-string-steps
...
Approved by erik-krogh
2021-03-18 04:16:07 -07:00
Rasmus Wriedt Larsen
42b2c3ed52
Python: Model C-based loaders for PyYAML
...
Not really that important. But easy to do while I was working on this library.
2021-03-18 11:55:01 +01:00
Rasmus Wriedt Larsen
54e6f51512
Python: Add example of C-based PyYAML loaders
...
```
In [6]: yaml.load("!!python/object/new:os.system [echo EXPLOIT!]", yaml.CLoader)
EXPLOIT!
Out[6]: 0
```
2021-03-18 11:50:59 +01:00
Rasmus Wriedt Larsen
25b15d7470
Python: Move PyYAML modeling classes within module
...
For now, this is how we're trying to structure things -- all in all it doesn't
matter too much, since everything is still marked as private.
2021-03-18 11:48:30 +01:00
Rasmus Wriedt Larsen
5ec8511d50
Python: Port PyYAML model to API graphs
2021-03-18 11:47:46 +01:00
Porcuiney Hairs
a88c3682ff
remove sanitiserGuards
2021-03-18 16:12:00 +05:30
Porcuiney Hairs
84c9137152
Include suggestions from review
2021-03-18 16:12:00 +05:30
porcupineyhairs
f27d2bdf6d
Update java/ql/src/experimental/semmle/code/java/Logging.qll
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-03-18 16:12:00 +05:30
Porcuiney Hairs
d0c82d3756
Add flogger and android logging support
2021-03-18 16:12:00 +05:30
Porcuiney Hairs
17d7ba8049
Add Log Injection Vulnerability
2021-03-18 16:12:00 +05:30
Rasmus Wriedt Larsen
14e9bda5de
Python: Refactor PyYAML tests a bit
2021-03-18 11:39:47 +01:00
Rasmus Wriedt Larsen
45a1fc6a96
Python: Add link to better PyYAML docs
...
I found this randomly
2021-03-18 11:20:22 +01:00
Asger Feldthaus
e30fa89405
JS: Update more test expectations
2021-03-18 10:04:39 +00:00
Erik Krogh Kristensen
8b931626ce
add edge from root type MkHasUnderlyingType
2021-03-18 11:04:08 +01:00
Rasmus Wriedt Larsen
7b92012edf
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-03-18 10:58:49 +01:00
Jaroslav Lobačevski
a9ed3317bf
Fix regex per suggestion
2021-03-18 11:54:55 +02:00
Erik Krogh Kristensen
40ec23cf13
refactor MkHasUnderlyingType to use Label::instance()
2021-03-18 10:47:38 +01:00
Mathias Vorreiter Pedersen
2abf4c068f
C++: Use getAnExpr. Also extend the other recursive case similarly.
2021-03-18 08:42:10 +01:00
Erik Krogh Kristensen
b2d6982318
add change note
2021-03-17 19:17:23 +01:00
Erik Krogh Kristensen
3995ff322d
add models for koa-route and koa-router
2021-03-17 19:17:20 +01:00
Jaroslav Lobačevski
7b6773c96a
Update javascript/ql/src/experimental/semmle/javascript/Actions.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-03-17 19:49:03 +02:00
CodeQL CI
1d9f8c2d37
Merge pull request #5427 from RasmusWL/use-new-builtin-modeling
...
Approved by yoff
2021-03-17 09:07:36 -07:00
Jaroslav Lobačevski
e3bf308952
Removed positive lookbehind
2021-03-17 17:32:10 +02:00
Mathias Vorreiter Pedersen
834e35f192
C++: Add change-note.
2021-03-17 16:26:15 +01:00
Asger Feldthaus
ae410aabd6
JS: Add change note
2021-03-17 15:24:10 +00:00
Asger Feldthaus
e4d891cab5
JS: Add tests for flow through replace
2021-03-17 15:20:40 +00:00
Asger Feldthaus
9cfbb90591
JS: Add test case for insufficient replace-sanitizer
2021-03-17 15:20:40 +00:00
Asger Feldthaus
198bdcab26
JS: Make XSS MetacharEscapeSanitizer more precise
2021-03-17 15:20:40 +00:00
Asger Feldthaus
effa52f9e1
JS: Step through string replace callbacks
2021-03-17 15:15:49 +00:00
CodeQL CI
7c20c4a664
Merge pull request #5396 from asgerf/js/shared-taint-step
...
Approved by erik-krogh, esbena
2021-03-17 08:07:20 -07:00
Mathias Vorreiter Pedersen
a3f806bb1d
Use GVN in AV rule 79.
2021-03-17 16:01:49 +01:00
Rasmus Wriedt Larsen
d426f1efaf
Docs: Highlight need for explicit import of DataFlow lib
...
at least in some langauges
2021-03-17 16:01:20 +01:00
yoff
514c9efcdd
Merge pull request #5426 from RasmusWL/insecure-default-protocl-tests-are-also-py3
...
Python: Also test py/insecure-default-protocol on Python 3
2021-03-17 15:59:00 +01:00
Rasmus Wriedt Larsen
4f63584179
Docs: Highlight that Configuration is not DataFlow::Configuration
...
I made that mistake when just reading it over (DOH). I think that calling it
MyConfiguration makes it a bit more clear that this is a configuration class you
wrote yourself :D
2021-03-17 15:55:58 +01:00
Rasmus Wriedt Larsen
27032af2eb
Python: Use API graphs for io.open
2021-03-17 15:50:02 +01:00
Rasmus Wriedt Larsen
d52d328587
Python: Use new API::builtin in stdlib modeling
2021-03-17 15:50:01 +01:00
Asger Feldthaus
bf5259096e
JS: Update cheat sheet
2021-03-17 14:34:30 +00:00
Rasmus Lerchedahl Petersen
f04ac87091
Python, doc: Include new section in toc
2021-03-17 15:04:07 +01:00
Rasmus Wriedt Larsen
315127d888
Python: Also test py/insecure-default-protocol on Python 3
2021-03-17 14:53:36 +01:00
Rasmus Lerchedahl Petersen
135a6713e8
Python, doc: References to section on API graphs.
2021-03-17 14:42:50 +01:00
CodeQL CI
d95b295e52
Merge pull request #5400 from erik-krogh/replaceCallbacks
...
Approved by asgerf
2021-03-17 06:42:34 -07:00
Rasmus Lerchedahl Petersen
7e9cf03f4d
Merge branch 'python-document-api-graphs' of https://github.com/tausbn/codeql into tausbn-python-document-api-graphs
2021-03-17 14:36:16 +01:00
Tom Hvitved
5b2d5ee010
Merge pull request #4940 from hvitved/csharp/base-ssa-phi-input
...
C#: Take phi nodes into account in `Steps::getARead()`
2021-03-17 14:33:59 +01:00
Asger Feldthaus
ccc879dc5c
JS: Autoformat
2021-03-17 13:29:17 +00:00
Asger Feldthaus
e1bfc6cd38
JS: Add qldoc to deprecated class member
2021-03-17 13:29:17 +00:00
Asger Feldthaus
ab1947a028
JS: Add comment explaining how to add new steps
2021-03-17 13:29:17 +00:00
Asger Feldthaus
c2764069b5
JS: Mention why we cache predicates outside the class
2021-03-17 13:29:17 +00:00
Asger Feldthaus
a97d3452a7
JS: Add DataFlow::SharedFlowStep to future-proof the tutorial
2021-03-17 13:29:17 +00:00
