Owen Mansel-Chan
b4a9689341
Convert .qlref test to inline expectations
2026-06-11 07:15:54 +02:00
Owen Mansel-Chan
c271755985
Add and use exprRefersToNil predicate
2026-03-12 13:28:57 +00:00
Owen Mansel-Chan
3850734a15
Use non-extending subtypes
2026-01-14 11:50:49 +00:00
Anders Schack-Mulligen
dc6d3fe7ba
Use flowFrom.
2025-12-03 14:04:18 +01:00
Owen Mansel-Chan
fe1c4e2eee
Make class qldoc start with "A".
2025-11-28 02:26:39 +00:00
Owen Mansel-Chan
0b79087782
Make predicate name start with has instead of get
2025-11-28 02:26:14 +00:00
Joe Farebrother
536e885f18
Remove experimental query
2025-11-25 14:34:41 +00:00
Owen Mansel-Chan
2c20d3ffeb
Move weak crypto algorithm query out of experimental
2025-11-19 14:36:26 +00:00
Nora Dimitrijević
0f0bd0f455
Go/SSRF
...
go/ql/src/experimental/CWE-918/SSRF.ql
2025-10-28 09:42:09 +01:00
Nora Dimitrijević
7722f31cb8
Go/DivideByZero
2025-10-28 09:39:24 +01:00
Owen Mansel-Chan
f0f5fc7eac
Improve SSRF additional flow step
2025-10-01 16:18:00 +01:00
Owen Mansel-Chan
2ffb638b7e
Delete WriteNode.writesFieldOnSsaWithFields
...
This can be easily expressed in terms of `WriteNode.writesFieldPreUpdate`.
2025-10-01 16:13:27 +01:00
Owen Mansel-Chan
489b8431ea
Add and use WriteNode.writesFieldPreUpdate
2025-10-01 16:13:25 +01:00
Owen Mansel-Chan
748c53a791
Refactor: Create writesFieldOnSsaWithFields
2025-10-01 16:12:56 +01:00
Owen Mansel-Chan
cf6cfe2a1e
Non-initializing writes should target post-update nodes
2025-10-01 16:12:54 +01:00
Michael Nebel
55e5281429
Go: Fix a couple more spelling errors.
2025-09-02 10:47:36 +02:00
Michael Nebel
d0323a6425
Fix one more violation.
2025-09-02 09:42:05 +02:00
Michael Nebel
ea664e08d1
Go: Fix some Ql4Ql violations.
2025-09-01 15:00:34 +02:00
Nora Dimitrijević
7b759f44f8
[DIFF-INFORMED] Go: AuthCookie
...
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/experimental/CWE-1004/CookieWithoutHttpOnly.ql#L97
2025-07-17 11:46:49 +02:00
Nora Dimitrijević
a1fe72c423
[DIFF-INFORMED] Go: SSRF
...
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/experimental/CWE-918/SSRF.ql#L23
2025-07-17 11:46:47 +02:00
Nora Dimitrijević
7bd6703f19
[DIFF-INFORMED] Go: ConditionalBypass
2025-07-17 11:46:46 +02:00
Nora Dimitrijević
19b373aa90
[DIFF-INFORMED] Go: SensitiveConditionBypass
...
https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/go/ql/src/experimental/CWE-807/SensitiveConditionBypass.ql#L33
2025-07-17 11:46:44 +02:00
Nora Dimitrijević
51826c72d0
Go: mass-add none() location overrides
2025-06-17 17:02:08 +02:00
Nora Dimitrijević
e233501144
Go: mass enable diff-informed data flow
...
An auto-generated patch that enables diff-informed data flow in the obvious cases.
Builds on https://github.com/github/codeql/pull/18345 and https://github.com/github/codeql-patch/pull/88
2025-06-11 18:44:24 +02:00
Owen Mansel-Chan
5bce70f78c
Move files out of experimental (no changes)
2025-05-01 15:39:15 +01:00
Owen Mansel-Chan
cf614a596d
Fix cwe tags to include leading zero
2025-04-30 16:43:03 +01:00
Owen Mansel-Chan
09c44616a0
Rename "named type" to "defined type"
2025-02-13 15:22:33 +00:00
Kevin Stubbings
4b95ea0987
Merge branch 'main' into go-rs-cors
2024-12-17 17:35:29 -08:00
Anders Schack-Mulligen
e846855bca
Go: Remove deprecated configuration classes referencing deleted api.
2024-12-03 20:08:44 +01:00
Rasmus Wriedt Larsen
13a4df9b68
Go: autoformat
2024-09-13 16:07:27 +02:00
Rasmus Wriedt Larsen
8c10155eb7
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
Owen Mansel-Chan
49f3959405
Convert url-redirection sinks to MaD
2024-08-11 00:29:53 +01:00
Owen Mansel-Chan
8536e7eb02
Convert path-injection sinks to use MaD
2024-08-08 17:03:53 +01:00
Owen Mansel-Chan
e4cd29efc6
Fix missing go-jose package path
2024-07-31 11:09:53 +01:00
Ed Minnix
46e16b88bb
Refactor experimental queries to use ThreadModelFlowSource
2024-06-18 12:27:17 -04:00
Owen Mansel-Chan
7e5891b443
Remove unnecessary additional flow step
...
TaintTracking already adds taint steps for field reads
2024-05-23 11:08:29 +01:00
Owen Mansel-Chan
b6f6bdc6f4
Make RemoteFlowAsSource private
...
`UntrustedFlowAsSource` should have been private. Since we are deprecating them anyway
we may as well make the replacement private (and make it use `instanceof`). The deprecation
comments have been updated.
2024-04-18 12:31:38 +01:00
Owen Mansel-Chan
a49b43fdf6
Add deprecated version of renamed public classes
2024-04-18 11:49:54 +01:00
Owen Mansel-Chan
db06c08141
Rename UntrustedSource to RemoteSource
...
Including renaming some files (in the experimental folder).
2024-04-18 11:49:30 +01:00
Owen Mansel-Chan
f39301f533
Fix "an remote" and similar
...
Preserve case, allow for "a `Remote" etc.
2024-04-18 11:49:18 +01:00
Owen Mansel-Chan
a6646021d0
Rename Untrusted Flow to Remote Flow
...
Not matching case but preserving original case.
2024-04-18 11:49:05 +01:00
Owen Mansel-Chan
d967b2baa3
Rename UntrustedFlowAsSource to RemoteFlowAsSource
2024-04-18 11:48:04 +01:00
Owen Mansel-Chan
81eaa6e327
Rename UntrustedFlowSource to RemoteFlowSource
...
Relaxed whole word requirement. Again skipped one instance in an old
change note.
2024-04-17 21:35:50 +01:00
Owen Mansel-Chan
5fba9895c6
Rename UntrustedFlowSource to RemoteFlowSource
...
Only the whole word. Skipped one instance in an old change note.
2024-04-17 21:27:32 +01:00
Tony Torralba
04436208ab
Merge pull request #15843 from atorralba/atorralba/go/uncontrolled-allocation-size
...
Go: Promote `go/uncontrolled-allocation-size` from experimental
2024-03-11 16:12:27 +01:00
Owen Mansel-Chan
820c14577a
Merge pull request #13553 from am0o0/amammad-go-bombs
...
Go: Decompression Bombs
2024-03-10 13:48:04 +00:00
am0o0
43df6a2c07
add comments for already implemented io.Read and io.WriteTo Sinks.
...
remove some sinks about `"decompressor"` which was added wrongly.
change `GeneralReadIoSink` type from module to class.
separate `KlauspostGzipAndPgzip` `KlauspostPgzip` and `KlauspostGzip`.
2024-03-08 20:05:46 +04:00
am0o0
66130d208e
convert abstract predicate isAdditionalFlowStep to non-abstract
2024-03-08 19:30:41 +04:00
Tony Torralba
7d74125508
Go: Promote go/uncontrolled-allocation-size
2024-03-07 15:17:49 +01:00
Owen Mansel-Chan
f1115af146
Merge pull request #15130 from Malayke/main
...
Go: new query for detect DOS vulnerability
2024-03-06 11:32:57 +00:00
