amammad
9245e1c2a4
remove CLI sources Library file & qldoc warnings
2023-10-01 00:37:56 +10:00
amammad
f0f60c3b7d
move JWT.qll to experimental
2023-09-30 22:30:30 +10:00
amammad
2961b79fb9
add multipart sources
2023-09-30 03:09:02 +10:00
amammad
2e7529cc70
remove local sources
2023-09-30 02:41:47 +10:00
amammad
c78f390128
add go generate support, upgrade JWT.qll
2023-09-27 20:17:31 +10:00
amammad
bc6a0fc776
move to CWE-347
2023-09-19 07:15:46 +10:00
Maiky
52007fb9a2
Change v3 to v2
2023-09-17 21:42:18 +02:00
amammad
e1d5c9d45b
fix grammar mistake
2023-09-15 06:32:23 +10:00
amammad
5a3a8d781a
fix some flowstate bug which Had caused to FP
2023-09-15 02:09:40 +10:00
amammad
08f78a2df4
fix some flowstate bug which Had caused to FP
2023-09-15 01:56:46 +10:00
amammad
0f540f4c25
add sources to detect CVE completely
2023-09-07 18:25:48 +10:00
amammad
f6f99fb459
remove parameter as source
2023-09-07 17:47:55 +10:00
amammad
c76d0d364d
fix a mistake ioutil => io/ioutil
2023-09-06 03:38:06 +10:00
amammad
68392e7ae7
V1
2023-08-28 22:23:51 +10:00
Owen Mansel-Chan
b7dfa2347c
Put QLDoc on data flow and taint tracking modules
...
We preserve all old QLDocs, but move them from the
config to the Flow module. This makes more sense than
the Config module, which is often private, and is generally
not directly accessed.
2023-08-11 10:06:12 +01:00
Owen Mansel-Chan
08e1e8a120
Improve inaccurate deprecation comments
2023-08-10 15:50:08 +01:00
Owen Mansel-Chan
36b1a0dc54
Update for recent changes to DsnInjection
2023-08-10 15:50:03 +01:00
Owen Mansel-Chan
e33d303b48
Do not make unnecessary changes
2023-08-10 15:49:59 +01:00
Owen Mansel-Chan
e6c8a0b653
Use more descriptive names for merged path graphs
2023-08-10 15:49:58 +01:00
Owen Mansel-Chan
6b4bf12316
Revert edit to deprecated class
2023-08-10 15:49:57 +01:00
Owen Mansel-Chan
b00e44725c
Make CorsMisconfiguration use new API
2023-08-10 15:49:43 +01:00
Owen Mansel-Chan
9b19cde8ab
Make SensitiveConditionBypass use new API
2023-08-10 15:49:42 +01:00
Owen Mansel-Chan
d9844bd4d6
Make WrongUsageOfUnsafe use new API
2023-08-10 15:49:39 +01:00
Owen Mansel-Chan
00ea023fdb
Make ConditionalBypass use new API
2023-08-10 15:49:37 +01:00
Owen Mansel-Chan
1b4fef9c21
Make HTMLTemplateEscapingPassthrough use new API
...
Removed edges and nodes are mostly duplicates. They were only there
originally due to multiple configurations being in scope.
`DataFlow::PathNode` has union semantics for configurations. Nodes are
only generated if they are reachable from a source, but this includes
sources from other configurations.
No alerts are lost.
2023-08-10 15:49:36 +01:00
Owen Mansel-Chan
ea1f39683d
Make DivideByZero use new API
...
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717 , which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:35 +01:00
Owen Mansel-Chan
045936b1fd
Make PamAuthBypass use new API
2023-08-10 15:49:33 +01:00
Owen Mansel-Chan
cfc4a6a6b7
Make Timing use new API
2023-08-10 15:49:32 +01:00
Owen Mansel-Chan
39762da5e0
Make DsnInjection use new API
2023-08-10 15:49:31 +01:00
Owen Mansel-Chan
a53da376d1
Make LDAPInjection use new API
2023-08-10 15:49:29 +01:00
Owen Mansel-Chan
1962aa3de4
Make SSRF use new API
2023-08-10 15:49:27 +01:00
Owen Mansel-Chan
71735c86c2
Make WeakCryptoAlgorithm use new API
2023-08-10 15:49:25 +01:00
Owen Mansel-Chan
46185e3a02
Make HardcodedKeys use new API
2023-08-10 15:49:24 +01:00
Owen Mansel-Chan
00cc78dfe6
Make CookieWithoutHttpOnly use new API
...
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717 , which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:00 +01:00
amammad
f79bd2a071
added remote flow sources related to multipart upload, added flag package command line source
2023-08-06 06:49:35 +10:00
amammad
7ce825c5ea
convert to module based dataflow
2023-07-31 22:43:45 +10:00
amammad
ab7e797fff
it seems that I must use both isSink and isSource with flow states!
2023-07-31 20:00:59 +10:00
amammad
26f1091d5f
fix a mistake :(
2023-07-31 19:48:21 +10:00
amammad
56d0254d2b
fix ReadAll argumrnt number
2023-07-31 19:37:28 +10:00
amammad
4ee54738fa
fix a mistake :(
2023-07-31 19:36:21 +10:00
amammad
260c111932
put comment about detecting https://github.com/advisories/GHSA-jpxj-2jvg-6jv9
2023-07-31 19:32:22 +10:00
amammad
1b598c8683
v1.2 make better sinks
2023-07-31 19:26:18 +10:00
Porcupiney Hairs
74e5c15eaa
Go : Improvements to Timing Attacks query
2023-07-31 06:30:47 +05:30
amammad
f1918fb4e0
v1.1
2023-07-31 05:11:09 +10:00
Owen Mansel-Chan
374f13e0dc
Revert "Go: Fix missing flow through receiver for function variable"
2023-07-20 13:31:14 +01:00
Owen Mansel-Chan
5b0d4ce7cb
Merge pull request #13644 from porcupineyhairs/dsnImprove
...
Go : Improvements to DSN Injection query
2023-07-19 16:10:34 +01:00
Owen Mansel-Chan
a3ba74a6a6
Cast to MethodCallNode before calling getReceiver()
...
This is not required, because getReceiver is still defined on CallNode,
but is done for consistency.
2023-07-19 11:17:38 +01:00
Maiky
08c54767f2
Correct Ldap Unauth Bind Sink
2023-07-05 17:56:49 +02:00
Porcupiney Hairs
dc0deb5e49
Go : Improvements to DSN Injection query
2023-07-02 17:38:01 +05:30
amammad
fbfc959f82
V1 Bombs
2023-06-25 01:21:09 +10:00
