Maiky
d654e98650
Add empty string as source
2023-06-18 22:21:12 +02:00
Maiky
1a9bfb38aa
Correct barrier
2023-06-05 01:25:17 +02:00
Maiky
bf9d0b93d7
Add Improper LDAP Auth Query (CWE-287)
2023-06-03 23:20:11 +02:00
Chris Smowton
ee64ea59e1
Merge pull request #12901 from porcupineyhairs/goDsn
...
Go: Add query to detect DSN Injection.
2023-05-11 22:45:43 +01:00
Chris Smowton
99f4eef9c5
Fix spelling
2023-05-11 22:12:35 +01:00
Chris Smowton
a10b11e09e
Fix spelling and remove dead code
2023-05-11 22:12:17 +01:00
Chris Smowton
b6c2db6baf
Fix duplicate query ID
2023-05-11 22:10:09 +01:00
Porcupiney Hairs
2c518c1fa6
Include changes from review
2023-05-12 01:59:42 +05:30
Porcupiney Hairs
ae6fda03b7
Include changes from review
2023-05-11 23:56:50 +05:30
Porcupiney Hairs
d536157c1a
Go : Add query to detect potential timing attacks
2023-05-11 09:57:50 +05:30
Owen Mansel-Chan
270ba09ffb
Merge pull request #11732 from owen-mc/go/fix/model-data-flow-through-varargs
...
Go: Allow data flow through varargs parameters
2023-05-11 05:26:40 +01:00
Porcupiney Hairs
ec424d7e51
Go: Add query to detect DSN Injection.
2023-05-11 03:45:29 +05:30
Owen Mansel-Chan
1c66564ccc
address review comments
2023-05-10 14:05:09 +01:00
Kasper Svendsen
e969018f99
Go: Make implicit this receivers explicit
2023-05-03 12:45:42 +02:00
Owen Mansel-Chan
bc0f9030e3
use CallNode.getSyntacticArgument
2023-04-28 06:09:10 +01:00
Michael B. Gale
72b082806b
Go: Update html-template-escaping-passthrough
...
Modify this query to apply sanitizers only in the data flow
between untrusted inputs and passthrough conversion types.
2023-04-27 17:14:38 +01:00
Owen Mansel-Chan
00fd23d7b9
Merge pull request #12396 from porcupineyhairs/GoJwtSignImprovements
...
Go: Add more JWT sinks
2023-04-04 13:28:38 +01:00
Porcupiney Hairs
e9615c57e9
Go: Add more JWT sinks
...
This pull requests adds modelling for `katras/iris/v12/middleware/jwt`, `katras/jwt` and `gogf/gf-jwt` frameworks.
2023-03-31 23:11:24 +05:30
Owen Mansel-Chan
cf89b00f47
Fix variable names in QLDocs
2023-03-31 16:47:57 +01:00
Owen Mansel-Chan
513409e082
Fix formatting of QLDocs
2023-03-31 16:47:56 +01:00
Owen Mansel-Chan
7a25200962
Remove fields which are only used in char pred
2023-03-31 16:47:55 +01:00
Owen Mansel-Chan
a113b8e8a4
No need for singleton set
2023-03-31 16:47:55 +01:00
Chris Smowton
99d3f689dc
Consolidate repeated calls to matches and regexpMatch
...
This is especially useful if it avoids temporary string construction, such as toLowerCase().matches(...)
2023-02-07 19:22:49 +00:00
Owen Mansel-Chan
9ed7836367
Fix files that gofmt can't parse
...
We have some .go files that gofmt can't parse because they don't start
with "package". This was intentional, as they are fragments to be
included in .qhelp files. They don't affect the return code as gofmt
doesn't change their formatting, so this wasn't changing the result of
the check. However, it was confusing that when the check failed because
some other files weren't formatted correctly, the user would see the
stderr complaining about those files, so we capture stderr.
It would be an improvement to print which files are not formatted
correctly, but that was beyond my abilities with bash and makefiles.
2023-02-06 07:16:58 +00:00
Pierre
c3116b3f0f
Merge branch 'main' into turbo/experimental/combined
2023-01-11 18:02:55 +01:00
Tony Torralba
7a92970d89
Go: Remove omittable exists variables
2023-01-10 13:36:48 +01:00
turbo
4ec401a3f6
Tag all security queries in supported languages' experimental directories with an experimental tag
2022-12-14 17:15:50 +01:00
Owen Mansel-Chan
f2e2c02db6
Rename predicates to avoid clashes
2022-11-17 14:27:06 +00:00
erik-krogh
f9195d194b
go: make sure the source/sink have the same type as the edges relation
2022-11-03 11:20:15 +01:00
erik-krogh
c9fcef2608
go: add a precision tag to go/examples/deferinloop
2022-11-03 11:20:15 +01:00
Josh Soref
e6998d40c3
spelling: cryptographically
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
Josh Soref
9b372f3db4
spelling: characters
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
Josh Soref
b1052992fe
spelling: against
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:35 -04:00
erik-krogh
d5c45056bd
fix some more style-guide violations in the alert-messages
2022-10-07 11:21:01 +02:00
erik-krogh
175d3acf4d
reword alert-message go/user-controlled-bypass to avoid using "here"
2022-09-20 22:51:35 +02:00
erik-krogh
3cf5516df6
make the alert messages of taint-tracking queries more consistent
2022-09-20 22:51:35 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
Erik Krogh Kristensen
06afe9c0f4
Merge pull request #9816 from erik-krogh/msgConsis
...
Make alert messages consistent across languages
2022-08-25 15:20:01 +02:00
Ian Lynagh
3fcfd32eb1
Make *.ql non-executable
2022-08-24 16:55:11 +01:00
Ian Lynagh
344863d896
Make *.qhelp non-executable
2022-08-24 16:38:15 +01:00
erik-krogh
151529d08f
correct the query-id of the experimental go/pam-auth-bypass query
2022-08-22 21:41:46 +02:00
erik-krogh
8066e39d07
delete some redundant imports
2022-08-17 13:50:04 +02:00
Erik Krogh Kristensen
887f6557ed
fix common misspellings throughout github/codeql
2022-08-10 23:21:41 +02:00
Chris Smowton
8ae4c21a3e
Update doc for divideByZeroSanitizerGuard
2022-06-21 12:11:19 +01:00
Anders Schack-Mulligen
406f5b525b
Go: Deprecate and replace BarrierGuard class
2022-06-20 15:46:27 +02:00
Chris Smowton
04422eeaee
Merge pull request #9378 from porcupineyhairs/goJwtSign
...
Golang : Add query to detect JWT signing vulnerabilities
2022-06-02 20:53:03 +01:00
Chris Smowton
e54b29a846
Autoformat
2022-06-02 15:58:29 +01:00
Chris Smowton
602495df4c
Replace cases accidentally handled by CompareExprSanitizer with ReturnedAlongsideErrorSanitizerGuard
2022-06-02 15:53:41 +01:00
Chris Smowton
b48a07e7b8
Tighten up CompareExprSanitizer
...
- Document
- Only actually consider comparisons
- Don't sanitize literals
2022-06-02 15:18:38 +01:00
Chris Smowton
3155771abe
Rename empty-string sanitizer to reflect what it actually does.
2022-06-02 15:10:02 +01:00
