Commit Graph

837 Commits

Author SHA1 Message Date
Owen Mansel-Chan
cfc4a6a6b7 Make Timing use new API 2023-08-10 15:49:32 +01:00
Owen Mansel-Chan
39762da5e0 Make DsnInjection use new API 2023-08-10 15:49:31 +01:00
Owen Mansel-Chan
a53da376d1 Make LDAPInjection use new API 2023-08-10 15:49:29 +01:00
Owen Mansel-Chan
f60ca76eb2 Make EmailInjection use new API 2023-08-10 15:49:28 +01:00
Owen Mansel-Chan
1962aa3de4 Make SSRF use new API 2023-08-10 15:49:27 +01:00
Owen Mansel-Chan
71735c86c2 Make WeakCryptoAlgorithm use new API 2023-08-10 15:49:25 +01:00
Owen Mansel-Chan
46185e3a02 Make HardcodedKeys use new API 2023-08-10 15:49:24 +01:00
Owen Mansel-Chan
b5ac0c94c6 Make ZipSlip use new API 2023-08-10 15:49:23 +01:00
Owen Mansel-Chan
7341b6156d Make XPathInjection use new API 2023-08-10 15:49:21 +01:00
Owen Mansel-Chan
a6177b3c92 Make UnsafeUnzipSymlink use new API 2023-08-10 15:49:20 +01:00
Owen Mansel-Chan
7db1daba6e Make TaintedPath use new API 2023-08-10 15:49:19 +01:00
Owen Mansel-Chan
6c91f77776 Make StringBreak use new API 2023-08-10 15:49:17 +01:00
Owen Mansel-Chan
30ae34352b Make StoredXss use new API 2023-08-10 15:49:16 +01:00
Owen Mansel-Chan
4334a51cf3 Make StoredCommand use new API 2023-08-10 15:49:15 +01:00
Owen Mansel-Chan
ac1670c0af Make SqlInjection use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:13 +01:00
Owen Mansel-Chan
d385113e11 Make InsufficientKeySize use new API 2023-08-10 15:49:09 +01:00
Owen Mansel-Chan
16ef11a3c3 Make ConstantOauth2State use new API
Removed edges were only there originally due to multiple configurations
being in scope. `DataFlow::PathNode` has union semantics for
configurations. Nodes are only generated if they are reachable from a
source, but this includes sources from other configurations.

No alerts are lost.
2023-08-10 15:49:08 +01:00
Owen Mansel-Chan
fbd0c4edd0 Make HostKeyCallbackAssignment use new API 2023-08-10 15:49:07 +01:00
Owen Mansel-Chan
a1a31bfd62 Make SuspiciousCharacterInRegexp use new API 2023-08-10 15:49:05 +01:00
Owen Mansel-Chan
8f644af769 Make MissingRegexpAnchor use new API 2023-08-10 15:49:04 +01:00
Owen Mansel-Chan
442f6875f5 Make IncompleteHostNameRegexp use new API 2023-08-10 15:49:03 +01:00
Owen Mansel-Chan
0e1383ddd7 Make UnhandledFileCloseWritableHandle use new API 2023-08-10 15:49:01 +01:00
Owen Mansel-Chan
00cc78dfe6 Make CookieWithoutHttpOnly use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:49:00 +01:00
Owen Mansel-Chan
a7382e06c2 Make ClearTextLogging use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:48:59 +01:00
Owen Mansel-Chan
1f6cdc7eda Make OpenURLRedirect use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.

Removed nodes and edges were only there originally due to multiple
configurations being in scope. `DataFlow::PathNode` has union semantics
for configurations. Nodes are only generated if they are reachable from
a source, but this includes sources from other configurations.
2023-08-10 15:48:55 +01:00
Owen Mansel-Chan
d2a5d19439 Make SafeUrlFlow use new API 2023-08-10 15:48:54 +01:00
Owen Mansel-Chan
97c32970a0 Make RequestForgery use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:48:53 +01:00
Owen Mansel-Chan
1c2536321c Make ReflectedXss use new API 2023-08-10 15:48:51 +01:00
Owen Mansel-Chan
3d9f8d50bc Make InsecureRandomness use new API 2023-08-10 15:48:50 +01:00
Michael B. Gale
87c089e0a8 Make CommandInjection.qll use new API
The new `edges` and `nodes` sections in the .expected files are because
the PathGraph module was not imported in the tests before, and thus
these query predicates were not in scope.
2023-08-10 15:48:48 +01:00
Michael B. Gale
957757c271 Make UntrustedDataToUnknownExternalAPI use new API 2023-08-10 15:48:47 +01:00
Michael B. Gale
d6919dd57b Make UntrustedDataToExternalAPI use new API 2023-08-10 15:48:46 +01:00
Michael B. Gale
82a1b15d11 Make AllocationSizeOverflow use new API
The extra nodes in .expected files are due to the changes from
https://github.com/github/codeql/pull/13717, which are not applied to
configuration classes extending DataFlow::Configuration or
TaintTracking::Configuration.
2023-08-10 15:48:44 +01:00
github-actions[bot]
432c21d4fb Post-release preparation for codeql-cli-2.14.2 2023-08-09 18:45:18 +00:00
github-actions[bot]
79c90fa36a Release preparation for version 2.14.2 2023-08-07 18:08:52 +00:00
amammad
f79bd2a071 added remote flow sources related to multipart upload, added flag package command line source 2023-08-06 06:49:35 +10:00
amammad
7ce825c5ea convert to module based dataflow 2023-07-31 22:43:45 +10:00
amammad
ab7e797fff it seems that I must use both isSink and isSource with flow states! 2023-07-31 20:00:59 +10:00
amammad
26f1091d5f fix a mistake :( 2023-07-31 19:48:21 +10:00
amammad
56d0254d2b fix ReadAll argumrnt number 2023-07-31 19:37:28 +10:00
amammad
4ee54738fa fix a mistake :( 2023-07-31 19:36:21 +10:00
amammad
260c111932 put comment about detecting https://github.com/advisories/GHSA-jpxj-2jvg-6jv9 2023-07-31 19:32:22 +10:00
amammad
1b598c8683 v1.2 make better sinks 2023-07-31 19:26:18 +10:00
Porcupiney Hairs
74e5c15eaa Go : Improvements to Timing Attacks query 2023-07-31 06:30:47 +05:30
amammad
f1918fb4e0 v1.1 2023-07-31 05:11:09 +10:00
github-actions[bot]
f91b7a9342 Post-release preparation for codeql-cli-2.14.1 2023-07-21 16:16:25 +00:00
github-actions[bot]
c936a920b0 Release preparation for version 2.14.1 2023-07-20 16:32:27 +00:00
Owen Mansel-Chan
374f13e0dc Revert "Go: Fix missing flow through receiver for function variable" 2023-07-20 13:31:14 +01:00
Owen Mansel-Chan
5b0d4ce7cb Merge pull request #13644 from porcupineyhairs/dsnImprove
Go : Improvements to DSN Injection query
2023-07-19 16:10:34 +01:00
Owen Mansel-Chan
a3ba74a6a6 Cast to MethodCallNode before calling getReceiver()
This is not required, because getReceiver is still defined on CallNode,
but is done for consistency.
2023-07-19 11:17:38 +01:00