Tony Torralba
dc6f60a501
Add new XXE query
...
Only XMLParser sinks for the time being
2022-11-03 12:01:42 +01:00
Tony Torralba
83caf01778
Merge pull request #11096 from atorralba/atorralba/swift/unit
...
Swift: Move the Unit class to its own file
2022-11-03 12:00:57 +01:00
erik-krogh
3159b3d9a1
swift: fix unused variable
2022-11-03 11:20:15 +01:00
Tony Torralba
978ed03e9c
Move the Unit class to its own file
2022-11-03 11:19:41 +01:00
Nora Dimitrijević
28b7f0884f
Swift: UnsafeJsEval test finally compiles
2022-11-03 11:16:48 +01:00
Nora Dimitrijević
7b599f5fef
Swift: Add async varant of WKWebView evaluateJavaScript(_:)
...
See concurrency note here: https://developer.apple.com/documentation/webkit/wkwebview/1415017-evaluatejavascript
See also https://developer.apple.com/documentation/swift/calling-objective-c-apis-asynchronously
2022-11-03 11:16:48 +01:00
Nora Dimitrijević
5c905c42b2
Swift: Initial UnsafeJsEval query
2022-11-03 11:16:48 +01:00
Mathias Vorreiter Pedersen
01f3150a70
Merge pull request #11092 from hvitved/swift/avoid-deprecated-ssa-predicates
...
Swift: Avoid calls to deprecated SSA predicates
2022-11-03 09:03:47 +00:00
Tom Hvitved
4e3fcc3235
Swift: Avoid calls to deprecated SSA predicates
2022-11-03 09:03:20 +01:00
Dave Bartolomeo
a475e5758d
Merge remote-tracking branch 'upstream/main' into dbartol/use-workspace-versions
2022-11-02 12:38:03 -04:00
Karim Ali
f6484e6e6b
cleanup old code comments
2022-11-02 16:21:51 +02:00
Karim Ali
27d2dc6d9e
update expected results
2022-11-02 16:13:50 +02:00
Karim Ali
eefda61445
add a query that checks for the use of static IVs
2022-11-02 16:09:00 +02:00
Paolo Tranquilli
3acd4486a3
Swift: add tests for RUN_UNDER support
...
While I would have preferred to add a proper unit test, this required
more infrastructure for mocking system calls. Instead I made `qltest.sh`
accept a `//codeql-extractor-env` header and used that to write a QL
test exercising the `RUN_UNDER` functionality.
2022-11-02 12:09:13 +01:00
Tony Torralba
759ffc4743
Merge pull request #11027 from atorralba/atorralba/swift/webview-js-native-bridge-sources
...
Swift: WebView JS-native bridge sources
2022-11-02 09:32:57 +01:00
Geoffrey White
85e99feb49
Swift: Have swift/unsafe-webview-fetch use indices instead of parameter names.
2022-11-01 22:58:48 +00:00
Geoffrey White
d87117f623
Swift: Have swift/string-length-conflation use indices instead of parameter names.
2022-11-01 22:51:10 +00:00
Dave Bartolomeo
9d5e5e3ee7
${workspace} all the things
2022-11-01 13:29:05 -04:00
Dave Bartolomeo
49c4c554c4
Merge from main
2022-11-01 13:22:40 -04:00
Karim Ali
8be4d47178
fix typos
2022-11-01 16:03:36 +02:00
Geoffrey White
84c754e007
Merge pull request #11062 from geoffw0/rename
...
Swift: Rename ECB-Encryption directory
2022-11-01 12:59:53 +00:00
Karim Ali
fe408cfb41
add a query that detects the use of constant passwords
2022-11-01 14:03:27 +02:00
Geoffrey White
c3577b2256
Swift: Rename test directory.
2022-11-01 09:21:50 +00:00
Geoffrey White
7d80c5c7f7
Swift: Rename query directory.
2022-11-01 09:21:10 +00:00
Karim Ali
3911f3b202
update query description following docs review
2022-10-31 13:54:35 +02:00
Karim Ali
76a330d4b9
update code example to be OWASP compliant
2022-10-31 13:52:49 +02:00
Karim Ali
723ca8ed88
update documentation following docs review
2022-10-31 13:50:30 +02:00
Tony Torralba
b62ede1544
Fix issue in JsExportedSource
...
Model the source as an access to the tainted field, instead of the field itself (which didn't work)
2022-10-31 12:08:03 +01:00
Geoffrey White
ca586b4f3d
Merge remote-tracking branch 'upstream/main' into global
2022-10-31 10:28:29 +00:00
Geoffrey White
0dd8f574a7
Swift: Redesign as a FreeFunctionDecl class + add some qldoc.
2022-10-31 10:24:12 +00:00
Geoffrey White
840b74dbb5
Swift: Add and use ApplyExpr.getArgumentByParamName.
2022-10-28 17:55:11 +01:00
Geoffrey White
f122005aaf
Swift: Simplify out some variables.
2022-10-28 17:26:17 +01:00
Tony Torralba
2402504a4c
Add missing SummaryPostUpdateNode
2022-10-28 18:24:17 +02:00
Geoffrey White
b4d939a620
Swift: Correct a comment.
2022-10-28 17:11:24 +01:00
Geoffrey White
648c2d09f9
Swift: Simplify InsecureTLS.ql.
2022-10-28 15:56:03 +01:00
Tony Torralba
baf7986cfa
Rework types exported through JSContext
...
Better model the JSExport protocol logic
2022-10-28 15:56:05 +02:00
Geoffrey White
cf9c3afc86
Swift: Add and use AbstractFunctionDecl.hasGlobalName predicate.
2022-10-28 13:57:24 +01:00
Mathias Vorreiter Pedersen
0a3d0c4f56
Merge pull request #11031 from geoffw0/simplify
...
Swift: Simplify queries using MethodDecl.hasQualifiedName
2022-10-28 13:58:08 +02:00
Tony Torralba
48b0cc0229
Add models for JSContext and JSValue
2022-10-28 13:01:25 +02:00
Tony Torralba
81701547b2
Add taint sources for WKScriptMessage
...
This is what contains externally-provided data in Webview JS-native bridges
2022-10-28 12:58:27 +02:00
Mathias Vorreiter Pedersen
142e50008e
Merge pull request #10967 from MathiasVP/fix-swift-summary
...
Swift: Fix flow out of summarized callables
2022-10-28 12:57:52 +02:00
Geoffrey White
368f37a27e
Swift: And another.
2022-10-28 11:46:27 +01:00
Geoffrey White
1f3ed1cec7
Merge remote-tracking branch 'upstream/main' into simplify
2022-10-28 11:42:05 +01:00
Geoffrey White
6fca350714
Use MethodDecl.hasQualifiedName.
2022-10-28 11:41:42 +01:00
Mathias Vorreiter Pedersen
062a0abceb
Swift: Fix flow out of summarized callables.
2022-10-28 12:09:05 +02:00
Rasmus Wriedt Larsen
8628ff5e52
Merge pull request #10999 from RasmusWL/inline-fail-tag
...
InlineExpectationsTest: Fail if missing `getARelevantTag`
2022-10-28 10:35:49 +02:00
Geoffrey White
ca279f4073
Merge pull request #10996 from geoffw0/methods
...
Swift: Add MethodDecl.hasQualifiedName
2022-10-27 19:18:48 +01:00
Geoffrey White
3507ea3f2a
Swift: Autoformat.
2022-10-27 17:37:21 +01:00
Geoffrey White
d0f45180ab
Swift: cache some predicated.
2022-10-27 14:17:51 +01:00
Rasmus Wriedt Larsen
adf109b624
Merge branch 'main' into inline-fail-tag
2022-10-27 13:42:32 +02:00
