github-actions[bot]
1e620c99c6
JS: Bump patch version of ML-powered library and query packs post-release
2022-03-23 11:53:34 +00:00
github-actions[bot]
dc0c8374d2
JS: Bump minor version of ML-powered library and query packs
2022-03-23 11:47:53 +00:00
github-actions[bot]
2b42d84ccd
JS: Bump patch version of ML-powered model pack post-release
2022-03-23 11:47:53 +00:00
github-actions[bot]
6fbc0e6e32
JS: Bump ML model pack dependency of ML-powered model building and query packs
2022-03-23 11:47:53 +00:00
github-actions[bot]
8d13662315
JS: Bump minor version of ML-powered model pack
2022-03-23 11:47:08 +00:00
Erik Krogh Kristensen
cd9d61c1fc
Merge pull request #8450 from erik-krogh/importAs
...
disallow lowercase import-as aliases
2022-03-16 11:32:37 +01:00
Erik Krogh Kristensen
b0fc958b32
simplify imports
...
Co-authored-by: Henry Mercer <henry.mercer@me.com >
2022-03-15 15:10:04 +01:00
Erik Krogh Kristensen
89af50f6d5
rename all lower-case import-as statements
2022-03-15 14:40:38 +01:00
Anna Railton
739d94e8f9
Add docstring to ExtractEndpointMapping.ql
2022-03-15 12:50:51 +00:00
Henry Mercer
f38b498eed
Merge pull request #8433 from github/henrymercer/js-atm-remove-isEffectiveSinkWithOverridingScore
...
JS: Remove `isEffectiveSinkWithOverridingScore` from ML-powered libraries
2022-03-15 10:04:30 +00:00
Henry Mercer
5102cadf8e
Merge pull request #8404 from github/codeql-ci/js-atm-new-release
...
JS: Bump version numbers of ML-powered packs after 0.1.0 release
2022-03-14 17:32:37 +00:00
Henry Mercer
8b1b2af2d8
JS: Remove isEffectiveSinkWithOverridingScore
...
This was previously used in the ATM external API query, but is now dead
code.
2022-03-14 14:25:36 +00:00
github-actions[bot]
7ac7657ffc
JS: Bump patch version of ML-powered library and query packs post-release
2022-03-11 12:17:13 +00:00
github-actions[bot]
2f6886642c
JS: Bump minor version of ML-powered library and query packs
2022-03-11 12:13:03 +00:00
Erik Krogh Kristensen
69353bb014
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
Tom Bolton
173f45f316
Merge pull request #8334 from github/tombolton/add-mapping-query
...
JS: Add query that maps queries to sink type
2022-03-07 10:35:37 +00:00
tombolton
2ffa6771ff
replace endpoint type name with encoding in mapping query
2022-03-04 11:00:31 +00:00
tombolton
bd9e845aea
update column names and remove encoding value
2022-03-03 15:59:10 +00:00
tombolton
f1f1526237
add query-sink mapping query
2022-03-03 15:20:06 +00:00
Erik Krogh Kristensen
1b5c7392f0
restrict the size of the getASubexpressionWithinQuery predicate, and remove double-recursion
2022-03-01 11:18:42 +01:00
Tom Bolton
8dfc0d25d1
Merge pull request #8232 from github/tombolton/use-updated-counting-query
...
Add new xss queries to result counting query
2022-02-24 16:38:53 +00:00
tombolton
d80ef6566d
add new xss queries to result counting query
2022-02-24 13:31:40 +00:00
Stephan Brandauer
517d6969e1
Merge pull request #8171 from kaeluka/js/update-atm-query-docs-for-nosql-sql-injection
...
update ATM NosqlInjection and SqlInjection query docs
2022-02-23 10:54:37 +01:00
Erik Krogh Kristensen
c487bb73a7
Merge pull request #8143 from erik-krogh/pred-ql-style
...
QL: add ql-for-ql query for detecting bad predicate qldoc
2022-02-22 17:49:12 +01:00
Stephan Brandauer
6a9186cdef
update ATM NosqlInjection and SqlInjection query docs
2022-02-22 16:56:18 +01:00
Henry Mercer
4f7604f0dd
Merge pull request #8151 from github/henrymercer/separate-atm-model-pack
2022-02-22 11:47:35 +00:00
Henry Mercer
5a3daa9e3f
JS: Add CWE tags for ML-powered queries
...
- Cross-site scripting: CWE-79
- Path injection: CWE-22, CWE-23, CWE-36, CWE-73, CWE-99
- NoSQL injection: CWE-943
- SQL injection: CWE-89
2022-02-21 16:18:33 +00:00
Henry Mercer
a89882c14e
JS: Update lockfiles for ML-powered queries packs
2022-02-21 16:03:05 +00:00
Henry Mercer
6fb9895367
JS: Separate the ML-powered queries model into its own pack
...
This allows users to more easily get started with development. Running
`codeql pack install` from the `-queries` pack will now install the ML
model.
2022-02-21 15:05:57 +00:00
tombolton
e02319be9f
add end to end predicate to result counting query
2022-02-21 14:35:58 +00:00
Erik Krogh Kristensen
1407b49a8f
fix some instances of ql/pred-doc-style for JS
2022-02-21 15:02:21 +01:00
Erik Krogh Kristensen
a1c5724be7
fix most ql-for-ql warnings in JS
2022-02-11 17:57:37 +01:00
Ian Wright
6c3daf49f9
Merge pull request #7785 from github/z80coder/impose-length-restriction
...
Restrict AST nodes according to string length
2022-02-04 16:35:04 +00:00
Ian Wright
be5e8dae05
Update javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/FunctionBodyFeatures.qll
...
Co-authored-by: Henry Mercer <henrymercer@github.com >
2022-02-04 15:41:50 +00:00
Ian Wright
e57a0e0e2f
Update javascript/ql/experimental/adaptivethreatmodeling/lib/experimental/adaptivethreatmodeling/FunctionBodyFeatures.qll
...
Co-authored-by: Henry Mercer <henrymercer@github.com >
2022-02-04 15:21:56 +00:00
Ian Wright
b38335a6c2
add QL comment; inline a predicate; restore a comment
2022-02-04 15:21:09 +00:00
Ian Wright
dca03d7b5d
reinstate the AST node limit to minimize change to feature values
2022-02-03 09:45:35 +00:00
Ian Wright
d5ab119039
actually count the number of chars
2022-02-03 09:41:51 +00:00
Henry Mercer
a586be956e
JS: Remove versions from packs we don't intend to publish
2022-02-02 18:10:57 +00:00
Henry Mercer
7018f6ad40
JS: Add missing @id for endpoint types query
2022-02-02 13:15:15 +00:00
Henry Mercer
fbcb8d6857
JS: Migrate CodeQL tests for ML-powered queries
2022-02-02 13:15:04 +00:00
Henry Mercer
14601316a5
JS: Autoformat
2022-02-01 17:08:21 +00:00
Henry Mercer
368839edfc
JS: Fix QLDoc style in ExtractMisclassifiedEndpointFeatures.ql
2022-02-01 15:39:15 +00:00
Henry Mercer
db0b4fc463
JS: Add model building pack for ML-powered queries
...
Tests are currently still internal. They will be migrated to
`github/codeql` in a subsequent PR.
2022-02-01 15:03:26 +00:00
Ian Wright
83ecc065ab
restrict size of strings
2022-01-31 12:28:46 +00:00
Ian Wright
aceeb7324c
restrict AST nodes according to string length
2022-01-28 15:06:10 +00:00
Henry Mercer
70f7535988
JS: Move experimental notice to the bottom of the ML-powered query help
...
The Code Scanning UI shows just the first paragraph of the query help
as a summary, until a user chooses to expand the help.
We decided it was more useful to display the standard query help in this
summary compared to the experimental query notice, since there is
already a notice about experimental queries on the alert show page.
2022-01-25 15:52:09 +00:00
Henry Mercer
84907f91f1
JS: Fix copy/paste error in XSS ML-powered queries results patterns
...
We didn’t catch this because our unit tests test only library code due
to the previous difficulty of running queries with an ML model (the ML
models in packs work should fix that), and because the end-to-end
evaluation runs separate queries that have different result patterns.
Going forward we should create unit tests for the queries themselves,
which will require using the ML model in tests. We should also be able
to catch this type of error using DCA.
2022-01-21 15:17:52 +00:00
Henry Mercer
c134e6c9ef
JS: Bump ML-powered query packs to v0.0.6
2022-01-19 14:40:42 +00:00
Henry Mercer
d467725ccd
JS: Bump ML-powered query packs to v0.0.5
2022-01-19 12:08:33 +00:00
