Max Schaefer
1ff032d11e
Add new query ConstantLengthComparison.
2019-11-22 20:55:14 +00:00
Max Schaefer
26a656b838
Merge pull request #189 from sauyon/use-taint-split
...
Use split taint predicates to emulate taint
2019-11-22 17:51:09 +00:00
Sauyon Lee
50b48e1c9e
Merge pull request #191 from max/isEmptyInterfaceNoInline
...
Mark `isEmptyInterface` as `noinline`.
2019-11-22 09:45:06 -08:00
Max Schaefer
e367a48f6e
Mark isEmptyInterface as noinline.
2019-11-22 09:19:34 +00:00
Sauyon Lee
4ea45dbf34
Use data-flow API in stringConcatStep
2019-11-21 23:48:23 -08:00
Sauyon Lee
9651a0bfc4
Use the split taint predicate to emulate taint where required
...
In particular, the OpenUrlRedirect and CleartextLogging queries, which both have taint flow into
an object when one of its fields is written.
2019-11-21 22:58:36 -08:00
Sauyon Lee
c0730fe4cc
Make taintStep public
2019-11-21 22:58:25 -08:00
Sauyon Lee
73922e98d7
Merge pull request #188 from Semmle/rc/1.23
...
Merge rc/1.23 into master
2019-11-21 22:52:12 -08:00
Max Schaefer
228e95a646
Merge pull request #185 from sauyon/open-redirect-fp1
...
OpenRedirect: treat assignments to Url.Path as a barrier
2019-11-21 16:51:16 +00:00
Sauyon Lee
81ba71e47b
Address review comments
2019-11-21 08:29:01 -08:00
Shati Patel
d8c6361312
Merge pull request #187 from max/rc/1.23
...
Add change notes for 1.23.
2019-11-21 16:07:21 +00:00
Max Schaefer
7136713a5f
Add change notes for 1.23.
2019-11-21 15:50:40 +00:00
Max Schaefer
a54d30c053
Merge pull request #186 from sauyon/taint-split
...
Split taintStep into many predicates
2019-11-20 20:39:27 +00:00
Sauyon Lee
3f437612e1
Add qldoc to all taint step predicates.
2019-11-20 11:27:24 -08:00
Sauyon Lee
1092fe5870
Move SsaWithFields to the Ssa file and rework it for public use
...
Also use it in OpenRedirect
2019-11-20 11:20:55 -08:00
Sauyon Lee
4c9bf2265e
OpenRedirect: treat assignments to Url.Path as a barrier
2019-11-20 11:20:54 -08:00
Max Schaefer
f94ce88ea4
Add .lgtm.yml to classify tests.
2019-11-20 10:24:54 +00:00
Sauyon Lee
09865a5f5c
Add a field read taint step
2019-11-18 23:58:01 -08:00
Sauyon Lee
e0c589060a
Split taintStep into many predicates
2019-11-18 23:58:00 -08:00
Max Schaefer
8cc60ba543
Add more codeql metadata files.
2019-11-14 10:35:21 +00:00
Sauyon Lee
eda858eafb
Merge pull request #184 from max/cleartext-logging-constant
...
Teach `CleartextLogging` not to flag constant sources.
2019-11-14 01:21:04 -05:00
Max Schaefer
616d78e2a5
Teach CleartextLogging not to flag constant sources.
2019-11-13 14:25:32 +00:00
Max Schaefer
50cde34878
Merge pull request #181 from sauyon/hardcoded-sensitive
...
HardcodedCredentials: Use SensitiveActions
2019-11-13 09:21:45 +00:00
Max Schaefer
ed95cdea56
Merge pull request #183 from sauyon/regexp-improvements
...
OpenUrlRedirect: Use the regexp library for RegexpCheck
2019-11-13 09:20:19 +00:00
Max Schaefer
899ae102b0
Merge pull request #182 from sauyon/fix-newline
...
autobuilder: Add a missing newline to the usage blurb
2019-11-13 09:19:22 +00:00
Sauyon Lee
3b39f5c2e1
OpenUrlRedirect: Use the regexp library for RegexpCheck
2019-11-12 15:14:05 -08:00
Sauyon Lee
2ba680ef4c
autobuilder: Add a missing newline to the usage blurb
2019-11-12 15:11:03 -08:00
Sauyon Lee
4e4d94da7b
Merge pull request #180 from max/receiver-deref-update
...
Conservatively handle indirect updates through pointer-type receiver.
2019-11-12 17:56:13 -05:00
Sauyon Lee
50a008900c
HardcodedCredentials: Use SensitiveActions
2019-11-12 14:08:44 -08:00
Max Schaefer
5726ec179c
Merge pull request #9 from github/autobuilder-add-print
...
autobuilder: Add line printing the environment and build versions of Go
2019-11-12 16:24:19 +00:00
Max Schaefer
06fe00006a
Conservatively handle indirect updates through pointer-type receiver.
...
Method references `x.m` where the receiver of `m` is a pointer implicitly take the address of `x`, so they should be treated much the same as `&x` in terms of data flow. (Ideally we'd make this explicit in the data-flow graph itself, but that's for another PR.)
2019-11-12 08:54:47 +00:00
Sauyon Lee
7c45316aa7
autobuilder: Add line printing the environment and build versions of Go
2019-11-08 19:59:52 -08:00
Max Schaefer
d14eb855fc
Go analysis support for CodeQL.
2019-11-08 12:16:26 +00:00
