Mathias Vorreiter Pedersen
24a63ae94d
C++: Block flow by default.
2024-02-16 12:56:19 +01:00
Mathias Vorreiter Pedersen
625c47fa9c
C++: Add a testcase.
2024-02-16 12:56:19 +01:00
Angela P Wen
4291c75488
Merge pull request #15631 from github/angelapwen/extend-permissions
...
Add `security-events: write` permission in `ql-for-ql-build.yml`
2024-02-16 02:28:30 -08:00
Angela P Wen
c75111619e
Add security-events: write permission
2024-02-16 02:17:17 -08:00
Cornelius Riemenschneider
4e022e2098
Merge pull request #15627 from github/criemen/java-test
...
Move the JS java tests to be a proper `java_test` target.
2024-02-16 11:15:18 +01:00
Erik Krogh Kristensen
037e64a4b5
Merge pull request #15623 from erik-krogh/cs-url
...
C#: update the QHelp for `cs/web/unvalidated-url-redirection`
2024-02-16 11:12:22 +01:00
Óscar San José
d46157135a
Merge pull request #15630 from tamasvajk/fix/change-coverage-updater-permissions
...
Extend permissions in `csv-coverage-update.yml`
2024-02-16 10:58:24 +01:00
Tamas Vajk
89384bb855
Extend permissions in csv-coverage-update.yml
2024-02-16 10:19:16 +01:00
Mathias Vorreiter Pedersen
c19ed4c17e
Merge pull request #15626 from MathiasVP/fix-constness-checking
...
C++: Don't strip specifiers away in `TFinalParameterUse`
2024-02-16 10:09:43 +01:00
Max Schaefer
a95f4128d9
Merge pull request #15554 from github/max-schaefer/automodel-candidate-fixes
...
Automodel: Improve handling of varargs and overriding in extraction queries
2024-02-16 08:51:54 +00:00
Ian Lynagh
c6f4a204e9
Merge pull request #15616 from igfoo/igfoo/kt2-exprs
...
Kotlin 2: Accept more location changes
2024-02-15 16:49:28 +00:00
Jeroen Ketema
da3ff4813f
Merge pull request #15612 from jketema/destructors4a
...
C++: Support `constexpr if` in the IR
2024-02-15 17:29:56 +01:00
Max Schaefer
652b6bb8e1
Fix bugs revealed by omittable exists variables.
2024-02-15 16:29:20 +00:00
Max Schaefer
8d4a344d47
Merge pull request #15592 from github/max-schaefer/rephrase-negative-characteristics
...
Automodel: Make description of some negative characteristics more explicit.
2024-02-15 16:20:17 +00:00
Cornelius Riemenschneider
798a1e250e
Move the JS java tests to be a proper java_test target.
...
Previously, we had a `sh_test` wrapping the `java_test` to do some setup.
This was extremely brittle on Windows, and relied on getting a deploy
jar from `java_test`. This breaks when updating to Bazel 7, where the
ability to get a deploy jar from `java_test` was removed.
Therefore, we now do all the test setup in `AllTests.java` instead.
This is much cleaner, and shouldn't break as easily.
2024-02-15 17:02:28 +01:00
Mathias Vorreiter Pedersen
532e8dac45
C++: Don't strip specifiers in 'TFinalParameterUse'.
2024-02-15 14:08:12 +01:00
Owen Mansel-Chan
9cd13cbf37
Merge pull request #15624 from owen-mc/go/update-library-coverage-frameworks
...
Add new libraries we cover to frameworks.csv
2024-02-15 12:55:19 +00:00
Owen Mansel-Chan
6cb4773188
Add new libraries we cover to frameworks.csv
2024-02-15 12:19:49 +00:00
erik-krogh
a5eb2dd906
update the QHelp for cs/web/unvalidated-url-redirection with examples inspired by the JS QHelp
2024-02-15 12:41:01 +01:00
Erik Krogh Kristensen
7c0557269a
Merge pull request #15596 from erik-krogh/url-san
...
C#: Add a few more sanitizers to `cs/web/unvalidated-url-redirection`
2024-02-15 12:09:06 +01:00
Angela P Wen
0643184a7e
Merge pull request #15493 from jsoref/declare-permissions
...
Declare permissions in workflows
2024-02-15 02:52:24 -08:00
Tony Torralba
f4c9052ba9
Merge pull request #15622 from atorralba/atorralba/java/path-sanitizer-equals
...
Java: Expand ExactPathSanitizer to work on the argument of 'equals' too
2024-02-15 11:29:09 +01:00
Tamás Vajk
a5e3643faf
Merge pull request #15621 from tamasvajk/buildless/cleanup
...
C#: Code quality improvements (fixed log message, removed unused interface)
2024-02-15 10:54:47 +01:00
Rasmus Wriedt Larsen
e4c30371f9
Merge pull request #13557 from am0o0/amammad-python-bombs
...
Python: Decompression Bombs
2024-02-15 10:43:12 +01:00
Tony Torralba
90a9d82b9d
Java: Expand ExactPathSanitizer to work on the argument of 'equals' too
2024-02-15 10:00:24 +01:00
Harry Maclean
a9abba5859
Merge pull request #15520 from hmac/hmac-erb-raw-output-directive
...
Ruby: Recognise raw Erb output as XSS sink
2024-02-15 08:05:16 +00:00
Harry Maclean
babae65e41
Merge pull request #15488 from hmac/ruby-mad-docs
...
Ruby: add docs for customizing library models with data extensions
2024-02-15 07:58:22 +00:00
Tamas Vajk
2f1472fa48
Code quality improvements (fixed log message, removed unused interface)
2024-02-15 08:52:44 +01:00
Tamás Vajk
8aff913c3c
Merge pull request #15614 from tamasvajk/buildless/razor-cleanup
...
C# Only remove temp files for MVC view generation if needed
2024-02-15 08:27:40 +01:00
Chris Smowton
7e41a895d8
Merge pull request #15618 from JLLeitschuh/patch-6
...
Fix typo in NettyRequestSplitting.java
2024-02-14 20:44:40 +00:00
Josh Soref
b58c856756
Declare permissions
...
Repositories can be configured with Default access (restricted)
https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
Best practice says that workflows should declare the minimal permissions they require.
Without declaring permissions, paranoid forks fail miserably.
2024-02-14 14:31:45 -05:00
Josh Soref
e468f4062f
use github/codeql-action...@main
2024-02-14 14:31:31 -05:00
amammad
09d8a75844
Fix QLDoc issues
2024-02-14 23:31:22 +04:00
Jonathan Leitschuh
50056d603e
Fix typo in NettyRequestSplitting.java
2024-02-14 14:03:33 -05:00
Ian Lynagh
f6d6a04ba2
Kotlin 2: Accept location changes in library-tests/exprs
2024-02-14 17:01:21 +00:00
Ian Lynagh
4fcc1c26d4
Kotlin 2: Accept location changes in library-tests/exprs
2024-02-14 16:56:22 +00:00
Ian Lynagh
b95c69dc66
Kotlin 2: Accept location changes in library-tests/exprs
2024-02-14 16:54:20 +00:00
Ian Lynagh
2fe4c8c519
Kotlin 2: Accept some loc changes in library-tests/exprs/exprs
2024-02-14 16:47:46 +00:00
Ian Lynagh
14979585c9
Kotlin 2: Accept loc changes for library-tests/exprs/funcExprs.kt
2024-02-14 16:40:54 +00:00
Tony Torralba
f5d9fe6b08
Merge pull request #15615 from atorralba/atorralba/go/hardcoded-credentials-test-fix
...
Go: Use less confusing name for hardcoded credentials tests
2024-02-14 17:33:43 +01:00
Ian Lynagh
efe5184a74
Kotlin 2: Accept loc change for fn in library-tests/exprs/funcExprs.kt
2024-02-14 16:09:14 +00:00
Tony Torralba
1202b5b429
Go: Use less confusing name for hardcoded credentials tests
...
We don't want name-based heuristics to pick these variable names, but also using something like 'safeName' may mislead readers into believing the test cases are intended to be GOOD cases (i.e. safe)
2024-02-14 17:06:05 +01:00
Ian Lynagh
18a28e2623
Kotlin 2: Accept loc changes in library-tests/exprs for kFunctionInvoke.kt
2024-02-14 16:04:10 +00:00
Ian Lynagh
c11bfb3c83
Kotlin 2: Accept loc changes in library-tests/exprs for localFunctionCalls.kt
2024-02-14 16:03:23 +00:00
Tamas Vajk
12663b58f1
C# Only remove temp files for MVC view generation if needed
2024-02-14 17:00:37 +01:00
Tony Torralba
99ac640536
Merge pull request #15527 from atorralba/atorralba/go/promote-hardcoded-key
...
Go: Promote `go/hardcoded-key` from experimental
2024-02-14 16:54:03 +01:00
Rasmus Wriedt Larsen
eb401a205d
Python: Fix test exclusion for stdlib Python 3.12
2024-02-14 16:53:19 +01:00
Ian Lynagh
1cc645b276
Kotlin 2: Accept location changes in library-tests/exprs for samConversion.kt
2024-02-14 15:49:44 +00:00
Ian Lynagh
9195be34a2
Kotlin 2: Accept location changes in library-tests/exprs/exprs for whenExpr.kt
2024-02-14 15:45:09 +00:00
Ian Lynagh
5d0b780c06
Kotlin 2: Accept some location improvements in library-tests/exprs/exprs.expected
2024-02-14 15:37:37 +00:00
