Slavomir
29eba441d7
Determine TLS version from int value
2020-06-22 17:50:20 +03:00
Slavomir
70bc4c81a0
Fix typo
2020-06-22 17:15:56 +03:00
Slavomir
783f710188
Fix comments
2020-06-22 17:12:15 +03:00
Slavomir
e38d4ecd9c
Fix typos
2020-06-22 17:00:31 +03:00
Slavomir
bbf8d7306b
Add CWE-327
2020-06-22 16:54:14 +03:00
Max Schaefer
18db1fe79f
Merge pull request #184 from max-schaefer/lookup-fields-in-cyclic-struct
...
Fix field lookup in cyclic structs
2020-06-21 09:23:57 +01:00
Max Schaefer
47c4c55923
Merge pull request #185 from github/max-schaefer-patch-2
...
Set up Code Scanning
2020-06-20 10:41:25 +01:00
Sauyon Lee
8742f09343
Merge pull request #186 from max-schaefer/fix-test-compile-errors
...
Fix compiler errors in tests.
2020-06-19 08:28:34 -07:00
Chris Smowton
6c230980a3
Merge pull request #187 from max-schaefer/fill-in-qldoc
...
Add qldoc for three public predicates in `PrintAst.qll`.
2020-06-19 15:30:24 +01:00
Max Schaefer
0f4297ff5c
Add qldoc for three public predicates in PrintAst.qll.
...
It's bland, but we try to maintain a 100% documentation coverage for our public library elements.
2020-06-19 14:25:57 +01:00
Max Schaefer
314bda2a7f
Fix compiler errors in tests.
2020-06-19 14:21:10 +01:00
Max Schaefer
df02ad404e
Set up Code Scanning
2020-06-19 14:02:31 +01:00
Max Schaefer
79b0ea8d77
Merge pull request #183 from smowton/smowton/cleanup/field-parent
...
Clean up @field and @fieldparent usage
2020-06-19 11:30:52 +01:00
Chris Smowton
3c8153ca1e
Clean up @field and @fieldparent usage
...
* Centralise use of raw types and database predicates in FieldParent and FieldBase classes
* Deduplicate type predicates common to all fields
* Deduplicate predicates common to function parameters and results
2020-06-19 11:00:42 +01:00
Max Schaefer
c31a7fc228
Add a few more tests.
2020-06-19 09:28:12 +01:00
Max Schaefer
2df8c275e0
Fix field lookup in cyclic structs.
2020-06-19 08:16:09 +01:00
Max Schaefer
7c2358c1d0
Merge pull request #181 from sauyon/reflectedxss-fps
...
ReflectedXSS refinement
2020-06-18 11:14:13 +01:00
Max Schaefer
7af168fc3b
Merge pull request #179 from smowton/smowton/feature/printast
...
Add barebones PrintAST for Go
2020-06-17 17:02:53 +01:00
Owen Mansel-Chan
2282def1e2
Merge pull request #180 from owen-mc/email-injection
...
Move email injection query out of experimental folder
2020-06-17 15:11:31 +01:00
Chris Smowton
1a823b21f1
PrintAst: Emit relative paths for file nodes
...
This is a workaround for codeql run test not itself truncating absolute paths
when comparing against actual output.
2020-06-17 15:03:29 +01:00
Owen Mansel-Chan
49abd0b9b1
Add test using hashing
2020-06-17 14:33:53 +01:00
Chris Smowton
80b9be1004
Add simple PrintAst test
...
This both checks that many common control-flow structures print as expected, and checks our unique child node numbering, which would otherwise give the same label to a file's package (its 0th child expression) and its 0th declaration.
2020-06-17 14:25:45 +01:00
Owen Mansel-Chan
83697f62ac
Address review comments on qhelp
2020-06-17 14:21:37 +01:00
Chris Smowton
bd7b7c06b5
Add AstNode.getCanonicalQlClass and use it in PrintAst
...
This gives those classes satisfied by an AstNode that are considered useful for developer understanding, cf. getAQlClass which returns all satisfied classes and hides overridden ones, even if they are interesting.
2020-06-17 13:47:23 +01:00
Owen Mansel-Chan
f926808c8a
Address review comments
2020-06-17 10:11:41 +01:00
Sauyon Lee
ed87c346cf
Add tests for the ReflectedXSS HTML content type sniffing regexp
2020-06-17 00:28:03 -07:00
Sauyon Lee
95235c8415
Add change note for reflected xss regexp fixes
2020-06-17 00:28:03 -07:00
Sauyon Lee
4f3854c052
ReflectedXSS: Ignore whitespace for HTML content type detection
2020-06-17 00:28:02 -07:00
Chris Smowton
464773d99a
Add initial implementation of PrintAST for Go
...
Known shortcomings:
* Uses getAQlClass rather than tagging AST nodes with a canonical class, as the C++ version of the same query does
* Types and go.mod lines are not printed informatively (typically we just get a short description of the node kind, e.g. 'function type')
* Children are always named for their child indices; we should give informative names to the edges where an accessor is declared (e.g. IfStmt names its children 'init', 'cond', 'if', 'else')
2020-06-16 17:21:56 +01:00
Owen Mansel-Chan
a3bc094731
Add change note
2020-06-16 15:48:39 +01:00
Owen Mansel-Chan
1b49bcc3b3
Put code snippets from qhelp in test folder
2020-06-16 15:44:51 +01:00
Owen Mansel-Chan
336eba1be4
Add Hash.Write and similar as sanitizers
2020-06-16 12:48:43 +01:00
Sauyon Lee
1853e990a3
ReflectedXss: Allow regexp to match newlines
2020-06-16 00:43:12 -07:00
Owen Mansel-Chan
f27ecdabb8
Set precision to high
2020-06-15 17:42:19 +01:00
Owen Mansel-Chan
4f6ce61de2
Move EmailInjection query out of experimental
2020-06-15 17:42:19 +01:00
Max Schaefer
a88bf4c9fa
Merge pull request #177 from sauyon/whitelist
...
Use allow or allowlist instead of whitelist
2020-06-13 19:44:51 +01:00
Sauyon Lee
66f733d798
Use allow or allowlist instead of whitelist
2020-06-12 09:16:41 -07:00
Owen Mansel-Chan
282b8cb9e4
Merge pull request #175 from owen-mc/array-slice-literal
...
Add classes for array and slice literals
2020-06-12 12:12:02 +01:00
Owen Mansel-Chan
e6217d90d7
Provide better strings for map and struct literals
2020-06-12 11:23:58 +01:00
Owen Mansel-Chan
dc113ab19f
Update tests for new strings
2020-06-12 10:40:13 +01:00
Owen Mansel-Chan
e9c2958095
Add classes for array and slice literals
2020-06-12 10:40:13 +01:00
Max Schaefer
47804d68c7
Merge pull request #176 from max-schaefer/update-data-flow
...
Data flow: Allow nodes to be hidden from path explanations
2020-06-12 07:23:15 +01:00
Owen Mansel-Chan
f11b956583
Add a superclass for literals ( #172 )
2020-06-11 19:53:40 +01:00
Max Schaefer
40ffa221bc
Merge pull request #171 from owen-mc/typeexprs-extend-typeexpr
...
Make `ArrayTypeExpr` and so on extend `TypeExpr`
2020-06-11 17:20:29 +01:00
Max Schaefer
b164cf33c7
Merge pull request #174 from github/rc/1.24
...
Merge rc/1.24 into master
2020-06-11 17:19:23 +01:00
Max Schaefer
9e3681cda4
Merge pull request #173 from owen-mc/update-ast-class-reference
...
Update AST class reference
2020-06-11 16:47:43 +01:00
Owen Mansel-Chan
71005f19c6
Update AST class reference
...
To match https://github.com/github/codeql/pull/3685
2020-06-11 16:08:36 +01:00
Owen Mansel-Chan
c891d22f74
Make ArrayTypeExpr and so on extend TypeExpr
...
To avoid a recursive definition, need to replace ArrayTypeExpr with@arraytypeexpr and so on in isTypeExprBottomUp(Expr e).
2020-06-11 11:06:15 +01:00
Max Schaefer
c6537f6d3b
Data flow: Allow nodes to be hidden from path explanations
...
cf https://github.com/github/codeql/pull/3657
2020-06-11 09:59:40 +01:00
Max Schaefer
24e2a294ed
Merge pull request #169 from max-schaefer/rc/1.24
...
Merge rc/1.24 into master
2020-06-11 09:15:28 +01:00
