Alvaro Muñoz
|
30d8dce389
|
check that either there are no custom message interpolator configured, or there is at least one that is insecure
|
2020-11-11 12:53:54 +01:00 |
|
Alvaro Muñoz
|
c3bc0d6c15
|
Apply formatting
|
2020-11-11 12:06:39 +01:00 |
|
Alvaro Muñoz
|
5b1858a514
|
Do not report the issue only if all message interpolators are secure
|
2020-11-11 11:50:15 +01:00 |
|
Alvaro Muñoz
|
02cf49a773
|
apply codeql formatting
|
2020-11-10 11:46:42 +01:00 |
|
Alvaro Muñoz
|
24a47fbb0f
|
additional qldoc commentes
|
2020-11-10 10:48:47 +01:00 |
|
Alvaro Muñoz
|
3545edb92c
|
address code review suggestions
|
2020-11-10 10:45:14 +01:00 |
|
Alvaro Muñoz
|
9db340c9ca
|
add some improvements to the bean validation query
|
2020-11-06 13:08:45 +01:00 |
|
CodeQL CI
|
9f2eb84f2b
|
Merge pull request #4624 from erik-krogh/concatFix
Approved by asgerf
|
2020-11-06 09:11:41 +00:00 |
|
Anders Schack-Mulligen
|
cb77e460ae
|
Merge pull request #4600 from porcupineyhairs/urirefactor
Java : Refactor all instances of `java.net.URI` into TypeUri
|
2020-11-06 09:35:09 +01:00 |
|
CodeQL CI
|
a908e5938e
|
Merge pull request #4574 from erik-krogh/jsdom
Approved by asgerf
|
2020-11-05 22:13:39 +00:00 |
|
Erik Krogh Kristensen
|
9137759d7c
|
calculate the size of the concatenation before doing the actual concatenation in Expr.qll
|
2020-11-05 22:55:52 +01:00 |
|
Tom Hvitved
|
a3894be1c5
|
Merge pull request #4607 from hvitved/csharp/msbuild-mono-no-shared-compilation
C#: Disable shared compilation when building with Mono+MSBuild
|
2020-11-05 19:56:25 +01:00 |
|
Erik Krogh Kristensen
|
e124ba66b4
|
moving jsdom sink to js/xss
|
2020-11-05 16:10:33 +01:00 |
|
Tom Hvitved
|
10ab3304c1
|
Merge pull request #4575 from hvitved/csharp/cfg/post-dominance
C#: Restrict post-dominance to normal execution
|
2020-11-05 15:31:13 +01:00 |
|
Anders Schack-Mulligen
|
45d117b68e
|
Merge pull request #4603 from pwntester/new_deser_sink
New UnsafeDeserialization sink and improvements to SnakeYaml sink
|
2020-11-05 13:09:15 +01:00 |
|
Alvaro Muñoz
|
f103955f38
|
change qldoc formating according to LSP suggestion
|
2020-11-05 11:48:26 +01:00 |
|
CodeQL CI
|
89a808cafe
|
Merge pull request #4552 from erik-krogh/tsImport
Approved by asgerf
|
2020-11-05 09:23:58 +00:00 |
|
CodeQL CI
|
b55f18bffd
|
Merge pull request #4549 from erik-krogh/pruneReturn
Approved by asgerf
|
2020-11-05 09:13:21 +00:00 |
|
CodeQL CI
|
c85f817cee
|
Merge pull request #4579 from erik-krogh/redos
Approved by asgerf
|
2020-11-05 08:38:44 +00:00 |
|
Robert Marsh
|
2f204869e7
|
Merge pull request #4604 from criemen/ir-block-sort-order
C++, C# IR: Stabilize sort order for basic blocks.
|
2020-11-04 18:22:23 -05:00 |
|
Erik Krogh Kristensen
|
342b6a4f2d
|
Update javascript/ql/src/semmle/javascript/security/performance/SuperlinearBackTracking.qll
Co-authored-by: Asger F <asgerf@github.com>
|
2020-11-04 22:37:56 +01:00 |
|
Alvaro Muñoz
|
302062b670
|
Merge branch 'new_deser_sink' of https://github.com/pwntester/ql into new_deser_sink
|
2020-11-04 18:58:57 +01:00 |
|
Alvaro Muñoz
|
6fef63306e
|
add qldoc
|
2020-11-04 18:58:41 +01:00 |
|
Erik Krogh Kristensen
|
e16fa0668a
|
update expected output
|
2020-11-04 18:24:31 +01:00 |
|
Geoffrey White
|
48628fa195
|
Merge pull request #4589 from criemen/model-vector-emplace
C++: Model std::vector emplace and emplace_back()
|
2020-11-04 16:09:31 +00:00 |
|
Tom Hvitved
|
b5063bbcb5
|
Merge pull request #4495 from hvitved/csharp/dataflow/summaries
C#: Shared interface/implementation for flow summaries
|
2020-11-04 17:02:19 +01:00 |
|
Cornelius Riemenschneider
|
78d885ee7d
|
C++: Accept test output.
|
2020-11-04 16:45:07 +01:00 |
|
Cornelius Riemenschneider
|
44d6584fa2
|
C++, C#: Auto-format.
|
2020-11-04 16:26:56 +01:00 |
|
Cornelius Riemenschneider
|
a13947424a
|
C++, C# IR: Stabilize sort order for basic blocks.
|
2020-11-04 16:26:56 +01:00 |
|
Cornelius Riemenschneider
|
e7e5754270
|
C++: Add taint model for std::vector::emplace/_back.
|
2020-11-04 16:20:01 +01:00 |
|
Erik Krogh Kristensen
|
03c46c9be0
|
autoformat
|
2020-11-04 16:18:24 +01:00 |
|
yoff
|
79fcf598f3
|
Merge pull request #4608 from RasmusWL/patch-1
Python: Remove unnecessary cached annotation from adjacentRefUse
|
2020-11-04 16:08:30 +01:00 |
|
Cornelius Riemenschneider
|
62a02cde73
|
C++: Add test to show missing taint steps for std::vector::emplace/_back
|
2020-11-04 16:07:15 +01:00 |
|
Cornelius Riemenschneider
|
081ab1e2bb
|
C++: Add std::vector::emplace/_back to our STL model.
|
2020-11-04 16:07:08 +01:00 |
|
Ian Lynagh
|
6ff939db5c
|
Merge pull request #4432 from dbartol/dbartol/temporaries/work
C++: Represent temporary object initialization in AST and IR
|
2020-11-04 14:38:45 +00:00 |
|
Rasmus Wriedt Larsen
|
31247739d7
|
Python: Remove unnecessary cached annotation from adjacentRefUse
As discussed in https://github.com/github/codeql/pull/4544#pullrequestreview-516575676
|
2020-11-04 15:16:08 +01:00 |
|
yoff
|
62cb4ec974
|
Merge pull request #4605 from RasmusWL/python-fix-django-response-modeling
Python: fix django response modeling
|
2020-11-04 15:00:52 +01:00 |
|
Tom Hvitved
|
131a05563a
|
C#: Disable shared compilation when building with Mono+MSBuild
|
2020-11-04 14:16:25 +01:00 |
|
Porcupiney Hairs
|
0a028dcb47
|
Java : Refactor all instances of java.net.URI into TypeUri
|
2020-11-04 18:23:26 +05:30 |
|
Rasmus Wriedt Larsen
|
5cf8285717
|
Python: Fix default mimetype for django FileResponse
|
2020-11-04 12:28:51 +01:00 |
|
Rasmus Wriedt Larsen
|
826aedeb85
|
Python: Remove resolved TODO
|
2020-11-04 12:17:31 +01:00 |
|
Rasmus Wriedt Larsen
|
353505ec6c
|
Python: Handle content of Django redirects correctly
|
2020-11-04 12:10:58 +01:00 |
|
Taus
|
180373c41d
|
Merge pull request #4597 from yoff/python-fix-ql-doc
Python: Fix ql doc
|
2020-11-04 11:37:32 +01:00 |
|
Rasmus Wriedt Larsen
|
92dc7dc2f3
|
Python: Use mimetype instead of content-type in django modeling
This enables the XSS query to actually find results from django responses.
|
2020-11-04 11:34:20 +01:00 |
|
Alvaro Muñoz
|
aa7b87aa33
|
Update java/change-notes/2020-11-04-commonslang-unsafe-deserialization-sinks.md
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2020-11-04 10:58:27 +01:00 |
|
Alvaro Muñoz
|
b284141a16
|
Merge branch 'new_deser_sink' of https://github.com/pwntester/ql into new_deser_sink
|
2020-11-04 10:51:07 +01:00 |
|
Alvaro Muñoz
|
436563d914
|
ChangeNote for new unsafe deserialization sinks
|
2020-11-04 10:50:50 +01:00 |
|
Anders Schack-Mulligen
|
22b4df0f3c
|
Merge pull request #4512 from luchua-bc/sensitive-broadcast
Java: Sensitive broadcast
|
2020-11-04 10:47:48 +01:00 |
|
Alvaro Muñoz
|
6f78b725e6
|
Apply suggestions from code review
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2020-11-04 10:43:37 +01:00 |
|
Anders Schack-Mulligen
|
26495225e0
|
Update java/ql/src/experimental/Security/CWE/CWE-927/SensitiveBroadcast.qhelp
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
|
2020-11-04 10:05:55 +01:00 |
|