709 Commits

Author	SHA1	Message	Date
Mathias Vorreiter Pedersen	d14ad92dbd	Merge pull request #14006 from MathiasVP/promote-invalid-pointer-deref-out-of-experimental ... C++: Promote `cpp/invalid-pointer-deref` out of experimental	2023-08-29 09:38:56 +01:00
Mathias Vorreiter Pedersen	89b91ec5c8	C++: Disable field flow from the 'cpp/invalid-pointer-deref' query.	2023-08-25 15:01:37 +01:00
Alex Eyers-Taylor	c43ba456e5	CPP: Remove old DeleteOrDeleteArrayExpr from a query.	2023-08-25 13:57:16 +01:00
Mathias Vorreiter Pedersen	123e58767b	C++: Share RangeAnalysisUtil with 'cpp/overrun-write'.	2023-08-23 22:42:00 +01:00
Alex Eyers-Taylor	949b0a2613	CPP:Move import to start of file	2023-08-23 13:39:29 +01:00
Alex Eyers-Taylor	7d99d61662	CPP: Convert SQL tainted to IR dataflow.	2023-08-23 13:39:29 +01:00
Mathias Vorreiter Pedersen	530c950b41	C++: Fix formatting.	2023-08-22 13:40:00 +01:00
Mathias Vorreiter Pedersen	66f11d427b	C++: Simplify description.	2023-08-22 13:39:38 +01:00
Mathias Vorreiter Pedersen	1c3a0d1632	Update cpp/ql/src/Security/CWE/CWE-193/InvalidPointerDeref.qhelp ... Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>	2023-08-22 13:03:07 +01:00
Mathias Vorreiter Pedersen	e88277bd3b	Update cpp/ql/src/Security/CWE/CWE-193/InvalidPointerDeref.qhelp ... Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>	2023-08-22 13:02:37 +01:00
Mathias Vorreiter Pedersen	abe28cb106	Update cpp/ql/src/Security/CWE/CWE-193/InvalidPointerDeref.ql ... Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>	2023-08-22 13:02:29 +01:00
Mathias Vorreiter Pedersen	e776178be5	C++: Add some whitespace to make stuff appear in the diff.	2023-08-21 10:23:41 +01:00
Mathias Vorreiter Pedersen	70fdfc2ae3	C++: Set precision to medium and add security severity.	2023-08-21 10:23:23 +01:00
Mathias Vorreiter Pedersen	4daabdae2b	C++: Promote 'cpp/invalid-pointer-deref' out of experimental.	2023-08-21 10:23:22 +01:00
Jonas Jensen	a002f59f58	C++: Undo BadlyBoundedWrite change from #13929 ... This rolls back the query change, ensuring that there is no need for a change note.	2023-08-18 13:48:58 +02:00
Jeroen Ketema	d0e7354a1b	C++: Only consider the maximum buffer size for badly bounded write	2023-08-09 12:30:00 +02:00
Anders Schack-Mulligen	c01a494ea5	C/C++: Don't force-include XxeFlowStateTransformer steps in XXE.ql.	2023-07-19 11:41:15 +02:00
Jeroen Ketema	52ab215560	C++/Swift: Remove none() dataflow configuration predicates ... These now have default implementations that are also `none()`	2023-07-12 23:49:29 +02:00
Jeroen Ketema	fa2ee26379	C++: Add more default predicates to product flow	2023-07-06 16:06:36 +02:00
Mathias Vorreiter Pedersen	f714de0040	Merge pull request #13610 from MathiasVP/promote-overrun-write-again ... C++: Move `cpp/overrun-write` back to `medium` precision	2023-07-05 13:39:12 +01:00
Mathias Vorreiter Pedersen	95ddc01ccb	Merge pull request #13502 from rvermeulen/rvermeulen/compare-using-integer-precision ... C++: Account for the signedness of the lesser operand in `cpp/comparison-with-wider-type`	2023-06-30 17:44:28 +01:00
Mathias Vorreiter Pedersen	67e3ef7b09	C++: Revert the barrier added in #13623.	2023-06-30 09:39:37 +01:00
Mathias Vorreiter Pedersen	59d9c6e3f2	C++: Use the pruning stage in the product-flow configuration.	2023-06-29 16:50:57 +01:00
Mathias Vorreiter Pedersen	285112f4cd	C++: Move 'cpp/overrun-write' back to medium precision.	2023-06-29 08:18:47 +01:00
Remco Vermeulen	c0884432e8	Format query	2023-06-20 10:38:08 -07:00
Remco Vermeulen	32d7faa3b8	Account for the signedness of the lesser operand	2023-06-19 16:57:36 -07:00
Jeroen Ketema	0bb67e45b3	C++: lower the precision of cpp/overrun-write to exclude it from our query suites	2023-06-16 19:07:56 +02:00
erik-krogh	a4ef8619c6	delete old deprecations	2023-06-08 10:10:21 +02:00
Mathias Vorreiter Pedersen	960e6521a4	Revert "C++: Whitespace commit to make qhelp show up in diff." ... This reverts commit ec192d621c.	2023-05-25 15:21:09 -07:00
Mathias Vorreiter Pedersen	ec192d621c	C++: Whitespace commit to make qhelp show up in diff.	2023-05-24 16:13:42 -07:00
Mathias Vorreiter Pedersen	e1223d0b21	C++: Add security severity.	2023-05-23 15:01:33 -07:00
Mathias Vorreiter Pedersen	0dfc9b996d	C++: Promote 'cpp/overrun-write' out of experimental.	2023-05-23 14:57:42 -07:00
Kasper Svendsen	c46898cb75	C++: Make implicit this receivers explicit	2023-05-09 15:35:54 +02:00
Mathias Vorreiter Pedersen	8fef101432	C++: Fix missing result and accept test changes.	2023-04-06 10:41:08 +01:00
Anders Schack-Mulligen	72415c7c2c	C++: Rename references.	2023-03-23 13:06:19 +01:00
Ed Minnix	2d5944fb0e	Refactor DataFlow configurations to use "Config" naming convention	2023-03-19 17:44:07 -04:00
Mathias Vorreiter Pedersen	84a61d1e02	C++: No need for 'matches'.	2023-03-09 15:36:26 +00:00
Mathias Vorreiter Pedersen	2931e5dea8	C++: Reduce duplication by blocking flow into sources (since we'll already be considering flow starting at those sources) and out of sinks (since we'll already be alerting on this sink if it's relevant).	2023-03-09 14:59:13 +00:00
Mathias Vorreiter Pedersen	03ba7ea851	C++: Move the weird global property 'not sqlite_encryption_used()' from the sink definition to the source definition. The dataflow library starts tracking flow from the sources, so it's better to to rule out the entire database in the source definition than in the sink definition.	2023-03-09 14:59:13 +00:00
Mathias Vorreiter Pedersen	7819a7d2bc	C++: Severely restrict the set of sinks in 'cpp/cleartext-storage-database'. This reduces the number of sinks considered on the 'sysown/proxysql' from > 62000 sinks to ~1000 sinks.	2023-03-09 14:59:13 +00:00
Jeroen Ketema	30cbc91092	C++: Update XXE XML query with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	8253f2d343	C++: Update UnsafeDaclSecurityDescriptor with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	7fe1a9431c	C++: Update PotentiallyExposedSystemData with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	53aa34bdd3	C++: Update UnsafeCreateProcessCall with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Mathias Vorreiter Pedersen	a247a8b3ea	Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow	2023-03-08 13:35:35 +00:00
Jeroen Ketema	5391b13db9	C++: Make dataflow configuration modules private in qll files	2023-03-08 09:18:09 +01:00
Jeroen Ketema	13bdd9c0c6	C++: Fix query compliation ... Apparently some queries we skipped in the testing I did locally.	2023-03-07 19:16:10 +01:00
Jeroen Ketema	57c5d5f2c7	C++: Add QLDoc on configuration modules where the original class had one	2023-03-07 19:01:05 +01:00
Jeroen Ketema	0c39d1e5ca	C++: Fix query formatting	2023-03-07 18:55:58 +01:00
Jeroen Ketema	2eb2e11ef7	C++: Fix query compilation	2023-03-07 18:53:07 +01:00