erik-krogh
355499ea52
move getACommonTld to the shared pack
2022-12-17 17:26:18 +01:00
erik-krogh
f67d0bc8c0
put the shared HostnameRegexp code in the shared regex pack
2022-12-17 17:26:18 +01:00
Tom Hvitved
e45edcc159
Merge pull request #11674 from hvitved/dataflow/param-context
...
Data flow: Track callable in flow-through pruning
2022-12-16 09:25:15 +01:00
Tom Hvitved
f8571dd0b6
Data flow: Work around functionality-induced misoptimization
2022-12-15 15:29:14 +01:00
Tom Hvitved
6eda042229
Data flow: Sync files
2022-12-15 15:29:13 +01:00
Jami
359e49044f
Merge branch 'main' into jcogs33/mad-metrics-query
2022-12-14 15:33:29 -05:00
Tom Hvitved
25b2d11368
Merge pull request #11635 from hvitved/dataflow/approx-content
...
Data flow: Introduce `ApproxContent` in a new pruning stage between stages 2 and 3
2022-12-14 12:56:50 +01:00
Erik Krogh Kristensen
8a89849476
Merge pull request #11660 from erik-krogh/dynamic-useInstanceOf
...
Py/JS/RB: Use instanceof in more places
2022-12-13 21:50:13 +01:00
Jami Cogswell
a33436a39b
Java: update hasProvenance
2022-12-13 11:26:23 -05:00
Tom Hvitved
24b1da4d02
Python: Implement ContentApprox
2022-12-13 09:53:01 +01:00
Tom Hvitved
0c2eee2a72
Data flow: Sync files
2022-12-13 09:52:55 +01:00
yoff
557a5b469f
Merge pull request #11555 from pwntester/new_python_cmdi_sinks
...
Added two new CMDi sinks for python's stdlib
2022-12-13 09:00:34 +01:00
Jami
93d8a03e73
Merge branch 'main' into jcogs33/mad-metrics-query
2022-12-12 20:31:53 -05:00
Jami Cogswell
623068c4b9
Java: add hasProvenance predicate, remove isManuallyGenerated and isBothAutoAndManuallyGenerated
2022-12-12 11:23:46 -05:00
erik-krogh
b3a9c1ca06
Py/JS/RB: Use instanceof in more places
2022-12-12 16:06:57 +01:00
Jami Cogswell
6854845b75
Java: refactor isManuallyGenerated and isBothAutoAndManuallyGenerated
2022-12-09 18:37:50 -05:00
Michael Nebel
f4f7d83349
Python: Rename Negative Summary Model to Neutral Model.
2022-12-09 15:04:43 +01:00
Michael Nebel
079d48c42a
Sync files.
2022-12-09 15:04:42 +01:00
Asger F
387a673c10
Merge pull request #11567 from asgerf/js/data-extensions2
...
JS: Move MaD models to data extensions
2022-12-09 10:09:24 +01:00
Jami Cogswell
0b2f2a3f88
Java: remove predicates from NegativeSummarizedCallable
2022-12-08 23:46:55 -05:00
Rasmus Wriedt Larsen
d684dbdf5c
Merge pull request #10656 from porcupineyhairs/PyPamImprove
...
Python: Improve the PAM authentication bypass query
2022-12-08 11:59:10 +01:00
Jami Cogswell
aa7e6d7811
Java: add negative numbers
2022-12-07 17:17:35 -05:00
Jami
5e694b5983
Merge pull request #11192 from jcogs33/jcogs33/share-key-sizes
...
Share encryption key sizes between Java and Python
2022-12-07 08:08:24 -05:00
Asger F
5af1b367c7
Support data extensions
2022-12-07 11:35:05 +01:00
Jami Cogswell
b82f9b1911
Java: add draft of generated vs manual MaD metrics query
2022-12-06 22:15:19 -05:00
Tom Hvitved
b5e2e1e469
Merge pull request #11564 from hvitved/dataflow/parameter-position-consistency-checks
...
Data flow: Add consistency checks for parameter positions
2022-12-06 09:33:36 +01:00
Tom Hvitved
52f3a48638
Data flow: Sync files
2022-12-05 12:57:27 +01:00
Tom Hvitved
faca4b5b56
Merge pull request #11461 from hvitved/ruby/unique-hash-splat-param
...
Ruby: At most one hash-splat `ParameterNode` per callable
2022-12-05 11:53:28 +01:00
Alvaro Muñoz
fc56843c04
improve predicate QLdoc
2022-12-03 16:34:14 +01:00
Alvaro Muñoz
7e0e56dadc
Added two new CMDi sinks fot python's stdlib
2022-12-02 22:16:40 +01:00
Asger F
2d578c1a73
Merge branch 'main' into merge-package-type-columns
2022-12-02 10:00:44 +01:00
Jami Cogswell
1f4bd00993
split rsa/dsa/dh
2022-12-01 11:56:44 -05:00
Jami Cogswell
0fa05d47e3
add shared key sizes
2022-12-01 11:56:44 -05:00
Tom Hvitved
b33f5925bb
Data flow: Sync files
2022-11-30 13:39:25 +01:00
Owen Mansel-Chan
55c4643b20
Dataflow: Sync.
2022-11-30 11:00:07 +00:00
Tom Hvitved
f3dca95958
Merge pull request #11087 from hvitved/dataflow/summary-ctx
...
Data flow: Add summary/return context to pruning stages 2-4
2022-11-29 10:36:53 +01:00
Rasmus Wriedt Larsen
3d9556e5a3
Python: Use proper Query suffix
2022-11-28 16:03:17 +01:00
Rasmus Wriedt Larsen
c310948521
Python: Remove enclosing module for PAM Auth Bypass.qll
2022-11-28 16:02:38 +01:00
Tom Hvitved
cde05e1190
Data flow: Sync files
2022-11-28 12:11:38 +01:00
Erik Krogh Kristensen
03737543d4
Merge pull request #11403 from erik-krogh/additional
...
ReDoS: add missing additional keywords
2022-11-24 15:53:51 +01:00
Erik Krogh Kristensen
1eec067474
Merge pull request #11294 from erik-krogh/fileDoc
...
QL: improve the "this block-comment should have been a QLDoc"-query
2022-11-23 22:23:36 +01:00
erik-krogh
95f35196e4
add missing additional keywords
2022-11-23 20:45:51 +01:00
Asger F
abf0c0f296
Python: update more comments referring to the package column
2022-11-23 15:02:08 +01:00
Asger F
1c910550e6
Python: merge package/type columns
2022-11-23 11:17:42 +01:00
Rasmus Wriedt Larsen
04a68f8d52
Merge pull request #11372 from RasmusWL/getpass
...
Python: Model `getpass.getpass` as source of passwords
2022-11-22 14:49:04 +01:00
Rasmus Wriedt Larsen
9195b73d84
Python: Model getpass.getpass as source of passwords
2022-11-22 14:11:52 +01:00
Rasmus Wriedt Larsen
80e71b202a
Python: Cleartext queires: Remove flow from getpass.py
2022-11-22 14:08:00 +01:00
Taus
8f4eb7107a
Merge pull request #10861 from tausbn/python-clean-up-import-resolution
...
Python: Clean up import resolution
2022-11-21 15:18:08 +01:00
Tom Hvitved
99e70e9a50
Data flow: Sync files
2022-11-20 10:19:23 +01:00
Porcupiney Hairs
db231a111c
Python : Improve the PAM authentication bypass query
...
The current PAM auth bypass query which was contributed by me a few months back, alert on a vulenrable function but does not check if the function is actually function. This leads to a lot of fasle positives.
With this PR, I add a taint-tracking configuration to check if the username parameter can actually be supplied by an attacker.
This should bring the FP's significantly down.
2022-11-19 01:29:25 +05:30
