Anders Schack-Mulligen
|
442de2e2d2
|
Java: Add qldoc.
|
2020-09-08 15:09:39 +02:00 |
|
Anders Schack-Mulligen
|
ed6c1798e2
|
Java: Fix reference to Unit.
|
2020-09-02 14:47:01 +02:00 |
|
Anders Schack-Mulligen
|
89829e870d
|
Java: Clean up SqlInjectionLib.
|
2020-09-02 11:17:56 +02:00 |
|
Calum Grant
|
29b3759655
|
Merge pull request #3961 from tausbn/python-add-typetracker
Python: Add type tracker and step summary implementation.
|
2020-09-02 09:42:14 +01:00 |
|
Jonas Jensen
|
db45b29806
|
Merge pull request #4102 from rdmarsh2/rdmarsh2/cpp/input-iterators-1
C++: Basic input iterator models
|
2020-09-02 07:57:35 +02:00 |
|
Robert Marsh
|
015bf6e879
|
C++: Add reverse flow when this ptr is returned
|
2020-09-01 13:08:44 -07:00 |
|
Robert Marsh
|
2a57fa22e3
|
C++: handle reference args to iterator operators
|
2020-09-01 12:52:01 -07:00 |
|
Anders Schack-Mulligen
|
cc61e6117e
|
Merge pull request #3542 from porcupineyhairs/mongoJava
Java : add MongoDB injection sinks
|
2020-09-01 16:19:17 +02:00 |
|
CodeQL CI
|
311e62f21d
|
Merge pull request #4081 from aschackmull/java/dispatch-ctx-this-param
Approved by aibaars
|
2020-09-01 15:06:47 +01:00 |
|
yoff
|
caa680c72e
|
Merge pull request #4149 from RasmusWL/python-more-additional-taint-steps
Python: more additional taint steps
|
2020-09-01 14:38:33 +02:00 |
|
Taus Brock-Nannestad
|
6a96c53d15
|
Python: Add missing getNode invocation
|
2020-09-01 14:04:31 +02:00 |
|
Taus Brock-Nannestad
|
26d14aba98
|
Python: Use nodeFrom/nodeTo instead of pred/succ
|
2020-09-01 14:00:30 +02:00 |
|
CodeQL CI
|
b9a6183ec2
|
Merge pull request #4175 from aschackmull/java/adjust-cwe-089-qltest
Approved by aibaars
|
2020-09-01 12:43:56 +01:00 |
|
Arthur Baars
|
2729d109a5
|
Merge pull request #4123 from aschackmull/java/records-dataflow
Java: Add data flow for record getters.
|
2020-09-01 13:02:24 +02:00 |
|
Anders Schack-Mulligen
|
e5d7208c12
|
Java: Adjust a few qltests.
|
2020-09-01 12:49:09 +02:00 |
|
Rasmus Wriedt Larsen
|
c5e3333d10
|
Python: Update expected tests after last commit
I'm pushing too fast it seems
|
2020-09-01 12:01:34 +02:00 |
|
Rasmus Wriedt Larsen
|
e0cfe8123e
|
Python: Update comments for new taint tests
I see I didn't keep them up to date as I implemented things
|
2020-09-01 11:58:26 +02:00 |
|
Rasmus Wriedt Larsen
|
cda88a5e64
|
Python: Refactor: use DataFlow::Node.asExpr()
|
2020-09-01 11:53:06 +02:00 |
|
Rasmus Wriedt Larsen
|
ddc55a18cf
|
Python: Fix taint handling of copy.deepcopy
(test results didn't change)
Thanks @yoff 👍
|
2020-09-01 11:50:46 +02:00 |
|
Rasmus Wriedt Larsen
|
e5a361c230
|
Python: Better taint tests for copy.deepcopy
|
2020-09-01 11:50:33 +02:00 |
|
Mathias Vorreiter Pedersen
|
aa3b268525
|
Merge pull request #4162 from jbj/ssa-ref-parameters
C++: SSA and range analysis for reference parameters
|
2020-09-01 11:48:41 +02:00 |
|
Anders Schack-Mulligen
|
82692876d8
|
Java: Add some test cases.
|
2020-09-01 11:24:30 +02:00 |
|
Anders Schack-Mulligen
|
c25dd4be8c
|
Merge pull request #3363 from ggolawski/xslt-injection
CodeQL query to detect XSLT injections
|
2020-09-01 11:03:19 +02:00 |
|
Anders Schack-Mulligen
|
1dae99e4a5
|
Merge pull request #3543 from porcupineyhairs/WebsocketReadAsSource
Java: add websocket reads as remote flow source.
|
2020-09-01 10:58:02 +02:00 |
|
Anders Schack-Mulligen
|
beca44ec2f
|
Merge pull request #4172 from rvermeulen/java/xss-sink-extensible
Java: Customizable XSS analysis
|
2020-09-01 09:27:50 +02:00 |
|
Robert Marsh
|
87b657054f
|
C++: reverse flow for iterator operator qualifiers
|
2020-08-31 14:53:05 -07:00 |
|
Robert Marsh
|
d4cf92e374
|
C++: Improve non-member iterator operator detection
|
2020-08-31 14:52:29 -07:00 |
|
Robert Marsh
|
10005dd199
|
Merge branch 'main' into rdmarsh2/cpp/input-iterators-1Merge changes to input/output models for functions that return thisand resolve conflicting changes to taint tests.
|
2020-08-31 14:49:01 -07:00 |
|
Remco Vermeulen
|
2bdd3d7712
|
Apply qldoc suggestions
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2020-08-31 17:28:51 +02:00 |
|
Taus Brock-Nannestad
|
ec64606d5a
|
Python: Remove CopyStep branch type
|
2020-08-31 17:23:02 +02:00 |
|
Taus Brock-Nannestad
|
eb6443df21
|
Merge branch 'python-add-typetracker' of github.com:tausbn/ql into python-add-typetracker
|
2020-08-31 17:22:13 +02:00 |
|
Taus
|
8e1f99af99
|
Python: Apply suggestions from code review
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
|
2020-08-31 17:20:12 +02:00 |
|
Taus Brock-Nannestad
|
3547c70d35
|
Python: Add tests with redefinition of fields/variables
|
2020-08-31 17:17:37 +02:00 |
|
Taus Brock-Nannestad
|
06103f4ff2
|
Python: Consistently use attribute/attr
|
2020-08-31 17:16:31 +02:00 |
|
CodeQL CI
|
35494ab97c
|
Merge pull request #4171 from max-schaefer/js/promise-flow-public
Approved by erik-krogh
|
2020-08-31 15:15:27 +01:00 |
|
CodeQL CI
|
79e87a6c3d
|
Merge pull request #4088 from aschackmull/java/string-formatted
Approved by aibaars
|
2020-08-31 15:02:49 +01:00 |
|
Rasmus Wriedt Larsen
|
cf2eacd7a6
|
Python: Adjust additional taint after PostUpdateNode addition
Still no results though :(
|
2020-08-31 14:59:29 +02:00 |
|
Rasmus Wriedt Larsen
|
4e73abc254
|
Merge branch 'main' into python-more-additional-taint-steps
|
2020-08-31 14:34:42 +02:00 |
|
Tom Hvitved
|
4e963a8a8e
|
Merge pull request #4165 from hvitved/csharp/foreach-guard
C#: Fix bug in guards logic for `foreach` loops
|
2020-08-31 14:32:09 +02:00 |
|
CodeQL CI
|
dc9cc20fdd
|
Merge pull request #4161 from yoff/SharedDataflow_PostUpdateNodes
Approved by RasmusWL, aschackmull, hvitved, jbj
|
2020-08-31 11:57:44 +01:00 |
|
Max Schaefer
|
22ccae6006
|
JavaScript: Make PromiseFlow module public.
|
2020-08-31 11:55:10 +01:00 |
|
CodeQL CI
|
9d6b2e7684
|
Merge pull request #4042 from aschackmull/java/xsssink-extensible
Approved by aibaars
|
2020-08-31 11:54:25 +01:00 |
|
Anders Schack-Mulligen
|
b89a22b583
|
Merge pull request #4170 from aibaars/drop-inefficient-toarray
Java: remove InefficientToArray.ql
|
2020-08-31 12:45:06 +02:00 |
|
Arthur Baars
|
66d39bb5f6
|
Java: remove InefficientToArray.ql
This query was deprecated 4 years ago.
Fixes: #4167
|
2020-08-31 10:39:03 +02:00 |
|
Grzegorz Golawski
|
0f555d42ed
|
Fix test
|
2020-08-30 22:55:17 +02:00 |
|
Porcupiney Hairs
|
441825919c
|
Java : add MongoDB injection sinks
|
2020-08-31 02:24:23 +05:30 |
|
Grzegorz Golawski
|
5e462a897d
|
Merge branch 'main' into xslt-injection
|
2020-08-30 22:45:31 +02:00 |
|
Grzegorz Golawski
|
37f4410764
|
Fix test
|
2020-08-30 22:32:57 +02:00 |
|
Porcupiney Hairs
|
4f07733b06
|
remove U+200B
|
2020-08-30 04:54:02 +05:30 |
|
Taus Brock-Nannestad
|
7108d28395
|
Python: Remove failing non-inline test
It is subsumed by `tracked.ql` anyway.
|
2020-08-28 21:21:29 +02:00 |
|