erik-krogh
45e78a355f
ensure call-apply.js is seen as a module
2022-08-23 10:11:46 +02:00
erik-krogh
2fd09d34de
improve performance of global dataflow by inlining a step predicate
2022-08-22 08:35:19 +02:00
erik-krogh
2f11f3760e
simplify getALibraryInputParameter by adding more general dataflow for the arguments object
2022-08-22 08:32:43 +02:00
Erik Krogh Kristensen
11b039c1f1
add tests
2022-08-22 08:29:28 +02:00
Erik Krogh Kristensen
31c09ba678
implement flow for .apply() by adding a ReflectiveParametersNode data-flow node
2022-08-22 08:29:28 +02:00
Erik Krogh Kristensen
d86b7f6c54
recognize an access to the arguments object as library-input
2022-08-22 08:29:24 +02:00
Erik Krogh Kristensen
7b1ef7473e
change ArrayCreationStep to a PreCallGraphStep and unrestrict the storeStep
2022-08-22 08:15:54 +02:00
Mathias Vorreiter Pedersen
b944005046
Merge pull request #10095 from MathiasVP/fix-joins-in-using-expired-stack-address
...
C++: Fix joins in `cpp/using-expired-stack-address`
2022-08-20 12:18:34 +01:00
Chris Smowton
e39475d778
Merge pull request #10100 from github/smowton/admin/note-java-19-support
...
Note support for Java 19
2022-08-19 17:20:23 +01:00
Tom Hvitved
a0a3dfb93d
Merge pull request #10108 from hvitved/remove-redundant-overrides
...
Remove redundant overrides
2022-08-19 16:43:23 +02:00
Paolo Tranquilli
75f62098e0
Merge pull request #10111 from github/redsun82/swift-add-methodrefexpr
...
Swift: synthesize `MethodRefExpr`
2022-08-19 16:27:16 +02:00
Paolo Tranquilli
631d234026
Swift: expand tests
2022-08-19 16:15:17 +02:00
Erik Krogh Kristensen
812b6bddcf
Merge pull request #10053 from erik-krogh/msgConsis-ql-query
...
QL: add ql/consistent-alert-message
2022-08-19 15:45:35 +02:00
Paolo Tranquilli
f0ec43b04c
Swift: remove getMethodDeclaration
...
`getStaticTarget` gives the same result.
2022-08-19 15:37:49 +02:00
Paolo Tranquilli
66459b81da
Swift: use field in MethodApplyExpr
...
Also rename `getMethod` to `getMethodDeclaration` to clear up possible
confusion with `getFunction`.
2022-08-19 15:31:00 +02:00
Tom Hvitved
99c049c09e
Merge pull request #10102 from hvitved/ql/redundant-override-refined
...
QL: Refine 'redundant override' query
2022-08-19 15:25:11 +02:00
Paolo Tranquilli
6706ba6ded
Swift: accept toString changes in tests
2022-08-19 15:22:02 +02:00
Paolo Tranquilli
e3f86a9eb0
Swift: fix QL warning
2022-08-19 15:03:18 +02:00
Paolo Tranquilli
9b50336e47
Swift: synthesize MethodRefExpr
...
This introduces a `MethodRefExpr` node synthesized out of
`DotSyntaxCallExpr` under the `LookupExpr` hierarchy. This means that
much like
```free_function(1, 2)```
is a `CallExpr` with `getFunction` giving a `DeclRefExpr`,
```foo.method(1, 2)```
is now a `CallExpr` with `getFunction` giving a `MethodRefExpr`.
`ApplyExpr::getStaticTarget` has been made work with it (as well as
`ConstructorRefCallExpr` which for the moment has been left where it
is), a new `MethodApplyExpr` has been introduced deriving from it,
and control and data flow libraries have adapted.
A small but was fixed in `qlgen` where the default constructor for DB
types was not correctly subtracting derived IPA types depending on the
order of definitions in `schema.yml`.
There are still some occurrences of `DotSyntaxCallExpr`, and as already
mentioned the other `SelfApply` class (`ConstructorRefCallExpr`) was
left alone. Their treatment is left for a future PR.
2022-08-19 14:48:36 +02:00
Tom Hvitved
18fb4a87af
Revert change to QL test
2022-08-19 14:37:25 +02:00
Tom Hvitved
1b29bddb73
Python: Revert change to AnyNode
2022-08-19 14:08:21 +02:00
Tom Hvitved
663096fe3a
Remove redundant overrides
2022-08-19 13:57:41 +02:00
Chris Smowton
949de2a8dd
Create 2022-08-19-java-19-support.md
2022-08-19 11:15:23 +01:00
Tom Hvitved
c86c9ec2c3
QL: Move query logic into library
2022-08-19 10:35:47 +02:00
Tom Hvitved
93fc952ef1
Merge pull request #10099 from hvitved/csharp/html-raw-tests
...
C#: Add a cshtml-based XSS test
2022-08-19 10:24:52 +02:00
Tom Hvitved
50a53008cd
QL: Refine 'redundant override' query
2022-08-19 10:15:47 +02:00
Mathias Vorreiter Pedersen
c953b05cc2
Merge branch 'main' into fix-joins-in-using-expired-stack-address
2022-08-18 15:13:05 +01:00
Chris Smowton
ec1cc72669
Note support for Java 19
2022-08-18 15:02:16 +01:00
Erik Krogh Kristensen
4f93f2b9ba
Merge pull request #10076 from erik-krogh/ql-for-ql-fixes
...
various QL-for-QL fixes
2022-08-18 15:46:48 +02:00
Tom Hvitved
f275885258
C#: Add a cshtml-based XSS test
2022-08-18 15:24:04 +02:00
Anders Schack-Mulligen
61a2c0dab5
Merge pull request #10084 from aschackmull/java/numericcasttainted-barrier
...
Java: Move sink-constraints into the configuration in NumericCastTainted.ql.
2022-08-18 15:22:00 +02:00
Tom Hvitved
2afb4abaa2
Merge pull request #10094 from hvitved/csharp/redundant-override
...
C#: Remove redundant override
2022-08-18 15:17:20 +02:00
Tom Hvitved
d68f817e53
Merge pull request #10098 from hvitved/ql/redundant-override
...
QL: Add redundant overrides query
2022-08-18 15:13:35 +02:00
Tom Hvitved
e5911df697
QL: Add redundant overrides query
2022-08-18 14:59:04 +02:00
Mathias Vorreiter Pedersen
5704995b62
C++: Fix joins in 'cpp/using-expired-stack-address'.
2022-08-18 13:23:39 +01:00
Chris Smowton
72009f8614
Merge pull request #10085 from smowton/smowton/fix/dont-use-write-instruction-for-channel-flow
...
Go: don't use WriteNode for channel writes
2022-08-18 12:47:55 +01:00
Tom Hvitved
ece37d80f0
C#: Remove redundant override
2022-08-18 13:13:06 +02:00
Tamás Vajk
ad1cb8f8c7
Merge pull request #10065 from tamasvajk/kotlin-1.7.20-Beta
...
Kotlin: Add support for version 1.7.20-Beta
2022-08-18 12:17:10 +02:00
Tom Hvitved
08a5b5dc73
Merge pull request #10089 from hvitved/ruby/local-source-nodes
...
Ruby: Reduce size of `isLocalSourceNode`
2022-08-18 12:02:35 +02:00
Tom Hvitved
e949458add
Merge pull request #10066 from hvitved/csharp/underlying-as-callable
...
C#: Include both source code and hand-written summaries in data flow
2022-08-18 12:01:49 +02:00
Asger F
349331d6ca
Merge pull request #10082 from asgerf/js/exports-handling2
...
JS: Handle nested conditions in "exports" section
2022-08-18 11:10:59 +02:00
Nick Rolfe
a46e2b3f2f
Merge pull request #10056 from hmac/hmac/action-controller-response-body
...
Ruby: Recognise Rails render calls as HTTP responses
2022-08-18 10:02:17 +01:00
Tom Hvitved
682986c0a2
Merge pull request #10087 from hvitved/ruby/unknown-member-warning
...
Ruby: Get rid of warning in `getUnknownMember`
2022-08-18 10:50:24 +02:00
erik-krogh
9e7c0c6ab9
revert changing imports in java/
2022-08-18 10:19:12 +02:00
Anders Schack-Mulligen
07e0bd3ce1
Merge pull request #10083 from aschackmull/java/sensitivelog-barrier
...
Java: Add some type-based sanitizers to SensitiveInfoLog.ql.
2022-08-18 10:18:33 +02:00
Tom Hvitved
93830f43cc
Address review comment
2022-08-18 10:06:26 +02:00
Tom Hvitved
baa646e102
Ruby: Remove unused UnknownMember from API graphs
2022-08-18 09:40:02 +02:00
Anders Schack-Mulligen
37e5f0438c
Java: Add change note.
2022-08-18 09:19:32 +02:00
Tamas Vajk
fb9a34851a
Apply code review changes
2022-08-18 09:01:10 +02:00
erik-krogh
4bc10f9b5c
explicitly import required frameworks that were previously implicitly imported
2022-08-18 08:40:46 +02:00
