Chris Smowton
|
8a78075d3d
|
Remove redundant method taint flow specifications
|
2021-08-02 14:30:31 +01:00 |
|
Mathias Vorreiter Pedersen
|
bbbbeda7c3
|
Merge pull request #6385 from MathiasVP/more-FieldConfiguration-sources
C++: Fix missing local flow in AST dataflow
|
2021-08-02 15:22:07 +02:00 |
|
Anders Schack-Mulligen
|
53e6ddfeb6
|
Merge pull request #6001 from atorralba/atorralba/promote-mvel-injection
Java: Promote MVEL injection query from experimental
|
2021-08-02 14:40:26 +02:00 |
|
Tony Torralba
|
f4b78ef3bd
|
Fix stubs
|
2021-08-02 14:12:05 +02:00 |
|
Tony Torralba
|
9b384d84cc
|
Merge branch 'main' into atorralba/promote-ognl-injection
|
2021-08-02 14:06:45 +02:00 |
|
Tony Torralba
|
351a24558d
|
Add tests for JacksonSerializability
Upgraded jackson stubs to 2.12
|
2021-08-02 14:03:30 +02:00 |
|
Tony Torralba
|
632ae747c7
|
Fix JacksonModel duplicate row
|
2021-08-02 12:53:30 +02:00 |
|
Anders Schack-Mulligen
|
3b676d432f
|
Merge pull request #5900 from artem-smotrakov/unsafe-jackson-deserialization
Java: Unsafe deserialization with Jackson
|
2021-08-02 12:45:30 +02:00 |
|
Anders Schack-Mulligen
|
0a1c754de8
|
Merge pull request #6395 from github/bmuskalla/fixTypoInVariables
Fix typo in variables documentation
|
2021-08-02 12:30:14 +02:00 |
|
Benjamin Muskalla
|
d678cdc815
|
Update variables.rst
|
2021-08-02 12:07:09 +02:00 |
|
Tom Hvitved
|
7a475eb0a2
|
C#: Fix CSV overrides logic
|
2021-08-02 10:35:21 +02:00 |
|
Tom Hvitved
|
df29538840
|
C#: Add test that exhibits bug in CSV overrides logic
|
2021-08-02 10:35:21 +02:00 |
|
Anders Schack-Mulligen
|
6c973b59ac
|
Update java/ql/src/semmle/code/java/frameworks/Jackson.qll
|
2021-08-02 10:16:42 +02:00 |
|
Anders Schack-Mulligen
|
26881ec220
|
Merge pull request #6389 from github/yo-h-patch-1
Java: update `frameworks.rst` with Jackson
|
2021-08-02 10:07:02 +02:00 |
|
Tony Torralba
|
9fadb26325
|
Fix qhelp sample
|
2021-08-02 10:00:59 +02:00 |
|
Tony Torralba
|
4435853c8a
|
Apply suggestions from code review
Co-authored-by: Felicity Chapman <felicitymay@github.com>
|
2021-08-02 09:56:40 +02:00 |
|
ihsinme
|
098773dd10
|
Update FindIncorrectlyUsedSwitch.ql
|
2021-08-01 15:04:30 +03:00 |
|
ihsinme
|
80eb4907c0
|
Update FindIncorrectlyUsedSwitch.expected
|
2021-08-01 15:03:30 +03:00 |
|
ihsinme
|
5c71a7c024
|
Update test.c
|
2021-08-01 15:02:41 +03:00 |
|
Artem Smotrakov
|
7959e76da8
|
Better qldoc in UnsafeDeserializationQuery.qll
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2021-07-30 09:30:59 +02:00 |
|
Fosstars
|
a4b0041120
|
Better looksLikeResolveClassStep() predicate
|
2021-07-30 09:28:03 +02:00 |
|
Fosstars
|
1d3eb570bf
|
hasJsonTypeInfoAnnotation() should check fields recursively
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2021-07-30 08:30:40 +02:00 |
|
yo-h
|
6a18b33616
|
Java: update frameworks.rst with Jackson
Updating manually maintained list with coverage in `JacksonSerializability.qll`
|
2021-07-29 17:35:06 -04:00 |
|
Aditya Sharad
|
cb686ea802
|
Merge pull request #6388 from github/geoffw0-patch-2
Update query-metadata-style-guide.md
|
2021-07-29 10:20:26 -07:00 |
|
Geoffrey White
|
5e6e176f32
|
Update query-metadata-style-guide.md
Add a note about the `@security-severity` tag.
|
2021-07-29 17:53:31 +01:00 |
|
Mathias Vorreiter Pedersen
|
b1e5fbe2de
|
Merge pull request #6377 from sashabu/sashabu/virtual
C++: Allow querying virtual, override, and final declaration specifiers.
|
2021-07-29 17:51:14 +02:00 |
|
Tony Torralba
|
3fcc9fae79
|
Refactor sinks to reuse code
|
2021-07-29 16:48:47 +02:00 |
|
Geoffrey White
|
417edab126
|
C++: Simplify out the 'effect' string.
|
2021-07-29 15:44:53 +01:00 |
|
Geoffrey White
|
7f621bc737
|
C++: Repair the tests that use subtraction so that the thing they're testing is preserved, and add two new explicit tests of behaviour on subtraction.
|
2021-07-29 15:36:43 +01:00 |
|
Tony Torralba
|
6e3b6dcb98
|
Imporve qhelp
|
2021-07-29 16:36:38 +02:00 |
|
Tony Torralba
|
bdf0f582a4
|
QLDoc improvements from code review
Co-authored-by: Felicity Chapman <felicitymay@github.com>
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2021-07-29 16:34:21 +02:00 |
|
Tony Torralba
|
90b5e02b6e
|
Improve qhelp
|
2021-07-29 16:28:10 +02:00 |
|
Geoffrey White
|
13823df5a1
|
C++: Remove underflow detection.
|
2021-07-29 15:22:18 +01:00 |
|
Geoffrey White
|
9e0411238b
|
C++: Add some more test cases.
|
2021-07-29 15:15:26 +01:00 |
|
Mathias Vorreiter Pedersen
|
bbb38fd2aa
|
C++: Accept more test changes.
|
2021-07-29 15:49:50 +02:00 |
|
Tony Torralba
|
2628d3dc39
|
Improve csv sink models
|
2021-07-29 15:36:18 +02:00 |
|
Tony Torralba
|
3edc8bc679
|
Doc improvements
|
2021-07-29 15:35:39 +02:00 |
|
Tony Torralba
|
d9fb650dfb
|
JacksonCreateParserMethod converted to CSV summay model
|
2021-07-29 15:19:30 +02:00 |
|
Tony Torralba
|
b20d53cfd4
|
Update java/ql/src/semmle/code/java/security/OgnlInjection.qll
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2021-07-29 15:08:27 +02:00 |
|
Alexandre Boulgakov
|
e55bd4fb64
|
C++: Allow querying virtual, override, and final declaration specifiers.
|
2021-07-29 14:02:03 +01:00 |
|
Mathias Vorreiter Pedersen
|
41d233f086
|
C++: Make the 'definition by reference'-node in 'foo(a.b);' a source in the 'FieldConfiguration' configuration.
|
2021-07-29 14:49:59 +02:00 |
|
Mathias Vorreiter Pedersen
|
a082172422
|
C++: Add testcase demonstrating missing local flow out of fields that are defined by reference.
|
2021-07-29 14:46:32 +02:00 |
|
mc
|
8f1fc9e893
|
Update MvelInjection.qhelp
Minor tweaks
|
2021-07-29 11:30:19 +01:00 |
|
Joe Farebrother
|
143b302eef
|
Merge pull request #6384 from joefarebrother/test-gen-improvements
Java: Test generator: use getComponentType
|
2021-07-29 10:47:37 +01:00 |
|
Joe Farebrother
|
f7099f459f
|
Java: Test generator: use getComponentType
|
2021-07-29 10:08:45 +01:00 |
|
Artem Smotrakov
|
83a9b0ee28
|
Apply suggestions from code review
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
|
2021-07-29 11:04:21 +02:00 |
|
Benjamin Muskalla
|
b7b74b51a3
|
Track taint for String.valueOf(..)
|
2021-07-29 09:14:03 +02:00 |
|
Geoffrey White
|
ae35ae10e6
|
C++: Fix readlink FPs.
|
2021-07-28 17:45:18 +01:00 |
|
Fosstars
|
893f84fbf4
|
Merge branch 'unsafe-jackson-deserialization' of github.com:artem-smotrakov/ql into unsafe-jackson-deserialization
|
2021-07-28 18:25:53 +02:00 |
|
Fosstars
|
50497eb747
|
Make imports as private as possible
|
2021-07-28 18:25:05 +02:00 |
|