Sauyon Lee
49aa43bd49
Make header Get and Values calls into taint steps
2020-03-25 04:01:12 -07:00
Sauyon Lee
83a417f52e
OpenUrlRedirect: Use a taint-tracking safe URLs
2020-03-25 04:01:11 -07:00
Sauyon Lee
932840b0a3
Address review comments.
2020-03-25 04:01:10 -07:00
Sauyon Lee
fd88d913f7
Fix tests
2020-03-25 04:01:09 -07:00
Sauyon Lee
cc13a5d618
OpenUrlRedirect: Expand safe URL flow configuration
...
Also add some more tests
2020-03-25 04:01:08 -07:00
Max Schaefer
4ca87b84db
Merge pull request #68 from adityasharad/go/request-forgery
...
Add experimental query for request forgery.
2020-03-25 09:09:34 +00:00
Aditya Sharad
c44e5379df
Experimental: Remove query precision for now.
...
Address review comment.
2020-03-24 10:57:51 -07:00
Aditya Sharad
4f32d6651c
Experimental: Add sanitiser edge for request forgery.
...
Consider a URL string sanitised if the hostname cannot be controlled.
This approach is used by URL redirection queries.
2020-03-24 10:57:51 -07:00
Aditya Sharad
f984532236
Experimental: Add query for request forgery.
...
Tracks the flow of tainted data from untrusted input to the URL of an HTTP request.
Ported from the corresponding query for JavaScript, though currently limited in scope.
Includes companion libraries for customisation.
2020-03-24 10:57:51 -07:00
Aditya Sharad
d41e6a9d85
Model HTTP request functions in net/http package.
2020-03-24 10:57:51 -07:00
Aditya Sharad
b057ce8d46
Concepts: Add HTTP::ClientRequest class and module.
...
Extensible model of client requests to a URL.
Ported from the CodeQL JavaScript library.
2020-03-24 10:57:51 -07:00
Max Schaefer
330f11c2a3
Merge pull request #71 from intrigus-lgtm/patch-1
...
Fix error in Qldoc
2020-03-24 16:55:22 +00:00
intrigus-lgtm
24b3133e0c
Fix error in Qldoc
2020-03-24 17:53:51 +01:00
Max Schaefer
8dda4bd97f
Merge pull request #66 from intrigus-lgtm/CWE-643
...
CWE-643 XPathInjection on Go
2020-03-24 10:53:57 +00:00
Sauyon Lee
81e13473db
Merge pull request #69 from max-schaefer/issue-72
...
Track taint through element writes.
2020-03-24 03:41:05 -07:00
intrigus
1f635806b3
Fix copy-paste errors, remove debugging code
2020-03-23 16:49:45 +01:00
intrigus-lgtm
9187bacd3c
Apply suggestion from code review
...
Use getUnderlyingType() to account for named aliases.
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com >
2020-03-23 16:45:56 +01:00
Sauyon Lee
4ff3177fae
Merge pull request #67 from max-schaefer/more-qldoc
...
Add missing Qldoc for modules.
2020-03-23 05:29:40 -07:00
Max Schaefer
62b79721ea
Track taint through element writes.
...
This adds a taint step from `pred` to (the post-update node) of `succ` in `succ[idx] = pred` and its syntactic variants.
Unlike for structs, where partially tainted values are quite common, the theory is that arrays, maps, and slices are usually either completely tainted or completely clean.
2020-03-23 09:15:01 +00:00
intrigus
d81c9b145e
Update query help to use goxpath
2020-03-20 21:38:46 +01:00
intrigus
948b79df87
Update xpath example, use goxpath package
2020-03-20 21:38:46 +01:00
intrigus
c7ead88b91
Restructure query, add default sanitizer
2020-03-20 21:38:46 +01:00
intrigus-lgtm
ec40cf0379
Apply suggestions from review
...
Co-Authored-By: Max Schaefer <54907921+max-schaefer@users.noreply.github.com >
2020-03-20 21:38:02 +01:00
Max Schaefer
60fe6f4390
Add missing Qldoc for modules.
2020-03-20 17:36:08 +00:00
intrigus
d6ff6b74c5
CWE-643 XPathInjection on Go
2020-03-19 22:26:37 +01:00
Max Schaefer
37aaba10b7
Merge pull request #64 from sauyon/examples-in-json
...
Add examples qlpack.yml to CodeQL manifest
2020-03-19 07:54:39 +00:00
Sauyon Lee
f60f6ea7d0
Add examples qlpack.yml to CodeQL manifest
2020-03-18 09:30:45 -07:00
Max Schaefer
f53732ec5a
Merge pull request #39 from sauyon/go1.14
...
Go 1.14 support
2020-03-18 10:08:50 +00:00
Max Schaefer
0a59470640
Fix tests. ( #3 )
2020-03-18 02:10:24 -07:00
Max Schaefer
60ce9c5acd
Merge pull request #59 from max-schaefer/go-pg
...
Add model of `go-pg/pg`.
2020-03-18 07:35:23 +00:00
Max Schaefer
ad1324d2dd
Add test.
2020-03-17 12:08:42 +00:00
Max Schaefer
49c5779112
Add model of go-pg/pg.
2020-03-17 12:08:42 +00:00
Sauyon Lee
e9b47298ed
Merge pull request #61 from max-schaefer/better-method-sets
...
Reformulate `Method.hasQualifiedName` in terms of method sets
2020-03-17 07:46:19 -04:00
Max Schaefer
8cadc94f49
Clarify behaviour of getMethod on struct types.
2020-03-17 10:58:58 +00:00
Max Schaefer
74bcfdd01c
Remove an unused and potentially confusing predicate.
2020-03-16 13:24:57 +00:00
Max Schaefer
0fc7febd1d
Add another test.
2020-03-13 15:54:39 +00:00
Max Schaefer
f41151350a
Merge pull request #60 from sauyon/bitwise-xor-fps
...
MistypedExponentiation: Add a heuristic to reduce FPs
2020-03-13 15:46:03 +00:00
Max Schaefer
8898858fff
Add tests.
2020-03-13 14:19:27 +00:00
Max Schaefer
5175f1dcbe
Take promoted methods into account when computing method sets.
2020-03-13 14:19:27 +00:00
Max Schaefer
d0c6206a6a
Reformulate hasQualifiedName in terms of method sets.
2020-03-13 14:19:27 +00:00
Sauyon Lee
78ad006e68
Merge pull request #55 from max-schaefer/tainted-arithmetic
...
Add new query `AllocationSizeOverflow`.
2020-03-13 07:16:54 -07:00
Max Schaefer
39fa6052e6
Also treat second argument to make (slice capacity) as an allocation size.
2020-03-13 12:17:53 +00:00
Max Schaefer
864c85e886
Fix typo.
2020-03-13 10:27:58 +00:00
Max Schaefer
b2f1da8942
Simplify a condition.
2020-03-13 10:27:58 +00:00
Max Schaefer
d66888e651
Make query more extensible.
2020-03-13 10:27:58 +00:00
Max Schaefer
ea36d49218
Add new query AllocationSizeOverflow.
2020-03-13 10:18:51 +00:00
Sauyon Lee
ea5e6a324d
Add change note
2020-03-13 03:10:55 -07:00
Sauyon Lee
630d0cef89
Address review comments
2020-03-12 09:13:52 -07:00
Sauyon Lee
6e681f829b
MistypedExponentiation: Add a heuristic to reduce FPs
2020-03-12 09:13:52 -07:00
Max Schaefer
2c751f2945
Merge pull request #58 from max-schaefer/desemmlify
...
Docs: Remove some Semmle references.
2020-03-12 16:05:48 +00:00
