Slavomir
53e0e3ffbf
Merge branch 'standard-lib-pt-20' into from-331-to-337
2020-09-20 15:46:47 +02:00
Slavomir
9d1381349f
Merge branch 'standard-lib-pt-23' into from-331-to-337
2020-09-20 15:46:26 +02:00
Slavomir
1d13ca58ff
Merge branch 'standard-lib-pt-22' into from-331-to-337
2020-09-20 15:46:02 +02:00
Slavomir
cd151fcdd1
Merge branch 'standard-lib-pt-5' into from-331-to-337
2020-09-20 15:45:46 +02:00
Chris Smowton
fee596ac83
Merge pull request #343 from smowton/smowton/feature/chi-models
...
Add models for the Chi web framework
2020-09-16 11:38:08 +01:00
Chris Smowton
1bf366c1e3
Add models for the Chi web framework
...
This is mostly simple as the framework uses ordinary net/http methods and ordinary Go contexts for most purposes.
2020-09-16 09:14:23 +01:00
Max Schaefer
88e03c3ee5
Merge pull request #322 from gagliardetto/standard-lib-pt-11
...
Add taint-tracking for packages in `html/*`
2020-09-15 17:54:35 +01:00
Slavomir
a340270dc1
Move html TemplateEscape out of Texttemplate module
2020-09-14 15:47:52 +02:00
Slavomir
9a560e994c
Remove redundant field
2020-09-14 15:47:51 +02:00
Slavomir
ce67720542
Add taint-tracking for html/template package.
2020-09-14 15:47:51 +02:00
Slavomir
35136bbb2c
Add escape function.
2020-09-14 15:47:51 +02:00
Slavomir
52d4c71ec2
Add taint-tracking for html package.
2020-09-14 15:47:51 +02:00
Chris Smowton
8d7cbe3aa5
Merge pull request #323 from gagliardetto/standard-lib-pt-8
...
Add taint-tracking for packages in `encoding/*`
2020-09-14 14:41:19 +01:00
Chris Smowton
3ba85576ea
Merge pull request #338 from smowton/smowton/admin/update-dataflow-libs-2020-09-14
...
Port codeql#4238 (Dataflow: small fixes for naming in taint tracking)…
2020-09-14 14:19:06 +01:00
Slavomir
6bbe0182ca
Rename Syscall_non_windows.go to Syscall_non_win.go
2020-09-14 13:34:24 +02:00
Slavomir
4c2537017f
Fix TaintStep.expected: add params to json.MarshalIndent
2020-09-14 13:10:25 +02:00
Slavomir
64a61bd648
Remove redundant taint-tracking from MarshalingFunction and UnmarshalingFunction classes in EncodingXml module.
2020-09-14 13:10:25 +02:00
Slavomir
947bbabf62
Extend MarshalingFunction and UnmarshalingFunction with encoding/pem
2020-09-14 13:10:25 +02:00
Slavomir
d472d5abe5
Remove redundant taint-tracking from MarshalingFunction and UnmarshalingFunction classes in EncodingJson module.
2020-09-14 13:10:25 +02:00
Slavomir
ed2e5b0f92
Extend MarshalingFunction and UnmarshalingFunction with encoding/asn1
2020-09-14 13:10:25 +02:00
Slavomir
afede9bde5
Remove encoder taint-tracking for encoding/hex
2020-09-14 13:10:25 +02:00
Slavomir
96a700becb
Remove encoder taint-tracking for encoding/base64
2020-09-14 13:10:25 +02:00
Slavomir
0baca5fa6c
Remove encoder taint-tracking for encoding/base32
2020-09-14 13:10:25 +02:00
Slavomir
828d3863a0
Remove encoder taint-tracking for encoding/ascii85
2020-09-14 13:10:25 +02:00
Slavomir
f3a61ed65c
Add MarshalFunction and UnmarshalFunction classes to EncodingXml module.
2020-09-14 13:10:25 +02:00
Slavomir
b4ff653071
Add taint-tracking for encoding/xml
2020-09-14 13:10:25 +02:00
Slavomir
e7fc3c5039
Add taint-tracking for encoding/pem
2020-09-14 13:10:25 +02:00
Slavomir
669ed91b0b
Move EncodingJson to stdlib; add Escape class.
2020-09-14 13:10:25 +02:00
Slavomir
24c23ba333
Add taint-tracking for encoding/json
2020-09-14 13:10:25 +02:00
Slavomir
f5fc9494fc
Remove old EncodingHex module
2020-09-14 13:10:25 +02:00
Slavomir
74fdfba85c
Add taint-tracking for encoding/hex
2020-09-14 13:10:25 +02:00
Slavomir
7a42992850
Add taint-tracking for encoding/gob
2020-09-14 13:10:25 +02:00
Slavomir
57518c7e3d
Add taint-tracking for encoding/csv
2020-09-14 13:10:25 +02:00
Slavomir
df55bb459f
Add taint-tracking for encoding/binary
2020-09-14 13:10:25 +02:00
Slavomir
20b4826e8e
Add taint-tracking for encoding/base64
2020-09-14 13:10:25 +02:00
Slavomir
7060367de5
Add taint-tracking for encoding/base32
2020-09-14 13:10:24 +02:00
Slavomir
ba78eda277
Add taint-tracking for encoding/asn1
2020-09-14 13:10:24 +02:00
Slavomir
412ba1263b
Add taint-tracking for encoding/ascii85
2020-09-14 13:10:24 +02:00
Slavomir
a47842d1c3
Add taint-tracking for package encoding
2020-09-14 13:10:24 +02:00
Slavomir
27ba893ba2
Add taint-tracking for context package
2020-09-14 13:09:45 +02:00
Slavomir
eb3a18f172
Add taint-tracking for package sort
2020-09-14 13:08:54 +02:00
Slavomir
c2fc26a96a
Remove Range method on sync.Map
2020-09-14 13:04:52 +02:00
Slavomir
d51518f411
Add taint-tracking for sync/atomic package
2020-09-14 13:04:52 +02:00
Slavomir
e47715b2a9
Add taint-tracking for sync package
2020-09-14 13:04:52 +02:00
Chris Smowton
86ed037fd3
Port codeql#4238 (Dataflow: small fixes for naming in taint tracking) to Go's local copy of the dataflow libs
2020-09-14 12:01:30 +01:00
Slavomir
d929e8313a
Build syscall.StringSlicePtr only on non-windows OS
2020-09-14 12:49:41 +02:00
Slavomir
702a984dc0
Comment out test for syscall.StringSlicePtr because it's not present on windows.
2020-09-14 12:49:41 +02:00
Slavomir
72ef65f257
Add taint-tracking for syscall
2020-09-14 12:49:41 +02:00
Chris Smowton
362d210bc5
Merge pull request #330 from smowton/smowton/admin/standard-lib-pt-21-with-sanitiser
...
Move `strconv` and `strings` packages' taint-tracking to stdlib, and expand them + sanitise substrings of the HTTP Authorization header
2020-09-14 11:25:57 +01:00
Chris Smowton
b9b306aade
CleartextLogging: sanitize strings.Split(authheader, ":")[0] and similar
...
These can represent a username, method name or other non-sensitive component of an Authorization header. For greater precision we could split the query into one investigating Authorization headers and one investigating other sources of sensitive data that can't be sanitized by splitting this way.
2020-09-14 09:46:14 +01:00
