github-actions[bot]
fca754bddd
Post-release preparation for codeql-cli-2.11.3
2022-11-05 14:30:48 +00:00
github-actions[bot]
508327235a
Release preparation for version 2.11.3
2022-11-04 20:16:23 +00:00
Chris Smowton
b6e4f472d1
Remove unnecessary import
2022-10-29 11:40:57 +01:00
Chris Smowton
0c6c135967
Go: exclude protobuf read steps from cleartext-logging query
...
This query already treats structs differently to usual: it includes field -> whole struct taint steps, but explicitly excludes struct -> field steps. This means that a logging framework sinking an entire struct with a tainted field yields an alert, but we don't get FPs caused by writing field `x` but then reading field `y`.
However, protobuf messages have a special treatment, with taint usually associated with the whole struct and getter methods propagating that taint out. Suppressing these getter method steps specifically for the cleartext-logging query mirrors its treatment of structs in general and avoids this sort of field-mismatch FP.
On the downside we will miss same-field propagation like `m.field = password; Log(m.GetField())` if we don't have source code for the implementation of `m`. However this is hopefully unusual since the typical use of protobufs is to serialize and deserialize, rather than using the struct as a general-purpose datastructure.
2022-10-29 11:40:57 +01:00
github-actions[bot]
be7693283b
Post-release preparation for codeql-cli-2.11.2
2022-10-21 08:07:17 +00:00
github-actions[bot]
9a0848bbc4
Release preparation for version 2.11.2
2022-10-20 11:05:19 +00:00
Dave Bartolomeo
5ee7986649
Merge pull request #10736 from github/post-release-prep/codeql-cli-2.11.1
...
Post-release preparation for codeql-cli-2.11.1
2022-10-07 14:23:31 -04:00
github-actions[bot]
b8ef9e0ddc
Post-release preparation for codeql-cli-2.11.1
2022-10-07 15:59:45 +00:00
erik-krogh
d5c45056bd
fix some more style-guide violations in the alert-messages
2022-10-07 11:21:01 +02:00
github-actions[bot]
a02dcdc5e1
Release preparation for version 2.11.1
2022-10-07 02:20:28 +00:00
Chris Smowton
4e161c867e
Rename 2022-10-06-beego- to 2022-10-06-beego-request-body-source.md
2022-10-06 14:01:36 +01:00
Chris Smowton
7d98b74eec
Create 2022-10-06-beego-
2022-10-06 14:00:52 +01:00
gregxsunday
9960d11042
added RequestBody source to Beego framework
2022-10-06 13:23:56 +02:00
github-actions[bot]
6cef0af5df
Post-release preparation for codeql-cli-2.11.0
2022-09-23 21:01:40 +00:00
github-actions[bot]
f5cf8cffa3
Release preparation for version 2.11.0
2022-09-22 20:14:12 +00:00
Henry Mercer
f8f99af8b7
Bump the minor version of packs we regularly release
2022-09-22 12:14:19 +01:00
Andrew Eisenberg
58e4861b45
Merge branch 'main' into rc/3.7
2022-09-20 12:43:20 -07:00
erik-krogh
49d1e584a8
deprecate a source class that wasn't used anywhere
2022-09-19 15:07:18 +02:00
erik-krogh
f6ada6e022
use sanitizer class in the insecure-randomness query
2022-09-19 15:07:00 +02:00
Erik Krogh Kristensen
a4cd913aea
Merge pull request #10312 from erik-krogh/fix-caseDiff
...
ensure consistent casing of names
2022-09-19 10:43:12 +02:00
github-actions[bot]
67ce442674
Post-release preparation for codeql-cli-2.10.5
2022-09-16 14:23:44 +00:00
Rasmus Wriedt Larsen
ca66a29b18
Go: Rewrite ::Range patterns to use instanceof
2022-09-13 15:48:17 +02:00
Rasmus Wriedt Larsen
6f5701f9c7
Go: Rewrite concepts to use extends ... instanceof ...
2022-09-13 15:36:16 +02:00
erik-krogh
bae4490620
add change-note
2022-09-12 12:12:18 +02:00
erik-krogh
26d8553f6e
ensure consistent casing of names
2022-09-09 10:34:14 +02:00
github-actions[bot]
a9d80a5a48
Release preparation for version 2.10.5
2022-09-08 11:35:54 +00:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
github-actions[bot]
3b4ad3c4f1
Post-release preparation for codeql-cli-2.10.4
2022-08-26 09:32:11 +00:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
Ian Lynagh
711e769382
Update go/ql/lib/change-notes/released/0.2.4.md
...
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com >
2022-08-25 14:25:30 +01:00
Ian Lynagh
b951e94d85
Update go/ql/lib/CHANGELOG.md
...
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com >
2022-08-25 14:25:20 +01:00
github-actions[bot]
0f63bc077f
Release preparation for version 2.10.4
2022-08-25 12:52:26 +00:00
Michael Nebel
761ed283b6
C#/Java/Ruby/Swift: Address review comments.
2022-08-24 09:58:54 +02:00
Michael Nebel
37976d56bc
C#/Java/Go/Swift: Move CsvValidation back into ExternalFlow.
2022-08-24 09:58:53 +02:00
Michael Nebel
2c2e09b20b
Go: Add summary model validation on the kind column.
2022-08-24 09:58:52 +02:00
Michael Nebel
37f01fe10e
Go: Re-factor CSV validation into separate file.
2022-08-24 09:58:52 +02:00
erik-krogh
28083ebe09
run the implicit-this patch
2022-08-22 21:23:31 +02:00
erik-krogh
a593a52b5e
add missing qldoc (that was already missing?)
2022-08-22 21:22:39 +02:00
erik-krogh
e89e0eb7fb
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
Chris Smowton
6f4fbac412
Create 2022-08-19-go-119-support.md
2022-08-19 17:20:03 +01:00
Chris Smowton
45f922b3f2
Add models for Go 1.19's new url.JoinPath and URL.JoinPath functions
2022-08-19 10:29:45 +01:00
Chris Smowton
6068f63e9e
Add taint models for go 1.19's new fmt.Append functions
2022-08-19 10:29:45 +01:00
Chris Smowton
d2055283de
Add models for go 1.19's new atomic pointer typex
2022-08-18 17:47:13 +01:00
Erik Krogh Kristensen
4f93f2b9ba
Merge pull request #10076 from erik-krogh/ql-for-ql-fixes
...
various QL-for-QL fixes
2022-08-18 15:46:48 +02:00
Chris Smowton
72009f8614
Merge pull request #10085 from smowton/smowton/fix/dont-use-write-instruction-for-channel-flow
...
Go: don't use WriteNode for channel writes
2022-08-18 12:47:55 +01:00
erik-krogh
6b9f01535b
change All to Most in the change-notes
2022-08-17 15:34:57 +02:00
Chris Smowton
077bae55fe
Go: don't use WriteNode for channel writes
...
I overlooked the fact that this has a WriteInstruction, which wasn't bound in the channel-write case, but somehow the evaluator discarded the implied cartesian product until last night's performance evaluation.
Rather than try to cram channel writes into WriteInstruction, just handle them as their own beast.
2022-08-17 14:27:16 +01:00
erik-krogh
2622c78766
add change-notes
2022-08-17 13:55:16 +02:00
erik-krogh
8066e39d07
delete some redundant imports
2022-08-17 13:50:04 +02:00
erik-krogh
2e44fba67d
add explicit this
2022-08-17 13:33:31 +02:00
