Owen Mansel-Chan
9cb01d4573
Merge branch 'main' into go/mad/convert-sinks
2024-07-30 08:03:18 +01:00
Owen Mansel-Chan
a6cb511ed7
Convert XPath injection sinks to MaD
2024-07-25 12:56:06 +01:00
Owen Mansel-Chan
78b66abad3
Convert existing credentials sinks to MaD
...
I checked that the tests failed when I removed the classes and passed
again when I add the MaD models.
2024-07-25 12:53:16 +01:00
Owen Mansel-Chan
93c9910e6f
Convert go/request-forgery sinks to MaD
2024-07-25 12:53:15 +01:00
Owen Mansel-Chan
f7d681516a
Allow MaD sinks for go/request-forgery
...
Request forgery sinks which have `getRequest` different from the sink
itself cannot be modeled using models-as-data.
2024-07-25 12:53:14 +01:00
Anders Schack-Mulligen
7a48fe1102
Dataflow: Replace ppReprType with DataFlowType.toString.
2024-07-25 13:08:47 +02:00
github-actions[bot]
49cc8f8ff8
Post-release preparation for codeql-cli-2.18.1
2024-07-22 22:00:48 +00:00
github-actions[bot]
368bcb684a
Release preparation for version 2.18.1
2024-07-22 21:30:50 +00:00
Chuan-kai Lin
23320b6e5e
Revert "Release preparation for version 2.18.1"
2024-07-22 13:22:49 -07:00
github-actions[bot]
55935fc123
Release preparation for version 2.18.1
2024-07-22 14:56:15 +00:00
Owen Mansel-Chan
fc17b905f0
Convert WebSocketReaderAsSource to MaD
2024-07-18 10:53:13 +01:00
Owen Mansel-Chan
6b52cd4957
Do not use "request" threat model kind
...
It is not supported yet.
2024-07-17 12:12:00 +01:00
Owen Mansel-Chan
cfdd48711b
Convert Fasthttp::RequestHeader::RemoteFlowSource to MaD
2024-07-17 12:11:59 +01:00
Owen Mansel-Chan
abeca3d9f9
Convert Fasthttp::RequestCtx::RemoteFlowSource to MaD
2024-07-17 12:11:58 +01:00
Owen Mansel-Chan
729069e3d9
Convert Fasthttp::Request::RemoteFlowSource to MaD
2024-07-17 12:11:57 +01:00
Owen Mansel-Chan
c3169d258f
Convert Fasthttp::Args::RemoteFlowSource to MaD
2024-07-17 12:11:57 +01:00
Owen Mansel-Chan
5a00b5ec96
Convert Fasthttp::URI::RemoteFlowSource to MaD
2024-07-17 12:11:56 +01:00
Owen Mansel-Chan
4c3220ea9d
Use package grouping in models for gocb
2024-07-17 10:36:38 +01:00
Owen Mansel-Chan
4b2075bfb1
Split models for separate protobuf packages into separate files
2024-07-17 10:36:37 +01:00
Owen Mansel-Chan
aa0749e4ba
Use package grouping for go-jose/jwt models
2024-07-17 10:36:37 +01:00
Owen Mansel-Chan
e6c7e1a0bc
Merge pull request #16990 from owen-mc/go/change-string-prefix-check
...
Go: Change string prefix check
2024-07-17 09:57:45 +01:00
Owen Mansel-Chan
535b4ea986
Convert net/http UserControlledRequestField sources to MaD
2024-07-16 16:53:02 +01:00
Owen Mansel-Chan
873fd6646b
Convert Revel::UserControlledRequestMethod sources to MaD
2024-07-16 16:53:01 +01:00
Owen Mansel-Chan
034f2d4221
Convert Revel field read sources to MaD
2024-07-16 16:53:01 +01:00
Owen Mansel-Chan
2da1de7b13
Use packageGrouping in Revel models
2024-07-16 16:53:00 +01:00
Owen Mansel-Chan
8647f69720
Change string prefix check
...
This avoids putting all the prefixes in the string pool.
2024-07-16 15:56:28 +01:00
Owen Mansel-Chan
ca06589386
Make comments clearer
2024-07-16 12:14:21 +01:00
Owen Mansel-Chan
124567caa4
Convert Mux::RequestVars to MaD
2024-07-16 11:18:19 +01:00
Owen Mansel-Chan
b3744ef230
Sort Gin source models
2024-07-16 11:18:18 +01:00
Owen Mansel-Chan
061c187a8e
Convert GithubComGinGonicGinContextBindSource to MaD
2024-07-16 11:18:18 +01:00
Owen Mansel-Chan
ef833de123
Convert GithubComGinGonicGinContextSource to MaD
2024-07-16 11:18:17 +01:00
Owen Mansel-Chan
06a2a40f50
Convert GoRestfulReadEntitySource to MaD
2024-07-16 11:18:16 +01:00
Owen Mansel-Chan
7bfa4c1947
Convert GoRestfulSource to MaD
2024-07-16 11:18:14 +01:00
Anders Schack-Mulligen
0fb27fb6fc
Merge pull request #16979 from aschackmull/dataflow/internsets
...
Dataflow: Replace MakeSets with QlBuiltins::InternSets.
2024-07-16 10:47:07 +02:00
Anders Schack-Mulligen
da5abc8321
Dataflow: Replace MakeSets with QlBuiltins::InternSets.
2024-07-15 13:35:57 +02:00
Owen Mansel-Chan
99ed3c2ac1
Convert ElazarlGoproxy::UserControlledRequestData to MaD
2024-07-14 14:28:48 +01:00
Owen Mansel-Chan
2ec64a9ca8
Convert EchoContextBinder to MaD
2024-07-14 14:28:47 +01:00
Owen Mansel-Chan
3fc598dbe9
Convert EchoContextSource to MaD
2024-07-14 14:28:46 +01:00
Owen Mansel-Chan
5b38d51f62
Convert Chi::UserControlledMethod to MaD
2024-07-14 14:28:46 +01:00
Owen Mansel-Chan
3bd4a203bb
Convert Chi::UserControlledFunction to MaD
2024-07-14 14:28:44 +01:00
Owen Mansel-Chan
2c7fbda2ec
Accept review suggestion for QLDoc
2024-07-10 16:48:11 +01:00
Owen Mansel-Chan
32acff76c2
Make groupPrefix() private
...
This could be made public in future. But I expect that we will want to
use this logic for QL models as well then we will want to move it into a
different file, which will be much easier if it's all private at the
moment.
2024-07-10 16:48:10 +01:00
Owen Mansel-Chan
b64ef84393
Use prefix() method on string to check for group prefix
2024-07-10 16:48:10 +01:00
Owen Mansel-Chan
3e2ebf436c
Move logic for dealing with groups into a predicate
2024-07-10 16:48:09 +01:00
Owen Mansel-Chan
f6b9195a61
Add validation of package groups
2024-07-10 16:48:08 +01:00
Owen Mansel-Chan
ab991af2a5
Fix package validation errors
2024-07-10 16:48:07 +01:00
Owen Mansel-Chan
f650e3f72b
Update MaD documentation explain "group:" in package column
2024-07-10 16:48:06 +01:00
Owen Mansel-Chan
1e448d547d
Rename Beego MaD files using path from current version
2024-07-10 16:48:04 +01:00
Owen Mansel-Chan
fde7d7b969
Use packageGrouping for Beego models
2024-07-10 16:48:03 +01:00
Michael Nebel
4193b7e591
Allow grouping import paths for models-as-data
2024-07-10 16:48:02 +01:00
