Erik Krogh Kristensen
646bf99489
rewrite the qhelp to focus more on documenting unsafe functions
2021-05-10 10:48:40 +02:00
Erik Krogh Kristensen
3fe5dd0f35
add comment about filtering away jQuery from the source
2021-05-10 10:05:18 +02:00
Erik Krogh Kristensen
b53759c5a0
corrections after code review
2021-05-06 22:49:25 +02:00
Erik Krogh Kristensen
be69c3a458
Apply suggestions from code review
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2021-05-06 21:59:35 +02:00
Erik Krogh Kristensen
2d1ba59e6d
Apply suggestions from code review
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2021-05-06 21:55:30 +02:00
Erik Krogh Kristensen
3815797dda
add sanitizers from DOM and jQuery queries
2021-05-06 11:05:03 +02:00
Erik Krogh Kristensen
8ba5bddae8
add jQuery options objects as sources
2021-05-06 11:05:02 +02:00
Erik Krogh Kristensen
5c37e6a435
add change note
2021-05-06 11:05:02 +02:00
Erik Krogh Kristensen
7ef641e7b2
add qhelp
2021-05-06 11:05:02 +02:00
Erik Krogh Kristensen
ee0140e704
share code between unsafe-shell and unsafe-html queries
2021-05-06 11:05:02 +02:00
Erik Krogh Kristensen
23908f9ec2
remove flowpaths that has a returns without a matching call
2021-05-06 11:05:02 +02:00
Erik Krogh Kristensen
6e754c70aa
add test for js/html-constructed-from-input
2021-05-06 11:05:02 +02:00
Erik Krogh Kristensen
e86a3b5e57
add js/html-constructed-from-input query
2021-05-06 11:04:49 +02:00
Erik Krogh Kristensen
a400a1e9d4
split the markdown steps into a separate class
2021-05-06 10:44:39 +02:00
Shati Patel
059a5f35fa
Merge pull request #5812 from mario-campos/patch-1
...
Add React Native to JavaScript frameworks docs
2021-05-05 16:03:41 +01:00
CodeQL CI
69cd9dfb7d
Merge pull request #5826 from erik-krogh/moreLib
...
Approved by esbena
2021-05-05 04:40:49 -07:00
Erik Krogh Kristensen
e333267e69
require that the factory function is in a main module file
2021-05-05 12:00:38 +02:00
Erik Krogh Kristensen
fc3f5adbbb
more source code examples in PackageExports.qll
2021-05-05 11:48:41 +02:00
Erik Krogh Kristensen
28eef264e5
recognize the define(..) call in PackageExports.qll
2021-05-05 11:23:25 +02:00
Jonas Jensen
390ee3a6b8
Merge pull request #5829 from MathiasVP/reorder-get-instruction-opcode
...
C++: Reorder getInstructionOpcode
2021-05-05 11:13:15 +02:00
Erik Krogh Kristensen
3ca670146e
remove outdated comment
2021-05-05 11:10:45 +02:00
Mathias Vorreiter Pedersen
066cdb55d7
C++: Add qldoc explaining column order.
2021-05-05 09:30:12 +02:00
Mathias Vorreiter Pedersen
f03c99ab03
Merge pull request #5835 from hmakholm/hmakholm/pr/blowup-fix
...
CPP: fix semi-unused variables in WrongInDetectingAndHandlingMemoryAllocationErrors.q
2021-05-05 08:15:37 +02:00
Henning Makholm
4964ce347b
CPP: fix semi-unused variables in WrongInDetectingAndHandlingMemoryAllocationErrors.ql
...
The fact that `aex` and `it` was each used in just one disjunct of the
exists() body caused the optimizer to generate perfectly horrible
code, including a pointless cartesian product between them that caused
the evaluation to blow up.
Fix it such that each variable is logically scoped. That makes the
compiler much happier.
2021-05-05 02:31:11 +02:00
CodeQL CI
95f26aadd3
Merge pull request #5681 from yoff/python-support-pathlib
...
Approved by tausbn
2021-05-04 09:20:24 -07:00
Robert Marsh
5ee74d269a
Merge pull request #5822 from MathiasVP/more-cwe-tags-in-code-scanning
...
C++: Add more CWE tags to queries in the Code Scanning suite
2021-05-04 09:01:00 -07:00
Mathias Vorreiter Pedersen
d5793418f9
C++: Remove parent CWE tags.
2021-05-04 14:39:23 +02:00
CodeQL CI
b160badbf6
Merge pull request #5768 from erik-krogh/cacheMore
...
Approved by esbena
2021-05-04 04:16:15 -07:00
Tamás Vajk
05c045070e
Merge pull request #5810 from tamasvajk/feature/culture
...
C#: Use invariant culture in the extractor
2021-05-04 13:09:38 +02:00
Mathias Vorreiter Pedersen
568724bffd
C#: Fix getInstructionOpcode to make sure IRConstruction.qll compiles for C#.
2021-05-04 13:00:40 +02:00
Mathias Vorreiter Pedersen
ded377bcd2
C++: Reorder getInstructionOpcode to produce better RA.
2021-05-04 12:13:34 +02:00
Tamas Vajk
c547907784
C#: Use invariant culture in the extractor
2021-05-04 11:17:33 +02:00
Anders Schack-Mulligen
5bcf810a7c
Merge pull request #5821 from JarLob/patch-1
...
Update UncaughtServletException.qhelp
2021-05-04 10:39:02 +02:00
Anders Schack-Mulligen
9ee9186a1a
Merge pull request #5825 from github/yo-h/java-diagnostic-queries
...
Java: split extractor diagnostics query into two
2021-05-04 10:12:32 +02:00
Erik Krogh Kristensen
aaf754ebf5
recognize more library input
2021-05-04 10:06:14 +02:00
CodeQL CI
6931d9a6f7
Merge pull request #5785 from edvraa/httponlyjs
...
Approved by esbena
2021-05-03 23:14:26 -07:00
yo-h
edf1a90161
Java: split extractor diagnostics query into two
2021-05-03 20:27:07 -04:00
edvraa
6fa2f1e653
update test message
2021-05-04 00:32:01 +03:00
Taus
483199878d
Merge pull request #5793 from RasmusWL/fix-qldoc
...
Python: Minor fix to Django RawSQL QLDoc
2021-05-03 18:18:02 +02:00
Mathias Vorreiter Pedersen
2912c2e7f5
C++: Add more CWE tags to queries in the code scanning suite.
2021-05-03 16:58:47 +02:00
Edwin
27c680e28b
Apply suggestions from code review
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2021-05-03 16:41:09 +03:00
Jaroslav Lobačevski
38bce39baa
Update UncaughtServletException.qhelp
...
There is no single word in https://cwe.mitre.org/data/definitions/600.html about possible DoS or unexpected state.
2021-05-03 15:06:57 +03:00
edvraa
cef845ac47
Support string expressions
2021-05-03 13:46:56 +03:00
edvraa
ea38f0d3bd
a new test for simple flow
2021-05-03 12:19:05 +03:00
edvraa
000826af11
typo
2021-05-03 12:18:43 +03:00
Tom Hvitved
bb1cb73675
Merge pull request #5795 from hvitved/csharp/implicit-constructor-inits
...
C#: Extract implicit constructor initializer calls
2021-05-03 10:21:04 +02:00
Tom Hvitved
b77b3da8d6
C#: Add change note
2021-05-03 09:40:13 +02:00
Jonas Jensen
c05ef1225c
Merge pull request #5803 from MathiasVP/no-magic-in-getUnspecifiedType
...
C++: Add nomagic to getUnspecifiedType
2021-05-03 09:03:58 +02:00
edvraa
65183cde80
Move to experimental
2021-05-03 09:59:52 +03:00
edvraa
bd99114cd6
Comments added
2021-05-03 09:55:04 +03:00
