Arthur Baars
290167e1a3
Ruby: re-generated dbscheme/library
2023-01-13 10:22:41 +01:00
Harry Maclean
33a1469a56
Ruby: Add change note
2023-01-12 16:29:00 +13:00
Harry Maclean
8219465389
Ruby: fix missing doc
2023-01-12 11:35:35 +13:00
Harry Maclean
0626d693f5
Ruby: Recognise rack applications
...
This is a basic first step in modelling rack apps. We recognise classes
that look like rack applications and then treat the argument to `call`
in the same way that we treat `request.env` in ActionController classes.
This finds a TP in CVE-2021-43840.
2023-01-12 11:28:31 +13:00
Michael Nebel
7e4f7a0c17
C#: Address review comments and sync files.
2023-01-11 16:29:24 +01:00
Michael Nebel
67cbe38255
Sync files.
2023-01-11 16:20:55 +01:00
Michael Nebel
c01361a1fd
Ruby: Re-factor provenance related predicates for summarized callable.
2023-01-11 16:20:55 +01:00
Michael Nebel
ea173f9516
Sync files.
2023-01-11 16:20:55 +01:00
Tony Torralba
c9d1cd97fb
Ruby: Remove omittable exists variables
2023-01-10 13:39:49 +01:00
Erik Krogh Kristensen
5157d4df7b
Merge pull request #11581 from erik-krogh/stdin
...
Rb: add stdin as source for unsafe-deserialization
2023-01-09 13:57:47 +01:00
erik-krogh
d67e756f42
make the import of Gem private
2023-01-09 09:13:01 +01:00
Harry Maclean
5b117084db
Merge pull request #11534 from hmac/array-inclusion-barrier-guard-constant
...
Ruby: Make array inclusion barrier more sensitive
2023-01-09 20:57:09 +13:00
github-actions[bot]
cdb8f67601
Post-release preparation for codeql-cli-2.12.0
2023-01-06 10:36:34 +00:00
erik-krogh
19d2b49562
drive-by: make Base64.decode64(..) into a flowsummary that is shared with all queries
2023-01-06 09:04:37 +01:00
erik-krogh
1a27441cfb
drive-by: delete code-execution sinks from unsafe-deserialization, we risked duplicate alerts
2023-01-06 09:04:36 +01:00
erik-krogh
0e6028a7f3
add stdin as source for unsafe-deserialization
2023-01-06 09:04:36 +01:00
Erik Krogh Kristensen
d9176541c6
Apply suggestions from code review
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2023-01-05 20:02:54 +01:00
Jeroen Ketema
de37f3b7d5
Properly indent code block in change log
2023-01-05 18:38:33 +01:00
Jeroen Ketema
170242f79c
Apply suggestions from code review
2023-01-05 17:57:19 +01:00
github-actions[bot]
b6a8193785
Release preparation for version 2.12.0
2023-01-05 16:32:14 +00:00
Harry Maclean
4d228bcddf
Ruby: Recognise more string-valued variables
...
This increases the sensitivity of our barrier guards.
2023-01-04 11:45:10 +13:00
Harry Maclean
0fbb6bf608
Ruby: Make array inclusion barrier more sensitive
2023-01-04 11:45:09 +13:00
Aditya Sharad
9988c19a42
Merge branch 'main' into tutorial/library-pack
2023-01-03 14:08:37 -08:00
Harry Maclean
b70ca77afc
Merge pull request #10899 from hmac/flow-summary-docs
...
Ruby: Document flow summary syntax
2022-12-28 10:47:38 +13:00
Jami
c9258effb6
Merge pull request #11572 from jcogs33/jcogs33/model-top-jdk-apis
...
Java: model top 100 JDK APIs
2022-12-20 09:13:53 -05:00
Erik Krogh Kristensen
b1e6a86a4b
Merge pull request #11757 from erik-krogh/treesitter-qldoc
...
QL/RB: make top TreeSitter.qll comment into a qldoc
2022-12-20 13:36:31 +01:00
erik-krogh
2ff23a6fc0
make top TreeSitter.qll comment into a qldoc
2022-12-20 11:39:06 +01:00
Aditya Sharad
ed29b3e4d6
Shared packs: Depend on codeql/tutorial from all language libraries
...
This allows `import tutorial` from queries targeting
any language, just like before, while removing the
duplicate copies of `tutorial.qll`.
2022-12-19 15:52:11 -08:00
Erik Krogh Kristensen
f136651384
Merge pull request #11575 from erik-krogh/kernelLoad
...
Rb: add Kernel methods as sinks to path-injection
2022-12-19 15:09:21 +01:00
erik-krogh
d0af30b40a
cleanup the implementation of toString() for `SuperCall
2022-12-19 14:28:01 +01:00
erik-krogh
db49cfb723
Merge branch 'main' into kernelLoad
2022-12-19 09:46:25 +01:00
erik-krogh
ba7321ac5c
add qldoc to RegExpCharEscape
2022-12-18 17:23:45 +01:00
erik-krogh
26c5480ee6
share {js,rb}/regex/missing-regexp-anchor
2022-12-18 17:23:41 +01:00
erik-krogh
355499ea52
move getACommonTld to the shared pack
2022-12-17 17:26:18 +01:00
erik-krogh
f67d0bc8c0
put the shared HostnameRegexp code in the shared regex pack
2022-12-17 17:26:18 +01:00
Jami
ff652f7dee
Merge branch 'main' into jcogs33/model-top-jdk-apis
2022-12-16 15:32:50 -05:00
Henry Mercer
30451ee950
Merge pull request #11681 from github/henrymercer/mergeback-3.8
...
Merge `rc/3.8` back to `main`
2022-12-16 17:43:12 +00:00
Tom Hvitved
e629568eda
Merge pull request #11720 from hvitved/ruby/call-sensitive-initialize-bug-fix
...
Ruby: Fix bug in call-sensitivity logic for `initialize` calls
2022-12-16 16:36:31 +01:00
Tom Hvitved
5fba5e4895
Merge pull request #11718 from hvitved/ruby/self-allocate
...
Ruby: Recognize custom `self.new` methods that return `self.allocate`
2022-12-16 14:46:08 +01:00
Tom Hvitved
bfc257147c
Ruby: Fix bug in call-sensitivity logic for initialize calls
2022-12-16 11:17:15 +01:00
Tom Hvitved
e45edcc159
Merge pull request #11674 from hvitved/dataflow/param-context
...
Data flow: Track callable in flow-through pruning
2022-12-16 09:25:15 +01:00
Tom Hvitved
accf4ca364
Ruby: Recognize custom self.new methods that return self.allocate
2022-12-16 09:23:36 +01:00
Jami Cogswell
f01ee9e4c2
Java: remove PR-merging comment
2022-12-15 22:56:15 -05:00
Jami
fd63348549
Merge pull request #11585 from jcogs33/jcogs33/mad-metrics-query
...
Java: add MaD metrics query
2022-12-15 19:26:51 -05:00
Tom Hvitved
f8571dd0b6
Data flow: Work around functionality-induced misoptimization
2022-12-15 15:29:14 +01:00
Tom Hvitved
6eda042229
Data flow: Sync files
2022-12-15 15:29:13 +01:00
Tom Hvitved
adc738cb15
Data flow: Simplify reverse flow-through pruning
2022-12-15 15:29:12 +01:00
Tom Hvitved
d34901ac8c
Data flow: Track return position instead of return kind
...
Reverts bdb205a318
2022-12-15 15:29:12 +01:00
Tom Hvitved
1820bb4b0b
Data flow: Simplify forwards flow-through pruning
2022-12-15 15:29:11 +01:00
Tom Hvitved
cb84b557cf
Data flow: Track parameter instead of parameter position
...
Reverts 70d2a0df8a
2022-12-15 15:29:11 +01:00
