Rasmus Wriedt Larsen
68f526da1f
Python: Add change-note
2021-06-16 20:09:05 +02:00
Rasmus Wriedt Larsen
498703fc81
Python: Escaping only valid with both input/output defined
...
Problematic part is
```codeql
/** A escape from string format with `markupsafe.Markup` as the format string. */
private class MarkupEscapeFromStringFormat extends MarkupSafeEscape, Markup::StringFormat {
override DataFlow::Node getAnInput() {
result in [this.getArg(_), this.getArgByName(_)] and
not result = Markup::instance()
}
override DataFlow::Node getOutput() { result = this }
}
```
since the char-pred still holds even if `getAnInput` has no results...
I will say that doing it this way feels kinda dirty, and we _could_ fix
this by including the logic in `getAnInput` in the char-pred as well.
But as I see it, that would just lead to a lot of code duplication,
which isn't very nice.
2021-06-16 19:09:00 +02:00
Rasmus Wriedt Larsen
6539df6422
Python: Add ConceptsTest for MarkupSafe
2021-06-16 19:09:00 +02:00
Rasmus Wriedt Larsen
14de3bffb7
Python: Model MarkupSafe PyPI package
...
Since expectation tests had so many changes from ConceptsTest, I'm going
to do the changes for that on in a separate commit. The important part
is the changes to taint-tracking, which is highlighted in this commit.
2021-06-16 19:09:00 +02:00
Rasmus Wriedt Larsen
e1c4b8ca42
Python: Add helper predicates to Escaping kinds
...
The other approach felt a bit too much like specifying magic strings
that you had to get right. (crossing your fingers that no-one writes
`HTML` instead of `html`)
2021-06-16 19:09:00 +02:00
Rasmus Wriedt Larsen
bcef8d19e6
Python: Add Escaping concept
2021-06-16 19:09:00 +02:00
Rasmus Wriedt Larsen
d18b9a2704
Python: Add markupsafe tests
2021-06-16 19:09:00 +02:00
Anders Schack-Mulligen
19305a217a
Merge pull request #5374 from joefarebrother/guava-base
...
Java: Model additional flow steps for the package `com.google.common.base` of the Guava framwork.
2021-06-15 10:58:48 +02:00
Tom Hvitved
501ba4bd8a
Merge pull request #6012 from hvitved/csharp/early-labels
...
C#: Populate labels earlier
2021-06-15 10:28:23 +02:00
Cornelius Riemenschneider
0ebf53b9df
Merge pull request #6073 from geoffw0/loc
...
C++: Add lines of user code query
2021-06-15 09:18:46 +02:00
Shati Patel
cce8eac0a7
Merge pull request #5946 from shati-patel/vscode-custom-logs
...
Docs: Describe custom log directory setting in VS Code extension
2021-06-14 20:30:54 +01:00
Aditya Sharad
75ed7c0568
Merge pull request #6014 from github/docs-4179-legacy-tools
...
Remove docs about legacy tools
2021-06-14 11:50:18 -07:00
Taus
c6c9a5110a
Merge pull request #6063 from tausbn/python-promote-type-tracking-library
...
Python: Promote shared type tracking library
2021-06-14 18:56:03 +02:00
Geoffrey White
d7db18213d
C++: Add a generated file to the test.
2021-06-14 16:21:30 +01:00
Geoffrey White
1e1ae27974
C++: Test the new query.
2021-06-14 16:06:20 +01:00
Geoffrey White
e71264d1d2
C++: Lines of user code query.
2021-06-14 16:03:16 +01:00
Tom Hvitved
6b63e032a9
C#: Populate labels earlier
2021-06-14 15:17:33 +02:00
Joe Farebrother
36cb207600
Increase precision of tests to test value flow
2021-06-14 11:20:07 +01:00
CodeQL CI
02c017afec
Merge pull request #6058 from RasmusWL/more-aiohttp
...
Approved by yoff
2021-06-14 02:56:59 -07:00
Felicity Chapman
60b4669813
Remove sentence about legacy tools
2021-06-14 08:41:28 +01:00
Taus
8016715fb6
Python: Add missing QLDoc
2021-06-11 20:35:58 +00:00
Taus
3869ab76d1
Python: Promote shared type tracking library
...
This was slightly messier than anticipated, as I hadn't accounted for
the dozen uses of `startInAttr` in our codebase. To circumvent this,
I decided to put the type tracking implementation in the `internal`
directory, and wrap it with a file that ensures the old interface still
works.
2021-06-11 20:20:22 +00:00
Jonas Jensen
e23b88b7f1
Merge pull request #6052 from jsinglet/jsinglet/stdtypes
...
Implementation of standard C/C++ fixed width, minimum width, and maximum width types
2021-06-11 17:03:01 +02:00
Calum Grant
85467adc5e
Merge pull request #5839 from github/security-severities5
...
Add security-severity scores
2021-06-11 15:56:20 +01:00
John L. Singleton
8c6c011be2
Formatting fixes, comment moving.
2021-06-11 10:17:05 -04:00
Joe Farebrother
678597f3f9
Update CSV rows for collection flow
2021-06-11 15:08:27 +01:00
John L. Singleton
9c946a79c7
Update cpp/change-notes/2021-06-10-std-types.md
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2021-06-11 09:49:44 -04:00
Rasmus Wriedt Larsen
53f7633662
Python: Model await request.post() as MultiDictProxy
...
as highlight as being quite easy to do by @yoff 👍
2021-06-11 14:53:30 +02:00
Chris Smowton
76838809bb
Merge pull request #5818 from artem-smotrakov/rmi-deserialization
...
Java: Unsafe RMI deserialization
2021-06-11 13:43:07 +01:00
yoff
97486b448a
Merge pull request #5999 from RasmusWL/aiohttp-modeling
...
Python: Add aiohttp.web modeling
2021-06-11 14:26:52 +02:00
Anders Schack-Mulligen
f24565738b
Merge pull request #6029 from atorralba/atorralba/tainted-key-read-steps
...
Java: Add Map key-read-steps as local additional taint steps
2021-06-11 13:14:18 +02:00
Joe Farebrother
dc19d1db35
Add change note
2021-06-11 11:41:30 +01:00
Joe Farebrother
04ffe80366
Add unit tests
2021-06-11 11:41:27 +01:00
Joe Farebrother
153e0c4ac3
Add modelling for more com.google.common.base methods
2021-06-11 11:40:37 +01:00
Rasmus Wriedt Larsen
df67028a1d
Python: Model aiohttp.StreamReader
2021-06-11 12:06:53 +02:00
Tony Torralba
c828c7031f
Add change note
2021-06-11 12:04:11 +02:00
Rasmus Wriedt Larsen
2d31ef7016
Python: Fix last TODOs in aiohttp tests
2021-06-11 12:00:02 +02:00
Rasmus Wriedt Larsen
64a0e3fd0a
Merge branch 'main' into aiohttp-modeling
2021-06-11 11:42:24 +02:00
Rasmus Wriedt Larsen
8b8e1334cc
Python: Fix syntax error
2021-06-11 11:42:14 +02:00
Rasmus Wriedt Larsen
46f7a2b572
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2021-06-11 11:28:11 +02:00
John L. Singleton
cd61fb4753
this should be abstract
2021-06-10 19:54:58 -04:00
John L. Singleton
219dc71ae6
changlog entry
2021-06-10 17:15:06 -04:00
John L. Singleton
2a01324172
more maintainable pattern for class abstractions
2021-06-10 17:09:32 -04:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
John L. Singleton
bd7c416356
comment change
2021-06-10 11:21:11 -04:00
John L. Singleton
0d3f53b013
Changes to structure per feedback of @jbj
2021-06-10 11:16:58 -04:00
Taus
e7b9603c5b
Merge pull request #6053 from RasmusWL/fix-tests
...
Python: Fix tests
2021-06-10 16:55:45 +02:00
Rasmus Wriedt Larsen
dd457f9641
Python: Fix tests
2021-06-10 15:58:56 +02:00
John L. Singleton
f174d7a0e0
Comment changes
2021-06-10 09:52:22 -04:00
John L. Singleton
14c419a75f
autoformatting
2021-06-10 09:39:43 -04:00
