Asger Feldthaus
6a63f5b677
JS: Avoid bad join order in ImplicitProcessImport
2020-05-18 22:29:32 +01:00
Asger Feldthaus
c869812563
JS: Add UselessConditional test
2020-05-18 22:29:32 +01:00
semmle-qlci
192bf918c3
Merge pull request #3488 from asger-semmle/js/sql-type-tracking
...
Approved by erik-krogh
2020-05-18 19:57:32 +01:00
Asger F
96d6115452
Merge branch 'master' into js/sql-type-tracking
2020-05-18 15:58:42 +01:00
semmle-qlci
0da1e68462
Merge pull request #3498 from max-schaefer/js/remote-exec
...
Approved by esbena
2020-05-18 14:17:20 +01:00
Asger F
a9983fdb49
Update javascript/ql/src/semmle/javascript/frameworks/SQL.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2020-05-18 13:23:22 +01:00
Max Schaefer
bdd778f989
JavaScript: Add change note.
2020-05-18 12:08:36 +01:00
Max Schaefer
6797fec1a3
JavaScript: Add more models of packages that execute commands over SSH.
2020-05-18 12:08:14 +01:00
semmle-qlci
14664be467
Merge pull request #3468 from p0/imp/nodejs-vm-sinks
...
Approved by esbena
2020-05-18 11:10:13 +01:00
Asger Feldthaus
a18e0b37cf
JS: simplify sequelize model
2020-05-18 09:34:17 +01:00
Asger F
f52c827966
Apply suggestions from code review
...
Base type of EscapingSanitizer
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2020-05-18 09:31:09 +01:00
Asger F
ffb22c061a
Apply suggestions from code review
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2020-05-18 09:28:22 +01:00
semmle-qlci
6041d52936
Merge pull request #3424 from asger-semmle/js/express-param-handler
...
Approved by esbena
2020-05-18 08:48:24 +01:00
semmle-qlci
135eae9895
Merge pull request #3483 from esbena/js/fix-qhelp-FNs
...
Approved by asgerf
2020-05-18 08:47:05 +01:00
semmle-qlci
0230b79efc
Merge pull request #3391 from erik-krogh/SplitFPs
...
Approved by esbena
2020-05-18 08:46:26 +01:00
semmle-qlci
8d41ce1630
Merge pull request #3480 from erik-krogh/moreSlip
...
Approved by esbena
2020-05-16 21:17:27 +01:00
Mathias Vorreiter Pedersen
a42d80aa14
Merge pull request #3481 from dbartol/github/codeql-c-analysis-team/69
...
C++/C#: Allow memory operands to lack a definition
2020-05-16 11:53:00 +02:00
Asger Feldthaus
897a3e39c9
JS: Autoformat
2020-05-16 09:37:16 +01:00
Asger Feldthaus
0171c9e10c
JS: Autoformat
2020-05-16 09:25:18 +01:00
Asger Feldthaus
d279845a43
JS: Minor fixes
2020-05-16 09:24:53 +01:00
yo-h
4f00e40257
Merge pull request #3474 from aschackmull/java/string-formatted
...
Java: Add taint steps for String.formatted.
2020-05-15 22:04:36 -04:00
yo-h
69ab158910
Merge pull request #3473 from aschackmull/java/switchexpr
...
Java: Extend library support for switch expressions.
2020-05-15 20:46:37 -04:00
Dave Bartolomeo
96c87b309b
C++/C#: Use unique to get a better join order
...
The previous changes made the optimizer choose a bad join order for the RHS of the antijoin in `addressOperandAllocationAndOffset`. Once again, `unique` to the rescue.
2020-05-15 17:36:43 -04:00
Asger Feldthaus
435f9ea09f
JS: Change note
2020-05-15 17:27:30 +01:00
Asger Feldthaus
5249e84359
JS: Type track spanner model
2020-05-15 17:27:30 +01:00
Asger Feldthaus
d225715828
JS: Type track mssql model
2020-05-15 17:27:30 +01:00
Asger Feldthaus
6dcee5a0ef
JS: Type track sqlite model
2020-05-15 17:27:30 +01:00
Asger Feldthaus
84cd02cf01
JS: Type track pg model
2020-05-15 17:27:27 +01:00
Asger Feldthaus
f7771f17d1
JS: Type track mysql model
2020-05-15 17:27:27 +01:00
Asger Feldthaus
3e9849b7c4
JS: Type track sequelize model
2020-05-15 17:27:24 +01:00
Jonas Jensen
b08de6c051
Merge pull request #3482 from MathiasVP/getlim-taint-source
...
C++: Add GetDelim as taint step
2020-05-15 15:54:29 +02:00
Calum Grant
5787871734
Merge pull request #3351 from hvitved/csharp/unification-nested-types
...
C#: Teach unification library about nested types
2020-05-15 14:11:00 +01:00
Calum Grant
cc844648ff
Merge pull request #3365 from hvitved/csharp/format-queries-path-problem
...
C#: Convert `string.format()` queries to path queries
2020-05-15 14:08:54 +01:00
Rasmus Wriedt Larsen
061f318576
Merge pull request #3460 from yoff/boolDefault
...
Python: __bool__ does not raise TypeError by default
2020-05-15 15:07:45 +02:00
Dave Bartolomeo
89ec60c948
C++/C#: Add missing QLDoc
2020-05-15 09:01:16 -04:00
Dave Bartolomeo
bcddaf4c29
C++/C#: Fix formatting
2020-05-15 08:56:32 -04:00
Mathias Vorreiter Pedersen
7502c6f821
Set mustWrite to false in response to PR feedback
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2020-05-15 14:32:46 +02:00
Asger Feldthaus
e311cc7689
JS: Change note
2020-05-15 13:06:37 +01:00
Rasmus Lerchedahl Petersen
60d5ba23b3
Python: Move test into appropriate class.
...
Also update test expectations with changed line numbers.
2020-05-15 13:51:51 +02:00
Rasmus Lerchedahl Petersen
1b0687e2f2
Python: update expectations correctly
2020-05-15 13:25:20 +02:00
Esben Sparre Andreasen
1c5bffc095
JS: fix some FNs in the qhelp examples
2020-05-15 12:40:38 +02:00
Jonas Jensen
8a0af0bcac
Merge pull request #3465 from MathiasVP/remove-abstract-from-access-and-cast
...
C++: Remove abstract keyword from `Access` and `Cast` classes
2020-05-15 12:25:34 +02:00
Mathias Vorreiter Pedersen
866b1361ec
C++: Accept tests
2020-05-15 11:12:47 +02:00
Mathias Vorreiter Pedersen
e70f22c753
C++: Model getdelim and friends
2020-05-15 11:05:57 +02:00
Mathias Vorreiter Pedersen
90d473d886
C++: Demonstrate lack of taint through getdelim
2020-05-15 11:01:27 +02:00
Asger Feldthaus
d84f1b47c2
JS: Refactor RequestInputAccess to use source nodes
2020-05-15 09:59:28 +01:00
Asger Feldthaus
da974f1527
JS: Add test with dynamic access to req.query
2020-05-15 09:59:28 +01:00
Asger Feldthaus
659e2ff709
JS: Tweak evaluation of route handler params
2020-05-15 09:59:27 +01:00
Asger F
b9995b784d
Update javascript/ql/src/semmle/javascript/frameworks/ConnectExpressShared.qll
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2020-05-15 09:59:27 +01:00
Asger Feldthaus
a982cdc39c
JS: Autoformat
2020-05-15 09:59:27 +01:00
