22029 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Rasmus Wriedt Larsen	770429fd68	Python: Autoformat	2021-05-18 14:02:46 +02:00
Rasmus Wriedt Larsen	9156316b14	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2021-05-18 11:53:11 +02:00
Rasmus Wriedt Larsen	0ade23ab2a	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2021-05-18 11:49:59 +02:00
Rasmus Wriedt Larsen	f9383a31bf	Python: Fix BrokenCryptoAlgorithm.qhelp	2021-04-22 15:58:28 +02:00
Rasmus Wriedt Larsen	222c087e8c	Python: Remove type-tracking performance workaround ... Since we shouldn't need it anymore (yay)	2021-04-22 15:31:49 +02:00
Rasmus Wriedt Larsen	b82209964a	Python: Add change-note for new weak crypto queries	2021-04-22 15:23:42 +02:00
Rasmus Wriedt Larsen	fc1a6d0e32	Python: Say salting is not part of py/weak-sensitive-data-hashing	2021-04-22 15:23:41 +02:00
Rasmus Wriedt Larsen	ac83c695ad	Python: Add py/weak-sensitive-data-hashing query	2021-04-22 15:23:41 +02:00
Rasmus Wriedt Larsen	499adc26a3	Python: Extend SensitiveDataSource tests ... Now it contains all the sort of things we actually support 👍	2021-04-22 15:23:40 +02:00
Rasmus Wriedt Larsen	794a86a6b0	Python: Add SensitiveDataSource	2021-04-22 15:23:39 +02:00
Rasmus Wriedt Larsen	56c409737d	Python: Port py/weak-cryptographic-algorithm ... The other query (py/weak-sensitive-data-hashing) is added in future commit	2021-04-22 15:23:38 +02:00
Rasmus Wriedt Larsen	59edd18c34	Python: Move framework test-files out of experimental ... This PR was rebased on newest main, but was written a long time ago when all the framework test-files were still in experimental. I have not re-written my local git-history, since there are MANY updates to those files (and I dare not risk it).	2021-04-22 15:23:37 +02:00
Rasmus Wriedt Larsen	1616975e06	Python: Model hashlib from standard library	2021-04-22 15:23:37 +02:00
Rasmus Wriedt Larsen	7ffbfa8043	Python: Expand stdlib md5 tests with keyword-arguments	2021-04-22 14:51:20 +02:00
Rasmus Wriedt Larsen	fa88f22453	Python: Model hashing operations in cryptography package	2021-04-22 14:51:20 +02:00
Rasmus Wriedt Larsen	c5f826580b	Python: Model encrypt/decrypt in cryptography package ... I introduced a InternalTypeTracking module, since the type-tracking code got so verbose, that it was impossible to get an overview of the relevant predicates. (this means the "first" type-tracking predicate that is usually private, cannot be marked private anymore, since it needs to be exposed in the private module.	2021-04-22 14:51:19 +02:00
Rasmus Wriedt Larsen	bf6f5074c2	Python: Port cryptodome tests to crypto ... I don't know if this is really a smart test-setup... I feel a bit stupid when doing this xD	2021-04-22 14:51:19 +02:00
Rasmus Wriedt Larsen	f8254381f3	Python: Add MISSING: CryptographicOperationAlgorithm annotations ... For RSA it's unclear what the algorithm name should even be. Signatures based on RSA private keys with PSS scheme is ok, but with pkcs#1 v1.5 they are weak/vulnerable. So clearly just putting RSA as the algorithm name is not enough information... and that problem is also why I wanted to do this commit separetely (to call extra atten to this).	2021-04-22 14:51:18 +02:00
Rasmus Wriedt Larsen	23140dfb76	Python: Add CryptographicOperation modeling for Cryptodome	2021-04-22 14:51:17 +02:00
Rasmus Wriedt Larsen	1b2ed9d99a	Python: Align cryptodome tests	2021-04-22 14:51:16 +02:00
Rasmus Wriedt Larsen	2c0df8e656	Python: Add MD5 tests	2021-04-22 14:51:16 +02:00
Rasmus Wriedt Larsen	a8de2aba3b	Python: Move CryptoAlgorithms implementation	2021-04-22 14:51:15 +02:00
Rasmus Wriedt Larsen	65c8d9605e	Python: Add CryptographicOperation Concept ... I considered using `getInput` like in JS, but things like signature verification has multiple inputs (message and signature). Using getAnInput also aligns better with Decoding/Encoding.	2021-04-22 14:51:14 +02:00
Rasmus Wriedt Larsen	d18fbb7f07	Python: Add working tests of AES and RC4	2021-04-22 14:51:14 +02:00
Rasmus Wriedt Larsen	cf64701bcb	Python: Move weak-crypto-algorithm tests to own folder	2021-04-22 14:51:13 +02:00
Mathias Vorreiter Pedersen	2b8afe55e8	Merge pull request #5747 from rdmarsh2/rdmarsh2/cpp/deprecate-return-stack-allocated-object ... C++: deprecate cpp/return-stack-allocated-object	2021-04-22 11:37:07 +02:00
Owen Mansel-Chan	fea9f5f431	Merge pull request #5746 from owen-mc/java/refactor-exec-tainted ... Make ExecTainted easier to extend	2021-04-22 10:14:28 +01:00
Owen Mansel-Chan	8a01799fb8	Make imports private ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2021-04-22 09:46:49 +01:00
Owen Mansel-Chan	4b8d4f5bbd	Update docs	2021-04-22 09:30:50 +01:00
Owen Mansel-Chan	e448dcb725	Avoid bad join order ... We want to avoid joining on `i` first.	2021-04-22 09:30:49 +01:00
Owen Mansel-Chan	9f1704560b	Include constructors in abstract class	2021-04-22 09:30:48 +01:00
Tamás Vajk	a7cc9f98ef	Merge pull request #5745 from tamasvajk/feature/fix-arg-default ... C#: Fix special case of default argument value extraction	2021-04-22 08:58:13 +02:00
Robert Marsh	cac1bef6ea	C++: deprecate cpp/return-stack-allocated-object	2021-04-21 15:17:31 -07:00
Chris Smowton	94f0a1532d	Merge pull request #5682 from smowton/smowton/docs/fix-has-modifier-comment ... Fix documentation of Modifier.qll	2021-04-21 15:41:29 +01:00
Tamas Vajk	a0f5e45ae9	C#: Fix special case of default argument value extraction	2021-04-21 16:34:29 +02:00
Geoffrey White	ba335089c4	Merge pull request #5601 from ihsinme/ihsinme-patch-259 ... CPP: Add query for CWE-691 Insufficient Control Flow Management After Refactoring The Code	2021-04-21 15:13:38 +01:00
Owen Mansel-Chan	9c72e73a82	Make ExecTainted easier to extend ... To add a method that executes a command, you can now define a class extending ExecMethod.	2021-04-21 14:55:37 +01:00
CodeQL CI	30d7f0dc98	Merge pull request #5687 from RasmusWL/inline-taint-tests ... Approved by yoff	2021-04-21 06:24:12 -07:00
yoff	a19373ab54	Merge pull request #5727 from tausbn/python-use-localsource-in-stepsummary ... Python: Use `LocalSourceNode` in `StepSummary::step`	2021-04-21 13:50:31 +02:00
Tamás Vajk	205469316c	Merge pull request #5738 from tamasvajk/feature/loc ... C# Add line of code metric query	2021-04-21 13:49:32 +02:00
Tamas Vajk	2a6f979ce6	C# Add line of code metric query	2021-04-21 10:42:06 +02:00
Anders Schack-Mulligen	9362ae0687	Merge pull request #5422 from tamasvajk/feature/sink-migration-ldap ... Java: Migrate LDAP injection sinks to CSV format	2021-04-21 10:05:28 +02:00
Rasmus Wriedt Larsen	63a2657aef	Merge branch 'main' into inline-taint-tests	2021-04-21 10:02:55 +02:00
Tom Hvitved	7080b256fb	Merge pull request #5715 from hvitved/csharp/ssa/perf-tweaks ... C#: A few minor SSA performance tweaks	2021-04-21 09:59:12 +02:00
Tom Hvitved	def62e8c22	Merge pull request #5718 from hvitved/csharp/hardcoded-cred-remove-cp ... C#: Remove CP from `HardcodedCredentials::getCredentialSink`	2021-04-21 09:58:56 +02:00
Tom Hvitved	1ed11b297b	Merge pull request #5725 from hvitved/csharp/dataflow/performance ... C#: Various data-flow performance tweaks	2021-04-21 09:46:15 +02:00
yoff	ef0ea247c4	Merge pull request #5679 from tausbn/python-fix-bad-points-to-joins ... Python: Fix bad points-to joins	2021-04-20 21:19:32 +02:00
Tom Hvitved	3eba5b0aac	Merge pull request #5676 from hvitved/csharp/dispatch/get-a-viable-overrider-perf ... C#: Speedup `DispatchMethodOrAccessorCall::getAViableOverrider()`	2021-04-20 19:57:59 +02:00
yo-h	00137f2905	Merge pull request #5721 from github/yo-h/java-diagnostic-queries ... Java: add extractor `diagnostic` queries	2021-04-20 13:36:49 -04:00
Taus	890f96d9b5	Python: Prevent bad joins in TypeBackTracker ... Perhaps unsurprisingly, the join orderer was eager and willing to find the wrong join order in this predicate as well. Applying a similar fix to the one used in `TypeTracker::step` fixes the problem.	2021-04-20 15:01:04 +00:00