Henry Mercer
84907f91f1
JS: Fix copy/paste error in XSS ML-powered queries results patterns
...
We didn’t catch this because our unit tests test only library code due
to the previous difficulty of running queries with an ML model (the ML
models in packs work should fix that), and because the end-to-end
evaluation runs separate queries that have different result patterns.
Going forward we should create unit tests for the queries themselves,
which will require using the ML model in tests. We should also be able
to catch this type of error using DCA.
2022-01-21 15:17:52 +00:00
Erik Krogh Kristensen
a235f8f023
remove redundant inline type casts
2022-01-21 11:46:33 +01:00
Erik Krogh Kristensen
f500bccbe4
add explicit this to member call
2022-01-21 11:46:33 +01:00
CodeQL CI
b02f1c87a1
Merge pull request #7679 from erik-krogh/ql-doc-style
...
Approved by esbena
2022-01-20 23:43:44 -08:00
CodeQL CI
2287b6e549
Merge pull request #7675 from erik-krogh/move-url-sink-to-customizations
...
Approved by esbena
2022-01-20 23:43:15 -08:00
Erik Krogh Kristensen
15c1ce722a
Merge pull request #7678 from erik-krogh/use-set
...
JS: use more set literals
2022-01-20 21:03:48 +01:00
Erik Krogh Kristensen
2bffe56580
update expected output
2022-01-20 16:06:57 +01:00
Erik Krogh Kristensen
3155114e36
use more set literals
2022-01-20 16:06:34 +01:00
Erik Krogh Kristensen
a77b2b0209
Merge pull request #7668 from erik-krogh/simplify-casts
...
simplify expressions that could be type-casts
2022-01-20 15:20:18 +01:00
Erik Krogh Kristensen
5780161b2c
fix most issues found by ql/class-doc-style in JS
2022-01-20 15:10:16 +01:00
Erik Krogh Kristensen
7167e856fe
move electron sink to the customizations file
2022-01-20 14:07:23 +01:00
CodeQL CI
cfa670c123
Merge pull request #7651 from erik-krogh/CWE-471
...
Approved by asgerf, esbena
2022-01-20 01:47:39 -08:00
Erik Krogh Kristensen
4e8e3a7420
simplify expressions that could be type-casts
2022-01-20 10:41:35 +01:00
Henry Mercer
c134e6c9ef
JS: Bump ML-powered query packs to v0.0.6
2022-01-19 14:40:42 +00:00
Erik Krogh Kristensen
cb9e14f544
add cwe-471 to js/prototype-pollution
2022-01-19 14:54:57 +01:00
Erik Krogh Kristensen
e4203a4109
add CWE-471 to the prototype-pollution queries
2022-01-19 14:26:34 +01:00
Henry Mercer
d467725ccd
JS: Bump ML-powered query packs to v0.0.5
2022-01-19 12:08:33 +00:00
Henry Mercer
63672ca394
Merge pull request #7616 from github/henrymercer/js-atm-add-query-help
...
JS: Add query help for ML-powered queries
2022-01-18 18:11:53 +00:00
Henry Mercer
be0c26f83d
Merge pull request #7617 from github/henrymercer/js-atm-update-alert-messages
...
JS: Update alert messages for ML-powered queries
2022-01-18 11:37:02 +00:00
Henry Mercer
1893b9f7a9
Merge pull request #7376 from github/henrymercer/js-atm-absent-features-optimization
...
JS: Update featurization for absent features optimization
2022-01-18 10:15:53 +00:00
Henry Mercer
ffa4135cbe
JS: Update alert messages for ML-powered queries
2022-01-17 17:19:49 +00:00
Henry Mercer
e9128466d4
JS: Add query help for ML-powered queries
...
Query help is identical to the original query, except for a new
paragraph prepended to the overview explaining that the queries are
experimental.
We add Markdown query help since only Markdown query help is embedded in
SARIF via `--sarif-add-query-help`.
2022-01-17 16:34:50 +00:00
Henry Mercer
568d37e9b9
JS: Update definition of ATM query suite
...
It's simpler to just run all the queries in the pack instead of
specifying the IDs.
2022-01-17 16:34:50 +00:00
Andrew Eisenberg
fbb5d7196f
Merge branch 'main' into post-release-prep/codeql-cli-2.7.5
2022-01-14 08:23:43 -08:00
Ian Lynagh
bba8e45e74
Merge pull request #7602 from igfoo/igfoo/typos
...
Fix a couple of typos: clases / clasess
2022-01-14 15:56:04 +00:00
Henry Mercer
ed28b7f174
Merge pull request #7575 from github/henrymercer/atm-remove-code-to-features
...
JS: Remove ATM `CodeToFeatures` library
2022-01-14 15:31:34 +00:00
Ian Lynagh
22dc24629f
Fix a couple of typos: clases / clasess
2022-01-14 14:28:29 +00:00
Henry Mercer
d55e6d1ca7
Merge pull request #7594 from github/henrymercer/js-atm-rename-queries
...
JS: Update names, IDs, and tags for ML-powered queries
2022-01-14 10:28:24 +00:00
Edoardo Pirovano
f2818ebb5e
Merge pull request #7489 from edoardopirovano/fix-example
...
Fix example in JavaScript query
2022-01-14 08:58:28 +00:00
Henry Mercer
e9bb9f5294
JS: Update names, IDs, and tags for ML-powered queries
2022-01-13 17:45:40 +00:00
Henry Mercer
8e9d8c112d
JS: Improve comments in FunctionBodyFeatures.qll
2022-01-13 17:20:42 +00:00
Henry Mercer
2aea3257cb
JS: Improve documentation for getTokenizedAstNode
2022-01-13 17:20:41 +00:00
Andrew Eisenberg
4ffd8c62ac
Merge pull request #7579 from github/aeisenberg/changenote-upgrades-removal
...
Changenotes: Add changenotes for upgrades refactoring
2022-01-13 09:09:06 -08:00
Henry Mercer
92d6fecc73
Optimize performance of body tokens
...
The refactoring to remove the `CodeToFeatures` AST reintroduced a
performance problem. This commit resolves it by pushing size
restrictions into intermediate predicates.
2022-01-13 16:29:04 +00:00
Stephan Brandauer
40ad88ba53
Merge pull request #7474 from kaeluka/db-reads-as-taint-sources
...
JS: DB reads as taint sources
2022-01-13 12:06:48 +01:00
Erik Krogh Kristensen
89bab6ae12
Merge pull request #7097 from erik-krogh/railsReDoS
...
JS/PY/RB: support a limited number of ranges for ReDoS analysis
2022-01-13 11:04:36 +01:00
Stephan Brandauer
93507a2d71
combine two implementations for database-accesses as remote flow sources
2022-01-13 10:53:58 +01:00
Stephan Brandauer
63aaf24063
base implementation of Sequelize model on models-as-data
2022-01-13 09:41:25 +01:00
Andrew Eisenberg
e435a3e9c3
Changenotes: Add changenotes for upgrades refactoring
2022-01-12 11:36:31 -08:00
Stephan Brandauer
09a28c428c
base implementation of Spanner model on models-as-data
2022-01-12 17:07:16 +01:00
Henry Mercer
9abc3411a4
JS: Bump ATM pack versions to 0.0.4
2022-01-12 15:19:13 +00:00
github-actions[bot]
8a2d92badc
Post-release preparation for codeql-cli-2.7.5
2022-01-12 13:28:43 +00:00
Henry Mercer
7f61738a23
Use US English spelling
2022-01-12 13:07:09 +00:00
Henry Mercer
6e37a65e84
Remove CodeToFeatures AST library
2022-01-12 12:47:28 +00:00
Henry Mercer
957e34d8a7
Make function body features library independent of CodeToFeatures AST
2022-01-12 12:47:28 +00:00
Henry Mercer
9e50ce873d
Move function body features into their own file
2022-01-12 12:47:28 +00:00
Henry Mercer
865fb5d0ef
Migrate representative entity -> representative function
2022-01-12 12:47:27 +00:00
Henry Mercer
0e5b493d0e
Remove CodeToFeatures AST consistency checks
...
We no longer use the `CodeToFeatures` AST, therefore these checks are
defunct.
2022-01-12 12:47:27 +00:00
Henry Mercer
387829bbb4
Extract body tokens from the JS AST, not the CodeToFeatures AST
2022-01-12 12:47:25 +00:00
Henry Mercer
3ef69763a7
Merge pull request #7567 from github/henrymercer/atm-body-tokens-perf-opt
...
ATM: Optimize body tokens by pushing in size restriction
2022-01-12 12:45:27 +00:00
