46012 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Jeroen Ketema	80ef3b39ff	Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow	2022-10-31 18:26:34 +01:00
Jeroen Ketema	222c9a6357	Merge pull request #11048 from jketema/add-constant-test ... C++: Add `strcpy` test for `cpp/non-constant-format`	2022-10-31 18:01:13 +01:00
Jeroen Ketema	b43cbf7f95	Update cpp/ql/test/query-tests/Likely Bugs/Format/NonConstantFormat/test.cpp ... Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>	2022-10-31 17:03:29 +01:00
Jeroen Ketema	abe9258943	C++: Add strcpy test for cpp/non-constant-format	2022-10-31 15:29:17 +01:00
Jeroen Ketema	83afc2a0ad	C++: Add strcpy prototype to test	2022-10-31 15:25:35 +01:00
Ian Lynagh	21600c612d	Merge pull request #11037 from igfoo/igfoo/log ... Kotlin: Integration tests: Allow \ as a path separator in logs test	2022-10-31 14:03:57 +00:00
Tamás Vajk	e356720c73	Merge pull request #11014 from tamasvajk/kotlin-for-loop-var ... Kotlin: Resugar `for` loops	2022-10-31 14:48:21 +01:00
Chris Smowton	d959630991	Merge pull request #11040 from smowton/smowton/fix/inherited-method-implementing-collection-interface ... Kotlin: fix method types when an inherited method implements a collection type	2022-10-31 12:40:28 +00:00
Ian Lynagh	a53c2104d1	Kotlin: Integration tests: Allow \ as a path separator in logs test	2022-10-31 11:24:39 +00:00
Chris Smowton	c11d63e4d2	Merge pull request #11015 from smowton/smowton/fix/go-cleartext-logging-exclude-protobuf-getters ... Go: exclude protobuf read steps from cleartext-logging query	2022-10-31 10:43:52 +00:00
Geoffrey White	c161bb5e95	Merge pull request #11035 from geoffw0/simplify2 ... Swift: Simplify some more QL	2022-10-31 09:50:55 +00:00
Rasmus Wriedt Larsen	ead0844174	Merge pull request #10998 from RasmusWL/essa-use-use-test ... Python: Add failing ESSA use-use test	2022-10-31 10:38:26 +01:00
Tamas Vajk	4cd0f1ca66	Apply code review findings	2022-10-31 08:43:53 +01:00
Harry Maclean	3f403f0f87	Merge pull request #10700 from hmac/activesupport ... Ruby: Model some ActiveSupport methods	2022-10-31 11:50:44 +13:00
Chris Smowton	b370497f96	Avoid split overrides	2022-10-29 18:23:45 +01:00
Chris Smowton	3573e211cc	Correct test expectations	2022-10-29 11:40:58 +01:00
Chris Smowton	b6e4f472d1	Remove unnecessary import	2022-10-29 11:40:57 +01:00
Chris Smowton	6d321e0151	Add change note	2022-10-29 11:40:57 +01:00
Chris Smowton	5c66d87ed6	gofmt	2022-10-29 11:40:57 +01:00
Chris Smowton	0c6c135967	Go: exclude protobuf read steps from cleartext-logging query ... This query already treats structs differently to usual: it includes field -> whole struct taint steps, but explicitly excludes struct -> field steps. This means that a logging framework sinking an entire struct with a tainted field yields an alert, but we don't get FPs caused by writing field `x` but then reading field `y`. However, protobuf messages have a special treatment, with taint usually associated with the whole struct and getter methods propagating that taint out. Suppressing these getter method steps specifically for the cleartext-logging query mirrors its treatment of structs in general and avoids this sort of field-mismatch FP. On the downside we will miss same-field propagation like `m.field = password; Log(m.GetField())` if we don't have source code for the implementation of `m`. However this is hopefully unusual since the typical use of protobufs is to serialize and deserialize, rather than using the struct as a general-purpose datastructure.	2022-10-29 11:40:57 +01:00
Chris Smowton	8266a22332	Kotlin: fix method types when an inherited method implements a collection type ... In this circumstance the compiler seems to generate a specialised version of the implementing function with its argument type replaced by the interface-implementing child class' type parameter. However it stores a back-pointer to the real declared function, which we should use as the call target.	2022-10-29 11:29:04 +01:00
Dave Bartolomeo	85790fcade	Merge pull request #10964 from smowton/smowton/admin/modernise-qlpacks ... qlpacks: libraryPathDependencies -> dependencies	2022-10-28 16:44:22 -04:00
Mathias Vorreiter Pedersen	18d3801c92	Merge pull request #11033 from MathiasVP/exclude-void-calls ... C++: Don't create `DataFlow::Node`s for `void`-typed instructions	2022-10-28 20:46:33 +02:00
Chris Smowton	d9744c81b7	Merge pull request #11017 from smowton/smowton/fix/kotlin-wildcard-suppression-annotation ... Kotlin: fix wildcard suppression where the annotation applies to a parent type/argument.	2022-10-28 18:33:07 +01:00
Ian Lynagh	84427e132e	Kotlin: Move the logs test to all-platforms	2022-10-28 17:56:41 +01:00
Geoffrey White	f122005aaf	Swift: Simplify out some variables.	2022-10-28 17:26:17 +01:00
Geoffrey White	b4d939a620	Swift: Correct a comment.	2022-10-28 17:11:24 +01:00
Chris Smowton	f9e811bddf	Legacy support qlpacks: continue using libraryPathDependencies; add a comment noting this is obsolete.	2022-10-28 16:47:30 +01:00
Chris Smowton	1914a114a2	Merge pull request #11018 from smowton/smowton/fix/kotlin-extension-specialisation ... Kotlin: specialise extension receivers the same as other function parameters	2022-10-28 16:15:41 +01:00
Chris Smowton	d6e2f5f4a8	Use ?.not() to negate a nullable boolean	2022-10-28 16:13:55 +01:00
Chris Smowton	1e1c9f639c	Avoid Kotlin 1.5+ function firstNotNullOfOrNull	2022-10-28 16:13:55 +01:00
Chris Smowton	24f87ac963	Kotlin: fix wildcard suppression where the annotation applies to a parent type/argument. ... In the process I also fix the missed case where suppression can be switched off using a parameterized annotation.	2022-10-28 16:13:55 +01:00
Ian Lynagh	2796d60d79	Merge pull request #11019 from igfoo/igfoo/win_integ ... Kotlin: Get some integration tests running on Windows	2022-10-28 16:12:15 +01:00
Chris Smowton	5ad5cdce47	Swift integration-test runner: use --additional-packs	2022-10-28 16:07:38 +01:00
Chris Smowton	ee63e60bb7	qlpacks: libraryPathDependencies -> dependencies	2022-10-28 16:07:36 +01:00
Geoffrey White	648c2d09f9	Swift: Simplify InsecureTLS.ql.	2022-10-28 15:56:03 +01:00
Rasmus Wriedt Larsen	a04c78ab94	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2022-10-28 15:31:42 +02:00
Ian Lynagh	49425e6c2a	Kotlin: Integration tests: Make a couple more posix-only for now	2022-10-28 13:59:36 +01:00
Tamas Vajk	d745381ebe	Remove unneeded consistency test output	2022-10-28 14:56:25 +02:00
Tamas Vajk	803a97df7f	Kotlin: Resugar for loops with tuples as loop variables	2022-10-28 14:55:50 +02:00
Tamas Vajk	841340b266	Kotlin: Resugar for loops	2022-10-28 14:55:50 +02:00
Tamas Vajk	1e3060598f	Kotlin: Add for loop tests	2022-10-28 14:55:50 +02:00
Mathias Vorreiter Pedersen	f3be58e2ba	C++: Accept more test changes.	2022-10-28 14:53:24 +02:00
Mathias Vorreiter Pedersen	20b188ff42	Merge pull request #11020 from rdmarsh2/rdmarsh2/repair-365-days-per-year ... C++: repair Adding365DaysPerYear.ql	2022-10-28 14:35:05 +02:00
Mathias Vorreiter Pedersen	f6ff9c9c66	Update cpp/ql/src/Likely Bugs/Leap Year/LeapYear.qll ... Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>	2022-10-28 14:32:08 +02:00
Tamás Vajk	caf9ac50d9	Merge pull request #11026 from tamasvajk/kotlin-remove-kotlin-java-eq-test ... Kotlin: Remove `javaEquivalent` consistency query	2022-10-28 14:08:53 +02:00
Chris Smowton	366410ee9e	Fix incorrect parameter ordering	2022-10-28 12:58:23 +01:00
Mathias Vorreiter Pedersen	0a3d0c4f56	Merge pull request #11031 from geoffw0/simplify ... Swift: Simplify queries using MethodDecl.hasQualifiedName	2022-10-28 13:58:08 +02:00
Mathias Vorreiter Pedersen	9888de8acb	Merge branch 'replace-ast-with-ir-use-usedataflow' into rdmarsh2/repair-365-days-per-year	2022-10-28 13:48:12 +02:00
Mathias Vorreiter Pedersen	42e8ec32d7	Merge pull request #11030 from MathiasVP/fix-ql-for-ql-errors ... C++: Fix QL-for-QL in #10817	2022-10-28 13:39:50 +02:00