9176 Commits

Author	SHA1	Message	Date
Mathias Vorreiter Pedersen	84a61d1e02	C++: No need for 'matches'.	2023-03-09 15:36:26 +00:00
Mathias Vorreiter Pedersen	2931e5dea8	C++: Reduce duplication by blocking flow into sources (since we'll already be considering flow starting at those sources) and out of sinks (since we'll already be alerting on this sink if it's relevant).	2023-03-09 14:59:13 +00:00
Mathias Vorreiter Pedersen	03ba7ea851	C++: Move the weird global property 'not sqlite_encryption_used()' from the sink definition to the source definition. The dataflow library starts tracking flow from the sources, so it's better to to rule out the entire database in the source definition than in the sink definition.	2023-03-09 14:59:13 +00:00
Mathias Vorreiter Pedersen	7819a7d2bc	C++: Severely restrict the set of sinks in 'cpp/cleartext-storage-database'. This reduces the number of sinks considered on the 'sysown/proxysql' from > 62000 sinks to ~1000 sinks.	2023-03-09 14:59:13 +00:00
Jeroen Ketema	30cbc91092	C++: Update XXE XML query with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	6f2407412e	C++: Update some dataflow tests to use DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	8253f2d343	C++: Update UnsafeDaclSecurityDescriptor with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	7fe1a9431c	C++: Update PotentiallyExposedSystemData with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	53aa34bdd3	C++: Update UnsafeCreateProcessCall with DataFlow::ConfigSig	2023-03-08 15:04:53 +01:00
Jeroen Ketema	af612a12de	C++: Update TlsSettingsMisconfiguration with DataFlow::ConfigSig	2023-03-08 15:04:52 +01:00
Jeroen Ketema	4363a8ea30	C++: Update leap year queries with DataFlow::ConfigSig	2023-03-08 15:04:52 +01:00
Jeroen Ketema	e65ba13da4	C++: Update NonConstantFormat with DataFlow::ConfigSig	2023-03-08 15:04:52 +01:00
Jeroen Ketema	661160a98e	C++: Update PrivateCleartextWrite with DataFlow::ConfigSig	2023-03-08 15:04:45 +01:00
Mathias Vorreiter Pedersen	a247a8b3ea	Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow	2023-03-08 13:35:35 +00:00
Mathias Vorreiter Pedersen	e68bb53a6b	Merge pull request #12435 from jketema/more-config ... C++: Convert a number of data flow based queries to use `ConfigSig`	2023-03-08 13:25:54 +00:00
Mathias Vorreiter Pedersen	c84d88f5aa	Merge pull request #12429 from MathiasVP/actually-implement-language-specific-flow-into-call-node-cand1 ... C++: Implement `getAdditionalFlowIntoCallNodeTerm`	2023-03-08 11:58:56 +00:00
Mathias Vorreiter Pedersen	8308c661b4	Merge pull request #12432 from MathiasVP/fix-ir-uninitialized-node ... C++: Fix `asUninitialized`	2023-03-08 10:03:46 +00:00
Mathias Vorreiter Pedersen	5a6b94eda2	C++: Respond to PR reviews.	2023-03-08 09:38:56 +00:00
Mathias Vorreiter Pedersen	263b208282	C++: Disambiguate a test annotation.	2023-03-08 09:07:07 +00:00
Jeroen Ketema	5391b13db9	C++: Make dataflow configuration modules private in qll files	2023-03-08 09:18:09 +01:00
Jeroen Ketema	0f8a12f3ac	C++: Add change note for deprecated data flow configurations in qll files	2023-03-08 09:00:43 +01:00
Jeroen Ketema	13bdd9c0c6	C++: Fix query compliation ... Apparently some queries we skipped in the testing I did locally.	2023-03-07 19:16:10 +01:00
Jeroen Ketema	57c5d5f2c7	C++: Add QLDoc on configuration modules where the original class had one	2023-03-07 19:01:05 +01:00
Jeroen Ketema	0c39d1e5ca	C++: Fix query formatting	2023-03-07 18:55:58 +01:00
Jeroen Ketema	2eb2e11ef7	C++: Fix query compilation	2023-03-07 18:53:07 +01:00
Jeroen Ketema	fb57914751	C++: Convert a number of data flow based queries to use ConfigSig	2023-03-07 18:21:52 +01:00
Mathias Vorreiter Pedersen	cc0b8bbebb	Merge pull request #12430 from MathiasVP/no-to-string-on-state-in-cast-array-pointer-arith ... C++: Convert `cpp/upcast-array-pointer-arithmetic` to the new API	2023-03-07 16:48:15 +00:00
Mathias Vorreiter Pedersen	eea02e1ac1	C++: Accept test changes.	2023-03-07 16:18:43 +00:00
Mathias Vorreiter Pedersen	a39a6ea648	C++: Don't use indirect instructions for asUnitialized.	2023-03-07 16:18:27 +00:00
Mathias Vorreiter Pedersen	ce02de48a0	C++: Fix Code Scanning error.	2023-03-07 14:40:36 +00:00
Mathias Vorreiter Pedersen	f2b311a008	C++: We don't need to check type equivalence at the end anymore: the dataflow state now precisely tracks the types.	2023-03-07 14:31:11 +00:00
Mathias Vorreiter Pedersen	ce6366f023	C++: Use the parameterized module dataflow API in 'cpp/upcast-array-pointer-arithmetic'. ... This allows us to swap out the old string state with the Type-based state.	2023-03-07 14:17:12 +00:00
Mathias Vorreiter Pedersen	0d1e061f5a	C++: Implement 'getAdditionalFlowIntoCallNodeTerm'.	2023-03-07 13:45:32 +00:00
Mathias Vorreiter Pedersen	63690066c5	Merge branch 'main' into mathiasvp/replace-ast-with-ir-use-usedataflow	2023-03-07 13:06:43 +00:00
Mathias Vorreiter Pedersen	b054b9c5cd	Merge pull request #12408 from jketema/merge-main ... C++: use-use dataflow merge main	2023-03-07 13:05:30 +00:00
Paolo Tranquilli	c4fd39ec3f	C++: fix example code for FilePermissions.qll	2023-03-07 13:50:20 +01:00
Paolo Tranquilli	bdad847584	Merge pull request #12422 from github/redsun82/cpp-scanf-fp ... C++: add false positives to `MissingCheckScanf` test	2023-03-07 13:29:22 +01:00
Michael B. Gale	b75f138507	Merge pull request #12385 from github/mbg/csharp/readd-tsp-support ... C#: Add support for the tool status page	2023-03-07 12:10:52 +00:00
Paolo Tranquilli	429518bcea	C++: add further FP to test	2023-03-07 12:03:34 +01:00
Paolo Tranquilli	311cf4e7fd	C++: add false positives to MissingCheckScanf test ... See https://github.com/github/codeql/issues/12412 for the initial report.	2023-03-07 11:56:05 +01:00
Jeroen Ketema	3a4c0a2aae	Merge pull request #12389 from jketema/more-deprecated ... C++: Add `deprecated` to predicates that are deprecated according to the QLDoc	2023-03-07 11:21:43 +01:00
Jeroen Ketema	9ec479a2a0	C++: Update queries to use DataFlow::ConfigSig	2023-03-07 10:15:11 +01:00
Jeroen Ketema	c9bccd9b43	C++: Fix more tests that used deprecated function	2023-03-07 09:01:13 +01:00
Jeroen Ketema	47930f94e2	Merge remote-tracking branch 'upstream/main' into merge-main	2023-03-06 15:20:39 +01:00
Mathias Vorreiter Pedersen	92ad099c1b	DataFlow: Remove bindingsets, remove the call column, and swap parameter and argument columns.	2023-03-06 13:47:59 +00:00
Mathias Vorreiter Pedersen	3bf28cc752	DataFlow: Sync identical files.	2023-03-06 13:46:21 +00:00
Mathias Vorreiter Pedersen	05314b48e8	C++: Add stub.	2023-03-06 13:44:23 +00:00
Mathias Vorreiter Pedersen	6e8a2a6375	DataFlow: Add a language-specific predicate for modifying 'branch' and 'join'.	2023-03-06 13:44:19 +00:00
Anders Schack-Mulligen	5c7f2ac7f7	Merge pull request #12186 from aschackmull/dataflow/refactor-configuration ... Data flow: Refactor configuration	2023-03-06 13:38:59 +01:00
Mathias Vorreiter Pedersen	d2d91cfb29	C++: Accept test changes.	2023-03-06 11:30:40 +00:00