Chris Smowton
de2ed83b55
Note that filepath.Clean("/" + e) is a sanitizer against path traversal attacks.
2022-01-28 19:32:58 +00:00
Andrew Eisenberg
9e0580da32
Add new groups for examples packs
...
Will make it easier to avoid publishing them.
2022-01-26 14:47:46 -08:00
Chris Smowton
8111fbb69b
Delete m
2022-01-20 10:57:11 +00:00
Owen Mansel-Chan
85319b2dbf
Add tests for tainted path sanitizers and sanitizer guards
2022-01-19 09:49:15 +00:00
Chris Smowton
749698759a
Note that the %q format directive escapes newlines, and therefore prevents log injection
2022-01-05 16:04:20 +00:00
Chris Smowton
5760841812
Merge pull request #647 from smowton/smowton/admin/not-all-you-fmt-is-log
...
Declassify fmt.Fprintf as a log sink
2022-01-05 14:09:55 +00:00
Erik Krogh Kristensen
afe7ee17a0
run the use-set-literals patch
2021-12-20 17:55:19 +01:00
Chris Smowton
92d3da5e56
Declassify fmt.Fprintf as a log sink
...
In future we could try harder to find out whether you're Fprintf'ing to stdout, a file named xyz.log etc, but for now this causes Fprintf'ing to an HTTP writer to be mistaken for log-injection rather than just XSS.
2021-12-17 17:07:58 +00:00
Owen Mansel-Chan
ec3dd1e1c0
Revert "Update tests for no flow through receivers when no function body"
...
This reverts commit 06f889fce6
2021-12-16 19:35:54 +00:00
Chris Smowton
ede57b6527
Merge pull request #637 from smowton/smowton/fix/log-injection-sanitizers
...
Fix sanitization by strings.Replace[All] in go/unsafe-quoting and go/log-injection
2021-12-16 12:28:40 +00:00
Chris Smowton
9de1532735
Add log-injection test using strings.ReplaceAll
2021-12-15 15:35:14 +00:00
Chris Smowton
c2b42ce091
Fix sanitization by strings.Replace[All] in go/unsafe-quoting and go/log-injection
2021-12-14 12:37:18 +00:00
Owen Mansel-Chan
6a2a8298dd
Add missing tests for DatabaseSql function models
2021-12-13 14:18:46 -05:00
Chris Smowton
9309abf8cd
Merge pull request #574 from sauyon/dataflow-update
...
Update dataflow libraries and add support for CSV summary flow
2021-12-13 11:28:28 +00:00
Andrew Eisenberg
3cc48fea6a
Merge pull request #622 from github/post-release/v2.7.3
...
Post release/v2.7.3
2021-12-10 10:00:11 -08:00
Owen Mansel-Chan
06f889fce6
Update tests for no flow through receivers when no function body
...
This branch originally included a commit to enable flow through receivers
when there is no function body. This was dropped, to be pursued later.
2021-12-08 16:03:18 -05:00
Owen Mansel-Chan
88e7c44a6d
Update expected test results with extra nodes
2021-12-08 15:28:28 -05:00
Owen Mansel-Chan
16fdb9aa11
Do not test ReturnValue as input for sink
...
The documentation in ExternalFlow.qll does not specify
that "ReturnValue" can be used as the input column.
2021-12-08 11:20:34 -05:00
Chris Smowton
3cf1459c4f
Revert getACallee type change
2021-12-08 11:20:33 -05:00
Owen Mansel-Chan
5ec0b09160
Diasble clearing content and add test for it
2021-12-08 11:20:32 -05:00
Owen Mansel-Chan
e940a53cc6
Test models of flow through fields
2021-12-08 11:20:32 -05:00
Owen Mansel-Chan
d717734820
Do not allow "Argument" on its own
2021-12-08 11:20:30 -05:00
Owen Mansel-Chan
12058a2621
Fix containerStoreStep and containerReadStep
2021-12-08 11:20:29 -05:00
Owen Mansel-Chan
ab8096b717
Add tests for more content types (Element, MapKey, MapValue)
2021-12-08 11:20:28 -05:00
Owen Mansel-Chan
f375553933
Add variadic functions test for function models
2021-12-08 11:20:27 -05:00
Owen Mansel-Chan
b75def62fe
Add variadic functions test for external flow
2021-12-08 11:20:27 -05:00
Owen Mansel-Chan
d9848fe515
Add more tests for variadic functions
2021-12-08 11:20:27 -05:00
Owen Mansel-Chan
8044fb2519
Add more flow tests for external flow
2021-12-08 11:20:26 -05:00
Owen Mansel-Chan
63d997f820
(Unimportant) Fix module name for vendored stubs
...
This doesn't affect the test, but does mean that you can run
`go build` to check the test would build.
2021-12-08 11:20:26 -05:00
Owen Mansel-Chan
1929a1f7a7
Fix unrelated test in experimental
2021-12-08 11:20:25 -05:00
Owen Mansel-Chan
5e38f48b74
Autoformat
2021-12-08 11:20:25 -05:00
Owen Mansel-Chan
a3df3614a5
Convert completetest to an inline flow test
2021-12-08 11:20:24 -05:00
Owen Mansel-Chan
8f7a34f9cb
Fix external flow tests
2021-12-08 11:20:24 -05:00
Sauyon Lee
3379790686
add flow test involving CSV
2021-12-08 11:20:22 -05:00
Owen Mansel-Chan
038f951e9f
Fix containerStoreStep
...
Update some comments as well, and change a variable name
2021-12-08 11:20:20 -05:00
Owen Mansel-Chan
be6501d8e4
Add tests for data and taint flow through arrays and var args
2021-12-08 11:20:20 -05:00
Sauyon Lee
2060731077
Add tests for external flow
2021-12-08 11:20:20 -05:00
Sauyon Lee
afe7edc093
Fix test output
...
Includes a bunch of new edges, but no new results
2021-12-07 07:39:28 -05:00
Sauyon Lee
30ab22f5a6
Fix compilation errors with new DataFlowCallable
2021-12-07 07:39:26 -05:00
Sauyon Lee
3ac2a50497
Update test output
2021-12-07 07:39:21 -05:00
Owen Mansel-Chan
d0c9aacd54
Distinguish variadic and non-variadic signature types in extractor
2021-12-01 09:33:44 -05:00
Owen Mansel-Chan
628835d3b3
Add failing tests for isVariadic
...
`nonvariadicDeclaredFunction` has the same signature as
`variadicDeclaredFunction`, so it is being erroneously reported as
variadic.
2021-12-01 09:32:12 -05:00
Owen Mansel-Chan
acc5c4098a
Fix Function.isVariadic to work on external packages
...
Going via `getFuncDecl()` didn't work as we don't function declarations
from external packages. It works to use `getType()` instead.
2021-11-30 15:11:34 -05:00
Owen Mansel-Chan
a6d8deae3e
Add Fmt.Fprint to isVariadic tests
...
We didn't have any tests involving a function in an imported package.
2021-11-30 15:07:57 -05:00
Dave Bartolomeo
52b68963d2
Prepare for automatic release prep
2021-11-29 16:47:30 -05:00
Owen Mansel-Chan
f9a3832aa2
Add extractor test that empty interface type exists
2021-11-26 15:16:09 -05:00
Tony Torralba
662f880ab8
Merge pull request #609 from github/atorralba/log-injection-query
...
Go: Add Log Injection query (CWE-117)
2021-11-24 15:41:43 +01:00
tunnelshade
aeaa861fc6
Add Where method of squirrel sql builders to query range
2021-11-23 10:11:31 +05:30
Tony Torralba
f2017b626e
Fix stubs
2021-11-22 09:15:12 +01:00
Tony Torralba
c9332cdccb
Fix *Depth log levels in glog and klog
2021-11-22 09:15:01 +01:00
