Jeroen Ketema
|
83d35a9a96
|
C++: Use isSanitizerOut(DataFlow::Node node) in cpp/command-line-injection
|
2022-04-08 11:28:17 +02:00 |
|
Geoffrey White
|
146318dbc1
|
Merge pull request #8580 from geoffw0/privdata
C++: Port PrivateData.qll from C# and use it in cpp/cleartext-transmission
|
2022-03-31 10:12:46 +01:00 |
|
Geoffrey White
|
0e3e145e53
|
C++: Add CWE-359 tag to cpp/cleartext-transmission.
|
2022-03-29 14:44:06 +01:00 |
|
Geoffrey White
|
3fed7bf6d0
|
C++: Extend cpp/cleartext-transmission using PrivateData.qll.
|
2022-03-28 11:16:56 +01:00 |
|
Geoffrey White
|
9f3fd57534
|
Merge branch 'main' into cwe497b
|
2022-03-25 11:57:30 +00:00 |
|
Geoffrey White
|
e377eebdbc
|
C++: More 'adversary' -> 'malicious user' and related doc changes.
|
2022-03-25 11:34:37 +00:00 |
|
Geoffrey White
|
11074b6d77
|
Update cpp/ql/src/Security/CWE/CWE-497/PotentiallyExposedSystemData.ql
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
|
2022-03-25 11:08:07 +00:00 |
|
Geoffrey White
|
6b6ee61d3f
|
Apply suggestions from code review
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>
|
2022-03-25 11:06:46 +00:00 |
|
Jeroen Ketema
|
2d9b630fa8
|
C++: Fix ExecTainted.ql formatting
|
2022-03-21 23:28:58 +01:00 |
|
Jeroen Ketema
|
b79eb6d10d
|
C++: Encode string value of data flow nodes in ExecState
|
2022-03-21 21:29:42 +01:00 |
|
Jeroen Ketema
|
f8198c3123
|
C++: Use flow states in cpp/command-line-injection
|
2022-03-18 20:06:45 +01:00 |
|
Geoffrey White
|
46f3f28a11
|
C++: Fix broken merge.
|
2022-03-15 14:53:25 +00:00 |
|
Geoffrey White
|
71e0da738d
|
Merge branch 'main' into cwe497b
|
2022-03-15 13:29:32 +00:00 |
|
Mathias Vorreiter Pedersen
|
9f014be7c7
|
Merge pull request #8447 from MathiasVP/add-missing-security-severity
C++: Add missing `security-severity` tags
|
2022-03-15 11:29:28 +00:00 |
|
Geoffrey White
|
28315df405
|
Merge branch 'main' into cwe497b
|
2022-03-15 11:23:00 +00:00 |
|
Mathias Vorreiter Pedersen
|
7337ebd569
|
C++: Add missing 'security-severity' tags.
|
2022-03-15 10:54:36 +00:00 |
|
Geoffrey White
|
73710e9edb
|
C++: Fix QLDoc.
|
2022-03-14 19:11:43 +00:00 |
|
Geoffrey White
|
7c93eb1eaf
|
C++: Fix large newtype.
|
2022-03-14 19:06:41 +00:00 |
|
Geoffrey White
|
d1b04b4e07
|
C++: Use asDefiningArgument() where appropriate.
|
2022-03-14 17:53:47 +00:00 |
|
Mathias Vorreiter Pedersen
|
7593ebaa62
|
C++: Use 'getAstVariable' now that 'getASTVariable' is deprecated.
|
2022-03-14 13:38:27 +00:00 |
|
Mathias Vorreiter Pedersen
|
50b77761f1
|
C++: Port the 'predictable' barrier from 'DefaultTaintTracking' to 'cpp/unclear-array-index-validation' to prevent an explosion of new results.
|
2022-03-14 13:14:07 +00:00 |
|
Mathias Vorreiter Pedersen
|
0da5d91955
|
Merge branch 'main' into use-taint-configuration-in-three-more-queries
|
2022-03-14 11:12:23 +00:00 |
|
Erik Krogh Kristensen
|
69353bb014
|
patch upper-case acronyms to be PascalCase
|
2022-03-11 11:10:33 +01:00 |
|
Mathias Vorreiter Pedersen
|
272e096190
|
Merge branch 'main' into use-taint-configuration-in-three-more-queries
|
2022-03-11 09:24:03 +00:00 |
|
Mathias Vorreiter Pedersen
|
0d3e47bcae
|
C++: Pick the offset expression as the sink in 'cpp/unclear-array-index-validation' (and not the array expression).
|
2022-03-10 10:57:51 +00:00 |
|
Mathias Vorreiter Pedersen
|
693eca2179
|
C++: Give 'cpp/unclear-array-index-validation' precision low.
|
2022-03-10 10:17:08 +00:00 |
|
Mathias Vorreiter Pedersen
|
8a8fb692a3
|
C++: Use a 'TaintTracking::Configuration' for 'cpp/uncontrolled-allocation-size'.
|
2022-03-09 12:09:32 +00:00 |
|
Mathias Vorreiter Pedersen
|
2328898b19
|
C++: Use a 'TaintTracking::Configuration' for 'cpp/unclear-array-index-validation'.
|
2022-03-09 12:09:27 +00:00 |
|
Geoffrey White
|
9ebdb2ac1d
|
C++: QLDoc.
|
2022-03-08 16:12:58 +00:00 |
|
Geoffrey White
|
fc6f42296a
|
C++: Upgrade cpp/system-data-exposure.
|
2022-03-07 17:39:04 +00:00 |
|
Geoffrey White
|
cb33ed4fc2
|
C++: Only look for sensitive strings in appropriate parameters.
|
2022-03-07 11:29:09 +00:00 |
|
Geoffrey White
|
f1d6234483
|
C++: Add more information about registry query parameters.
|
2022-03-07 09:45:31 +00:00 |
|
Geoffrey White
|
4316026720
|
C++: VariableAccess -> Expr.
|
2022-03-04 18:00:54 +00:00 |
|
Mathias Vorreiter Pedersen
|
624795cbbf
|
Merge pull request #8059 from rdmarsh2/rdmarsh2/cpp/insufficient-key-strength
C++: new query for insufficient key strength
|
2022-03-04 17:11:44 +00:00 |
|
Robert Marsh
|
60532e631e
|
C++: fix missing paren
|
2022-03-03 14:45:43 -05:00 |
|
Geoffrey White
|
6848b6095b
|
C++: Autoformat.
|
2022-03-03 12:51:54 +00:00 |
|
Geoffrey White
|
5c6923c099
|
C++: Improve and differentiate the qhelp.
|
2022-03-03 11:04:55 +00:00 |
|
Geoffrey White
|
07b4bf7023
|
C++: Use the same trick as in ExposedSystemData to catch a few more results.
|
2022-03-03 10:33:39 +00:00 |
|
Geoffrey White
|
6e5729c924
|
C++: Fix typo and adjust violation message wording.
|
2022-03-03 10:28:53 +00:00 |
|
Robert Marsh
|
9fb94d85b4
|
C++: performance tweaks for InsufficientKeySize
|
2022-03-02 15:59:42 -05:00 |
|
Geoffrey White
|
2a14a4f14e
|
C++: Fill in metadata.
|
2022-03-02 18:52:52 +00:00 |
|
Geoffrey White
|
66b9356eb9
|
C++: There is no overlap between OutputWrite and RemoteFlowSinkFunction.
|
2022-03-02 18:16:39 +00:00 |
|
Geoffrey White
|
a1ace7122d
|
C++: Move SystemData class into a library.
|
2022-03-02 18:01:06 +00:00 |
|
Geoffrey White
|
d95b56fca0
|
C++: Create prototype query.
|
2022-03-02 17:56:49 +00:00 |
|
Geoffrey White
|
5402b02fd7
|
Merge branch 'main' into cwe497
|
2022-03-01 11:58:24 +00:00 |
|
Robert Marsh
|
a60fe9f4b8
|
C++: exclude 0 earlier in InsufficientKeySize
|
2022-02-24 14:26:37 -05:00 |
|
Geoffrey White
|
899ae90ba4
|
C++: Add GVN.
|
2022-02-24 17:22:37 +00:00 |
|
Geoffrey White
|
6c40cda68d
|
C++: Pragmatic solution to include more sinks (plus autoformat changes).
|
2022-02-24 12:10:34 +00:00 |
|
Geoffrey White
|
fc8ebdaeb2
|
C++: Increase the query to precision high.
|
2022-02-24 10:54:09 +00:00 |
|
Geoffrey White
|
c16302be13
|
C++: Fix the FP.
|
2022-02-24 10:54:08 +00:00 |
|