Max Schaefer
91ca2bb434
Merge pull request #231 from max-schaefer/taint-through-range
...
Propagate taint through `range` statements
2020-06-26 19:58:53 +01:00
Sauyon Lee
468d9812c4
Merge pull request #227 from max-schaefer/cve-2018-15798
...
Teach `OpenUrlRedirect` to propagate out of `URL.Path` and a few other fields.
2020-06-26 06:21:59 -07:00
Max Schaefer
57f8b08568
Update expected test output.
...
The tests for `UnsafeTLS` now work as expected.
2020-06-26 11:30:26 +01:00
Max Schaefer
66ec160f64
Add change note.
2020-06-26 11:20:45 +01:00
Max Schaefer
258a276242
Propagate taint through range loops.
2020-06-26 11:20:45 +01:00
Max Schaefer
ce3007395f
Rename arrayStep to elementStep, which is more accurate.
2020-06-26 11:20:45 +01:00
Max Schaefer
ba82a76948
Merge pull request #229 from max-schaefer/getAPrimaryQlClass
...
Rename `describeQlClass` to `getAPrimaryQlClass`.
2020-06-26 07:51:04 +01:00
Max Schaefer
9904b9e926
Allow flow through more URL fields.
2020-06-26 07:50:08 +01:00
Max Schaefer
3bf934d64b
Add change note.
2020-06-25 22:23:49 +01:00
Max Schaefer
d290bea39a
Rename describeQlClass to getAPrimaryQlClass.
2020-06-25 15:08:01 +01:00
Max Schaefer
a89e4971ac
Merge pull request #221 from gagliardetto/bad-tls
...
Add CWE-327 (unsafe TLS)
2020-06-25 09:18:42 +01:00
Slavomir
95b76dceca
Remove check
2020-06-24 21:39:23 +03:00
Slavomir
4dc1399385
Update comments on the lines that have incorrect flagging
2020-06-24 15:11:33 +03:00
Sauyon Lee
6883a97628
Merge pull request #223 from max-schaefer/update-data-flow
...
Data flow: Track precise types during field flow
2020-06-24 00:10:54 -07:00
Max Schaefer
8c27e16190
Merge pull request #226 from smowton/smowton/fix/remove-spurious-cfg-edge-from-expressionless-switch
...
Remove spurious control-flow edge around switch block without a test
2020-06-24 07:47:37 +01:00
Slavomir
3aa9b25673
Fix comment
2020-06-23 22:40:25 +03:00
Chris Smowton
4882f277f5
Remove spurious control-flow edge around switch block without a test-expression
...
Previously we thought it possible to get from top to bottom of a block like "switch { case f(): ... }", when in fact this is only possible if there are no case blocks to execute.
I also add tests for two possible corner cases of a switch without a test-expression: a completely empty switch (the 'true' is indeed the last node) and switch with an empty default block (a single 'skip' is generated for the default block and the 'true' is not the last node)
2020-06-23 17:46:08 +01:00
Chris Smowton
1dc427a2c5
Cleanup: use TypeSwitchStmt.getAssign, not a raw child accessor
2020-06-23 17:46:08 +01:00
Max Schaefer
4e6d9b3811
Teach OpenUrlRedirect to propagate out of URL.Path and a few other fields.
2020-06-23 15:29:18 +01:00
Slavomir
561c5b91d2
Implement code review feedback
2020-06-23 16:07:05 +03:00
Max Schaefer
95011cebc2
Merge pull request #225 from sauyon/unqualify-functioninput
...
Unqualify uses of FunctionInput and FunctionOutput
2020-06-23 11:24:46 +01:00
Slavomir
56727b220b
Try different ways of passing taint through a field
2020-06-23 12:14:49 +03:00
Sauyon Lee
ecff1e6a16
Unqualify uses of FunctionInput and FunctionOutput
2020-06-22 22:25:33 -07:00
Max Schaefer
d3e6e5c0b3
Data flow: Track precise types during field flow
...
cf https://github.com/github/codeql/pull/3456
2020-06-22 20:53:05 +01:00
Slavomir
4ab929a656
Simplify
2020-06-22 17:54:07 +03:00
Slavomir
29eba441d7
Determine TLS version from int value
2020-06-22 17:50:20 +03:00
Slavomir
70bc4c81a0
Fix typo
2020-06-22 17:15:56 +03:00
Slavomir
783f710188
Fix comments
2020-06-22 17:12:15 +03:00
Slavomir
e38d4ecd9c
Fix typos
2020-06-22 17:00:31 +03:00
Slavomir
bbf8d7306b
Add CWE-327
2020-06-22 16:54:14 +03:00
Max Schaefer
d8374adbde
Merge pull request #219 from max-schaefer/refine-virtual-dispatch
...
Refine potential targets for method call through interface
2020-06-22 13:47:48 +01:00
Max Schaefer
b2ea23685c
Merge pull request #220 from max-schaefer/master
...
Temporarily disable CodeQL analysis
2020-06-22 13:46:51 +01:00
Max Schaefer
b64d3467aa
Temporarily disable CodeQL analysis
...
https://github.com/github/codeql-go/pull/184 added a regression test for the non-termination it was fixing. The fix hasn't made it into Code Scanning yet, so for the time being it will fail with precisely that non-termination when analysing the regression tests.
2020-06-22 12:18:29 +01:00
Max Schaefer
1f68a32cdc
Add change note.
2020-06-22 09:22:47 +01:00
Max Schaefer
759e3d5632
Further refine potential call targets for interface calls.
...
The call target must belong to the method set of a type that implements the interface type of the method call receiver, if any.
For example, assume `h` has type `hash.Hash`, then `h.Write(...)` should only be resolved to implementations of `Write` in types implementing `hash.Hash`, not arbitrary other `Writer`s.
2020-06-22 09:22:47 +01:00
Max Schaefer
1c58028ae3
Expose receiver type in isInterfaceCallReceiver.
2020-06-22 09:22:47 +01:00
Max Schaefer
0e5e116217
Add a few more utility predicates to DataFlow::Node.
2020-06-22 09:22:47 +01:00
Max Schaefer
18db1fe79f
Merge pull request #184 from max-schaefer/lookup-fields-in-cyclic-struct
...
Fix field lookup in cyclic structs
2020-06-21 09:23:57 +01:00
Max Schaefer
47c4c55923
Merge pull request #185 from github/max-schaefer-patch-2
...
Set up Code Scanning
2020-06-20 10:41:25 +01:00
Sauyon Lee
8742f09343
Merge pull request #186 from max-schaefer/fix-test-compile-errors
...
Fix compiler errors in tests.
2020-06-19 08:28:34 -07:00
Chris Smowton
6c230980a3
Merge pull request #187 from max-schaefer/fill-in-qldoc
...
Add qldoc for three public predicates in `PrintAst.qll`.
2020-06-19 15:30:24 +01:00
Max Schaefer
0f4297ff5c
Add qldoc for three public predicates in PrintAst.qll.
...
It's bland, but we try to maintain a 100% documentation coverage for our public library elements.
2020-06-19 14:25:57 +01:00
Max Schaefer
314bda2a7f
Fix compiler errors in tests.
2020-06-19 14:21:10 +01:00
Max Schaefer
df02ad404e
Set up Code Scanning
2020-06-19 14:02:31 +01:00
Max Schaefer
79b0ea8d77
Merge pull request #183 from smowton/smowton/cleanup/field-parent
...
Clean up @field and @fieldparent usage
2020-06-19 11:30:52 +01:00
Chris Smowton
3c8153ca1e
Clean up @field and @fieldparent usage
...
* Centralise use of raw types and database predicates in FieldParent and FieldBase classes
* Deduplicate type predicates common to all fields
* Deduplicate predicates common to function parameters and results
2020-06-19 11:00:42 +01:00
Max Schaefer
c31a7fc228
Add a few more tests.
2020-06-19 09:28:12 +01:00
Max Schaefer
2df8c275e0
Fix field lookup in cyclic structs.
2020-06-19 08:16:09 +01:00
Max Schaefer
7c2358c1d0
Merge pull request #181 from sauyon/reflectedxss-fps
...
ReflectedXSS refinement
2020-06-18 11:14:13 +01:00
Max Schaefer
7af168fc3b
Merge pull request #179 from smowton/smowton/feature/printast
...
Add barebones PrintAST for Go
2020-06-17 17:02:53 +01:00
