am0o0
8c1c537150
finilize tests for zlib
2024-09-03 09:12:54 +02:00
am0o0
f97b1039cd
update test files, add one more additional flow step for inflate function, fix gzopen additional flow step thanks to @jketema
2024-07-30 17:49:34 +02:00
am0o0
a10b5021b4
fix tests, it is not fixed 100%
2024-07-15 10:13:57 +02:00
am0o0
361ad6be6a
use abstract class for decompression flow steps
2024-06-26 12:45:31 +02:00
am0o0
656dc4e276
use abstract class for decompression sinks
2024-06-25 18:09:27 +02:00
am0o0
13f697c056
relocate the query
2024-06-25 17:31:40 +02:00
Porcupiney Hairs
a7cdf0e2fd
CPP: Disabled SSL certificate verification
...
Disable SSL certificate verification can expose the communication to MITM attacks.
This PR adds a query to detect the same. This also include the tests and qhelp for the same.
2024-06-23 14:27:04 +05:30
am0o0
11a416ea7c
add FlowSources as a common source for all sinks, so we don't need States anymore
2024-06-13 03:30:07 +02:00
am0o0
273848c879
remove old comments
2024-06-07 05:40:17 +02:00
am0o0
a5363286f1
add implicit this
2024-06-07 05:37:58 +02:00
am0o0
184aa0480e
Merge branch 'amammad-cpp-bombs' of https://github.com/amammad/codeql into amammad-cpp-bombs
2024-06-07 05:27:12 +02:00
Am
a5c9dc74bf
Merge branch 'github:main' into amammad-cpp-bombs
2024-06-07 05:27:08 +02:00
am0o0
e37ceac3b1
merge all query files into one query file
2024-06-07 05:26:51 +02:00
Mathias Vorreiter Pedersen
00a940fd58
Merge pull request #16524 from catenacyber/deref-null-result
...
Adds another rule for null deref
2024-05-22 12:37:39 +01:00
Mathias Vorreiter Pedersen
eda815789b
Update cpp/ql/src/experimental/Likely Bugs/DerefNullResult.ql
2024-05-22 11:21:04 +01:00
Philippe Antoine
ab4b823c2e
fixup unique assignment
2024-05-21 22:10:00 +02:00
Philippe Antoine
8ace9da14a
fixup dataflow path and formatting
2024-05-20 21:31:47 +02:00
Philippe Antoine
73d306c8c8
Adds another rule for null deref
2024-05-17 17:35:07 +02:00
Mathias Vorreiter Pedersen
a8f2cbc2b1
Merge pull request #16331 from mario-campos/mario-campos/guarded-free
...
Cpp: new experimental query cpp/guarded-free
2024-05-01 17:32:44 +01:00
Mario Campos
5a7a1dc92e
C++: forgot to import semmle.code.cpp.controlflow.Guards
2024-05-01 11:00:19 -05:00
Mario Campos
c480431ec0
C++: simplify cpp/guarded-free
...
This new form is more declarative by use of the `GuardCondition`. Thanks to the tireless effort of @MathiasVP!
2024-05-01 10:59:16 -05:00
Mathias Vorreiter Pedersen
179270ffc1
C++: Move 'cpp/iterator-to-expired-container' out of experimental.
2024-04-29 11:07:55 +01:00
Mario Campos
3195f0c828
Use more specific hasGlobalName() for stdlib function free(3)
...
Based on the CodeQL documentation's example of strncpy(3) and strlen(3): https://codeql.github.com/docs/codeql-language-guides/hash-consing-and-value-numbering/#example-query
2024-04-26 09:10:40 -05:00
Mario Campos
d7c784ef2f
Initial commit of experimental query cpp/guarded-free.
2024-04-25 16:29:37 -05:00
Geoffrey White
0fb71e24cb
C++: Fix typo.
2024-04-25 14:52:56 +01:00
Mathias Vorreiter Pedersen
cedc84df8f
C++: Fix FPs by only having one dataflow config. This means we preserve the call context all the way though from the source to the sink.
2024-04-19 08:27:41 +01:00
Mathias Vorreiter Pedersen
96ba3ec88e
C++: Rename predicate.
2024-04-17 10:10:54 +01:00
Mathias Vorreiter Pedersen
eb2790ae63
C++: Fix 'case 2' in 'destroyedToBeginSink' now that we're working with the sink instead of the source.
2024-04-17 10:10:39 +01:00
Mathias Vorreiter Pedersen
d22e2bae8e
C++: Select the post-update node in 'getADestroyedNode'.
2024-04-17 10:10:39 +01:00
Mathias Vorreiter Pedersen
b2974ba1c6
C++: Factor body of isSink into its own predicate.
2024-04-17 10:10:21 +01:00
Mathias Vorreiter Pedersen
b944f3b411
C++: Fix FP.
2024-03-18 15:57:20 +00:00
Mathias Vorreiter Pedersen
7b6accd33a
Update cpp/ql/src/experimental/Security/CWE/CWE-416/IteratorToExpiredContainer.ql
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2024-03-18 12:01:51 +00:00
Mathias Vorreiter Pedersen
457d71d7bc
Update cpp/ql/src/experimental/Security/CWE/CWE-416/IteratorToExpiredContainer.ql
...
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com >
2024-03-18 12:01:44 +00:00
Mathias Vorreiter Pedersen
a8718f99a1
C++: Add qhelp for 'cpp/iterator-to-expired-container'.
2024-03-15 17:35:47 +00:00
Mathias Vorreiter Pedersen
23cf99734a
C++: Add a new experimental query ' cpp/iterator-to-expired-container'.
2024-03-15 14:29:29 +00:00
Ian Lynagh
e357d18d35
C++: Fix typo
2024-01-12 17:57:34 +00:00
Geoffrey White
17cd22f9d0
Merge pull request #14972 from geoffw0/cryptoprimitives
...
C++: Experimental query for implementation of a cryptographic primitive
2023-12-11 09:47:46 +00:00
Geoffrey White
521d98ed8d
C++: Make the encryption words a tiny bit more flexible.
2023-12-05 18:03:17 +00:00
Geoffrey White
e95098f61f
C++: Add 'experimental' tag.
2023-12-05 18:03:11 +00:00
Geoffrey White
2f0be40f37
C++: Exclude results in some common libraries.
2023-12-05 18:00:00 +00:00
Geoffrey White
fb02e996d4
C++: Address QL-for-QL comments.
2023-12-05 17:58:35 +00:00
Geoffrey White
c83cfe4936
C++: Make output clearer in cases where the function name is a macro expansion (I've seen this more than once).
2023-12-05 17:58:22 +00:00
Jeroen Ketema
b185efa9e4
C++: Remove unneeded dataflow imports
2023-12-01 21:11:22 +01:00
Geoffrey White
b0514de094
C++: Add cpp/crypto-primitive query to experimental.
2023-11-30 15:03:03 +00:00
Chris Campbell
114b694553
Remove @precision values, correct missing tags
2023-11-16 15:50:41 +00:00
Josh Brown
ad86e576a4
autoformat
2023-10-03 13:40:17 -07:00
Benjamin Rodes
25203db4e7
Removing 'security' tags from all queries.
2023-09-27 12:43:51 -04:00
Benjamin Rodes
c0c2ae544b
Updating weak elliptic curve sample queries.
2023-09-21 12:12:16 -07:00
Benjamin Rodes
50db4fd63e
Moved Cpp into sub directory 'cryptography' instead of crypto. Added python models, inventory, and example alerts.
2023-09-21 12:12:15 -07:00
Benjamin Rodes
fe22dc45b1
Moving inventory queries into a new subdirectory structure for new_models and old_models.
2023-09-21 12:12:15 -07:00
