hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-29 14:23:03 +01:00
Code Issues Packages Projects Releases Wiki Activity
1,452 Commits 1,684 Branches 159 Tags
a78c35b95ea39df22e8f62386e452602d3d8a03e
Commit Graph

133 Commits

Author SHA1 Message Date
Chris Smowton
3817ae80e5 Add support for html.Render method. 
This entails generalising Http::ResponseBody to account for any modelled function writing to a ResponseWriter.
 2020-11-06 11:04:53 +00:00
Chris Smowton
02f353eabd Add models for the read side of golang.org/x/net/html 
This covers cases where an HTML document is retrieved and then parts of its structure are output without proper escaping.
 2020-11-06 11:04:53 +00:00
Chris Smowton
03bbef7286 Add models for the read side of golang.org/x/net/html 
This covers cases where an HTML document is retrieved and then parts of its structure are output without proper escaping.
 2020-11-06 11:04:53 +00:00
Chris Smowton
9aceae8bd6 Revel: add support and tests for Render and Redirect sinks. 2020-10-20 10:00:05 +01:00
Owen Mansel-Chan
f49ff279b8 Merge pull request #375 from owen-mc/spew 
Model Spew logging framework
 2020-10-16 13:20:13 +01:00
Owen Mansel-Chan
b89775ac65 Update change-notes/2020-10-14-spew.md 
Co-authored-by: Chris Smowton <smowton@github.com>
 2020-10-16 10:56:27 +01:00
Chris Smowton
2b07e6a0f4 Merge pull request #324 from sauyon/tracing 
Build tracing
 2020-10-15 11:27:34 +01:00
Sauyon Lee
3addb962a9 Add change note for build tracing 2020-10-14 09:42:12 -07:00
Sauyon Lee
2e73f3efd1 Add change note for go.mod extraction change 
Co-authored-by: Chris Smowton <smowton@github.com>
 2020-10-14 09:25:39 -07:00
Owen Mansel-Chan
8811758e44 Add change note 2020-10-14 14:49:50 +01:00
Chris Smowton
72ee460a64 Fix changenote typo 2020-10-14 13:32:26 +01:00
Chris Smowton
0afa0e75c4 Merge pull request #374 from smowton/smowton/feature/more-accurate-allocation-overflow 
Improve accuracy of allocation-size-overflow by excluding len(...) calls that never see a large operand
 2020-10-14 13:25:45 +01:00
Chris Smowton
83a7411a05 Improve accuracy of allocation-size-overflow by excluding len(...) calls that never see a large operand 
This is achieved by splitting the query into two pieces: (1) trace flow from indefinitely large object creation to len(...) calls, then (2) considering those particular len(...) calls as taint propagators, trace taint from the same sources all the way to an allocation call. This is more accurate than the previous solution, which considered any len(...) call to propagate taint, potentially confusing an array that stored a large value in one of its cells for an array which is itself of large size.
 2020-10-14 10:16:08 +01:00
Chris Smowton
40869480e1 Extend context models to cover its old golang.org/x/net/context home. 2020-10-12 12:27:19 +01:00
Chris Smowton
c8a2d30e39 Merge pull request #360 from smowton/smowton/feature/stack-trace-exposure 
Add stack-trace exposure query
 2020-10-07 11:08:37 +01:00
Chris Smowton
0eb7ac94cc Add stack-trace exposure query 
This is a port of `java/stack-trace-exposure`, and does the same job: warn that a stack dump is written to an HTTP response.
 2020-10-06 14:42:59 +01:00
Chris Smowton
88c740bbbc Merge pull request #353 from gagliardetto/remove-duplicate-models 
Remove duplicate models (the end)
 2020-09-24 13:31:18 +01:00
Slavomir
4f7edb85da Fix package count 2020-09-24 12:41:14 +02:00
Slavomir
1f5da54ac9 Update change-notes/2020-09-23-stdlib.md 
Co-authored-by: Chris Smowton <smowton@github.com>
 2020-09-24 12:40:39 +02:00
Slavomir
8e007623ca Improve change note 2020-09-23 18:03:11 +02:00
Slavomir
ef20f75cbe Add change note 2020-09-23 17:52:52 +02:00
Chris Smowton
59138048bb Add query spotting probably-bad escapes in regular expressions. 
Inspired by js/useless-regexp-character-escape, but much much simpler because the Go source code parser forbids unrecognised escapes and its regex engine refuses to compile \\x where x is not a character class or other special token (e.g. start-of-word).
 2020-09-23 15:07:22 +01:00
Chris Smowton
397282f41a Add models for the Echo framework 2020-09-21 17:35:40 +01:00
Chris Smowton
1bf366c1e3 Add models for the Chi web framework 
This is mostly simple as the framework uses ordinary net/http methods and ordinary Go contexts for most purposes.
 2020-09-16 09:14:23 +01:00
Max Schaefer
e9bf3317b5 Merge pull request #328 from owen-mc/gorm-exec 
Update GORM model
 2020-09-11 08:41:09 +01:00
Owen Mansel-Chan
13e82de53d Add change note 2020-09-10 17:29:06 +01:00
Chris Smowton
405babf5af Reflected XSS query: exclude more uses of encoding/json.Marshal 
Previously we only detected these if the marshalling directly fed the request body within the same function; now it's a general sanitiser for the purposes of XSS.
 2020-09-10 16:52:06 +01:00
Owen Mansel-Chan
cd6020810a Add change note for #296 2020-09-08 16:32:12 +01:00
Chris Smowton
faf43efb60 Promote OAuth2 constant-state query to mainline 2020-09-02 15:05:22 +01:00
Max Schaefer
b4550f244b Merge pull request #313 from github/rc/1.25 
Merge rc/1.25 into main
 2020-08-27 14:27:26 +01:00
Owen Mansel-Chan
7fd5e7e978 Add change note for https://github.com/github/codeql-go/pull/277 2020-08-26 10:54:18 +01:00
Owen Mansel-Chan
ad6c94e8f9 Add change note for https://github.com/github/codeql-go/pull/251 2020-08-26 07:58:19 +01:00
Owen Mansel-Chan
210208b003 Add change note for https://github.com/github/codeql-go/pull/226 2020-08-26 07:46:56 +01:00
Owen Mansel-Chan
d4a377b7cc Add change note for https://github.com/github/codeql-go/pull/107 
The model for websocket was included in another change note
 2020-08-26 07:21:05 +01:00
Owen Mansel-Chan
944b69066e Add change note for github/codeql-go#125 2020-08-26 07:20:24 +01:00
Owen Mansel-Chan
dc99a62dca Add change note for Gin framework 
This was originally put in too early because the Gin framework was
accidentally not added to the default includes.

This reverts commit 41e98d6afc.
 2020-08-25 10:29:42 +01:00
Max Schaefer
42c1116ac7 Merge pull request #303 from github/rc/1.25 
Merge rc/1.25 into main
 2020-08-24 17:22:56 +01:00
Owen Mansel-Chan
caf77e2a44 Merge pull request #298 from smowton/smowton/admin/changenote-blank-lines 
Remove blank lines from changenote
 2020-08-20 16:05:29 +01:00
Chris Smowton
cc2a153c57 Remove blank lines from changenote 2020-08-20 11:45:29 +01:00
Owen Mansel-Chan
41e98d6afc Remove change note so it isn't accidentally put into this release 2020-08-20 10:27:51 +01:00
Owen Mansel-Chan
53cc3621ad Change date on Gin change note 
The Gin model wasn't added to the default imports
till 2020-08-19
 2020-08-20 10:27:41 +01:00
Max Schaefer
fe6cf8c625 Merge pull request #275 from owen-mc/incorrect-integer-conversion 
Incorrect integer conversion
 2020-08-13 20:19:47 +01:00
Owen Mansel-Chan
97bbdca8a3 Extend negativeLengthCheck query to unsigned integers 
Like return values from len and cap, unsigned integers are never negative
 2020-08-11 10:48:03 +01:00
Owen Mansel-Chan
681ca9065a Add change note 2020-08-10 11:04:25 +01:00
Max Schaefer
b057cbee7b Merge pull request #256 from smowton/smowton/admin/cwe-327-cleanup 
Polish CWE-327 (weak TLS config) query
 2020-08-03 10:28:53 +01:00
Max Schaefer
2134757ebf Merge pull request #261 from smowton/smowton/admin/cleanup-cwe-322 
Polish CWE-322: detect and exclude cases where host-checking is optional
 2020-07-30 10:38:57 +01:00
Chris Smowton
f162a5be94 Promote CWE-322 out of experimental status 2020-07-29 14:43:47 +01:00
Chris Smowton
026dc5c97f Add changelog notes regarding added library support 2020-07-28 14:57:14 +01:00
Chris Smowton
718c4e8531 Add change note for insecure-TLS query 2020-07-28 11:55:58 +01:00
Max Schaefer
302eb55d23 Merge pull request #245 from smowton/smowton/feature/missing-error-check-query-conservative 
Add query searching for missing error checks on functions that return a (pointer, error) pair
 2020-07-09 15:37:32 +01:00