Jeroen Ketema
8b4c42dd07
C++: Add cpp/command-line-injection test using a wrapper macro
2022-03-21 11:19:54 +01:00
Jeroen Ketema
f8198c3123
C++: Use flow states in cpp/command-line-injection
2022-03-18 20:06:45 +01:00
Jeroen Ketema
d37ef1b5ca
C++: Add command line injection test that currently results in a false positive
2022-03-18 16:12:09 +01:00
Jeroen Ketema
459870ac1e
C++: Add additional command line injection tests
2022-03-18 13:42:27 +01:00
Jeroen Ketema
1a1c34e1be
C++: Handle C11 _Noreturn in DefaultOptions
2022-03-15 23:21:14 +01:00
Mathias Vorreiter Pedersen
3c17d90e3b
C++: Accept test changes.
2022-03-11 09:30:44 +00:00
Mathias Vorreiter Pedersen
272e096190
Merge branch 'main' into use-taint-configuration-in-three-more-queries
2022-03-11 09:24:03 +00:00
Mathias Vorreiter Pedersen
dfb20f7721
Merge pull request #8368 from MathiasVP/add-must-flow-lib
...
C++: Factor must-flow predicates out of two queries
2022-03-09 17:07:23 +00:00
Mathias Vorreiter Pedersen
f2676968f0
C++: Actally convert 'cpp/overflow-destination' to a path-problem query.
2022-03-09 13:49:52 +00:00
Mathias Vorreiter Pedersen
8a8fb692a3
C++: Use a 'TaintTracking::Configuration' for 'cpp/uncontrolled-allocation-size'.
2022-03-09 12:09:32 +00:00
Mathias Vorreiter Pedersen
2328898b19
C++: Use a 'TaintTracking::Configuration' for 'cpp/unclear-array-index-validation'.
2022-03-09 12:09:27 +00:00
Mathias Vorreiter Pedersen
69417e150a
C++: Address review comments.
2022-03-08 13:15:02 +00:00
Mathias Vorreiter Pedersen
7106fe35aa
C++: Accept test changes. This is just a change in the names of the path nodes. These names are actually better as they don't refer to the name of IR instructions.
2022-03-08 11:40:56 +00:00
Mathias Vorreiter Pedersen
624795cbbf
Merge pull request #8059 from rdmarsh2/rdmarsh2/cpp/insufficient-key-strength
...
C++: new query for insufficient key strength
2022-03-04 17:11:44 +00:00
Robert Marsh
280fdbfc1b
C++: accept test output from perf improvement
...
The last commit removed some source nodes from the dataflow graph, which
changed the test expectations slightly. No result changes occurred.
2022-03-04 11:39:10 -05:00
Mathias Vorreiter Pedersen
9a91e66714
Merge pull request #8321 from MathiasVP/improve-using-expired-address-query
...
C++: More TPs from `cpp/using-expired-stack-address`
2022-03-04 12:07:55 +00:00
Mathias Vorreiter Pedersen
bf10456bf5
C++: Add a path explanation to the 'cpp/using-expired-stack-address' query.
2022-03-03 13:55:00 +00:00
Mathias Vorreiter Pedersen
9df923a7c8
C++: Catch more true positives by stepping into calls in the 'cpp/using-expired-stack-address' query.
2022-03-03 13:53:09 +00:00
Geoffrey White
5402b02fd7
Merge branch 'main' into cwe497
2022-03-01 11:58:24 +00:00
Mathias Vorreiter Pedersen
dfd30e46b0
Merge pull request #8227 from geoffw0/319improve
...
C++: Promote cpp/non-https-url
2022-02-25 08:48:44 +00:00
Geoffrey White
899ae90ba4
C++: Add GVN.
2022-02-24 17:22:37 +00:00
Geoffrey White
0bb9a95563
C++: Extend tests.
2022-02-24 17:15:29 +00:00
Geoffrey White
6c40cda68d
C++: Pragmatic solution to include more sinks (plus autoformat changes).
2022-02-24 12:10:34 +00:00
Mathias Vorreiter Pedersen
e4af34253a
C++: Actually fix incorrect annotation
2022-02-24 11:06:57 +00:00
Geoffrey White
c16302be13
C++: Fix the FP.
2022-02-24 10:54:08 +00:00
Geoffrey White
326dfa5bc2
C++: Add test cases.
2022-02-23 18:37:58 +00:00
Mathias Vorreiter Pedersen
033edc24f4
C++: Respond to review comments.
2022-02-23 16:23:49 +00:00
Mathias Vorreiter Pedersen
53299d61eb
C++: Add more tests.
2022-02-23 11:38:01 +00:00
Robert Marsh
a37f746dff
C++: fix FP and add paths in InsufficientKeySize
2022-02-22 15:38:50 -05:00
Mathias Vorreiter Pedersen
ea35f56212
C++: Add a query for detecting uses of expired stack pointers that escaped through global variables.
2022-02-22 19:12:08 +00:00
Geoffrey White
4908eaf5ec
C++: Typos.
2022-02-22 14:33:11 +00:00
Robert Marsh
103796dfa8
C++: respond to PR comments on InsufficientKeySize
2022-02-16 14:58:29 -05:00
Geoffrey White
703f18b82f
C++: Better deduplication.
2022-02-15 17:52:27 +00:00
Geoffrey White
c4d9c1d9e7
C++: Reduce result duplication.
2022-02-11 16:03:38 +00:00
Geoffrey White
00ba76b7e4
C++: Convert to IR taint tracking.
2022-02-11 13:00:42 +00:00
Robert Marsh
dbe4770c7d
C++: add initial insufficient key size query
2022-02-10 14:53:40 -05:00
Geoffrey White
b0c2a144cc
C++: Remove no longer relevant tests.
2022-02-10 11:11:31 +00:00
Geoffrey White
20ad92a82e
C++: Filter noisiest sources.
2022-02-10 11:11:30 +00:00
Geoffrey White
7b5b2fdcd1
C++: Modernize cpp/system-data-exposure as a path-problem using IR taint, RemoteFlowSinkFunction.
2022-02-10 11:11:26 +00:00
Geoffrey White
5490809bcf
C++: Expand tests.
2022-02-10 10:43:21 +00:00
Jeroen Ketema
46821fe136
Update C++ variable hiding test
...
Structured bindings are now handled better, so the false negative
related to structured bindings is now a true positive.
2022-02-10 10:58:32 +01:00
Jeroen Ketema
1f2865c7cc
Merge pull request #7798 from jketema/missing-open-arg
...
C++: Add query for missing mode argument in `open`/`openat` calls
2022-02-07 12:01:44 +01:00
Geoffrey White
8031c3f699
Merge branch 'main' into clrtxt9
2022-02-03 17:01:59 +00:00
Geoffrey White
02b1774d7f
C++: Switch from GVN to localFlow.
2022-02-03 16:00:26 +00:00
Geoffrey White
3cfd1b5052
C++: More test cases.
2022-02-03 15:11:59 +00:00
Geoffrey White
4048ba0a1c
C++: Fix false positives around terminal output.
2022-02-02 17:59:28 +00:00
Geoffrey White
39a2ffd438
C++: Fix false positives around 'stdin'.
2022-02-02 17:39:14 +00:00
Jeroen Ketema
f32500306a
Address review comments
2022-02-02 17:24:55 +01:00
Geoffrey White
cc20969bdd
C++: Add test cases based on some remaining real world FPs.
2022-02-02 16:15:59 +00:00
Jeroen Ketema
92d9e51d2a
Extract the value of O_CREAT and O_TMPFILE from the defining macro
...
There are operating systems that define `O_CREAT` with a different
value than Linux, which uses `0x40`. For example, OpenBSD uses `0x0200`.
Hence, we cannot use a hardcoded value.
Also handle `O_TMPFILE` while here.
2022-02-02 15:16:26 +01:00
