Tony Torralba
6d7234f8ed
Merge pull request #13225 from atorralba/atorralba/java/path-injection-mad-sinks-2
...
Java: Migrate path injection sinks to models-as-data (simplified)
2023-06-07 14:27:36 +02:00
Erik Krogh Kristensen
6ba7f9a238
Merge pull request #13352 from erik-krogh/once-again-deps-not-py-cpp
...
delete old deprecations
2023-06-07 13:00:57 +02:00
Ian Lynagh
f690d150b0
Merge pull request #13373 from igfoo/igfoo/kotlin-loc
...
Java/Kotlin: Split lines of code by language
2023-06-06 11:49:18 +01:00
Nick Rolfe
6c5c338e6b
Merge pull request #13348 from github/nickrolfe/java-location-tostring
...
Java: avoid call to `Location.toString()`
2023-06-06 09:55:42 +01:00
Ian Lynagh
e49b278d61
Java/Kotlin: Add a changenote for the lines-of-code changes.
2023-06-05 16:33:12 +01:00
Ian Lynagh
a4a7ad8f99
Java/Kotlin: Split lines of code by language
...
We were giving the sum of all lines for both languages, but labelling it
as "Total lines of Java code in the database", which was confusing.
Now we give separate sums for Kotlin and Java lines.
2023-06-05 13:57:47 +01:00
erik-krogh
44b6366586
delete old deprecations
2023-06-02 11:58:08 +02:00
Tony Torralba
527fe523a8
Add PathCreation.qll sinks to models-as-data
...
The old PathCreation sinks can't be removed because doing so would cause alert wobble in the path injection queries. See their getReportingNode predicates.
2023-06-02 09:14:35 +02:00
Jami
617107de35
Merge pull request #12916 from jcogs33/jcogs33/revamp-java-sink-kinds
...
Java: revamp MaD sink kinds
2023-06-01 12:48:30 -04:00
Nick Rolfe
7290e2bfd9
Java: avoid call to Location.toString()
2023-06-01 17:06:34 +01:00
Erik Krogh Kristensen
96a720cfa0
Merge pull request #13285 from erik-krogh/redoshelp
...
ReDoS: fix whitespace in the samples in ReDoS.qhelp
2023-06-01 15:53:58 +02:00
Jami Cogswell
5dbb698481
Java: update open/jdbc-url sink kinds to request-forgery
2023-05-31 15:50:31 -04:00
Jami Cogswell
cb10f4976b
Java: update create/read-file sink kinds to path-injection
2023-05-31 15:49:07 -04:00
Jami Cogswell
eb1a8e2189
Java: update write-file sink kind to file-system-store
2023-05-31 15:49:07 -04:00
Jami Cogswell
430010daa3
Java: update logging sink kind to log-injection
2023-05-31 15:49:06 -04:00
Arthur Baars
490d22d123
Merge remote-tracking branch 'upstream/main' into post-release-prep/codeql-cli-2.13.3
2023-05-30 21:31:28 +02:00
Andrew Eisenberg
6ba8f9eb36
Merge pull request #13314 from github/aeisenberg/adds-to-pack
...
Fix `addsTo.pack` references
2023-05-30 08:30:16 -07:00
Andrew Eisenberg
2d81e30d81
Fix addsTo.pack references
...
This change is a prerequisite for a CLI change where there will be
strict testing of the `addsTo.pack` values. It must resolve to a pack
reference that is a transitive dependency of the current query's pack.
2023-05-29 13:45:41 -07:00
Tony Torralba
6386ef3b96
Further perf improvements
2023-05-29 09:58:52 +02:00
Tony Torralba
4dfc9b13cd
Java: Fix performance issue in the stub generator
2023-05-26 12:44:53 +02:00
erik-krogh
9f5bf8fb22
also fix the first code-block
2023-05-25 13:56:29 +02:00
erik-krogh
765076bcba
fix whitespace in the samples in ReDoS.qhelp
2023-05-25 13:28:39 +02:00
github-actions[bot]
d2e192020b
Post-release preparation for codeql-cli-2.13.3
2023-05-24 11:26:12 +00:00
Erik Krogh Kristensen
50cb5ea184
Merge pull request #13164 from erik-krogh/polyQhelp
...
ReDoS: add another example to the qhelp in poly-redos, showing how to just limit the length of the input
2023-05-23 09:25:15 +02:00
github-actions[bot]
7aa23cf11d
Release preparation for version 2.13.3
2023-05-22 20:47:00 +00:00
erik-krogh
710b309142
apply suggestions from doc review
2023-05-21 22:18:48 +02:00
erik-krogh
10bf17c33e
Merge branch 'main' into polyQhelp
2023-05-21 22:17:06 +02:00
Tony Torralba
b58eb3a92c
Java: Add TemplateEngine.createTemplate as a groovy injection sink
2023-05-19 17:45:47 +02:00
Tony Torralba
1b06bf132c
Merge pull request #12932 from atorralba/atorralba/java/promote-xxe-experimental-sinks
...
Java: Promote experimental XXE sinks
2023-05-17 17:39:31 +02:00
Stephan Brandauer
a5ef738bb0
add extra parameters in query-messages
2023-05-17 08:37:18 +00:00
erik-krogh
480e71fd69
avoid contractions
2023-05-17 08:42:45 +02:00
Stephan Brandauer
2cd8a879a5
use asParameter().getName() instead of toString()
...
Co-authored-by: Taus <tausbn@github.com >
2023-05-16 17:28:02 +02:00
Stephan Brandauer
9845887452
automodel java fix: export method name as 'name' metadata parameter; export parameter name as 'parameterName' parameter
2023-05-16 15:07:14 +00:00
Tony Torralba
770099f210
Merge branch 'main' into atorralba/java/promote-xxe-experimental-sinks
2023-05-16 09:49:34 +02:00
Tony Torralba
7d79d87d48
Add XPath.evaluate as XXE sink
2023-05-15 17:39:35 +02:00
erik-krogh
83ca1495e0
trim the whitespace in the poly-redos examples
2023-05-15 16:47:24 +02:00
erik-krogh
d989359656
add another example to the qhelp in poly-redos, showing how to just limit the length of the input
2023-05-15 16:47:02 +02:00
Kasper Svendsen
d40cd0f275
Java: Make implicit this receivers explicit
2023-05-12 12:47:21 +02:00
Stephan Brandauer
510febf46d
Merge pull request #12830 from github/kaeluka/parameter-candidate-extraction
...
Java: Automodel Framework Mode Extraction Queries
2023-05-11 18:00:55 +02:00
Stephan Brandauer
c31ad01579
squash ql-for-ql warnings
2023-05-11 16:18:52 +02:00
Tony Torralba
c17b0e809f
Apply suggestions from code review
2023-05-11 14:53:56 +02:00
Anders Schack-Mulligen
587ee53917
Java: Fix ExternalApi.jarContainer().
2023-05-11 14:09:27 +02:00
Stephan Brandauer
e15610cfcd
use ascii dash
2023-05-11 11:32:05 +02:00
Stephan Brandauer
f3d096cf37
update DollarAtString class to use hasLocationInfo instead of getURL
2023-05-10 15:02:22 +02:00
Stephan Brandauer
79f2beca2a
ql-for-ql
2023-05-10 14:04:29 +02:00
Stephan Brandauer
cd388264d3
use new DollarAtString class to return metadata using notation
2023-05-10 13:44:50 +02:00
Stephan Brandauer
6be11d93bd
document FrameworkCandidatesImpl
2023-05-10 12:03:32 +02:00
Stephan Brandauer
d2d884b007
special case for Argument[this]
2023-05-10 11:53:40 +02:00
Stephan Brandauer
7ae6a992b6
fix code compilation error after main branch breaking change
2023-05-10 11:29:49 +02:00
Stephan Brandauer
9ed3c248ad
Merge branch 'main' into kaeluka/parameter-candidate-extraction
2023-05-10 11:26:49 +02:00
