erik-krogh
d370b2a51e
simplify the where clause of rb/kernel-open
2022-10-04 13:49:50 +02:00
erik-krogh
bf74481f65
add a link to the source in the alert-message for rb/kernel-open
2022-10-04 13:41:50 +02:00
Tamas Vajk
09051e76cf
Kotlin: extract isEnumConstant relation
2022-10-04 13:30:02 +02:00
Tamas Vajk
876bea653d
Kotlin: Add test case for missing enum constants
2022-10-04 13:29:15 +02:00
Tamas Vajk
d2861361d9
Kotlin: extract implInterface
2022-10-04 13:12:01 +02:00
Tamas Vajk
d50be83f57
Kotlin: add test to distinguish implements vs extends
2022-10-04 13:10:19 +02:00
Arthur Baars
88b5d4da16
Ruby: extend may have multiple arguments
2022-10-04 12:58:50 +02:00
Arthur Baars
ab3a62de3c
Update ruby/ql/lib/codeql/ruby/dataflow/internal/DataFlowPrivate.qll
2022-10-04 12:58:50 +02:00
Tom Hvitved
6e61ef10b8
Ruby: Add another dataflow copy
2022-10-04 12:58:50 +02:00
Tom Hvitved
9d7d6c29f9
Review comments
2022-10-04 12:58:50 +02:00
Tom Hvitved
77c47bc856
Ruby: Add another call graph test
2022-10-04 12:58:49 +02:00
Arthur Baars
44cc6f7350
Ruby: improve tracking of regular expressions
...
There are two flavours of `match?`. If the receiver of `match?` has type String
then the argument to `match?` is a regular expression. However, if the receiver of
`match?` has type Regexp then the argument is the text.
The role of receiver and argument flips depending on the type of the receiver, this
caused a lot of false positives when looking for string-like literals that are
used as a regular expression.
This commit attempts to improve things by trying to determine whether the type of the
receiver is known to be of type Regexp. In such cases we know that the argument
is unlikely to be regular expression.
2022-10-04 12:58:49 +02:00
Arthur Baars
0160c374e4
Ruby: add flow summaries for Object#dup and Kernel#tap
2022-10-04 12:58:49 +02:00
Arthur Baars
5d55daa491
Ruby: use resolveConstantReadAccess instead of trackModuleAccess for 'extend' calls
...
This avoids non-linear recursion at the cost of losing some results.
2022-10-04 12:58:49 +02:00
Arthur Baars
c2b98a4761
Ruby: add support for 'extend' method
2022-10-04 12:58:49 +02:00
Arthur Baars
09bc78eafc
Ruby: local dataflow step for || and &&
2022-10-04 12:58:49 +02:00
Arthur Baars
e95b5468d9
Ruby: use Dataflow for Pathname instead of TypeTracking
2022-10-04 12:58:49 +02:00
Arthur Baars
f9b952f04f
Ruby: Pathname use TypeTracker instead of local flow
2022-10-04 12:58:49 +02:00
Nick Rolfe
dd1b302fce
Ruby: revert making inActionViewContext private
2022-10-04 11:29:09 +01:00
Tony Torralba
9db65eae7f
Address review comments
2022-10-04 12:27:01 +02:00
Tony Torralba
b8fa9433be
Fix duplicated test
2022-10-04 12:27:01 +02:00
Tony Torralba
264d6db9d7
Rename AllowListGuard to AllowedPrefixGuard
2022-10-04 12:27:01 +02:00
Tony Torralba
90020b6aab
Make block lists work with substring matching too
...
A block list approach doesn't need to restrict itself to prefix matching
2022-10-04 12:27:01 +02:00
Tony Torralba
69d1895175
Update java/ql/lib/semmle/code/java/security/PathSanitizer.qll
2022-10-04 12:27:01 +02:00
Tony Torralba
6fcaae20e7
Add tests and fix bugs highlighted by them
2022-10-04 12:27:01 +02:00
Tony Torralba
f19eb783be
Generalize file/path taint steps
...
This is needed by PathSanitizer but also helps simplify ZipSlip.ql
2022-10-04 12:27:01 +02:00
Tony Torralba
4e29c39c78
Merge ZipSlip sanitization logic into PathSanitizer.qll
...
Apply code review suggestions regarding weak sanitizers
2022-10-04 12:27:01 +02:00
Tony Torralba
89d905cc03
Add change note
2022-10-04 12:27:01 +02:00
Tony Torralba
08c67fb174
Use PathInjectionSanitizer in relevant queries
2022-10-04 12:27:01 +02:00
Tony Torralba
dff878e531
Apply TaintedPath recent changes to TaintedPathLocal
2022-10-04 12:26:59 +02:00
Tony Torralba
5706e8b377
Improve PathSanitizer
...
Rename PathTraversalSanitizer to PathInjectionSanitizer
2022-10-04 12:26:17 +02:00
Tony Torralba
50ad234694
Move PathSanitizer to the main library
2022-10-04 12:26:17 +02:00
Tony Torralba
d5478a01ab
Merge pull request #10671 from github/revert-10640-atorralba/fix-cartesian-product
...
Java: Revert #10489 and #10640
2022-10-04 12:25:46 +02:00
Chris Smowton
e29be411ef
Merge pull request #9811 from smowton/smowton/feature/kotlin-jvmoverloads-annotation
...
Kotlin: Implement JvmOverloads annotation
2022-10-04 11:21:44 +01:00
Nick Rolfe
a738f1d5cf
Ruby: remove public abstract classes for Action{View,Controller}
2022-10-04 10:53:41 +01:00
Asger F
948594043d
Ruby: share type-tracking test with array test
2022-10-04 11:15:13 +02:00
Asger F
28f4dff1d3
Python: sync
2022-10-04 11:15:11 +02:00
Asger F
b6231e82ec
Ruby: do not treat WithoutElement[0..!] as a type filter
2022-10-04 11:14:31 +02:00
Asger F
3ccc3a2058
Ruby: move special treatment of Hash.[] into Hash.qll
2022-10-04 11:14:31 +02:00
Asger F
94d41b9fa4
Ruby: add hook for adding type-tracking steps
...
fixup docs
fixup docs
fixup TypeTrackingStep
2022-10-04 11:14:31 +02:00
Asger F
96711b2810
Ruby: improve join order in trackInstanceRec
2022-10-04 11:14:31 +02:00
Asger F
6e7aea85ef
Ruby: update benign test output
...
API graph tests only report the shortest path, and a new shortest path has appeared, but the old path is still there, so this is not a regression.
2022-10-04 11:14:31 +02:00
Asger F
c220f4e103
Ruby: prune unusable summaries earlier
...
Ruby: prune more aggressively
2022-10-04 11:14:30 +02:00
Asger F
ff4ce4a151
Ruby: use Element[n..] tokens in inject and reduce
2022-10-04 11:14:30 +02:00
Asger F
fd9c1e4507
Ruby: filter out obvious module 'prepend' calls
2022-10-04 11:14:30 +02:00
Asger F
00e52ad109
Ruby: add type-tracking variant of hash-flow test
...
Ruby: fixup type-tracking hash flow test
Fixup! type-tracking hash flow test result
2022-10-04 11:14:30 +02:00
Asger F
9302271c15
Ruby: Hack special-casing of hash literals
2022-10-04 11:14:30 +02:00
Asger F
bd11946aec
Ruby: support WithoutContent steps in restricted cases
...
fixup ContentFilter
fixup basicWith(out)contentstep
2022-10-04 11:14:28 +02:00
Asger F
323abf45ca
Ruby: Speed up evaluateSummaryComponentStackLocal
2022-10-04 11:12:09 +02:00
Asger F
a7d764d2a7
Ruby: Improve join order when generating edges
2022-10-04 11:12:09 +02:00
