1607 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Max Schaefer	bc74bcec21	Merge pull request #459 from owen-mc/update-barrier-guard-comment ... Make comment on BarrierGuard more specific	2021-01-25 14:34:20 +00:00
Owen Mansel-Chan	f8c3fbf845	Merge pull request #454 from owen-mc/default-taint-sanitizer-guard-equality-test-guard ... Make EqualityTestGuard a default taint sanitizer guard	2021-01-25 14:24:08 +00:00
Owen Mansel-Chan	06c6ceda50	Make comment on BarrierGuard more specific ... The problem that this comment is trying to warn about is the following: say you have two subclasses of BarrierGuard BG1 and BG2, both of which contain some node g. Also assume that you have a configuration C which specifies BG1 as a barrier guard, but not BG2. Because g is contained in both classes, you will then still get the barrier guard definition from BG2 due to the way dynamic dispatch works in QL.	2021-01-25 13:16:23 +00:00
Owen Mansel-Chan	8acf572283	Add change note	2021-01-22 17:38:26 +00:00
Owen Mansel-Chan	71f2ed36f2	Make EqualityTestGuard a default taint sanitizer guard ... It will apply to all configurations, not just those involving Xss.	2021-01-22 17:38:26 +00:00
Owen Mansel-Chan	7dfe5d9f07	Merge pull request #457 from owen-mc/cleanup-avoid-code-duplication ... Reuse existing class instead of repeating it	2021-01-21 10:56:14 +00:00
Owen Mansel-Chan	7f00ab1f08	Merge pull request #456 from owen-mc/add-guarding-function-test ... Add tests for guarding functions proxied by a variable	2021-01-21 10:55:54 +00:00
Owen Mansel-Chan	7339f3e095	Reuse existing class instead of repeating it ... This is already done elsewhere.	2021-01-20 16:11:33 +00:00
Owen Mansel-Chan	b623a4c8ec	Add tests for guarding functions proxied by a variable ... Negation doesn't appear to be handled correctly, so one of the lines is marked as a false positive.	2021-01-20 14:36:53 +00:00
Owen Mansel-Chan	e2a79f400e	Make use of this explicit ... It makes it easier to understand the code.	2021-01-19 15:55:02 +00:00
Owen Mansel-Chan	903ff33b0d	Add class for default taint sanitizer guards ... This allows us to specify taint sanitizer guards that apply in all configurations.	2021-01-18 10:51:59 +00:00
Owen Mansel-Chan	83c26a3594	Improve predicate name ... Renamed `defaultTaintSanitizer` to `isDefaultTaintSanitizer`.	2021-01-18 10:50:26 +00:00
Owen Mansel-Chan	fbe0474d0c	Merge pull request #453 from owen-mc/update-architectures ... Update Architectures.qll	2021-01-15 16:01:52 +00:00
Owen Mansel-Chan	6219a28b13	Update Architectures.qll	2021-01-15 14:01:01 +00:00
Owen Mansel-Chan	2f9c1a6049	Merge pull request #452 from owen-mc/package-path ... Use `package()` for package paths not in the standard library	2021-01-15 07:25:06 +00:00
Owen Mansel-Chan	5e2c066e8b	Use package() for package paths not in the standard library ... This has the advantage that it deals with versioning. For example, `package("a.io", "b")` matches "a.io/v2/b" as well as "a.io/b". At the same time I have created `packagePath()` predicates where they seemed useful and tried to standardise them a bit.	2021-01-14 17:11:23 +00:00
Owen Mansel-Chan	62052a8772	Merge pull request #449 from owen-mc/model-couchbase-gocb ... Model Couchbase Go library	2021-01-14 17:00:05 +00:00
Owen Mansel-Chan	a6b5e8b1db	Remove distinct between package paths for v1 and v2	2021-01-14 15:48:21 +00:00
Owen Mansel-Chan	5cd984f3ca	Merge pull request #450 from owen-mc/misc ... Miscellaneous clean-ups	2021-01-13 12:33:21 +00:00
Owen Mansel-Chan	b5dfef894b	Add change note	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	d8105a5be0	Add tests for Couchbase v2 NoSQL queries	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	b02fc16dfc	Add tests for Couchbase v1 NoSQL queries	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	2ee20b3026	Add tests for Couchbase v1	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	d2164e16d1	Switch NoSQL tests to use inline expectations	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	a5ac947d16	Model Couchbase v2 NoSQL queries	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	7fc88ad85b	Model Couchbase v1 NoSQL query sinks	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	a973ce4539	Model Couchbase gocb v1	2021-01-13 09:18:54 +00:00
Owen Mansel-Chan	9a51de56de	Add comment explaining \Q and \E in regex	2021-01-12 16:56:04 +00:00
Owen Mansel-Chan	9236ad752b	Improve formatting and style in Gin.qll	2021-01-12 16:56:04 +00:00
Owen Mansel-Chan	71774ed2d4	Remove redundant code ... RawMessage implements Marshaler and Unmarshaler, so these methods are covered by the two sections below	2021-01-12 16:56:04 +00:00
Owen Mansel-Chan	57ee3a8a64	Use set literal	2021-01-12 16:56:04 +00:00
Owen Mansel-Chan	fe1f08fb12	Use existing predicate ... There already exists the predicate implements(string pkg, string tp, string name) which does exactly what this code does	2021-01-12 16:55:51 +00:00
Sauyon Lee	3f1197d605	Merge pull request #448 from sauyon/autoformat ... Autoformatter update	2021-01-12 14:29:45 +00:00
Sauyon Lee	c11028229a	Bump codeql version	2021-01-12 13:15:31 +00:00
Sauyon Lee	7a4dbc6fa7	Autoformatter update	2021-01-12 13:13:15 +00:00
Chris Smowton	c79e4f7836	Merge pull request #447 from smowton/smowton/admin/git-change-note ... Add change-note for addition of `git` to the list of known interpreters for the go/command-injection query	2021-01-12 11:33:49 +00:00
Chris Smowton	a9cff82161	Add change-note for addition of git to the list of known interpreters for the go/command-injection query.	2021-01-11 18:48:54 +00:00
Chris Smowton	45635b67c6	Merge pull request #445 from smowton/smowton/feature/git-as-shell ... Add 'git' as a possible command-interpreter, unless arguments are sanitized using "--"	2021-01-07 15:01:25 +00:00
Chris Smowton	83cee4a334	Add 'git' as a possible command-interpreter, unless arguments are sanitized using "--" ... This is because some git flags can specify arbitrary commands to execute, but its positional arguments cannot, and "--" like in many commands instructs git to consume no further flags.	2021-01-07 11:54:41 +00:00
Chris Smowton	2dffd3e261	Merge pull request #443 from smowton/smowton/admin/missing-change-notes-2021-01 ... Add change-notes for recent PRs that were missing them	2021-01-05 11:41:35 +00:00
Chris Smowton	e6327f502c	Merge pull request #444 from smowton/smowton/admin/merge-rc-126 ... Merge rc/1.26 back into `main`	2021-01-05 11:40:34 +00:00
Chris Smowton	19921ed115	Add change-notes for recent PRs that were missing them	2021-01-05 11:39:26 +00:00
Chris Smowton	2b608e5822	Merge remote-tracking branch 'origin/rc/1.26' into HEAD	2021-01-04 15:32:15 +00:00
Sauyon Lee	ace9271cc4	Merge pull request #441 from twpayne/contributing-building-and-testing ... Docs: Add building and testing to contributing guide	2020-12-29 11:13:37 -08:00
Tom Payne	06721ce189	Docs: Add building and testing to contributing guide	2020-12-29 00:28:17 +01:00
Sauyon Lee	2ba26f69c0	Merge pull request #440 from twpayne/regexp-anchors ... Support more regexp anchors	2020-12-23 11:42:06 -08:00
Tom Payne	9bbdf86487	Support more regexp anchors	2020-12-23 14:04:33 +01:00
Chris Smowton	5647a47bd4	Merge pull request #436 from sauyon/InVisionApp/main ... Refactor HTTP tests	2020-12-18 12:08:46 +00:00
Jason Rogers	baa169cc77	Refactored HTTP tests ... This will align test location with the library.	2020-12-17 08:10:06 -08:00
Owen Mansel-Chan	e3d0ccabae	Merge pull request #435 from owen-mc/use-implements-where-possible ... Use `implements` for interface methods	2020-12-17 16:02:14 +00:00