hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-22 03:36:30 +01:00
Code Issues Packages Projects Releases Wiki Activity
46,831 Commits 1,672 Branches 157 Tags
c2035e85d2bef276a8da5d84e88e390fa1ceaf9c
Commit Graph

86 Commits

Author SHA1 Message Date
Geoffrey White
af9ad7b699 Merge branch 'main' into tuples 2022-11-08 21:38:38 +00:00
Geoffrey White
24c8f1d8b5 Swift: Add some local (and remote) flow sources for String. 2022-11-08 13:38:25 +00:00
Geoffrey White
c5285acb04 Swift: Add more tests for String flow sources. 2022-11-08 13:05:40 +00:00
Geoffrey White
645906a7d7 Merge branch 'main' into tuples 2022-11-07 13:17:12 +00:00
Geoffrey White
3c07ff592a Swift: Fix result expectations. 2022-11-04 09:44:48 +00:00
Geoffrey White
24f0eeb6df Swift: Better assigning to tuple values. 2022-11-03 15:52:01 +00:00
Geoffrey White
6dc51edb4c Swift: Assigning to tuple values. 2022-11-03 15:51:58 +00:00
Geoffrey White
472ece45e7 Swift: Basic content flow through tuples. 2022-11-03 15:51:33 +00:00
Geoffrey White
a7ecdef2a6 Swift: Add dataflow tests for tuples. 2022-11-03 15:50:27 +00:00
Tony Torralba
b62ede1544 Fix issue in JsExportedSource 
Model the source as an access to the tainted field, instead of the field itself (which didn't work)
 2022-10-31 12:08:03 +01:00
Tony Torralba
2402504a4c Add missing SummaryPostUpdateNode 2022-10-28 18:24:17 +02:00
Tony Torralba
baf7986cfa Rework types exported through JSContext 
Better model the JSExport protocol logic
 2022-10-28 15:56:05 +02:00
Tony Torralba
48b0cc0229 Add models for JSContext and JSValue 2022-10-28 13:01:25 +02:00
Tony Torralba
81701547b2 Add taint sources for WKScriptMessage 
This is what contains externally-provided data in Webview JS-native bridges
 2022-10-28 12:58:27 +02:00
Mathias Vorreiter Pedersen
062a0abceb Swift: Fix flow out of summarized callables. 2022-10-28 12:09:05 +02:00
Tony Torralba
30f5fb6d83 Update expectations after merge 2022-10-24 14:24:13 +02:00
Tony Torralba
f523fbc9d0 Merge branch 'main' into atorralba/swift/customurlschemes 2022-10-24 11:41:50 +02:00
Tony Torralba
3973e1ce04 Update swift/ql/test/library-tests/dataflow/dataflow/FlowConfig.qll 
Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>
 2022-10-24 11:37:51 +02:00
Tony Torralba
80f7d58fae Add missing tests for not-quite-working flow steps 2022-10-24 09:37:22 +02:00
Paolo Tranquilli
408968a417 Swift: fix swift compilation in QL tests 2022-10-21 15:20:38 +02:00
Tony Torralba
c2a2d6b379 Fix LaunchOptionsUrlVarDecl 
Update test expectations
 2022-10-19 17:42:28 +02:00
Tony Torralba
e2c9240973 Add a new Custom URL Scheme source 
Also adds a couple of data flow steps to model flow through `?` expressions.
 2022-10-19 16:55:14 +02:00
Tony Torralba
1d745a6365 Merge pull request #10774 from atorralba/atorralba/swift/url-field-summaries 
Swift: Add summaries for tainted URL fields
 2022-10-18 15:32:23 +02:00
Tony Torralba
0eeaf71716 Simplify models by introducing TaintInheritingContent 2022-10-18 12:36:18 +02:00
Tony Torralba
81d38132cf Fix test expectations 2022-10-17 12:00:51 +02:00
Tony Torralba
1e4850044c Increase precision of the URL(string:relativeTo:) models 2022-10-17 11:29:30 +02:00
Tony Torralba
4b2aa93a05 Update test expectations after rebase 2022-10-11 17:54:59 +02:00
Mathias Vorreiter Pedersen
fc810ddbf4 Merge pull request #10775 from atorralba/atorralba/swift/custom-url-scheme-sources 
Swift: Add taint sources for custom URL scheme URLs
 2022-10-11 16:47:52 +01:00
Tony Torralba
8525db5af6 Add summaries for tainted URL fields 2022-10-11 17:24:26 +02:00
Tony Torralba
f4d43deec4 Add taint sources for custom URL scheme URLs 2022-10-11 17:19:04 +02:00
Tony Torralba
0892a5795d Add taint step for subscript expressions 2022-10-11 15:33:45 +02:00
Mathias Vorreiter Pedersen
0065a5af96 Swift: Accept path-explanation test changes. 2022-10-06 10:30:18 +01:00
Mathias Vorreiter Pedersen
1edd4d855a Swift: Add an example with flow through a callback function. 2022-10-06 10:30:11 +01:00
Mathias Vorreiter Pedersen
0b6ea703ea Swift: Create explicit parameter nodes for source parameters and MaD parameters. 2022-10-06 10:29:52 +01:00
Mathias Vorreiter Pedersen
2593120300 Merge pull request #10597 from geoffw0/swifttaintsource 
Swift: URL taint sources
 2022-10-04 09:22:27 +01:00
Geoffrey White
1248810e35 Swift: Add model for URL.resourceBytes and URL.lines. 2022-09-27 18:58:56 +01:00
Geoffrey White
fa5e03a53d Swift: Add tests of URL.resourceBytes and URL.lines. 2022-09-27 18:58:56 +01:00
Geoffrey White
69dd2c0eec Swift: Add a test of taint sources. 2022-09-27 18:58:56 +01:00
Geoffrey White
3ffb2a3ee6 Swift: Fix. 2022-09-27 18:39:03 +01:00
Geoffrey White
286fcb672c Swift: Additional test results. 2022-09-27 18:31:43 +01:00
Mathias Vorreiter Pedersen
a4209df239 Merge branch 'main' into swift-field-flow-2 2022-08-30 18:52:23 +01:00
Paolo Tranquilli
38d65d3fae Swift: make ConstructorDecl's name include params 
In order to distinguish overloads of the constructor and for consistency
with other function calls, `ConstructorDecl` string representation uses
the name which includes parentheses and parameter labels.

For consistency also the destructor got the same change, which means
all `DestructorDecl`s will now show as `deinit()` rather than `deinit`.
 2022-08-30 11:11:50 +02:00
Mathias Vorreiter Pedersen
f2d9393928 Swift: Only test local-flow step relations for nodes with proper location information. 2022-08-24 17:14:11 +01:00
Mathias Vorreiter Pedersen
2d90940111 Swift: Add field flow. 2022-08-24 14:52:36 +01:00
Mathias Vorreiter Pedersen
edb29b498d Swift: Teach 'DataFlowDispatch' about property getters, observers and setters. 2022-08-24 13:08:26 +01:00
Mathias Vorreiter Pedersen
de03fbdc49 Swift: Accept test changes. 2022-08-24 10:03:21 +01:00
Mathias Vorreiter Pedersen
6e148a4c3f Swift: Use the inline testing framework for dataflow tests. 2022-08-23 16:31:05 +01:00
Paolo Tranquilli
9b50336e47 Swift: synthesize MethodRefExpr 
This introduces a `MethodRefExpr` node synthesized out of
`DotSyntaxCallExpr` under the `LookupExpr` hierarchy. This means that
much like
```free_function(1, 2)```
is a `CallExpr` with `getFunction` giving a `DeclRefExpr`,
```foo.method(1, 2)```
is now a `CallExpr` with `getFunction` giving a `MethodRefExpr`.

`ApplyExpr::getStaticTarget` has been made work with it (as well as
`ConstructorRefCallExpr` which for the moment has been left where it
is), a new `MethodApplyExpr` has been introduced deriving from it,
and control and data flow libraries have adapted.

A small but was fixed in `qlgen` where the default constructor for DB
types was not correctly subtracting derived IPA types depending on the
order of definitions in `schema.yml`.

There are still some occurrences of `DotSyntaxCallExpr`, and as already
mentioned the other `SelfApply` class (`ConstructorRefCallExpr`) was
left alone. Their treatment is left for a future PR.
 2022-08-19 14:48:36 +02:00
Geoffrey White
1dcc44ff2f Swift: taintedFromLine -> tainted. 2022-08-11 11:01:05 +01:00
Geoffrey White
d16a7754e1 Swift: Take out common code. 2022-08-10 19:04:01 +01:00