Michael Nebel
a2d9f4f6f4
Java: Introduce language specific file for model generator code.
2022-03-14 13:40:40 +01:00
jorgectf
a0bf68f7cd
Generally extend TaintTracking::AdditionalTaintStep
2022-03-14 13:39:20 +01:00
Michael Nebel
a1c642685a
Java: Re-arrange code in ModelGeneratorUtils.
2022-03-14 13:35:56 +01:00
Chris Smowton
f83ea25ead
Add change note
2022-03-14 12:14:37 +00:00
Erik Krogh Kristensen
3bf5e06d53
delete all dead code
2022-03-14 13:03:31 +01:00
Chris Smowton
aada8d3af9
Merge pull request #8405 from smowton/smowton/fix/range-analysis-use-ranked-phi-nodes
...
C#/Java: Range analysis: use ranked phi nodes
2022-03-14 11:55:55 +00:00
Jeroen Ketema
4c2081b7fc
Merge pull request #8401 from jketema/taint-flow
...
Extend taint tracking interface with flow states
2022-03-14 12:06:10 +01:00
Erik Krogh Kristensen
83f26eb833
rename all upper-case variables to start with a lower-case letter
2022-03-14 11:50:48 +01:00
Erik Krogh Kristensen
bbb2847ec1
Merge pull request #8323 from erik-krogh/acronyms
...
Enforcing consistent casing of acronyms
2022-03-14 11:38:25 +01:00
Jeroen Ketema
c832b21fbe
Add change notes for changes to the taint tracking library
2022-03-14 10:38:48 +01:00
Tony Torralba
1f4f4207b5
Add missing security-severity scores
2022-03-14 09:50:14 +01:00
jorgectf
ded9663f2b
Finish taint steps
2022-03-13 13:59:03 +01:00
p0wn4j
ee67d27b56
Java: Add JDBC connection SSRF sinks
2022-03-12 16:35:32 +04:00
Joe Farebrother
b924de631f
Add change note, minor docs improvement
2022-03-11 17:58:52 +00:00
Joe Farebrother
594d51e84d
Exclude constants
2022-03-11 17:45:42 +00:00
Joe Farebrother
06f2c03828
Add tests
2022-03-11 17:44:52 +00:00
Jonathan Leitschuh
50ff2c2c68
Code cleanup from code review
2022-03-11 11:44:15 -05:00
Chris Smowton
58d4513d84
Change note
2022-03-11 12:51:13 +00:00
Chris Smowton
496cae7742
Revert 8325, Add CharacterLiteral to CompileTimeConstantExpr.getStringValue
...
As pointed out in 8325's thread, this breaks the corner case of char-literal addition and the convention that getStringValue only applies to String-typed constants.
2022-03-11 12:45:53 +00:00
Chris Smowton
579b57cf67
Range analysis: use ranked phi nodes
...
This borrows a technique (and the implementing code) off Modulus analysis.
2022-03-11 12:32:12 +00:00
Erik Krogh Kristensen
1e365611fc
fix all other implicit-this warnings introduced by the acronym patch
2022-03-11 13:22:07 +01:00
Erik Krogh Kristensen
2e2970128e
fix typo in change-note
2022-03-11 13:16:34 +01:00
Jeroen Ketema
93a0da75b6
Fix taint tracking configurations that broke due to interface change
2022-03-11 12:18:04 +01:00
Chris Smowton
46cd85c70b
Revert #8360 , "Add CompileTimeConstantExpr.getStringified method"
2022-03-11 11:13:21 +00:00
Jeroen Ketema
cd28f09ae0
Extend taint tracking interface with flow states
2022-03-11 11:50:35 +01:00
Chris Smowton
f006cd0e37
Merge pull request #8360 from JLLeitschuh/feat/JLL/compile_time_constant_getStringified
...
[Java] Add CompileTimeConstantExpr.getStringified method
2022-03-11 10:34:52 +00:00
Erik Krogh Kristensen
1a275a32f7
add change-notes
2022-03-11 11:18:14 +01:00
Erik Krogh Kristensen
bb32c79f0c
Java: add missing qldoc
2022-03-11 11:17:38 +01:00
Erik Krogh Kristensen
cc43a94385
Java: remove duplicated class
2022-03-11 11:10:38 +01:00
Erik Krogh Kristensen
69353bb014
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
Tony Torralba
c99bad4047
Recover old change note
2022-03-11 10:35:04 +01:00
github-actions[bot]
3a5ebbb861
Post-release preparation for codeql-cli-2.8.3
2022-03-11 09:23:34 +00:00
Jonathan Leitschuh
1c9864286d
Remove SystemProperty from FlowSources
2022-03-10 18:29:29 -05:00
github-actions[bot]
6b194bc55f
Release preparation for version 2.8.3
2022-03-10 19:43:58 +00:00
Jonathan Leitschuh
ecb8911756
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-03-10 11:48:16 -05:00
Joe Farebrother
4bf6c10896
Split configs into Query.qll library
2022-03-10 13:23:40 +00:00
Chris Smowton
3113b27606
Fix style
2022-03-10 10:03:14 +00:00
Erik Krogh Kristensen
9c4fcf4c6d
fix typo in change-note
...
Co-authored-by: Stephan Brandauer <kaeluka@github.com >
2022-03-09 18:28:13 +01:00
Erik Krogh Kristensen
5312e4a8b5
add change note that all old deprecations were deleted
2022-03-09 18:28:11 +01:00
Erik Krogh Kristensen
f924d69dbd
Java: remove deprecations that were recently updated from an automated patch of mine
2022-03-09 18:28:11 +01:00
Erik Krogh Kristensen
a86f0afb3c
delete all deprecations that are over 14 months old
2022-03-09 18:28:07 +01:00
Jonathan Leitschuh
2a6c4e9350
Add localFlowPlusInitializers
2022-03-09 11:06:26 -05:00
Jonathan Leitschuh
363fff2358
Cleanup from code review feedback
2022-03-09 10:48:06 -05:00
Taus
7b877fb317
Merge pull request #8336 from tausbn/python-fix-a-bunch-of-ql-warnings
...
Python: Fix a bunch of QL warnings
2022-03-09 16:31:28 +01:00
Jonathan Leitschuh
65457cc2e2
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-03-09 10:25:05 -05:00
jorgectf
447636bf1c
Attempt to add MyBatis' sinks and taint steps to SQL and OGNL injection queries
2022-03-09 04:21:26 +01:00
jorgectf
e000163614
Properly model AbstractSQL sinks and taint steps
2022-03-09 04:20:34 +01:00
Taus
063a8bbc43
Python: Apply suggestions from code review
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-08 15:20:35 +01:00
Jonathan Leitschuh
2e8b5f743b
[Java] Add CompileTimeConstantExpr.getStringified method
...
Removes CharacterLiteral from CompileTimeConstantExpr.getStringValue
Resolves:
- https://github.com/github/codeql/pull/8325#issuecomment-1060470279
- https://github.com/github/codeql/pull/8325#issuecomment-1060587205
2022-03-07 20:11:38 -05:00
Jonathan Leitschuh
a21992ade9
Minor refactoring to improve tests and documentation
2022-03-07 18:40:53 -05:00
