Mathias Vorreiter Pedersen
aca4c8727f
Merge pull request #8802 from github/post-release-prep/codeql-cli-2.9.0
...
Post-release preparation for codeql-cli-2.9.0
2022-04-25 22:52:55 +01:00
Anders Schack-Mulligen
c06efa1f42
Dataflow: Sync.
2022-04-25 13:11:04 +02:00
Anders Schack-Mulligen
40a16325a9
Minor clean-up in AccessPathSyntax.
2022-04-25 12:27:48 +02:00
Tom Hvitved
bffa8fa7cb
Merge pull request #8641 from hvitved/dataflow/interpret-read-store
...
Data flow: Introduce `ContentSet`
2022-04-25 12:17:34 +02:00
Tom Hvitved
2466288656
Data flow: Simplify revFlowStore
2022-04-25 10:11:54 +02:00
Tom Hvitved
cf0a1e748a
Add change notes
2022-04-25 09:17:40 +02:00
Jeroen Ketema
79164056d1
Replace help.semmle.com links by codeql.github.com links
2022-04-22 20:42:11 +02:00
Tom Hvitved
bc6ee10583
Data flow: Sync files
2022-04-22 15:10:00 +02:00
Tom Hvitved
488a4ede94
Data flow: Inline getAStoreContent up-front
2022-04-22 15:09:59 +02:00
Tom Hvitved
b033f107df
Merge remote-tracking branch 'upstream/main' into dataflow/interpret-read-store
2022-04-22 14:35:02 +02:00
Erik Krogh Kristensen
ff73dbc35c
delete redundant imports
2022-04-22 12:55:28 +02:00
Erik Krogh Kristensen
a96489b23d
delete duplicate imports
2022-04-22 12:41:30 +02:00
Erik Krogh Kristensen
c015ef6ef4
Merge pull request #8810 from erik-krogh/rubyPathgraph
...
Ruby: dont import the PathGraph module from Query.qll files
2022-04-22 12:02:59 +02:00
Tom Hvitved
093a3879be
Merge pull request #8794 from hvitved/ruby/capture-barrier-guards
...
Ruby: Handle captured variables in `BarrierGuard::getAGuardedNode()`
2022-04-22 11:47:36 +02:00
Erik Krogh Kristensen
a737350f27
RB: dont import the PathGraph module from Query.qll files
2022-04-22 11:46:06 +02:00
Tom Hvitved
be5363ea53
Merge pull request #8801 from hvitved/ruby/exclude-splat-in-taint-tracking
...
Ruby: Exclude `SplatExpr` from taint tracking
2022-04-22 11:12:05 +02:00
github-actions[bot]
1aecfc67c2
Post-release preparation for codeql-cli-2.9.0
2022-04-21 19:22:19 +00:00
Tom Hvitved
c20ce62767
Ruby: Exclude SplatExpr from taint tracking
...
`SplatExpr`s are modelled using flow summaries, so there is no need to include them
explicitly in `defaultAdditionalTaintStep`.
2022-04-21 20:27:04 +02:00
Dave Bartolomeo
f042d9bfea
Fix formatting in change log
2022-04-21 10:58:26 -04:00
Dave Bartolomeo
36ca792986
Fix formatting in change log
2022-04-21 10:57:35 -04:00
Dave Bartolomeo
ab50df829e
Fix formatting in change log
2022-04-21 10:57:05 -04:00
github-actions[bot]
eeaf233c29
Release preparation for version 2.9.0
2022-04-21 14:49:00 +00:00
Tom Hvitved
bd09c61504
Merge pull request #8786 from hvitved/ruby/dataflow/argument-tokens
...
Ruby: Implement `Argument[any]` and `Argument[n..]`
2022-04-21 16:31:24 +02:00
Tom Hvitved
addb92f13b
Ruby: Handle captured variables in BarrierGuard::getAGuardedNode()
2022-04-21 13:25:47 +02:00
Tom Hvitved
325b451288
Ruby: Add barrier guards test involving captured variables
2022-04-21 13:25:40 +02:00
Erik Krogh Kristensen
8bd975a6ec
Merge pull request #8785 from hvitved/ruby/api-graph-labels
...
Ruby: Mention `newtype` constructors in API graph label classes
2022-04-20 18:32:09 +02:00
Anders Schack-Mulligen
677c436e99
Merge pull request #8703 from aschackmull/dataflow/revert-state-in-out-barriers
...
Dataflow: Revert support for flow-state based in-/out-barriers
2022-04-20 14:54:02 +02:00
Tom Hvitved
b4542c58c2
Ruby: Implement Argument[any] and Argument[n..]
2022-04-20 13:55:18 +02:00
Tom Hvitved
501b03149f
Ruby: Mention newtype constructors in API graph label classes
2022-04-20 13:37:55 +02:00
Nick Rolfe
9b2a98326c
Ruby: update use of PostUpdateNode now that it's public
2022-04-20 12:08:41 +01:00
Nick Rolfe
9b6e610e24
Merge remote-tracking branch 'origin/main' into nickrolfe/incomplete_sanitization
2022-04-20 12:05:22 +01:00
Nick Rolfe
f1b8af1db9
Ruby: rename PostUpdateNode::Range to PostUpdateNodeImpl
2022-04-20 10:35:40 +01:00
Nick Rolfe
c02670aca2
Ruby: make PostUpdateNode public
2022-04-19 17:12:51 +01:00
Anders Schack-Mulligen
48fbbf2531
Dataflow: Add change notes.
2022-04-19 15:29:35 +02:00
Anders Schack-Mulligen
b521d64156
Dataflow: Sync.
2022-04-19 15:29:35 +02:00
Nick Rolfe
08f6fbbe10
Ruby: make comment about backslash escaping clearer
2022-04-19 14:05:17 +01:00
Nick Rolfe
76c6a521fd
Ruby: add clarifying comment
2022-04-19 13:10:57 +01:00
Nick Rolfe
76587c4144
Ruby: fix capitalisation of String in qhelp
2022-04-19 11:42:31 +01:00
Nick Rolfe
468c718da0
Ruby: simplify predicate
2022-04-19 11:32:26 +01:00
Nick Rolfe
ac805f0cdc
Ruby: simplify predicate by using DataFlow::CallNode
2022-04-19 11:27:33 +01:00
Nick Rolfe
ca4dc0583d
Ruby: fix comment typos
2022-04-19 11:15:34 +01:00
Nick Rolfe
14de91ce94
Ruby: make StringSubstitutionCal extend DataFlow::CallNode
2022-04-19 10:52:14 +01:00
Mathias Vorreiter Pedersen
91b413d59f
Dataflow: Sync identical files.
2022-04-19 09:57:21 +01:00
Harry Maclean
c3f1fba985
Merge pull request #8598 from hmac/hmac/insecure-dep-resolution
...
Ruby: Add rb/insecure-dependency query
2022-04-14 02:09:44 +02:00
Nick Rolfe
a1a7d2c088
Ruby: add changenote for rb/incomplete-sanitization
2022-04-13 17:32:38 +01:00
Nick Rolfe
fdca896614
Ruby: improve handling of [g]sub!
...
rb/incomplete-sanitization has a few cases where we find flow from one
one string substitution call to another, e.g.
a.sub(...).sub(...)
But this didn't find typical chained uses of the destructive variants,
e.g.
a.sub!(...)
a.sub!(...)
We now handle those cases by tracking flow from the post-update node for
the receiver of the first call.
2022-04-13 17:19:25 +01:00
Nick Rolfe
bbb8177176
Ruby: add rc/incomplete-sanitization query
2022-04-13 16:48:43 +01:00
Dave Bartolomeo
9f074cd8fd
Bump a few more versions
...
Also fixes up some dependency declarations that should have been "*" because they refer to packs in the same workspace.
2022-04-08 13:01:41 -04:00
Edoardo Pirovano
f25618eed6
Bump minor version of all packs
2022-04-08 15:38:58 +01:00
Edoardo Pirovano
ce82c54b94
Merge branch 'main' into edoardo/3.5-mergeback
2022-04-08 15:30:58 +01:00
