Sauyon Lee
c8a2a6356a
Add summary parameter nodes
2021-12-07 07:39:25 -05:00
Sauyon Lee
4af4a11729
Make getACallee return DataFlowCallable
2021-12-07 07:39:24 -05:00
Sauyon Lee
8cba368ef5
Model archive/tar.FileInfoHeader in CSV
2021-12-07 07:39:24 -05:00
Sauyon Lee
86d3410041
Add asFunctionNode to new dataflowcallable
2021-12-07 07:39:23 -05:00
Sauyon Lee
d9383d9412
Don't use internal predicates in revel
2021-12-07 07:39:23 -05:00
Sauyon Lee
73684f483c
Allow for Return[i] specifications
2021-12-07 07:39:22 -05:00
Sauyon Lee
aa747ea5ff
Fix validation regexes for go
2021-12-07 07:39:22 -05:00
Sauyon Lee
0151cd4f2e
Document SourceOrSinkElement
2021-12-07 07:39:22 -05:00
Sauyon Lee
0b50b7b2b1
Make DataFlowCallable either a Function or a FuncLit
2021-12-07 07:39:21 -05:00
Sauyon Lee
3ac2a50497
Update test output
2021-12-07 07:39:21 -05:00
Owen Mansel-Chan
763861bef9
Keep call to defaultTaintSanitizerGuard
2021-12-07 07:39:21 -05:00
Sauyon Lee
e41d609921
Use newtype for SourceOrSinkElement
2021-12-07 07:39:20 -05:00
Sauyon Lee
9bfe1c94b3
autoformat
2021-12-07 07:39:20 -05:00
Sauyon Lee
16371ac488
Add support for summary elements
2021-12-07 07:39:19 -05:00
Sauyon Lee
96c58b58dd
Add EmptyInterfaceType
2021-12-07 07:39:19 -05:00
Sauyon Lee
26d00f1d5b
Move basicLocalFlowsStep to DataFlowPrivate
2021-12-07 07:39:19 -05:00
Sauyon Lee
3098a4ef16
Qualify uses and add imports in DataFlowNodes
2021-12-07 07:39:18 -05:00
Sauyon Lee
93f2569f1d
Refactor data-flow nodes
2021-12-07 07:39:18 -05:00
Sauyon Lee
9ceda08d13
Sync dataflow libraries
2021-12-07 07:39:12 -05:00
Sauyon Lee
4c67ef2b0b
Add FlowSummaryImpl to sync-dataflow-nodes target
2021-12-02 10:31:01 -05:00
Sauyon Lee
459f4d18a8
Fix sync-dataflow-libraries
2021-12-02 10:31:01 -05:00
Chris Smowton
894102defd
Merge pull request #621 from owen-mc/extractor-add-variadic-to-type-label
...
Update extractor to distinguish variadic and non-variadic signature types
2021-12-01 15:44:09 +00:00
Owen Mansel-Chan
d0c9aacd54
Distinguish variadic and non-variadic signature types in extractor
2021-12-01 09:33:44 -05:00
Owen Mansel-Chan
628835d3b3
Add failing tests for isVariadic
...
`nonvariadicDeclaredFunction` has the same signature as
`variadicDeclaredFunction`, so it is being erroneously reported as
variadic.
2021-12-01 09:32:12 -05:00
Chris Smowton
e07958d64c
Merge pull request #619 from owen-mc/update-is-variadic
...
Update `isVariadic`
2021-12-01 08:48:16 +00:00
Owen Mansel-Chan
e08007b287
Add missing qldocs for two isVariadic() predicates
2021-11-30 15:13:42 -05:00
Owen Mansel-Chan
acc5c4098a
Fix Function.isVariadic to work on external packages
...
Going via `getFuncDecl()` didn't work as we don't function declarations
from external packages. It works to use `getType()` instead.
2021-11-30 15:11:34 -05:00
Owen Mansel-Chan
a6d8deae3e
Add Fmt.Fprint to isVariadic tests
...
We didn't have any tests involving a function in an imported package.
2021-11-30 15:07:57 -05:00
Erik Krogh Kristensen
adbe19878f
Merge pull request #615 from erik-krogh/explicit-this
...
apply the implicit-this patch to the remaining go code
2021-11-29 17:16:43 +01:00
Chris Smowton
b37fa9c447
Merge pull request #614 from owen-mc/always-extract-empty-interface-type
...
Always extract empty interface type
2021-11-29 12:15:52 +00:00
Erik Krogh Kristensen
1ade6c55d8
apply the implicit-this patch to the remaining go code
2021-11-29 13:10:04 +01:00
Owen Mansel-Chan
f9a3832aa2
Add extractor test that empty interface type exists
2021-11-26 15:16:09 -05:00
Owen Mansel-Chan
d35a46e2f3
Always extract an empty interface type
2021-11-26 15:04:05 -05:00
Tony Torralba
662f880ab8
Merge pull request #609 from github/atorralba/log-injection-query
...
Go: Add Log Injection query (CWE-117)
2021-11-24 15:41:43 +01:00
Tony Torralba
cc8d9bdc7f
Update ql/src/Security/CWE-117/LogInjection.qhelp
...
Co-authored-by: Matt Pollard <mattpollard@users.noreply.github.com >
2021-11-24 13:57:34 +01:00
Chris Smowton
5ed4e3651b
Merge pull request #611 from tunnelshade/main
...
Add `Where` method of squirrel sql builders to query range
2021-11-23 11:13:19 +00:00
Chris Smowton
ab9ab106e5
Merge pull request #612 from smowton/smowton/fix/zipslip-sanitizer-guard-efficiency
...
Improve ZipSlip sanitizer guard efficiency
2021-11-23 09:35:54 +00:00
tunnelshade
aeaa861fc6
Add Where method of squirrel sql builders to query range
2021-11-23 10:11:31 +05:30
Chris Smowton
271e239dee
Introduce manual magic to TaintedPathSanitizerGuardAsBacktrackingSanitizerGuard
...
This avoids computing the full `localTaint` relation when actually there are few `TaintedPath::SanitizerGuard` instances to start from.
2021-11-22 17:41:56 +00:00
Chris Smowton
8bf78b07e5
Avoid recursively defining DataFlow::BarrierGuard
...
In fact there never was true recursion, but the compiler thought there could be because it supposed that ZipSlip::SanitizerGuard growing may introduce instances that happen to also satisfy TaintedPath::SanitizerGuard. In fact this never happens, but here we make it clear by defining the shared sanitizer guards outside the DataFlow::BarrierGuard hierarchy and then introducing the sanitizers in each query that uses them.
2021-11-22 17:36:06 +00:00
Tony Torralba
f2017b626e
Fix stubs
2021-11-22 09:15:12 +01:00
Tony Torralba
c9332cdccb
Fix *Depth log levels in glog and klog
2021-11-22 09:15:01 +01:00
Tony Torralba
d4a20f1222
Autoformat
2021-11-19 18:04:51 +01:00
Tony Torralba
c886d10388
Add Log Injection query
2021-11-19 17:55:34 +01:00
Chris Smowton
4cae4b23fc
Merge pull request #606 from github/criemen/update-tracing-config
...
Update tracing-config.lua to newest API.
2021-11-17 10:49:20 +00:00
Chris Smowton
b190c4ed4a
Merge pull request #608 from smowton/smowton/fix/missing-id
...
Add missing @id tag
2021-11-16 20:06:06 +00:00
Chris Smowton
33fd1aaf2a
Add missing @id tag
2021-11-16 18:52:41 +00:00
Cornelius Riemenschneider
b3e2a83298
Update tracing-config.lua to newest API.
2021-11-15 12:35:53 +01:00
Chris Smowton
792bc4bce0
Merge pull request #596 from pupiles/feature/cwe-090
...
CWE-090: Ldap Injection
2021-11-10 11:31:36 +00:00
Chris Smowton
f3ba40e29d
Update test expectations
2021-11-10 09:42:19 +00:00
