Esben Sparre Andreasen
|
c8a478d48d
|
Remove additional path-injection sinks
|
2022-02-24 13:32:57 +00:00 |
|
Esben Sparre Andreasen
|
c60d6dc868
|
Add benjamin-button.md
|
2022-02-24 13:32:57 +00:00 |
|
Esben Sparre Andreasen
|
d39e7d914c
|
Remove pseudo-properties
|
2022-02-24 13:32:57 +00:00 |
|
Esben Sparre Andreasen
|
83dfa60747
|
Remove 2020 sinks from SqlInjection.ql
|
2022-02-24 13:32:57 +00:00 |
|
Esben Sparre Andreasen
|
0b5b3ac6d1
|
Remove 2020 sinks from Xss.ql
|
2022-02-24 13:32:57 +00:00 |
|
Esben Sparre Andreasen
|
7b826e1c16
|
Remove 2020 sinks from TaintedPath.ql
|
2022-02-24 13:32:57 +00:00 |
|
tombolton
|
d80ef6566d
|
add new xss queries to result counting query
|
2022-02-24 13:31:40 +00:00 |
|
Henry Mercer
|
e42f759f6b
|
Merge pull request #8153 from github/henrymercer/atm-add-cwe-tags
JS: Add CWE tags for ML-powered queries
|
2022-02-21 17:24:02 +00:00 |
|
Henry Mercer
|
5a3daa9e3f
|
JS: Add CWE tags for ML-powered queries
- Cross-site scripting: CWE-79
- Path injection: CWE-22, CWE-23, CWE-36, CWE-73, CWE-99
- NoSQL injection: CWE-943
- SQL injection: CWE-89
|
2022-02-21 16:18:33 +00:00 |
|
Tom Bolton
|
0108642464
|
Merge pull request #8148 from github/tombolton/modify-counting-query
Update counting query to match end-to-end results
|
2022-02-21 15:02:43 +00:00 |
|
tombolton
|
e02319be9f
|
add end to end predicate to result counting query
|
2022-02-21 14:35:58 +00:00 |
|
Asger F
|
02c4966109
|
Merge pull request #7878 from asgerf/dot-separated-access-paths
Shared: Switch to dot-separated access paths in summary specs
|
2022-02-21 13:29:09 +01:00 |
|
Alex Ford
|
9196b64d6e
|
Merge pull request #8138 from github/ruby/file-write
Ruby: Implement `FileSystemWriteAccess` concept
|
2022-02-21 10:13:27 +00:00 |
|
Alex Ford
|
746290d903
|
Merge pull request #7713 from github/ruby/clear-text-logging
Ruby: Add `rb/clear-text-logging-sensitive-data` query
|
2022-02-21 10:12:33 +00:00 |
|
Esben Sparre Andreasen
|
1d437dd722
|
Merge pull request #8043 from github/esbena/sharpen-hardcoded-credentials
JS: Sharpen hardcoded credentials
|
2022-02-21 10:02:58 +01:00 |
|
Erik Krogh Kristensen
|
5f9bd7a4a1
|
Merge pull request #7984 from erik-krogh/fix-ql-for-ql-js
JS: fix most ql-for-ql warnings
|
2022-02-21 09:15:06 +01:00 |
|
Asger Feldthaus
|
7848fcec80
|
Shared: sync AccessPathSyntax.qll
|
2022-02-21 08:21:53 +01:00 |
|
Asger Feldthaus
|
d7f07167ac
|
Shared: Remove getLastToken again
|
2022-02-21 08:21:53 +01:00 |
|
Asger Feldthaus
|
2c2a82a070
|
Shared: allow spaces between arguments in a token
|
2022-02-21 08:21:53 +01:00 |
|
Asger Feldthaus
|
55ac5cb012
|
Shared: auto format
|
2022-02-21 08:21:53 +01:00 |
|
Asger Feldthaus
|
4985fbb526
|
Shared: update getSummaryCsv and related test output
|
2022-02-21 08:21:53 +01:00 |
|
Asger Feldthaus
|
dcc523a2b7
|
Shared: auto format
|
2022-02-21 08:21:53 +01:00 |
|
Asger Feldthaus
|
7fcbdbeada
|
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
|
2022-02-21 08:21:52 +01:00 |
|
Asger Feldthaus
|
d911e0abf8
|
Shared: use getToken instead of getLastToken
|
2022-02-21 08:21:52 +01:00 |
|
Asger Feldthaus
|
c4304a980d
|
Shared: add explicit this
|
2022-02-21 08:21:52 +01:00 |
|
Asger Feldthaus
|
dc6a13242b
|
Shared: update comment in AccessPathSyntax.qll
|
2022-02-21 08:21:52 +01:00 |
|
Asger Feldthaus
|
2907d53e17
|
Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll
|
2022-02-21 08:21:52 +01:00 |
|
Asger Feldthaus
|
be63cf7049
|
Shared: fix qldoc and move getRawToken to top-level
|
2022-02-21 08:21:52 +01:00 |
|
Asger Feldthaus
|
c189df2341
|
Revert "JS: Add support for " of " syntax to help during transition"
This reverts commit 9bf522b3048c3b11f7e6d734ed797a613614a095.
|
2022-02-21 08:21:51 +01:00 |
|
Asger Feldthaus
|
57bf0b1432
|
Ruby: remove support for legacy syntax
|
2022-02-21 08:21:51 +01:00 |
|
Asger Feldthaus
|
e3605eed44
|
Ruby: update CSV rows to dot-separated syntax
|
2022-02-21 08:21:50 +01:00 |
|
Asger Feldthaus
|
7005d53a67
|
Ruby: manually rewrite DigSummary access path
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
6dbeb81f36
|
Ruby: use AccessPathSyntax.qll to parse input/output summary specs
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
0af9e8aa58
|
C#: remove support for legacy syntax
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
6bb15dcc27
|
C#: update CSV rows to dot-separated syntax
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
dffa1d1558
|
C#: use AccessPathSyntax.qll to parse input/output summary specs
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
affdbe9955
|
Java: remove support for legacy syntax
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
a121b73181
|
Java: update CSV rows to dot-separated syntax
|
2022-02-21 08:16:55 +01:00 |
|
Asger Feldthaus
|
7f808710ec
|
Java: update model generator
|
2022-02-21 08:16:54 +01:00 |
|
Asger Feldthaus
|
753c557dbe
|
Java: use AccessPathSyntax.qll to parse input/output summary specs
|
2022-02-21 08:16:54 +01:00 |
|
Asger Feldthaus
|
53935db6c6
|
JS: Add support for " of " syntax to help during transition
|
2022-02-21 08:16:54 +01:00 |
|
Asger Feldthaus
|
30254686d8
|
JS: Move ".."-parsing trick into AccessPathSyntax.qll
|
2022-02-21 08:16:54 +01:00 |
|
Asger Feldthaus
|
7c2cff3227
|
JS: Factor out AccessPathSyntax.qll
|
2022-02-21 08:16:54 +01:00 |
|
Asger Feldthaus
|
e2cbf47b16
|
JS: Fix accidental recursion
|
2022-02-21 08:16:53 +01:00 |
|
Harry Maclean
|
e4f801bea8
|
Merge pull request #7886 from github/hmac/split-ruby-std-library
Ruby: split standard library models into multiple files
|
2022-02-21 13:39:43 +13:00 |
|
Harry Maclean
|
9a60c7e4ac
|
Ruby: Update filename in test fixture
|
2022-02-21 09:43:36 +13:00 |
|
Alex Ford
|
6b8537c4e0
|
Ruby: FileSystemWriteAccess changenote
|
2022-02-20 20:14:01 +00:00 |
|
Alex Ford
|
baabe66551
|
Ruby: update Files.ql tests for write accesses
|
2022-02-20 19:28:12 +00:00 |
|
Alex Ford
|
12ce3d4784
|
Ruby: Implement FileSystemWriteAccess for IO/File API
|
2022-02-20 19:27:11 +00:00 |
|
Alex Ford
|
4f0174e89a
|
Ruby: add FileSystemWriteAccess concept
|
2022-02-20 19:26:54 +00:00 |
|