Mathias Vorreiter Pedersen
|
7991eb4919
|
PS: Accept test changes.
|
2025-07-24 00:16:20 +01:00 |
|
Mathias Vorreiter Pedersen
|
3ba87996e3
|
PS: Unhide some dataflow nodes to make paths more explicit.
|
2025-07-24 00:11:45 +01:00 |
|
Mathias Vorreiter Pedersen
|
95926cbc70
|
PS: Remove environment variables as flow sources from 'powershell/microsoft/public/sql-injection'.
|
2025-07-24 00:11:31 +01:00 |
|
Chanel
|
a0dbf930a2
|
Update powershell/ql/src/queries/security/cwe-319/UnsafeSMBSettings.ql
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
|
2025-07-23 11:30:30 -07:00 |
|
Chanel Young
|
482fda7541
|
formatting
|
2025-07-23 11:22:12 -07:00 |
|
Chanel Young
|
4e0ea04d3b
|
add query, tests
|
2025-07-23 11:16:11 -07:00 |
|
Chanel
|
d78280ea0f
|
Merge branch 'main' into powershell-unsafe-deserialization
|
2025-07-22 10:07:10 -07:00 |
|
Chanel
|
3b90949d4d
|
Update powershell/ql/src/queries/security/cwe-502/BinaryFormatterDeserialization.qhelp
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
|
2025-07-22 10:06:59 -07:00 |
|
Chanel
|
2e93ec5490
|
Update powershell/ql/src/queries/security/cwe-502/UnsafeDeserialization.qhelp
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
|
2025-07-22 10:06:52 -07:00 |
|
Chanel
|
6d62e8717a
|
Update powershell/ql/src/queries/security/cwe-502/BinaryFormatterDeserialization.qhelp
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
|
2025-07-22 10:06:46 -07:00 |
|
Chanel
|
9266713d19
|
Update powershell/ql/src/queries/security/cwe-502/BinaryFormatterDeserialization.qhelp
Co-authored-by: Mathias Vorreiter Pedersen <mathiasvp@github.com>
|
2025-07-22 10:06:39 -07:00 |
|
Chanel Young
|
1149d33691
|
updated .expected test file
|
2025-07-17 13:19:07 -07:00 |
|
Mathias Vorreiter Pedersen
|
b72af27e81
|
PS: Add tests showing that there is no flow starting at environment variables, but we still have flow through them.
|
2025-07-17 20:05:21 +01:00 |
|
Mathias Vorreiter Pedersen
|
a95f3b3f47
|
PS: Accept test changes.
|
2025-07-17 19:01:09 +01:00 |
|
Mathias Vorreiter Pedersen
|
6ab627955f
|
PS: Implement global dataflow for environment variable write/reads.
|
2025-07-17 18:59:25 +01:00 |
|
Mathias Vorreiter Pedersen
|
2541bcdf5e
|
PS: Add test cases.
|
2025-07-17 18:59:19 +01:00 |
|
Mathias Vorreiter Pedersen
|
3f4a16978e
|
PS: Change the AST so that an 'EnvVariable' is actually a 'Variable', and make it possible for a 'VarAccess' to target a read/write of an environment variable.
|
2025-07-17 18:48:11 +01:00 |
|
Chanel Young
|
6ac935469f
|
move logic to qlls
|
2025-07-17 08:27:36 -07:00 |
|
Chanel Young
|
cb8496bbfe
|
added queries, tests, docs
|
2025-07-16 14:27:23 -07:00 |
|
Mathias Vorreiter Pedersen
|
ef3654f9cf
|
PS: Small cleanup.
|
2025-07-16 20:21:08 +01:00 |
|
Mathias Vorreiter Pedersen
|
72af800101
|
PS: Accept test changes.
|
2025-07-16 14:33:02 +01:00 |
|
Mathias Vorreiter Pedersen
|
205d2e58ff
|
PS: Add dot sourcing as a sink.
|
2025-07-16 14:33:01 +01:00 |
|
Mathias Vorreiter Pedersen
|
670ad745ca
|
PS: Add false negative.
|
2025-07-16 14:32:42 +01:00 |
|
Mathias Vorreiter Pedersen
|
5f07641bd3
|
PS: Fix false positive by fixing the 'getCommand' predicates in 'CallOperatorCfgNode' and 'CallOperator'. Also fix 'DotSourcingOperator::getPath' while here.
|
2025-07-16 14:31:51 +01:00 |
|
Mathias Vorreiter Pedersen
|
75d37dcead
|
PS: Add false positive.
|
2025-07-16 13:46:44 +01:00 |
|
Mathias Vorreiter Pedersen
|
f39d08ecfa
|
PS: Fix spelling.
|
2025-07-16 13:45:09 +01:00 |
|
Josh Brown
|
3606679eee
|
Terminate p tag
|
2025-07-10 10:35:09 -07:00 |
|
Mathias Vorreiter Pedersen
|
d1988774a3
|
PS: Add more flow sources and accept test changes.
|
2025-07-09 12:22:33 +01:00 |
|
Mathias Vorreiter Pedersen
|
1816356515
|
PS: Add test with missing remote flow.
|
2025-07-09 12:20:41 +01:00 |
|
Mathias Vorreiter Pedersen
|
3101cc81e6
|
Merge pull request #253 from microsoft/add-set-execution-policy-bypass-query
PS: Add query for insecure uses of `Set-ExecutionPolicy`
|
2025-07-07 19:33:06 +01:00 |
|
Mathias Vorreiter Pedersen
|
398d27b779
|
PS: Fix missing AST child.
|
2025-07-07 19:15:18 +01:00 |
|
Mathias Vorreiter Pedersen
|
28de6ede04
|
PS: Also require '-Force' with a truthy value. Note the 'NOT DETECTED' test. We will fix that in the next commit.
|
2025-07-07 19:14:01 +01:00 |
|
Mathias Vorreiter Pedersen
|
1d64a7949b
|
Merge pull request #252 from microsoft/add-more-remote-flow-sources
PS: Add flow sources from `System.Net.WebClient`
|
2025-07-07 14:50:03 +01:00 |
|
Mathias Vorreiter Pedersen
|
b6b4df5ce0
|
PS: Implement 'localExprTaint' instead of leaving it as 'none()'.
|
2025-07-04 20:24:22 +01:00 |
|
Mathias Vorreiter Pedersen
|
4e524a189d
|
PS: Add tests.
|
2025-07-04 19:44:49 +01:00 |
|
Mathias Vorreiter Pedersen
|
f7c9899450
|
PS: Add documentation.
|
2025-07-04 19:44:39 +01:00 |
|
Mathias Vorreiter Pedersen
|
2731983fbe
|
PS: Add query for insecure uses of 'Set-ExecutionPolicy'.
|
2025-07-04 19:44:15 +01:00 |
|
Chanel Young
|
654bf2f42f
|
random newline to reset git latest pusher
|
2025-07-04 10:07:57 -07:00 |
|
Mathias Vorreiter Pedersen
|
766cf826bb
|
PS: Add more models and accept test changes.
|
2025-07-04 18:01:45 +01:00 |
|
Mathias Vorreiter Pedersen
|
bd9043576d
|
PS: Add test with missing remote flow source.
|
2025-07-04 18:00:19 +01:00 |
|
Chanel
|
8aa8dde439
|
Merge branch 'main' into powershell-commandinjection-invokesinkfix
|
2025-07-04 09:59:15 -07:00 |
|
Mathias Vorreiter Pedersen
|
2a26c43c19
|
PS: Cleanup a few manually generated models.
|
2025-07-04 17:01:25 +01:00 |
|
Mathias Vorreiter Pedersen
|
eec092c4c4
|
PS: Mark the BAD results in the test appropriately.
|
2025-07-04 11:13:15 +01:00 |
|
Mathias Vorreiter Pedersen
|
7d07773a33
|
PS: Accept test changes.
|
2025-07-04 11:12:55 +01:00 |
|
Mathias Vorreiter Pedersen
|
0585c2f9e5
|
PS: Gets back the previously-lost false negative by making the variable property name expression the sink when there is a call to 'Invoke'.
|
2025-07-04 11:12:31 +01:00 |
|
Lindsay Simpkins
|
52f5ac528c
|
Merge branch 'main' into fix-ps-performance
|
2025-06-20 23:01:38 -04:00 |
|
Mathias Vorreiter Pedersen
|
cb89695c1d
|
PS: Improve alert message.
|
2025-06-20 20:40:53 +01:00 |
|
Mathias Vorreiter Pedersen
|
9032d863bd
|
PS: Accept test changes.
|
2025-06-20 16:40:44 +01:00 |
|
Mathias Vorreiter Pedersen
|
1486200146
|
PS: Allow for implicit reads at sinks in 'ps/sql-injection'.
|
2025-06-20 16:34:16 +01:00 |
|
Mathias Vorreiter Pedersen
|
1ff04d9f94
|
PS: Add new false negative.
|
2025-06-20 16:30:49 +01:00 |
|