Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
Tom Hvitved
7a39f077d9
Data flow: Add ConfigSig::accessPathLimit
2024-03-11 13:01:58 +01:00
Tamás Vajk
35a8e7cbf0
Merge pull request #15854 from tamasvajk/buildless/change-assembly-id
...
C#: Change ID of buildless output assembly
2024-03-11 10:03:40 +01:00
Rasmus Wriedt Larsen
42acd9c22c
Merge pull request #15695 from github/tausbn/python-add-copy-method-as-copy-step
...
Python: Add `.copy()` method call as copy step
2024-03-11 09:43:34 +01:00
Michael Nebel
6485dcc0fc
Merge pull request #15859 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2024-03-11 09:10:52 +01:00
Edward Minnix III
7fe378e831
Merge pull request #15756 from egregius313/egregius313/csharp/dataflow/threat-model/remove-addlocalsource
...
C#: Remove `AddLocalSource` classes from queries
2024-03-10 22:56:28 -04:00
Ed Minnix
3fdc7e95df
Add local models to CodeInjection tests
2024-03-10 22:20:54 -04:00
Ed Minnix
8187b00562
Change note
2024-03-10 22:20:52 -04:00
Ed Minnix
d300736c7e
Remove AddLocalSource classes
2024-03-10 22:20:51 -04:00
Edward Minnix III
58f2777532
Merge pull request #15629 from egregius313/egregius313/csharp/dataflow/threat-modeling/remove-stored-query-variants
...
C#: Remove `Stored` variants of queries
2024-03-10 22:17:03 -04:00
github-actions[bot]
589a34241c
Add changed framework coverage reports
2024-03-11 00:16:32 +00:00
Owen Mansel-Chan
820c14577a
Merge pull request #13553 from am0o0/amammad-go-bombs
...
Go: Decompression Bombs
2024-03-10 13:48:04 +00:00
Edward Minnix III
e7852f520f
Merge pull request #15605 from egregius313/egregius313/csharp/dataflow/sources/commandargs-and-environment
...
C#: Add more `environment` and `commandargs` sources for the C# Standard Library
2024-03-08 14:10:09 -05:00
Edward Minnix III
5440dbf70d
Merge pull request #15758 from egregius313/egregius313/csharp/docs/threat-modeling-in-mad-docs
...
C#: Add references to threat modeling to C# Models-as-Data documentation
2024-03-08 11:50:51 -05:00
am0o0
43df6a2c07
add comments for already implemented io.Read and io.WriteTo Sinks.
...
remove some sinks about `"decompressor"` which was added wrongly.
change `GeneralReadIoSink` type from module to class.
separate `KlauspostGzipAndPgzip` `KlauspostPgzip` and `KlauspostGzip`.
2024-03-08 20:05:46 +04:00
am0o0
66130d208e
convert abstract predicate isAdditionalFlowStep to non-abstract
2024-03-08 19:30:41 +04:00
Tamas Vajk
9b5cfc9026
Change assembly population in buildless
2024-03-08 15:02:30 +01:00
Tom Hvitved
9ee2314ef6
Merge pull request #15847 from hvitved/ruby/orm-field-as-source-no-args
...
Ruby: Exclude calls with arguments from `OrmFieldAsSource`
2024-03-08 13:52:34 +01:00
Asger F
7c35309732
Merge pull request #15823 from asgerf/js/lift-cg-restriction
...
JS: Call graph improvements
2024-03-08 13:40:38 +01:00
Asger F
245cd5c0b5
Merge pull request #15760 from asgerf/js/summarised-tt-store-steps
...
JS: Summarise store steps for type tracking
2024-03-08 13:16:25 +01:00
Asger F
ac4601cb8f
Update javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-03-08 13:01:38 +01:00
Ian Lynagh
a9bab18804
Merge pull request #15848 from igfoo/igfoo/deleg2
...
Kotlin 2: Accept some more loc changes in exprs test
2024-03-08 11:49:11 +00:00
Michael Nebel
36a775502f
Merge pull request #15851 from microsoft/54-csharp-add-missing-mad-for-httprequestmessage-upstream
...
csharp update MaD for HttpRequestMessage
2024-03-08 12:39:08 +01:00
Michael Nebel
7c46e9fcf4
Merge pull request #15838 from michaelnebel/csharp/deleteirqueries
...
C#: Remove IR queries.
2024-03-08 11:29:23 +01:00
Tamas Vajk
33eb69164c
C#: Change ID of buildless output assembly
2024-03-08 11:20:04 +01:00
Asger F
546b0a9a89
Merge pull request #15763 from asgerf/js/escaping-instance-detection
...
JS: Improve detection of classes with escaping instances
2024-03-08 11:13:50 +01:00
Asger F
fc5b9e2796
JS: Expand test case
2024-03-08 10:34:39 +01:00
Tom Hvitved
2896bfbd9f
Merge pull request #15821 from hvitved/dataflow/clears-content-store
...
Data flow: Allow for direct stores into nodes with `clearsContent`
2024-03-08 09:59:29 +01:00
Ed Minnix
7f950d8e0d
Fix ExpandEnvironmentVariables test case
2024-03-07 21:48:05 -05:00
Lindsay Simpkins
7dd175d938
change note
2024-03-07 17:16:17 -08:00
Lindsay Simpkins
feb1ca29cc
csharp update MaD for HttpRequestMessage
2024-03-07 15:00:05 -08:00
Chris Smowton
e4f680d476
Merge pull request #15778 from smowton/smowton/admin/test-multi-release-jars
...
Java: Add tests for multi-release jars under Java 11 and 17
2024-03-07 22:59:35 +00:00
Chris Smowton
2321eecb9e
Add tests for multi-release jars under Java 11 and 17
2024-03-07 21:07:49 +00:00
Ian Lynagh
e74606eba3
Kotlin 2: Accept some more loc changes
2024-03-07 18:40:59 +00:00
Ian Lynagh
79c5ad93b0
Kotlin 2: Accept a loc change
...
This is a bit of an odd location for the IrVariableImpl as it includes a
comment, but the comment is already included in the corrresponding
IrLocalDelegatedPropertyImpl so it's not clearly wrong:
Element: 16 59 (2:4 - 2:47) class org.jetbrains.kotlin.ir.declarations.impl.IrLocalDelegatedPropertyImpl
-Element: 29 42 (2:17 - 2:30) class org.jetbrains.kotlin.ir.declarations.impl.IrVariableImpl
+Element: 16 59 (2:4 - 2:47) class org.jetbrains.kotlin.ir.declarations.impl.IrVariableImpl
So just accept the change.
2024-03-07 18:37:00 +00:00
Michael Nebel
f2e467d8ea
C#: Cleanup identical-files.
2024-03-07 19:22:47 +01:00
Michael Nebel
5b48bc4a3e
C#: Delete the experimental IR queries.
2024-03-07 19:22:47 +01:00
Michael Nebel
48fcec82d6
Merge pull request #15736 from michaelnebel/csharp/disconnectfromdotnet
...
C#: Deprecate dotnet and CIL in QL.
2024-03-07 19:17:05 +01:00
Ed Minnix
608a3f907c
Add type signature for methods with no overloads
2024-03-07 12:32:06 -05:00
Ed Minnix
1f64f5f8c9
Change note
2024-03-07 12:32:05 -05:00
Ed Minnix
f8c805de6b
Microsoft.Extensions.Configuration models
2024-03-07 12:32:04 -05:00
Ed Minnix
ec6e17360d
Replace Main-method parameters with ThreatModelFlowSource
2024-03-07 12:30:08 -05:00
Ed Minnix
a3f6bfe1df
commandargs sources
2024-03-07 12:30:06 -05:00
Ed Minnix
51afe12ae1
Environment variable sources
2024-03-07 12:20:48 -05:00
Ed Minnix
b0eb0e1f1e
Move common source kinds to "shared"
2024-03-07 12:20:45 -05:00
Tom Hvitved
85782ff1d4
Ruby: Exclude calls with arguments from OrmFieldAsSource
2024-03-07 17:34:01 +01:00
Tamás Vajk
1fa151db7c
Merge pull request #15844 from tamasvajk/buildless/sdk-version-parsing
...
C#: Improve `global.json` file parsing
2024-03-07 17:03:12 +01:00
Tom Hvitved
76564edc93
Address review comment
2024-03-07 16:50:28 +01:00
Edward Minnix III
92b086d36f
Merge pull request #15798 from egregius313/egregius313/csharp/mad/fix-textreader-models
...
C#: Change `System.IO.TextReader` models to transfer taint to out parameter
2024-03-07 10:40:28 -05:00
Chris Smowton
c9474050c8
Merge pull request #15839 from smowton/smowton/admin/jdk22-extractor-upgrade-test-changes
...
Java: Explicitly import Lock class
2024-03-07 15:05:50 +00:00
