Chris Smowton
715b0b3fb8
Accept test changes
2022-07-25 15:17:14 +01:00
luchua-bc
962069ccff
Add path check in a security context (redirect)
2022-07-22 23:10:52 +00:00
Chris Smowton
9593ceeda5
Kotlin: Special-case String.charAt naming
...
In the Kotlin universe this is called `get` so that Kotlin programmers can use the `[]` operator on `String`s.
2022-07-21 09:17:08 +01:00
Chris Smowton
0a351b73cb
Underscore query: tolerate synthetic functions
2022-07-21 09:15:27 +01:00
Chris Smowton
1cbe26a54f
Kotlin: fix for-loop iterators over primitive or wildcard types
...
Array<*> can't be queried for an argument type, and IntArray doesn't have an argument at all; both were previously causing the extractor to fail to extract the whole file due to throwing an exception.
2022-07-21 09:13:55 +01:00
luchua-bc
48f143e7d4
Query to detect regex dot bypass
2022-07-20 22:39:24 +00:00
Shyam Mehta
09ec37943c
Partial Path Traversal split into 2 queries
2022-07-20 17:53:26 -04:00
smehta23
b7e522749f
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2022-07-20 15:32:59 -04:00
Asger F
b9bdee6651
Merge branch 'main' into post-release-prep/codeql-cli-2.10.1
2022-07-19 16:24:35 +02:00
yo-h
d4443592eb
Merge pull request #9776 from raulgarciamsft/azure-sdk-client-encryption-version
...
New queries to detect unsafe client side encryption in Azure Storage
2022-07-16 14:59:51 -04:00
Raul Garcia
eefa659503
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: yo-h <55373593+yo-h@users.noreply.github.com >
2022-07-16 08:23:59 -07:00
Raul Garcia
fe789c8aa9
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: yo-h <55373593+yo-h@users.noreply.github.com >
2022-07-16 08:22:18 -07:00
Chris Smowton
41ca791966
Implement is-underscore-parameter for old versions of Kotlin
2022-07-15 12:36:37 +01:00
Chris Smowton
d4b0163c4c
Kotlin: Don't extract a name for a '_' parameter
...
I can't reproduce the exact circumstances, but these sometimes get "<anonymous parameter X>" names and sometimes get "$noName_X" names. Whichever way, avoiding extracting a synthetic name seems safest; anyone finding the .class file and not reading the metadata indicating it came from a `_` will extract the binary name selected, or else QL will
invent a name.
2022-07-14 16:36:26 +01:00
github-actions[bot]
0ee476129a
Post-release preparation for codeql-cli-2.10.1
2022-07-14 14:38:49 +00:00
Erik Krogh Kristensen
85a652f3d1
remove a bunch of repeated words
2022-07-14 12:42:48 +02:00
Jeroen Ketema
fe1f1bb79d
Fix issues with change notes
2022-07-14 11:06:14 +02:00
github-actions[bot]
d1aa0d7dd3
Release preparation for version 2.10.1
2022-07-14 08:56:03 +00:00
github-actions[bot]
9a186ba5d2
Add changed framework coverage reports
2022-07-14 00:18:56 +00:00
Chris Smowton
a6970638cb
Improve description
2022-07-13 20:27:10 +01:00
Chris Smowton
01cec0490b
Abbreviate qhelp
2022-07-13 20:24:44 +01:00
Chris Smowton
f9da4a0456
Add change note
2022-07-13 14:11:31 +01:00
Chris Smowton
b1dd3c2d84
Model java.util.Properties.getProperty
2022-07-13 13:59:28 +01:00
Erik Krogh Kristensen
595875ff98
remove redundant not-equals check
2022-07-13 12:06:12 +02:00
Erik Krogh Kristensen
a4262f8d91
add some more references to the overly-large-range qhelp
2022-07-13 11:20:24 +02:00
Raul Garcia
0dbb03f732
Adding CVE information.
2022-07-12 21:49:19 -07:00
Raul Garcia
a4adf06713
Addressing feedback for the qhelp file.
2022-07-12 13:51:12 -07:00
Ian Lynagh
83edb3b5e9
Kotlin: Remove the last uses of fakeLabel
2022-07-12 17:43:50 +01:00
Raul Garcia
64343e00f4
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-07-12 08:14:25 -07:00
Raul Garcia
8a48708014
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-07-12 08:14:13 -07:00
Raul Garcia
2bac181094
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-07-12 08:13:53 -07:00
Raul Garcia
a4e35a97ea
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-07-12 08:13:38 -07:00
Raul Garcia
a51d713925
Update java/ql/src/experimental/Security/CWE/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-07-12 08:13:12 -07:00
Erik Krogh Kristensen
8e52fc97fc
changes based on review by Shack
2022-07-12 16:02:50 +02:00
Erik Krogh Kristensen
220ff3cb2e
convert tabs to spaces in qhelp
2022-07-12 16:02:50 +02:00
Erik Krogh Kristensen
aae3e2ddde
other changes based on Esbens review
2022-07-12 16:02:50 +02:00
Erik Krogh Kristensen
ff25451699
rename query to overly-large-range, and rewrite the @description
2022-07-12 16:02:46 +02:00
Ian Lynagh
a0636ff843
Merge pull request #9545 from igfoo/igfoo/type_cycles
...
Java: Fix RefType.getAStrictAncestor() in the presence of type hierarchy cycles
2022-07-12 14:28:54 +01:00
Ian Lynagh
d0bf424b19
Merge pull request #9806 from igfoo/igfoo/useType
...
Kotlin: Extract an ErrorType if we fail to correctly extract a type
2022-07-12 13:45:04 +01:00
Ian Lynagh
1bcb17b760
Update java/ql/lib/change-notes/2022-07-12-errortype.md
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2022-07-12 12:16:24 +01:00
Ian Lynagh
2edeeaac0e
Merge pull request #9801 from igfoo/igfoo/psi
...
Kotlin: We can't extract comments for < 1.5.20
2022-07-12 11:01:30 +01:00
Ian Lynagh
965f5a980a
Java/Kotlin: Add changenote for ErrorType
2022-07-12 10:58:16 +01:00
Shyam Mehta
65b9947428
Incorporate jksco's feedback
2022-07-12 02:02:31 -04:00
smehta23
781a2a73d3
Merge branch 'main' into feat/SM/java_partial_path_traversal_vulnerability
2022-07-12 01:48:12 -04:00
Raul Garcia
d5791e2d56
Addressing feedback from the PR
2022-07-11 15:45:15 -07:00
Raul Garcia
ac05577966
Making various changes based on the feedback. Pending: 2 non-trivial fixes for Java & Python.
2022-07-11 13:25:35 -07:00
Ian Lynagh
960d1dba8a
Kotlin: We can't etract comments for < 1.5.20
...
We were making our own PsiSourceManager, but that didn't know about any
IrFile -> PsiFile mappings.
2022-07-11 19:36:43 +01:00
Ian Lynagh
4c68624b00
Kotlin: Pass a FileLogger to Psi2Ir
2022-07-11 19:17:21 +01:00
Ian Lynagh
b9072a3594
Kotlin: Share a Psi2Ir instance
2022-07-11 18:57:43 +01:00
Ian Lynagh
28a8999b74
Java: Add an upgrade script
2022-07-11 12:09:48 +01:00
