hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-30 06:42:57 +01:00
Code Issues Packages Projects Releases Wiki Activity
995 Commits 1,684 Branches 159 Tags
e89cd16cb16cb043c63afa702e4ed0bc70b46bf0
Commit Graph

995 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Chris Smowton
e89cd16cb1 Move query-specific flag definitions into their respective .ql files 2020-07-29 15:21:49 +01:00
Chris Smowton
f31ed52943 Clean up InsecureFeatureFlag 
Move the flag regexes inline, use `any` instead of a constructor function to select a particular flag kind, and remove explicit limitation on the common superclass FlagKind.
 2020-07-29 15:15:50 +01:00
Chris Smowton
abfae4365f Move CWE-327 out of experimental 2020-07-28 15:47:44 +01:00
Chris Smowton
88cb435843 Split security flags into more distinct categories 
There are now three categories: general security or option flags, those related to TLS version selection, and those related to certificate configuration. The TLS and disabled-certificate-check queries use two categories each.
 2020-07-28 13:54:37 +01:00
Chris Smowton
3c244e2235 Insecure-TLS: remove obsolete TODO 
The case noted works fine.
 2020-07-28 13:04:16 +01:00
Chris Smowton
9b4e189374 Insecure-TLS: Use DataFlow::Node::getRoot, and factor getEnclosingFunction 2020-07-28 11:55:58 +01:00
Chris Smowton
2751552cbe Insecure-TLS: Reintroduce tests for InsecureCipherSuites() 
These stopped producing an alert because they used a variable name that acknowledges an insecure setup
 2020-07-28 11:55:58 +01:00
Chris Smowton
db9760082d Insecure-TLS: simplify warning message 2020-07-28 11:55:58 +01:00
Chris Smowton
2a0642b67b Insecure-TLS: remove is-test-file filter 2020-07-28 11:55:58 +01:00
Chris Smowton
5c8534f56e EXCUSED -> OK 2020-07-28 11:55:58 +01:00
Chris Smowton
d0c76187da Fix comment 2020-07-28 11:55:58 +01:00
Chris Smowton
a10db25b7d Remove redundant constraint 2020-07-28 11:55:58 +01:00
Chris Smowton
779901cdbd Reference Mozilla's TLS advice in qhelp 2020-07-28 11:55:58 +01:00
Chris Smowton
718c4e8531 Add change note for insecure-TLS query 2020-07-28 11:55:58 +01:00
Chris Smowton
db27f8477a Update CWE-327 test 
This now checks various carve-outs for probable feature / compatibility flags
 2020-07-28 11:55:58 +01:00
Chris Smowton
21d107e0e9 Check for suspected feature-flags more uniformly 
These are now checked of all source *and* sink nodes, and the checks are factored with similar paths for is-insecure and is-old flags.
 2020-07-28 11:55:58 +01:00
Chris Smowton
7d294c5d81 Factor and generalise InsecureFeatureFlag 
The same path is now used to classify flags relating to old/legacy versions.
 2020-07-28 11:21:51 +01:00
Chris Smowton
34c8cc5019 Improve documentation and function naming 2020-07-28 11:21:51 +01:00
Chris Smowton
17200a8569 Use SsaWithFields to find similar good-tls-version flows 
Note: if accepted, merge this into a previous commit before submitting the PR
 2020-07-28 10:31:45 +01:00
Chris Smowton
a7e549e771 Exclude TLS version sources accompanied by a non-nil error 
It is common to return 0 has a dummy value with an error; these are very likely not going to be used as a real TLS version.
 2020-07-28 10:31:44 +01:00
Chris Smowton
af960ed2cd Exclude more hits whose context suggests an intentionally old TLS configuration 2020-07-28 10:31:44 +01:00
Chris Smowton
8afa0c51d9 Filter out bad TLS versions where there is a converging flow supplying a good version 
I'm supposing these usually indicate something configurable, rather than a hard-coded insecure choice. The *default* being insecure is still a problem, but probably not amenable to automated analyses.
 2020-07-28 10:31:44 +01:00
Chris Smowton
b66a91bd5f Exclude InsecureTLS problems guarded by feature flags 2020-07-28 10:31:44 +01:00
Chris Smowton
6058c90485 Factor predicates for identifying security-related feature flags from DisabledCertificateCheck 2020-07-28 10:31:44 +01:00
Chris Smowton
a6ab92bbca Supress paths that extend beyond the first sink 
For this particular query it's hardly ever interesting to complain about a bad cipher suite being configured, then read from the list and re-added elsewhere. In such a case the longer path will be detected when the shorter one is fixed in any case.
 2020-07-28 10:31:44 +01:00
Chris Smowton
08ec017e4c Cleanup: disjunction -> set literal 2020-07-28 10:31:44 +01:00
Chris Smowton
75d69efb15 Merge pull request #267 from smowton/smowton/feature/print-ast-label-package-node 
PrintAst: Label File nodes' package-name children, and ensure that child comes before all declarations
 2020-07-24 13:30:12 +01:00
Chris Smowton
b4e15fb17a Merge pull request #268 from smowton/smowton/admin/downgrade-checkout-action 
Downgrade to checkout@v1 to work around https://github.com/actions/checkout/issues/237
 2020-07-24 13:28:06 +01:00
Chris Smowton
8aaa7c8925 Downgrade to checkout@v1 to work around https://github.com/actions/checkout/issues/237 2020-07-24 11:24:51 +01:00
Chris Smowton
454993fe64 PrintAst: Label File nodes' package-name children, and ensure that child comes before all declarations 2020-07-24 11:08:57 +01:00
Chris Smowton
b9e61115f3 Merge pull request #266 from sauyon/query-tags 
Add correctness tag to MistypedExponentiation
 2020-07-22 15:27:46 +01:00
Chris Smowton
6c4a1d0a34 Merge pull request #264 from smowton/smowton/feature/printast-restrict-files 
PrintAst: improve support for restricting subsets of the AST to print
 2020-07-22 15:20:14 +01:00
Chris Smowton
f8d141f7ff PrintAst: Sort root File nodes by relative path. 
This should make graphtext output deterministic, rather than depending on the order the results interpretation step happens to see the nodes.
 2020-07-22 13:43:34 +01:00
Sauyon Lee
c9df4d81b4 Add correctness tag to MistypedExponentiation 2020-07-22 04:26:56 -07:00
Chris Smowton
c30d198f3d Switch to using top-level function declarations to filter PrintAst 
This means it's no longer possible to ask for the AST of a function literal, but this is hopefully a niche use-case that we can add if and when there is demand.
 2020-07-22 10:40:41 +01:00
Owen Mansel-Chan
3018874f69 Merge pull request #259 from gagliardetto/oauth2-fixed-state 
CWE-352: Use of constant `state` in Oauth2 flow
 2020-07-21 17:11:46 +01:00
Chris Smowton
09990f9764 Configure plugin AST printer to ignore comments and only print one file 2020-07-21 17:01:07 +01:00
Chris Smowton
b8c4004c59 PrintAst: support excluding comments 2020-07-21 17:01:07 +01:00
Chris Smowton
e0aa59ced1 PrintAst: improve support for restricting subsets of the AST to print 
* Exclude function definitions, not just their children, when excluded by configuration
* Allow excluding files
* Test both features
 2020-07-21 17:00:28 +01:00
Chris Smowton
a625a4c7d5 Merge pull request #263 from smowton/smowton/feature/order-functypeexpr-children 
PrintAst: order parameter and result declarations
 2020-07-21 15:47:26 +01:00
Andrew Eisenberg
f35343e618 Merge pull request #262 from aeisenberg/aeisenberg/print-ast 
Add the printAst contextual query
 2020-07-20 11:11:42 -07:00
Slavomir
02b5fce67e Add go.mod to CWE-352 test folder 2020-07-20 17:46:12 +03:00
Chris Smowton
ce0cc31b03 PrintAst: order parameter and result declarations 
This adds support for generally overriding the default AstNode child ordering, and uses it to sort parameter and result declarations in the context of a FuncTypeExpr in left-to-right textual order.
 2020-07-20 14:32:42 +01:00
Andrew Eisenberg
0ae1330c02 Add the printAst contextual query 
This is similar to the cpp query for printing the AST in the
context of VS Code.

This PR also includes a small refactoring to extract the
`getEncodedFile` predicate to a new `qll` file.
 2020-07-17 10:12:48 -07:00
Slavomir
27f62b0b3a Fix examples 2020-07-17 13:12:18 +03:00
Slavomir
ee2804dfb1 Improve comments 2020-07-17 11:01:25 +03:00
Slavomir
ee4356501a Apply suggestions from code review 
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>
 2020-07-16 18:36:40 +03:00
Slavomir
fb78818db7 Fix .expected 2020-07-16 18:33:35 +03:00
Slavomir
ef7198c0cb Improve query scenarios 2020-07-16 18:29:15 +03:00
Slavomir
282f7af6d9 Improve comments, naming, docs 2020-07-16 12:52:41 +03:00