Michael Nebel
afec9b05e9
Merge pull request #13147 from michaelnebel/csharp/entityframeworkrefactor
...
C#: Use synthetic global in the EntityFramework code instead of jump steps.
2023-06-14 13:47:56 +02:00
Anders Schack-Mulligen
1a4fca334f
Merge pull request #13273 from aschackmull/dataflow/summarynode-refactor
...
Dataflow: Refactor FlowSummaryImpl to synthesize nodes independently from DataFlow::Node.
2023-06-14 09:38:36 +02:00
Anders Schack-Mulligen
2d616d494e
C#/Ruby: Add fields as per review comments.
2023-06-13 11:26:30 +02:00
Asger F
0d45074caa
Merge pull request #13422 from asgerf/rb/map_filter
...
Ruby: fix bug in filter_map summary
2023-06-13 09:43:47 +02:00
Arthur Baars
fad73d71e5
Merge pull request #13307 from hmac/amammad-ruby-YAMLunsafeLoad
...
Ruby: Add YAML unsafe deserialization sinks
2023-06-12 10:43:37 +02:00
Anders Schack-Mulligen
5062442982
Go/Python/Ruby/Swift: Add stub.
2023-06-09 15:39:28 +02:00
Anders Schack-Mulligen
98f51d7f29
Dataflow: Sync.
2023-06-09 15:39:28 +02:00
Anders Schack-Mulligen
4e531af71b
Ruby: Adjust to FlowSummaryImpl changes.
2023-06-09 15:30:35 +02:00
Anders Schack-Mulligen
2cc5bde925
Dataflow: Sync.
2023-06-09 15:27:17 +02:00
Asger F
a50d91ea48
Ruby: fix bug in filter_map summary
2023-06-09 14:31:10 +02:00
Anders Schack-Mulligen
1b7bbf6320
Merge pull request #13083 from aschackmull/dataflow/typestrengthen
...
Dataflow: Strengthen tracked types.
2023-06-09 13:23:30 +02:00
Anders Schack-Mulligen
d230509905
Dataflow: Address review comments.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
4399138c82
Dataflow: Fix QL4QL alert.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
53f2b8aab0
Dataflow: Sync.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
fd832416d8
Dataflow: Add empty type strengthening predicate for languages without type pruning.
2023-06-09 08:37:35 +02:00
Anders Schack-Mulligen
e8cea79f1d
Dataflow: Sync.
2023-06-09 08:37:35 +02:00
Asger F
d6741f655d
Ruby: restrict ORM tracking to calls
2023-06-08 14:01:51 +02:00
Alex Ford
22b9ab43c6
Merge pull request #13259 from alexrford/rb/actiondispatch-refactor
...
Ruby: Refactor and slightly expand `ActionDispatch` modelling
2023-06-08 11:08:36 +01:00
Tom Hvitved
cee70883f0
Merge pull request #12964 from hvitved/ruby/remove-synth-returns
...
Ruby: Remove canonical return nodes
2023-06-08 10:07:48 +02:00
Erik Krogh Kristensen
6ba7f9a238
Merge pull request #13352 from erik-krogh/once-again-deps-not-py-cpp
...
delete old deprecations
2023-06-07 13:00:57 +02:00
Tom Hvitved
88c5700c24
Ruby: Use CallGraphConstruction in call graph construction
2023-06-07 09:02:03 +02:00
Tom Hvitved
4bf124bffe
Ruby/Python: Add CallGraphConstruction module for recursive type-tracking based call graph construction
2023-06-07 09:02:03 +02:00
Arthur Baars
7324d1705e
Merge branch 'main' into amammad-ruby-YAMLunsafeLoad
2023-06-06 12:09:06 +02:00
erik-krogh
ac9ede4ec0
add change-notes
2023-06-02 11:58:11 +02:00
erik-krogh
c3e57382f7
Ruby: fix compilation
2023-06-02 11:58:08 +02:00
erik-krogh
44b6366586
delete old deprecations
2023-06-02 11:58:08 +02:00
Alex Ford
606d601923
qlformat
2023-06-01 16:26:05 +01:00
Alex Ford
d09f6d318c
Merge branch 'main' into maikypedia/sqli-sink
2023-06-01 15:02:44 +01:00
Alex Ford
4794066d3c
Merge branch 'main' into maikypedia/sqli-sink-2
2023-06-01 13:04:54 +01:00
Maiky
7579f182ad
Add requested changes
2023-06-01 11:00:35 +02:00
Michael Nebel
06b02eb3ce
Sync files.
2023-06-01 09:30:31 +02:00
Maiky
13ce6a6d8e
Update Frameworks.qll
2023-06-01 00:53:01 +02:00
Arthur Baars
c211b704f3
Merge pull request #13272 from github/post-release-prep/codeql-cli-2.13.3
...
Post-release preparation for codeql-cli-2.13.3
2023-05-31 15:33:12 +02:00
Michael Nebel
2266e28583
Merge pull request #13262 from michaelnebel/flowsummary/refactorgetcomponentstack
...
C#: Re-factor getComponent.
2023-05-31 08:22:44 +02:00
Arthur Baars
490d22d123
Merge remote-tracking branch 'upstream/main' into post-release-prep/codeql-cli-2.13.3
2023-05-30 21:31:28 +02:00
Arthur Baars
d91fa2d038
Ruby: add print-cfg query
2023-05-30 17:30:04 +02:00
Harry Maclean
562065f29e
Ruby: Add change note
2023-05-27 01:20:09 +00:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
d727d573d5
v4.2 write exact version of yaml.load default loader change
2023-05-27 01:15:29 +00:00
amammad
335441ce04
v4: make variable names camelCase, some inhancement, remove some duplicates
2023-05-27 01:15:29 +00:00
amammad
e76ed9454a
v3 add global taint steps for to_ruby of YAML/Psych
2023-05-27 01:15:24 +00:00
amammad
ad7e107ff5
add the new YAML/PLIST sinks into the existing rb/unsafe-deserialization query
2023-05-27 01:14:36 +00:00
Asger F
3831dc7785
Merge pull request #13288 from asgerf/rb/super-and-flow-through
...
Ruby: two bug fixes
2023-05-26 15:04:52 +02:00
Arthur Baars
e0466900ad
Merge pull request #12992 from Sim4n6/ruby-UBV
...
[Ruby] Add Unicode Bypass Validation query, test and help file
2023-05-26 13:00:21 +02:00
Alex Ford
baabd2d1fa
Merge pull request #12832 from maikypedia/maikypedia/pg-sqli
...
Ruby: Add SQL Injection Sinks
2023-05-26 11:36:17 +01:00
Michael Nebel
915042a881
Minor cleanup and sync files.
2023-05-26 12:25:00 +02:00
Michael Nebel
58fcbc136c
Ruby: Re-factor getComponent.
2023-05-26 12:25:00 +02:00
Asger F
9e8cef5e1b
Ruby: fix type-tracking flow-through for new->initialize calls
2023-05-25 15:03:38 +02:00
Asger F
93678e5d36
Ruby: fix name of super calls in singleton methods
2023-05-25 15:03:34 +02:00
Sim4n6
52dd247a81
Removed redundant cast
2023-05-25 11:55:13 +01:00
