Erik Krogh Kristensen
c4cb410970
Merge pull request #11472 from erik-krogh/exit-code
...
JS: make the JS autobuilder consistent with Ruby when no JS code was detected
2022-12-02 16:01:02 +01:00
Matt Rothenberg
95f994a82b
Update RequestForgeryBad.js
2022-12-02 14:17:37 +01:00
Matt Rothenberg
7d674e7cdc
set base URL
2022-12-02 14:17:17 +01:00
Matt Rothenberg
c49e9e8503
fix: use let for subdomain assignment
2022-12-02 14:07:39 +01:00
Matt Rothenberg
a453405365
Update RequestForgeryBad.js
2022-12-02 14:03:37 +01:00
Matt Rothenberg
2ae0c7e115
Update RequestForgeryGood.js
2022-12-02 14:02:54 +01:00
Asger F
ef72e222b0
Merge pull request #11513 from asgerf/js/api-graph-async-result-node
...
JS: Remove MkAsyncFunctionResult
2022-12-02 11:29:03 +01:00
Jean Helie
352d1a7e8c
ATM: update tests
2022-12-01 19:01:30 +01:00
Jean Helie
98923cee94
ATM: update missing .qll
2022-12-01 18:47:36 +01:00
Jean Helie
ae0d82efd8
ATM: update predicate name
2022-12-01 18:22:33 +01:00
Jean Helie
880548bafc
Merge branch 'main' into tiferet/boost-xss-through-dom
2022-12-01 18:13:27 +01:00
Jean Helie
50a3c0d725
ATM: update expected ML test values
2022-12-01 17:53:09 +01:00
Jean Helie
f388703a3d
ATM: update further files following the addition of XssThroughDom query
2022-12-01 17:45:07 +01:00
erik-krogh
6289ae329b
fix a race-condition
2022-12-01 15:27:41 +01:00
Asger F
eb9bee23a0
JS: Remove MkAsyncFunctionResult
2022-12-01 15:15:27 +01:00
tiferet
4a6de3e444
Apply suggestion from code review
2022-11-30 17:25:19 -08:00
tiferet
a0a742eb82
Rename predicates to fit style guide:
...
- `getEndpoints` → `appliesToEndpoint`
- `getImplications` → `hasImplications`
- `getAlerts` → `hasAlert`
2022-11-30 17:01:56 -08:00
erik-krogh
cddc9db690
change back to the old order of extracting externs before Xml
2022-11-30 15:46:46 +01:00
erik-krogh
6620ba8cc8
Merge branch 'main' into exit-code
2022-11-30 15:26:31 +01:00
tiferet
b885249d9d
Add a boosted version of XssThroughDOM
2022-11-29 17:40:20 -08:00
tiferet
c5184d37e7
Suggestion from code review:
...
Name the query configuration e.g. `NosqlInjectionATMConfig` rather than `Configuration`.
2022-11-29 15:46:05 -08:00
tiferet
6f807e9d43
Doc suggestion from code review
2022-11-29 13:20:47 -08:00
tiferet
75cd7a9ebc
Remove code duplication in query .ql files:
...
Define the query for finding ATM alerts in the base class `AtmConfig`, and call it from each query's .ql file.
2022-11-29 13:20:47 -08:00
tiferet
a710b723d1
Move the definition of isSink to the base class:
...
Holds if `sink` is a known taint sink or an "effective" sink.
2022-11-29 13:20:47 -08:00
tiferet
cd24ec88d6
Move the definition of isSource to the base class:
...
A long as we're not boosting sources, `isSource` is identical to `isKnownSource`.
2022-11-29 13:20:47 -08:00
tiferet
50291c7b7c
AtmConfig inherits from TaintTracking::Configuration.
...
That way the specific configs which inherit from `AtmConfig` also inherit from `TaintTracking::Configuration`.
This removes the need for two separate config classes for each query.
2022-11-29 13:20:47 -08:00
tiferet
05a943c9b5
Delete StandardEndpointFilters.
...
All remaining functionality in `StandardEndpointFilters` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-29 13:20:47 -08:00
tiferet
5402f047bf
Delete CoreKnowledge.
...
All remaining functionality in `CoreKnowledge` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-29 13:20:47 -08:00
tiferet
1d4b2ccab4
Merge branch 'main' into tiferet/complexity-reduction
2022-11-29 12:47:18 -08:00
Tiferet Gazit
f375b0cc1b
Merge pull request #11281 from github/tiferet/endpoint-filters
...
ATM: Implement the current endpoint filters as EndpointCharacteristics
2022-11-29 12:38:12 -08:00
erik-krogh
de5ffd5cfa
bump extractor version
2022-11-29 21:32:43 +01:00
Erik Krogh Kristensen
d0cf709d2e
use proper path construction
...
Co-authored-by: Asger F <asgerf@github.com >
2022-11-29 21:30:50 +01:00
erik-krogh
63a5f8965e
fix tests
2022-11-29 14:08:21 +01:00
erik-krogh
136b6db2ad
only delete the src/ folder if it was empty
2022-11-29 13:42:27 +01:00
erik-krogh
f3f7a89ef8
make the JS autobuilder consistent with Ruby when no JS code was detected
2022-11-29 13:42:27 +01:00
tiferet
4580b55673
Oops -- forgot to stage one file in the previous commit :)
2022-11-28 11:34:34 -08:00
tiferet
210644e87d
Delete StandardEndpointFilters.
...
All remaining functionality in `StandardEndpointFilters` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-28 11:34:34 -08:00
tiferet
15121931b4
Delete CoreKnowledge.
...
All remaining functionality in `CoreKnowledge` is only being used in `EndpointCharacteristics`, so it can be moved there as a small set of helper predicates.
2022-11-28 11:34:34 -08:00
tiferet
1c679378e7
FilteringReason is no longer being used and can be deleted
2022-11-28 11:34:33 -08:00
tiferet
99de397a5f
Remove redundant code
...
`isOtherModeledArgument` and `isArgumentToBuiltinFunction` contained the old logic for selecting negative endpoints for training.
These can now be deleted, and replaced by a single base class that collects all EndpointCharacteristics that are currently used to indicate negative training samples: `OtherModeledArgumentCharacteristic`.
This in turn lets us delete code from `StandardEndpointFilters` that effectively said that endpoints that are high-confidence non-sinks shouldn't be scored at inference time, either.
2022-11-28 11:34:33 -08:00
tiferet
7b0269c999
Fix British spelling that code scanning didn't like.
...
I've been working with Brits for too long :)
2022-11-28 11:28:08 -08:00
tiferet
963407de4c
Update the documentation
2022-11-28 11:16:06 -08:00
Erik Krogh Kristensen
7a3898168f
Update README.md
2022-11-28 12:12:36 +01:00
Henry Mercer
56e5f01ce0
Merge branch 'main' into codeql-ci/atm/release-0.4.2
2022-11-24 14:41:49 +00:00
github-actions[bot]
78d49e44b1
JS: Bump version of ML-powered library and query packs to 0.4.3
2022-11-24 14:22:14 +00:00
github-actions[bot]
8d96bfe973
JS: Bump patch version of ML-powered library and query packs
2022-11-24 14:18:13 +00:00
Erik Krogh Kristensen
1eec067474
Merge pull request #11294 from erik-krogh/fileDoc
...
QL: improve the "this block-comment should have been a QLDoc"-query
2022-11-23 22:23:36 +01:00
Erik Krogh Kristensen
efdfc361be
Merge pull request #11396 from erik-krogh/jsTypo
...
JS: fix two typos
2022-11-23 22:18:43 +01:00
tiferet
03b8e649f1
Filter endpoints by confidence
...
Select endpoints to score at inference time base purely on their confidence level, and not on whether they fit the historical definition of endpoint filters.
2022-11-23 10:46:27 -08:00
erik-krogh
2eb6b1adb3
JS: fix two typos
2022-11-23 14:38:12 +01:00
