Henry Mercer
fcd9219406
Remove NoSQL sinks since September 2018
2022-05-26 09:50:09 +00:00
Esben Sparre Andreasen
7bc1263c8b
Remove additional Xss sinks
2022-05-26 09:50:09 +00:00
Esben Sparre Andreasen
938e9bc6dd
Remove additional SQL sinks
2022-05-26 09:50:09 +00:00
Esben Sparre Andreasen
e62c18e714
Remove additional path-injection sinks
2022-05-26 09:50:09 +00:00
Esben Sparre Andreasen
33ffc8a503
Remove pseudo-properties
2022-05-26 09:50:08 +00:00
Esben Sparre Andreasen
6a0e98a689
Remove 2020 sinks from SqlInjection.ql
2022-05-26 09:50:08 +00:00
Esben Sparre Andreasen
72920be8bb
Remove 2020 sinks from Xss.ql
2022-05-26 09:50:08 +00:00
Esben Sparre Andreasen
20023e44db
Remove 2020 sinks from TaintedPath.ql
2022-05-26 09:50:08 +00:00
Tom Hvitved
ae1f5bbe25
Merge pull request #9334 from hvitved/ruby/dataflow/hash-splat-literal
2022-05-26 10:36:04 +02:00
Robert Marsh
da90440ea3
Merge pull request #9333 from rdmarsh2/rdmarsh2/swift/dataflow-local-flow
...
Swift: local dataflow
2022-05-25 15:59:50 -04:00
Robert Marsh
bba3564187
Swift: adjust for changes in main
2022-05-25 18:52:47 +00:00
Robert Marsh
91b34d5e8f
Swift: make LambdaCallKind a TODO
2022-05-25 18:26:38 +00:00
Robert Marsh
765e1e1115
Swift: autoformat
2022-05-25 18:26:38 +00:00
Robert Marsh
cf22ade9f3
Swift: initial local data flow implementation
2022-05-25 18:26:37 +00:00
Robert Marsh
117a1ad2f4
Swift: DataFlow expr and parameter nodes
2022-05-25 18:26:37 +00:00
Tom Hvitved
b3ce2d4a2b
Ruby: Data flow for hash-splat expressions in hash literals
2022-05-25 19:55:28 +02:00
Tom Hvitved
47051ec8c9
Merge pull request #9320 from hvitved/ruby/hash-splat-flow
...
Ruby: Flow through hash-splat parameters
2022-05-25 19:31:09 +02:00
Nick Rolfe
d5c8188625
Merge pull request #9330 from github/nickrolfe/ruby-typos
...
Ruby: fix spelling errors
2022-05-25 17:56:50 +01:00
Nick Rolfe
385e442f7f
Ruby: fix spelling errors
2022-05-25 16:38:48 +01:00
Mathias Vorreiter Pedersen
0b6e35a2a9
Merge pull request #9291 from MathiasVP/swift-ipa-the-cfg
...
Swift: CFG for property reads and writes
2022-05-25 15:57:32 +01:00
Erik Krogh Kristensen
361b2aa6bb
Merge pull request #9325 from erik-krogh/CWE-940
...
JS: add CWE-940 to js/missing-origin-check
2022-05-25 16:41:40 +02:00
Nick Rolfe
79fb9e8fd2
Merge pull request #9159 from github/nickrolfe/join_order_tweak
...
Ruby: tweak join order in `API::Impl::edge`
2022-05-25 14:57:24 +01:00
Asger F
893f4ab8fb
Merge pull request #9288 from asgerf/js/resource-exhaustion-no-buffer.from
...
JS: Remove Buffer.from sink from js/resource-exhaustion
2022-05-25 15:51:54 +02:00
Tom Hvitved
ce4959287a
Ruby: Flow through hash-splat expressions
2022-05-25 15:40:08 +02:00
Mathias Vorreiter Pedersen
80fad348bb
Swift: Implement CFG for property reads, writes, and observers.
2022-05-25 13:46:14 +01:00
Mathias Vorreiter Pedersen
67cc1b503b
Swift: Implement step 3 from the previous commit message.
2022-05-25 13:44:59 +01:00
Mathias Vorreiter Pedersen
1f4924f978
Swift: Create a custom "AST" version of the public CFG classes. This is
...
necessary because the CFG library doesn't support the following
two requirements simultaneously:
1. Traverse AST classes by virtual dispatch
2. Construct ControlFlowElements from non-AST classes
Because the CFG trees derive from the a base type that must be a
subtype of `ControlFlowElement`. So if we make `ControlFlowElement`
an IPA type, we cannot write:
```
class AssignTree extends PostOrderTree instanceof AssignExpr { ... }
```
because `AssignExpr` is not a subtype of PostOrderTree (since
PostOrderTree is now a subtype of the new IPA type).
To fix this, Tom suggested the following (which is implemented in
this PR):
1. Create a copy of the CFG tree classes (i.e., Pre/PostOrderTree,
LeafTree, etc.) and call them AstPreOrderTree/AstPostOrderTree,
AstLeafTree, etc.
2. For each tree AstTree from step 1, create a instance of the
internal CFG library's appropriate class.
3. In `ControlFlowGraphImpl`, proceed as normal with virtual
dispatch using `instanceof`, but extend the AstTree classes
from step 1 instead of the CFG's own tree classes.
This works because each AstTree implements one of the CFG
library's tree classes (as per step 2).
This commit performs step 1 and 2. Step 3 will be the next commit.
2022-05-25 13:39:48 +01:00
Mathias Vorreiter Pedersen
ab268514a1
Swift: Create a custom IPA type for 'ControlFlowElement's and fixup various type annotations.
2022-05-25 13:39:48 +01:00
Erik Krogh Kristensen
ed907f6f63
add CWE-940 to js/missing-origin-check
2022-05-25 14:15:48 +02:00
Tom Hvitved
a7b39ebeca
Ruby: Flow through hash-splat parameters
2022-05-25 12:37:22 +02:00
Nick Rolfe
134cf4e0e1
Ruby: tweak join order in API::Impl::edge
2022-05-25 10:54:43 +01:00
Tom Bolton
67572bb770
Merge pull request #9193 from github/tombolton/add-counting-queries
...
JS: Add individual per-security-query counting queries
2022-05-25 10:02:28 +01:00
Michael Nebel
e9d371c650
Merge pull request #8600 from michaelnebel/csharp/dotnetruntimemodels
...
C#: Dotnet Runtime models.
2022-05-25 10:33:09 +02:00
AlexDenisov
8b131adeb1
Merge pull request #9283 from github/alexdenisov/swift-integration-tests
...
Swift: add integration tests
2022-05-25 10:04:08 +02:00
Asger F
4913a7a911
Merge branch 'main' into js/resource-exhaustion-no-buffer.from
2022-05-25 09:25:00 +02:00
Michael Nebel
9cab92b16f
C#: Update flow summaries test after rebase. The rebase included a fix to the isAutoGenerated predicate, which means that a summary is only considered autogenerated, if no hand-written version exist. This affects the printing as well.
2022-05-25 08:28:15 +02:00
Michael Nebel
5b405bb4cf
C#: Update FlowSummaries test with generated printing (needed due to rebase).
2022-05-25 08:28:15 +02:00
Michael Nebel
ba7238d6e2
C#: Update XML Injectiont test output after rebase (query has been turned into a path-problem and the output is now affected by the added summaries for NameValueCollection).
2022-05-25 08:28:15 +02:00
Michael Nebel
75532432af
C#: Update flow summaries test (note that the test doesn't correctly print the generated flag at the moment).
2022-05-25 08:28:15 +02:00
Michael Nebel
c8ede58704
C#: Flow summaries has now been added for Exception stack trace, but not for ToString. The latter will be encoded as an extra taintstep in the analysis. To reduce noise for all uses of an exception itself an isSanitizerIn is introduced.
2022-05-25 08:28:15 +02:00
Michael Nebel
4d6d1c8376
C#: Since NameValueCollection now has a flow summary for the string indexer it is no longer consider an unsafe external api, which is why it has disappared from the result.
2022-05-25 08:28:14 +02:00
Michael Nebel
ee027f845c
C#: Since NameValueCollection now has a flow summary for the indexer it is considered a SafeExternalApiCallable and will thus not be included in the result of the test.
2022-05-25 08:28:14 +02:00
Michael Nebel
268230ef19
C#: Add QlDoc to the Generated file.
2022-05-25 08:28:14 +02:00
Michael Nebel
e2d6cd20c7
C#: Update tests due to new summaries for ProcessStartInfo.
2022-05-25 08:28:14 +02:00
Michael Nebel
9b8636aa23
C#: Update test because we now have a flow summary the string indexer for NameValueCollection.
2022-05-25 08:28:14 +02:00
Michael Nebel
d9c7ba471d
C#: Update taint steps test as the generated models now include a model for the getters for KeyValuePair (we only had manual summaries for the constructor).
2022-05-25 08:28:14 +02:00
Michael Nebel
f8e729025f
C#: Add generated Dotnet Runtime summary models that allows to up two reads and two stores and update flow summaries test.
2022-05-25 08:28:14 +02:00
Michael Nebel
3b62b45ea8
C#: Add generated framework models to ExternalFlow.
2022-05-25 08:28:14 +02:00
Tom Hvitved
efda248bea
Merge pull request #9315 from michaelnebel/swift/dataflowsync
...
Swift: Sync changes to DataFlowImplCommon from PR #9024 .
2022-05-25 08:24:15 +02:00
Michael Nebel
5f3a039c65
Swift: Sync changes to DataFlowImplCommon from PR #9024 .
2022-05-25 08:05:22 +02:00
