Taus
ea32299ab0
Python: Use API-graph flow for boolean tracking
...
Introduces a false positive, but arguably that false positive should
have been there with the local flow as well.
2022-05-17 13:14:55 +00:00
Erik Krogh Kristensen
86e97c32d6
fix all ql/use-string-compare
2022-05-17 14:11:05 +02:00
Taus
ba8d73c2be
Python: Use API::CallNode
2022-05-17 12:00:17 +00:00
Erik Krogh Kristensen
03da62713c
fix typo identified by QL-for-QL
2022-05-17 12:32:40 +02:00
Erik Krogh Kristensen
818975dc56
sync upstream typo fixes
2022-05-17 12:25:52 +02:00
Erik Krogh Kristensen
5d1c41c269
Merge branch 'main' into pyMaD
2022-05-17 12:23:03 +02:00
Erik Krogh Kristensen
2868eb61ea
add test for Parameter[any] and Parameter[any-named]
2022-05-17 12:08:53 +02:00
Erik Krogh Kristensen
f273ccf73b
add explicit test of what Parameter[0] matches
2022-05-17 11:17:15 +02:00
Erik Krogh Kristensen
ce21d7e5a8
use test-sink for sinks in the MaD test
2022-05-17 11:13:59 +02:00
Erik Krogh Kristensen
aef592fec8
make a more realistic test for self-parameter
2022-05-17 11:13:35 +02:00
Mathias Vorreiter Pedersen
1280d43e36
Merge pull request #9141 from github/post-release-prep/codeql-cli-2.9.2
...
Post-release preparation for codeql-cli-2.9.2
2022-05-17 10:01:37 +01:00
Erik Krogh Kristensen
55ffdb4aa1
make most imports in ApiGraphModelsSpecific.qll private
2022-05-17 10:34:17 +02:00
Erik Krogh Kristensen
1f8e7c39f4
fix typo in comment
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2022-05-17 10:32:31 +02:00
Nick Rolfe
c518150b49
Merge pull request #9132 from github/nickrolfe/misspelling
...
QL for QL: generalise non-US spelling query
2022-05-16 16:03:36 +01:00
Alex Ford
bda1c21562
BrokenCryptoAlgorithm block mode change notes
2022-05-16 15:49:19 +01:00
Anders Schack-Mulligen
83f817ca45
Merge pull request #9134 from aschackmull/dataflow/perf-std-order
...
Dataflow: Improve standard order through easier type check elimination.
2022-05-16 10:05:17 +02:00
Alex Ford
66736ebd9d
sync CryptoAlgorithmNames.qll (remove isWeakBlockMode predicate)
2022-05-13 21:26:01 +01:00
Alex Ford
bc073eb460
python: update py/weak-cryptographic-algorithm to flag use of ECB block mode
2022-05-13 16:32:36 +01:00
Alex Ford
da135448a2
python: update tests for CryptographicOperation#getBlockMode
2022-05-13 16:32:36 +01:00
Alex Ford
9f2c59cd6d
python: implement getBlockMode for CryptographicOperations
2022-05-13 16:32:36 +01:00
github-actions[bot]
b7cbd8fd75
Post-release preparation for codeql-cli-2.9.2
2022-05-12 18:21:38 +00:00
Nick Rolfe
1115227f9d
Merge remote-tracking branch 'origin/main' into nickrolfe/misspelling
2022-05-12 16:10:27 +01:00
Nick Rolfe
2efa38aaa6
Python: fix typos in comments
2022-05-12 16:02:20 +01:00
Anders Schack-Mulligen
8c8440a58a
Merge pull request #9101 from hvitved/dataflow/include-hidden
...
Data flow: Add `Configuration::includeHiddenNodes()`
2022-05-12 15:36:12 +02:00
Taus
a0f8e2f0b1
Python: Modernise py/jinja2/autoescape-false
...
A simple rewrite to use API graphs instead.
The handling of falsy values is potentially a bit more restrictive now,
as it only accounts for local flow. We should probably figure out a
better way of capturing this pattern, but I felt that this was out of
scope for the present PR.
2022-05-12 12:55:42 +00:00
Joe Farebrother
59e400d2e0
Merge pull request #7723 from joefarebrother/redos
...
Java: Add ReDoS queries
2022-05-12 13:50:38 +01:00
Erik Krogh Kristensen
fb077bec66
sync AccessPathSyntax changes
2022-05-12 14:46:54 +02:00
Erik Krogh Kristensen
dea5596289
update MaD test to reflect that dotted module names don't work
2022-05-12 14:45:29 +02:00
Erik Krogh Kristensen
31e9876de7
Merge branch 'main' into pyMaD
2022-05-12 14:43:16 +02:00
Anders Schack-Mulligen
adb56dfa39
Dataflow: Improve standard order through easier type check elimination.
2022-05-12 14:31:38 +02:00
Rasmus Wriedt Larsen
7cd51d6147
Merge pull request #9126 from RasmusWL/moduleimport-with-dots
...
Python: Fully disallow `API::moduleImport` of module with dots
2022-05-12 14:16:25 +02:00
Rasmus Wriedt Larsen
795adf0566
Python: Fix API::moduleImport("foo.bar")
2022-05-12 13:33:00 +02:00
Rasmus Wriedt Larsen
3844c5b5c0
Python: Add change-note
2022-05-12 13:32:59 +02:00
Rasmus Wriedt Larsen
f8253f5fef
Python: Fully disallow API::moduleImport of module with dots
...
Inspired by discussion about this for MaD in
https://github.com/github/codeql/pull/8883#discussion_r865858084
2022-05-12 13:30:26 +02:00
Rasmus Wriedt Larsen
597a8414d9
Python: Add test of API::moduleImport with dots
...
This is currently semi-works -- the import is allowed, but doesn't
always work when used :|
2022-05-12 13:29:16 +02:00
Nick Rolfe
234a36ff61
Merge pull request #9119 from github/nickrolfe/non-us-spelling-fixes
...
Fix non-US spellings and the corresponding query
2022-05-12 12:29:14 +01:00
Mathias Vorreiter Pedersen
103c589c1d
Update python/ql/lib/change-notes/released/0.3.0.md
2022-05-12 11:47:19 +01:00
Mathias Vorreiter Pedersen
499878a44d
Update python/ql/lib/CHANGELOG.md
2022-05-12 11:47:08 +01:00
Mathias Vorreiter Pedersen
43265c4133
Update python/ql/lib/change-notes/released/0.3.0.md
2022-05-12 11:43:39 +01:00
Mathias Vorreiter Pedersen
b069d1bd17
Update python/ql/lib/CHANGELOG.md
2022-05-12 11:43:33 +01:00
github-actions[bot]
ee9980b31c
Release preparation for version 2.9.2
2022-05-12 10:17:28 +00:00
Tom Hvitved
46ab25b61e
Merge pull request #9098 from aschackmull/dataflow/perf
...
Dataflow: Performance fixes
2022-05-11 20:41:48 +02:00
Nick Rolfe
e1b277386a
Fix non-US spellings: s/analyse/analyze
2022-05-11 17:48:27 +01:00
Anders Schack-Mulligen
4884520ee1
Dataflow: Review fix.
2022-05-11 15:40:49 +02:00
Rasmus Wriedt Larsen
044829c3bb
Python: Add @security-severity to py/pam-auth-bypass
...
The value 8.1 was calculated by our internal tool. This corresponds to a
'High' severity, which from my gut feeling seems reasonable for
authorization bypass.
2022-05-11 14:57:21 +02:00
Rasmus Wriedt Larsen
cff950f5f7
Python: Fix select of py/insecure-cookie
2022-05-11 14:06:30 +02:00
Rasmus Wriedt Larsen
0956d506de
Python: Actually promote py/pam-auth-bypass
...
🤦
2022-05-11 13:44:47 +02:00
Rasmus Wriedt Larsen
fc8633cc01
Python: Fix select for py/cookie-injection
2022-05-11 13:18:14 +02:00
Rasmus Wriedt Larsen
27b99c51e9
Python: Add placeholder precision for py/insecure-cookie
2022-05-11 11:36:06 +02:00
Rasmus Wriedt Larsen
a902d3d8f0
Python: Add security-severity for py/insecure-cookie
...
Matching the Java query
7d4767a4f5/java/ql/src/Security/CWE/CWE-614/InsecureCookie.ql (L7)
2022-05-11 11:34:16 +02:00
