40697 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Andrew Eisenberg	392adf2a25	Workflows: Remove dry-run flag for labeller	2021-04-14 08:25:34 -07:00
Dave Bartolomeo	b29f35f564	Fix formatting	2021-04-14 11:15:16 -04:00
Arthur Baars	24bb11b20a	Improve module/class resolution	2021-04-14 17:14:38 +02:00
Arthur Baars	12ee957331	Add test cases	2021-04-14 17:12:39 +02:00
Arthur Baars	3b73d41cc4	Merge pull request #163 from github/aibaars/modules-2 ... Ignore include/prepend statements in blocks	2021-04-14 17:09:34 +02:00
Geoffrey White	64fed4cb10	Merge pull request #5677 from MathiasVP/fix-duplicate-ids-in-experimental ... C++: Fix duplicate names in experimental queries	2021-04-14 15:58:49 +01:00
Mathias Vorreiter Pedersen	ed64ed3d8d	C++: Make exprMightOverflowPositively/exprMightOverFlowNegatively hold for unanalyzable expressions. This hopefully means that expressions that do not satisfy these predicates will never overflow/underflow.	2021-04-14 16:45:27 +02:00
Jonas Jensen	b4f01c9afa	Merge pull request #5578 from MathiasVP/ast-flow-smart-pointers ... C++: AST dataflow through smart pointers	2021-04-14 16:39:05 +02:00
Mathias Vorreiter Pedersen	53a320a810	C++: Fix duplicate names.	2021-04-14 16:33:18 +02:00
Mathias Vorreiter Pedersen	bb447d7174	C++: Make sure missingGuardAgainstOverflow (and underflow) holds when range analysis fails to deduce a bound.	2021-04-14 16:30:43 +02:00
yoff	447f339857	Merge pull request #5641 from tausbn/python-use-localsourcenode-in-typetrackers ... Python: Use API graphs in PEP249 support	2021-04-14 15:39:49 +02:00
Mathias Vorreiter Pedersen	92508beb82	Merge pull request #5600 from ihsinme/ihsinme-patch-258 ... CPP: Add query for CWE-691 Insufficient Control Flow Management When Using Bit Operations	2021-04-14 14:55:30 +02:00
Anders Schack-Mulligen	f43d427875	Merge pull request #5645 from Marcono1234/marcono1234/primary-ql-class ... Java: Override getAPrimaryQlClass() for more classes	2021-04-14 14:51:29 +02:00
Mathias Vorreiter Pedersen	bc7cc2f7ce	C++: Remove rule that wasn't needed.	2021-04-14 14:50:27 +02:00
Mathias Vorreiter Pedersen	da36508714	Revert "C++: As response to the review comments this commit adds a reference-to-pointer state to AddressFlow. A call to an unwrapper function now adds a pointer -> reference-to-pointer transition, and a ReferenceDereference adds a reference-to-pointer -> pointer transition." ... This reverts commit 5aeaab7c6d.	2021-04-14 14:41:22 +02:00
Chris Smowton	591ac38c31	Merge pull request #5591 from Marcono1234/marcono1234/member-nested-type ... Java: Add MemberType	2021-04-14 12:29:54 +01:00
Taus	54c79bff74	Merge pull request #5666 from RasmusWL/django-refactor ... Python: Refactoring and exposing of Django views/fields/forms	2021-04-14 13:07:20 +02:00
Mathias Vorreiter Pedersen	2e40d01397	Update cpp/ql/src/semmle/code/cpp/security/Overflow.qll ... Co-authored-by: Geoffrey White <40627776+geoffw0@users.noreply.github.com>	2021-04-14 13:01:31 +02:00
Rasmus Wriedt Larsen	44d2bf42d7	Merge pull request #5671 from tausbn/python-use-api-graphs-in-werkzeug ... Python: Use API graphs in Werkzeug	2021-04-14 12:57:58 +02:00
Erik Krogh Kristensen	fd23e0bdda	use more API nodes in XmlParsers, and recognize more results from parsing XML	2021-04-14 11:48:31 +02:00
Anders Schack-Mulligen	3b6cd0f681	Merge pull request #5661 from smowton/smowton/cleanup/call-is-exprparent ... Make Call a subclass of ExprParent.	2021-04-14 10:49:33 +02:00
Rasmus Wriedt Larsen	9de8085571	Merge pull request #5665 from tausbn/python-use-api-graphs-in-tornado ... Python: Tornado cleanup using API graphs	2021-04-14 10:22:21 +02:00
Rasmus Wriedt Larsen	2d0c9b6bf2	Merge pull request #5670 from tausbn/python-use-api-graphs-in-dill ... Python: Use API graphs in Dill model	2021-04-14 10:08:02 +02:00
Rasmus Wriedt Larsen	55723618a9	Python: Apply suggestions from code review ... Co-authored-by: Taus <tausbn@github.com>	2021-04-14 10:05:50 +02:00
Arthur Baars	9afda342bc	Address comments	2021-04-14 09:57:49 +02:00
Arthur Baars	754bfdd136	Ignore include/prepend statements in blocks ... Include and prepend statements are rarely used in block in normal code and when used in normal code they tend to be in blocks that are passed to methods like `module_eval` which is a builtin method that evaluates a block in the context of some other module (typically created with Module.new). We currently don't attempt to track such "dynamically" constructed modules, and ignoring such modules and the `module_eval` calls on them seems fine for now. Another, much more frequent use of include/prepend statements in blocks is in Rspec.describe and Rspec.context method calls in tests. Rspec also evaluates those blocks in the context of some special Rspec class. Precisely tracking such calls during the initial construction of the module/class hierarchy would be really hard and there would be little benefit because the interesting modules and classes of an application are not defined in test files.	2021-04-14 09:53:19 +02:00
Arthur Baars	280fe73063	Add test case with 'module_eval' call with block containing 'prepend' statement	2021-04-14 09:53:19 +02:00
Chris Smowton	2965a1f204	Use Thread$State as an inner-class example ... Map<>$Entry currently has odd generic notation that may be about to change.	2021-04-14 08:43:05 +01:00
Chris Smowton	5158e7964e	Add change note	2021-04-14 08:25:12 +01:00
Tom Hvitved	36fe72246b	C#: Add change note	2021-04-14 09:22:16 +02:00
Tom Hvitved	4810308b16	C#: Add Customizations.qll	2021-04-14 09:16:31 +02:00
haby0	77208bcc91	Fix the error that there is no VerificationMethodToIfFlowConfig	2021-04-14 13:14:43 +08:00
haby0	e2ed0d02b0	Delete existsFilterVerificationMethod and existsServletVerificationMethod, add from get handler to filter	2021-04-14 12:34:52 +08:00
haby0	37dae67a0d	Fix RequestResponseFlowConfig.isSink error	2021-04-14 09:55:24 +08:00
Robert Marsh	419d25cbcf	Merge pull request #5325 from ihsinme/ihsinme-patch-245 ... CPP: Add query for CWE-783 Operator Precedence Logic Error When Use Bool Type	2021-04-13 13:24:39 -07:00
Taus	981c5deb57	Merge pull request #5639 from tausbn/python-api-graphs-missing-builtins ... Python: Add missing builtins to `API::builtin`	2021-04-13 21:27:52 +02:00
Marcono1234	d853f0c400	Java: Add MemberType	2021-04-13 18:55:20 +02:00
Taus	a6bb9ebb9f	Python: Re-introduce abstract toString ... This seems like the easier solution in the short run.	2021-04-13 16:08:41 +00:00
Taus	079c7e089d	Python: Autoformat	2021-04-13 16:05:45 +00:00
Taus	273e8ce4ef	Python: Add change note	2021-04-13 16:04:07 +00:00
haby0	00235ed3b3	Update java/ql/src/semmle/code/java/frameworks/Servlets.qll ... Co-authored-by: Chris Smowton <smowton@github.com>	2021-04-13 23:58:52 +08:00
haby0	25b012db48	Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql ... Co-authored-by: Chris Smowton <smowton@github.com>	2021-04-13 23:58:28 +08:00
Taus	5f7d3d0d36	Python: Use API graphs in Werkzeug	2021-04-13 15:57:21 +00:00
haby0	7be45e7c5e	Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql ... Co-authored-by: Chris Smowton <smowton@github.com>	2021-04-13 23:56:17 +08:00
haby0	6e73d13670	Update java/ql/src/semmle/code/java/frameworks/Servlets.qll ... Co-authored-by: Chris Smowton <smowton@github.com>	2021-04-13 23:48:45 +08:00
Taus	2890fe6d61	Python: Use API graphs in Dill model ... If only all rewrites were this smooth...	2021-04-13 15:26:54 +00:00
Taus	7ed09904b4	Python: Use API graphs for Invoke ... A few stragglers remain, as they are modelling the use of decorators. They will be dealt with at a later date.	2021-04-13 15:21:19 +00:00
Mathias Vorreiter Pedersen	aa52585120	C++: Add change-note.	2021-04-13 17:17:05 +02:00
Marcono1234	89a5acf6e8	Java: Revert overriding XMLFile.getAPrimaryQlClass() ... Library file has to be kept in sync with the other languages, however except cpp none of them have the getAPrimaryQlClass() predicate declared in a superclass. Therefore for simplicity revert the change for Java.	2021-04-13 17:09:15 +02:00
Taus	7f131c1f35	Python: Get rid of _attr predicates	2021-04-13 14:55:44 +00:00