Commit Graph

41418 Commits

Author SHA1 Message Date
Dave Bartolomeo
0bc4b0421d C++: Remove unnecessary cast 2021-04-21 12:12:01 -04:00
Sauyon Lee
466d87684d Merge pull request #528 from sauyon/tuple-map-read 2021-04-21 08:50:40 -07:00
Rasmus Wriedt Larsen
5a9e27c6fc Merge branch 'main' into django-3.2 2021-04-21 17:15:47 +02:00
Chris Smowton
76091f0f8d Use ArrayElement accessor where needed 2021-04-21 15:58:41 +01:00
Chris Smowton
2c95b7539f Remove now-redundant steps 2021-04-21 15:57:09 +01:00
Chris Smowton
874733a61b Argument -> specific Argument indices 2021-04-21 15:53:55 +01:00
Chris Smowton
fce1d6122f Add change note 2021-04-21 15:47:20 +01:00
Chris Smowton
6589460357 Add models for Commons ToStringBuilder
These don't include support for reflectionToString yet, which is coming up in a subsequent PR.
2021-04-21 15:47:19 +01:00
Chris Smowton
94f0a1532d Merge pull request #5682 from smowton/smowton/docs/fix-has-modifier-comment
Fix documentation of Modifier.qll
2021-04-21 15:41:29 +01:00
Tamas Vajk
a0f5e45ae9 C#: Fix special case of default argument value extraction 2021-04-21 16:34:29 +02:00
Chris Smowton
9ab1a8d144 Reword change note
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
2021-04-21 15:28:28 +01:00
edvraa
a93d6a3ef6 Remove SafeConstructorTrackingConfig 2021-04-21 17:16:54 +03:00
Geoffrey White
ba335089c4 Merge pull request #5601 from ihsinme/ihsinme-patch-259
CPP: Add query for CWE-691 Insufficient Control Flow Management After Refactoring The Code
2021-04-21 15:13:38 +01:00
edvraa
9e46ef3cd9 Get rid of getParent 2021-04-21 17:11:40 +03:00
edvraa
808444986d Get rid of UnsafeDeserializerCallable 2021-04-21 17:06:20 +03:00
Owen Mansel-Chan
9c72e73a82 Make ExecTainted easier to extend
To add a method that executes a command, you can now define a class
extending ExecMethod.
2021-04-21 14:55:37 +01:00
edvraa
b6952d541a get rid of getParent 2021-04-21 16:55:34 +03:00
edvraa
9cc67e4266 make private where possible 2021-04-21 16:48:05 +03:00
CodeQL CI
30d7f0dc98 Merge pull request #5687 from RasmusWL/inline-taint-tests
Approved by yoff
2021-04-21 06:24:12 -07:00
Taus
71780228ae Python: Rename TypeTrackerPrivate.qll 2021-04-21 13:08:26 +00:00
Asger Feldthaus
2c9a6e7bef JS: Cache function-wrapping steps in type-tracking stage 2021-04-21 13:45:58 +01:00
Arthur Baars
bc6aec7a99 Merge pull request #167 from github/alexrford/numlines
Implement FLines metrics queries
2021-04-21 14:42:18 +02:00
Tamas Vajk
e25305e3cc Java: Introduce LoC summary metric query 2021-04-21 14:27:00 +02:00
Anders Schack-Mulligen
f9599da32d Java/C#: Move a couple of flow summary tweaks to the shared implementation. 2021-04-21 14:24:15 +02:00
Alex Ford
240f0abf27 drop @tags from metrics queries 2021-04-21 13:00:48 +01:00
Alex Ford
15289dba34 simplify File.getNumberOfLines 2021-04-21 12:59:25 +01:00
Rasmus Wriedt Larsen
be9cbd79d6 Python: Add change-note for Django 3.2 support 2021-04-21 13:58:34 +02:00
Alex Ford
cc5bbfce0b Get -> Gets 2021-04-21 12:57:55 +01:00
Alex Ford
5a191692df Update ql/src/queries/metrics/FLinesOfComments.ql
Co-authored-by: Arthur Baars <aibaars@github.com>
2021-04-21 12:57:12 +01:00
Rasmus Wriedt Larsen
59c6f76457 Python: Add test for new response.headers in Django
See https://docs.djangoproject.com/en/3.2/ref/request-response/#setting-header-fields
2021-04-21 13:55:22 +02:00
Rasmus Wriedt Larsen
2302c8d5fa Python: Model new alias method on django QuerySets 2021-04-21 13:52:38 +02:00
yoff
a19373ab54 Merge pull request #5727 from tausbn/python-use-localsource-in-stepsummary
Python: Use `LocalSourceNode` in `StepSummary::step`
2021-04-21 13:50:31 +02:00
Tamás Vajk
205469316c Merge pull request #5738 from tamasvajk/feature/loc
C# Add line of code metric query
2021-04-21 13:49:32 +02:00
Taus
489e1e94e4 Python: Prevent bad joins
Adds a few unbinds to prevent bad joins from occurring.

Firstly, we never want to join `StepSummary::step` with
`TypeTracker::append` on `summary` as the first join, as the resulting
relation is absolutely massive. So we decouple the two occurrences of
`summary` by unbinding each of them.

Secondly, in some cases the node we're stepping to (`nodeTo` for type
trackers, `nodeFrom` for type backtrackers) will get joined eagerly
with the typetracker one is defining, and again this produces an
uncomfortably large intermediate join. A bit of unbinding prevents this
as well.
2021-04-21 11:44:34 +00:00
Chris Smowton
e50ad90856 Elaborate comment and change-note a little 2021-04-21 12:36:43 +01:00
Chris Smowton
a152eec9f2 Add test for ExtractTupleElementInstruction.getResultType() 2021-04-21 12:33:51 +01:00
Chris Smowton
4fb714f445 Simplify implementation of ExtractTupleElementInstruction.getResultType 2021-04-21 12:33:00 +01:00
Taus
9e95f6e7c1 Python: Remove typePreservingStep
This requires a bit of explanation, so strap in.

Firstly, because we use `LocalSourceNode`s as the start and end points
of our `StepSummary::step` relation, there's no need to include
`simpleLocalFlowStep` (via `typePreservingStep`) in `smallstep`. Indeed,
since the successor node for a `step` is a `LocalSourceNode`, and local
sources never have incoming flow, this is entirely futile -- we can find
values for `mid` and `nodeTo` that satisfy the body of `step`, but
`nodeTo` will never be a `LocalSourceNode`.

With this in mind, we can simplify `smallstep` to only refer to
`jumpStep`.

This then brings the other uses of `typePreservingStep` into question.
The only other place we use this predicate is in the `TypeTracker` and
`TypeBackTracker` `smallstep` predicates. Note, however, that here we
no longer need `jumpStep` to be part of `typeTrackingStep` (as it is
already accounted for in `StepSummary::smallstep`) so we can simplify
to `simpleLocalFlowStep`. At this point, `typePreservingStep` is unused.

Finally, because of the way `smallstep` is used in `step` (inside
`StepSummary`), `nodeTo` must always be a `LocalSourceNode`, so I have
propagated this restriction to `smallstep` as well. We can always lift
this restriction later, but for now it seems like it's likely to cause
fewer surprises to have made this explicit.
2021-04-21 11:12:06 +00:00
asgerf
226792c73a JS: Expand RemoteFlowSource and move into own section 2021-04-21 12:04:09 +01:00
edvraa
8f6411dba3 Simpify with exists 2021-04-21 13:52:41 +03:00
asgerf
5df8583056 JS: Mention isUserControlledObject 2021-04-21 11:40:27 +01:00
asgerf
ff73c0b247 JS: Add section with access paths to cheat sheet 2021-04-21 11:40:27 +01:00
Alex Ford
4e119cc085 consider empty files (no ruby tokens) to have 0 lines 2021-04-21 11:29:55 +01:00
Alex Ford
a8597025aa fixed logic for line counting 2021-04-21 11:29:09 +01:00
edvraa
0590522e4b a deserializer 2021-04-21 13:29:00 +03:00
edvraa
3ac5f7bb18 Move RemoteSource and LocalSource to UnsafeDeserialization.qll 2021-04-21 13:27:26 +03:00
edvraa
452ec8c43f comments 2021-04-21 13:12:53 +03:00
edvraa
13655b5d80 Add RegExUtils 2021-04-21 13:08:35 +03:00
asgerf
f611d06ed0 JS: Add getALocalUse to cheat sheet 2021-04-21 10:53:10 +01:00
Alex Ford
bcc1be05de use explicit this prefixes in FileSystem.qll 2021-04-21 10:51:28 +01:00