Robert Marsh
947ad02db9
C++: autoformat
2020-09-21 11:38:57 -07:00
Chris Smowton
7b917f9dd7
Add utility functions for getting FunctionInputs and FunctionOutputs.
2020-09-21 17:35:40 +01:00
Chris Smowton
397282f41a
Add models for the Echo framework
2020-09-21 17:35:40 +01:00
Asger Feldthaus
e70bb20f34
JS: Support XML extraction when run with codeql
2020-09-21 17:21:54 +01:00
Rasmus Lerchedahl Petersen
08b51e67c4
Python: Update test annotation
2020-09-21 17:44:36 +02:00
Rasmus Lerchedahl Petersen
73d2d9b1f8
Python: Make constructor calls post-update nodes
2020-09-21 17:32:22 +02:00
Chris Smowton
bdb3e54299
Add tests for stdlib-http fields that aren't supposed to cause open-redirect alerts
2020-09-21 16:26:46 +01:00
Chris Smowton
b6b7bd2717
Generalise model of HTTP libraries
...
* Allow for HTTP response methods that define a content-type without a corresponding header write
* Factor out stdlib-http-specific classification of fields that aren't vulnerable to an open-redirect exploit
2020-09-21 16:26:39 +01:00
Taus
724baaf26a
Merge pull request #4308 from RasmusWL/python-private-import-of-DataFlowPrivate
...
Python: Make import of DataFlowPrivate private
2020-09-21 17:13:48 +02:00
Slavomir
0005775e2b
Apply suggestions from code review
...
Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com >
2020-09-21 16:23:21 +02:00
Tom Hvitved
06dbec78f7
C#: Add Guard::controlsBasicBlock() and simplify Guard::isEquality()
2020-09-21 16:15:12 +02:00
Tamas Vajk
8bf4a4209c
C#: Sign analysis
...
Synced between Java and C# through `identical-files.json`.
2020-09-21 16:15:12 +02:00
Rasmus Wriedt Larsen
2f9f51dbd8
Python: Fix tests that use DataFlowPrivate
2020-09-21 16:08:17 +02:00
yoff
557db3381d
Merge pull request #4265 from tausbn/python-add-global-flow-steps
...
Python: Add `ModuleVariableNode` to keep track of global reads and writes
2020-09-21 15:51:19 +02:00
Tom Hvitved
d3ea20cd2c
Merge pull request #4271 from github/matt-gretton-dann/csharp-dont-trace-macos-pkill
...
Don't trace through pkill or pgrep on macOS.
2020-09-21 15:44:48 +02:00
Tamas Vajk
441fbe3215
Add Java test file for sign analysis
2020-09-21 15:07:09 +02:00
Mathias Vorreiter Pedersen
873e871620
C++: Handle more cases in arrayReadStep.
2020-09-21 14:35:37 +02:00
Mathias Vorreiter Pedersen
73cd5ceb80
C++: Accept tests. Due to the removal of overlap between the reads steps there are fewer repeated edges in path explanations.
2020-09-21 14:17:49 +02:00
Rasmus Wriedt Larsen
6aca82fa82
Python: Make import of DataFlowPrivate private
...
Otherwise you are able to use `DataFlow::isExpressionNode` where
`isExpressionNode` is defined in `DataFlowPrivate.qll`.
2020-09-21 13:52:58 +02:00
Taus
9d7a2d2b5d
Merge branch 'main' into python-add-global-flow-steps
2020-09-21 13:50:20 +02:00
Anders Schack-Mulligen
4a3118b13e
Merge pull request #4246 from RasmusWL/java-fix-ssa-varBlockReaches
...
Java: Minor fixup for SSA AdjacentUsesImpl::varBlockReaches
2020-09-21 13:28:20 +02:00
CodeQL CI
016e6d2001
Merge pull request #4275 from erik-krogh/CVE760-indirect
...
Approved by esbena
2020-09-21 04:09:51 -07:00
Mathias Vorreiter Pedersen
62d42f20d9
C++: use(x) is no longer an array read.
2020-09-21 12:46:03 +02:00
Slavomir
dedeb7bbf1
Add taint-tracking for container/ring package
2020-09-21 12:34:00 +02:00
Slavomir
75e3ee6e77
Add taint-tracking for container/list package
2020-09-21 12:32:39 +02:00
Slavomir
4ecf9b0f6b
Add taint-tracking for container/heap package
2020-09-21 12:30:47 +02:00
Rasmus Wriedt Larsen
233dd43635
Java: Port varBlockReaches fix to BaseSSA.qll
2020-09-21 12:11:25 +02:00
Taus Brock-Nannestad
1d6558b4e8
Python: Add a bit more documentation to ModuleVariableNode
2020-09-21 11:46:18 +02:00
Mathias Vorreiter Pedersen
c560c7584c
C++: Add QLDoc for BufferMayWriteSideEffectFieldStoreQualifierNode
2020-09-21 11:08:06 +02:00
Mathias Vorreiter Pedersen
49dd576352
C++: Add more tests
2020-09-21 10:59:16 +02:00
Erik Krogh Kristensen
4571ba38a5
add change-note for es2021
2020-09-21 10:51:36 +02:00
Erik Krogh Kristensen
4bc91c4439
add support for Promise.any
2020-09-21 10:50:06 +02:00
Erik Krogh Kristensen
9f1b3d61b9
add test for numeric separators
2020-09-21 10:50:06 +02:00
Erik Krogh Kristensen
b09015380a
add support for String.prototype.replaceAll
2020-09-21 10:50:04 +02:00
Erik Krogh Kristensen
0dbdbfa659
bump extractor version
2020-09-21 10:49:50 +02:00
Erik Krogh Kristensen
87d4e13584
added support for ES2021 assignment operators
2020-09-21 10:49:50 +02:00
Erik Krogh Kristensen
9e7a1934ea
add express and HTTP to change-notes
2020-09-21 10:45:43 +02:00
Erik Krogh Kristensen
4dfc0680e2
support non SourceNode receiver for partialInvoke in routeHandlerStep
2020-09-21 10:42:19 +02:00
Chris Smowton
6770c74b7f
Merge pull request #345 from gagliardetto/from-331-to-337
...
Merge #331 , #332 , #333 , #334 , #335 , #336 , #337
2020-09-21 09:34:41 +01:00
Erik Krogh Kristensen
4cde48cfb8
change comma to dot in qldoc
2020-09-21 10:23:21 +02:00
Erik Krogh Kristensen
edebbd640e
revert change to return-type
2020-09-21 10:18:22 +02:00
Mathias Vorreiter Pedersen
6dd7675a97
Update cpp/ql/src/semmle/code/cpp/ir/dataflow/internal/DataFlowPrivate.qll
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2020-09-21 09:31:30 +02:00
Erik Krogh Kristensen
6c050d3160
revert change of return-type
2020-09-20 22:21:42 +02:00
Erik Krogh Kristensen
ae228cb5b2
move new predicates to a more fitting location
2020-09-20 22:15:03 +02:00
Erik Krogh Kristensen
5fd4c7a422
use PartialInvokeNode
2020-09-20 22:06:48 +02:00
Erik Krogh Kristensen
bef09254ee
rename forwardingCall to isAForwardingRouteHandlerCall
2020-09-20 21:59:33 +02:00
Erik Krogh Kristensen
62332121b2
remove getNumParameter constraint
2020-09-20 21:57:55 +02:00
Erik Krogh Kristensen
3aaa2d11a7
rename decoratedRouteHandler to isDecoratedCall
2020-09-20 21:54:56 +02:00
Slavomir
a7dba54001
Merge branch 'standard-lib-pt-15' into from-331-to-337
2020-09-20 18:25:29 +02:00
Slavomir
ad53583b5e
Remove methods on IP
2020-09-20 18:23:56 +02:00
