Max Schaefer
c2a26f8ec9
Don't allow varargs as function outputs.
...
In a call of the form `f(xs...)`, when we say that `f` taints its 0th argument its ambiguous whether that means that it taints the slice `xs` or its 0th element `xs[0]`.
In practice, it's usually the latter, but we have no way of expressing that using our current `FunctionOutput` implementation.
2020-08-10 07:30:23 +01:00
Max Schaefer
bdfd1d131f
Teach extractor to record the presence of an ellipsis in a call expression.
2020-08-10 07:30:23 +01:00
Rasmus Lerchedahl Petersen
02478774c3
Python: tests for context managers
2020-08-10 08:11:25 +02:00
Erik Krogh Kristensen
30dc77e538
update expected output
2020-08-08 21:26:45 +02:00
Erik Krogh Kristensen
244052f419
autoformat
2020-08-08 21:20:20 +02:00
Rasmus Lerchedahl Petersen
5b7c7f933c
Python: tests for numeric classes
2020-08-08 00:31:29 +02:00
Rasmus Lerchedahl Petersen
f6d6f91a42
Python: tests for containers
2020-08-07 23:39:42 +02:00
Rasmus Lerchedahl Petersen
aff4535965
Python: fix tests for descriptors
2020-08-07 23:07:58 +02:00
Arthur Baars
5874ecc28b
Merge pull request #3976 from luchua-bc/java-unsecure-basic-auth
...
Java: Insecure basic authentication
2020-08-07 21:39:23 +02:00
Rasmus Lerchedahl Petersen
d84294df3d
Python: Check that tests are valid
2020-08-07 20:07:02 +02:00
Erik Krogh Kristensen
2680afcdc9
deduplicate some implementation in storeStep and loadStep
2020-08-07 19:16:28 +02:00
Geoffrey White
3cf11eca2a
C++: And more test cases.
2020-08-07 17:30:07 +01:00
Erik Krogh Kristensen
aab2e6f803
update name of test file
2020-08-07 18:20:22 +02:00
Erik Krogh Kristensen
7670e7da97
retarget change-note for 1.26
2020-08-07 18:17:46 +02:00
Geoffrey White
7d491afaeb
C++: More test cases.
2020-08-07 17:05:13 +01:00
Erik Krogh Kristensen
54fd7d97c0
share implementation instead of copy-pasting
2020-08-07 18:00:10 +02:00
Sauyon Lee
0b97e486a2
Fix one use of master in README
2020-08-07 08:49:57 -07:00
Erik Krogh Kristensen
94cf3a8ddb
correct copy-paste note after refactorings
2020-08-07 17:48:55 +02:00
Erik Krogh Kristensen
8f06e9651f
update expected output
2020-08-07 17:40:58 +02:00
Erik Krogh Kristensen
b9a98f51ea
update existing tests to work with FunctionReturnNode
2020-08-07 17:40:02 +02:00
Erik Krogh Kristensen
0edb46c20d
improve precision for load/store steps with async functions
2020-08-07 17:39:59 +02:00
Erik Krogh Kristensen
26ef2f34da
add precise return-flow for async functions
2020-08-07 17:33:26 +02:00
Erik Krogh Kristensen
cc94c5ec60
remove imprecise return-flow from async functions
2020-08-07 17:33:24 +02:00
Erik Krogh Kristensen
0004c28fe8
introduce and use FunctionReturnNode
2020-08-07 17:32:25 +02:00
Geoffrey White
b7d2e0ca63
C++: Make all the tests meaningful.
2020-08-07 14:18:28 +01:00
CodeQL CI
1b0cfc96b3
Merge pull request #4015 from erik-krogh/nonAbstract
...
Approved by asgerf
2020-08-07 13:44:23 +01:00
Geoffrey White
0ba59210fc
Merge pull request #4020 from jbj/taint-range-based-for-ast
...
C++: Taint through RangeBasedForStmt (AST only)
2020-08-07 13:41:49 +01:00
lcartey@github.com
bdcf4198e6
Add additional Hibernate SQL sinks
2020-08-07 14:03:24 +02:00
Anders Schack-Mulligen
e3a12c5fea
Merge pull request #4004 from Marcono1234/patch-2
...
[Java] Clarify Wildcard.hasUpperBound() doc
2020-08-07 13:06:13 +02:00
Asger Feldthaus
64f58b74f6
JS: Fix extractor crash when some parameters have no type annotation
2020-08-07 11:56:54 +01:00
Tom Hvitved
c20d763490
Merge pull request #3951 from raulgarciamsft/users/raulgarciamsft/dataset_serialization
...
C#: DataSet serialization
2020-08-07 12:54:10 +02:00
Jonas Jensen
c8911ab973
C++: Test range-based-for with std::vector too
2020-08-07 12:40:00 +02:00
Anders Schack-Mulligen
77db87efb7
Merge pull request #3968 from rvermeulen/java-importable-cwe-090
...
Java: Move LDAP injection sinks, sanitizers, and additional taint steps to importable location
2020-08-07 11:57:51 +02:00
Arthur Baars
c177eff3d8
Merge pull request #4027 from aschackmull/java/weak-crypto-precision
...
Java: Update precision of java/weak-cryptographic-algorithm.
2020-08-07 10:31:38 +02:00
Anders Schack-Mulligen
f9de8eb3b4
Java: Update precision of java/weak-cryptographic-algorithm.
2020-08-07 09:40:21 +02:00
Anders Schack-Mulligen
05e956b374
Merge pull request #4022 from aibaars/int-to-long
...
Java: remove security tag from java/integer-multiplication-cast-to-long
2020-08-07 09:32:43 +02:00
Marcono1234
0e54b498b7
Clarify Wildcard.hasTypeBound() doc
2020-08-06 23:15:25 +02:00
Marcono1234
f477e09190
Clarify Wildcard.hasUpperBound() doc
2020-08-06 23:15:16 +02:00
Remco Vermeulen
3ae3a879d2
Fix qldoc grammar and style mistakes
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2020-08-06 23:00:03 +02:00
Raul Garcia
3682a902de
Update csharp/ql/src/experimental/Security Features/Serialization/DataSetSerialization.qhelp
...
Co-authored-by: James Fletcher <42464962+jf205@users.noreply.github.com >
2020-08-06 12:09:02 -07:00
Geoffrey White
6e18be43f3
C++: Change note.
2020-08-06 19:27:12 +01:00
Geoffrey White
0281456948
C++: Add a 1.26 change note file (what happened to the templates?)
2020-08-06 19:21:06 +01:00
Geoffrey White
0534c69c76
C++: Autoformat.
2020-08-06 19:11:46 +01:00
Geoffrey White
0b5b7fa095
C++: Fix another edge case.
2020-08-06 19:06:42 +01:00
Geoffrey White
b3f3f6d95a
C++: Fix edge case.
2020-08-06 19:03:43 +01:00
Geoffrey White
cbf30e37ed
C++: Fix the issue.
2020-08-06 18:50:18 +01:00
Geoffrey White
a7564c9e0e
C++: Add a test of unsigned count-down loops.
2020-08-06 18:44:22 +01:00
Arthur Baars
f16c263393
Java: remove security tag from java/integer-multiplication-cast-to-long
2020-08-06 17:42:01 +02:00
Rasmus Lerchedahl Petersen
3db1ceeb70
Python: format ql
2020-08-06 15:42:14 +02:00
Rasmus Lerchedahl Petersen
614103c3b6
Python: Test calls rather than flows
2020-08-06 15:40:41 +02:00
