Sauyon Lee
7676a56af6
Makefile: Make extractor-common extractor target
2020-01-28 14:38:15 -08:00
Grzegorz Golawski
bbcfbd7a28
Apply suggestion from code review
2020-01-28 22:34:01 +01:00
Sauyon Lee
41d04f3d96
Revert "Add DataFlow2"
...
This reverts commit 6a0203f33303847d9e7006ca67b1dba31428748b.
2020-01-28 13:01:37 -08:00
Sauyon Lee
478f906d7a
HTTP: Use Field.getQualifiedName in UserControlledRequestField
...
Also autoformat.
2020-01-28 13:01:36 -08:00
Sauyon Lee
d2e5322b94
Apply review comments
2020-01-28 13:01:35 -08:00
Sauyon Lee
3eee780fdd
TaintTracking: minor functionNodeStep call improvement
...
Co-Authored-By: Max Schaefer <max@semmle.com >
2020-01-28 13:01:34 -08:00
Sauyon Lee
9af436566f
OpenUrlRedirect: Use a data-flow configuration to track whole URLs
2020-01-28 13:01:33 -08:00
Sauyon Lee
a2b5bb85ab
OpenUrlRedirect: Fix test compilation
2020-01-28 13:01:19 -08:00
Sauyon Lee
e17f548780
Add DataFlow2
2020-01-28 12:59:47 -08:00
Sauyon Lee
30d2fb0b7f
TaintTracking: Make functionModelStep take a FunctionModel
...
This makes using only some function models easier.
2020-01-28 12:59:46 -08:00
Sauyon Lee
260b33be7e
OpenUrlRedirect: Add untrusted methods
...
Also use more up-to-date data-flow APIs
2020-01-28 12:59:45 -08:00
Sauyon Lee
abfdd7ee1e
OpenUrlRedirect: make functions like isValidRedirect barrier guards
2020-01-28 12:59:44 -08:00
Sauyon Lee
82635a46ad
OpenUrlRedirect: only make some parts of the URL untrusted
2020-01-28 12:59:43 -08:00
Max Schaefer
2b92cd5ba5
Merge pull request #209 from sauyon/bad-redirect-sanitiser
...
Bad redirect sanitiser
2020-01-28 20:11:46 +00:00
Robert Marsh
9504da54d1
Merge pull request #2713 from MathiasVP/dynamic-cast-taint-propagation
...
C++: Taint propagation through dynamic_cast
2020-01-28 15:09:49 -05:00
Dave Bartolomeo
60a0eff4d7
Merge remote-tracking branch 'upstream/master' into dbartol/Indirections
2020-01-28 12:06:43 -07:00
yo-h
97069a7988
Merge pull request #2683 from aschackmull/java/lshift32
...
Java: Add new query for large left shifts and bugfix ConstantExpAppearsNonConstant.
2020-01-28 13:30:26 -05:00
Dave Bartolomeo
542579de7f
C++: Accept dataflow test changes due to new alias analysis
2020-01-28 10:58:27 -07:00
Dave Bartolomeo
dda32359fa
C++: Accept IR dump test results changes due to new alias analysis
2020-01-28 10:58:05 -07:00
Dave Bartolomeo
7013bc6bf4
C++: Update escape analysis tests to new API
2020-01-28 10:57:07 -07:00
Dave Bartolomeo
bb9485d548
C++: Update points_to tests to use new framework
2020-01-28 10:56:49 -07:00
Dave Bartolomeo
af9d90cf46
C++: New test framework that allows expected results as comments in source code
2020-01-28 10:56:13 -07:00
Dave Bartolomeo
d12b140921
C++/C#: Update shared file list
2020-01-28 10:55:38 -07:00
Dave Bartolomeo
976b564b68
C++: Update AliasedSSA to use Allocation instead of IRVariable
...
This introduces a new type of `MemoryLocation`: `EntireAllocationMemoryLocation`, representing an entire contiguous allocation whose size is not known. This is used to model the memory accesses on `InitializeIndirection` and `ReturnIndirection`.
2020-01-28 10:55:24 -07:00
Dave Bartolomeo
165a45d9b5
C++/C#: Update SimpleSSA to use Allocation instead of IRVariable
2020-01-28 10:53:18 -07:00
Dave Bartolomeo
1bbc875442
C++/C#: Parameterize alias analysis based on AliasConfiguration
...
Instead of tracking `IRVariable`s directly, alias analysis now tracks instances of the `Allocation` type provided by its `Configuration` parameter. For unaliased SSA, an `Allocation` is just an `IRAutomaticVariable`. For aliased SSA, an `Allocation` is either an `IRVariable` or the memory pointed to by an indirect parameter.
2020-01-28 10:51:21 -07:00
Dave Bartolomeo
b15dd82732
C++/C#: Share alias analysis between C++ and C#
2020-01-28 10:47:37 -07:00
Dave Bartolomeo
1b1fded535
C++/C#: Add new MemoryAccessKind to represent entire allocation
2020-01-28 10:41:53 -07:00
Mathias Vorreiter Pedersen
67d29e31cc
C#: Sync identical files
2020-01-28 17:52:45 +01:00
Mathias Vorreiter Pedersen
c1091a03d0
C++: Accept output
2020-01-28 17:38:35 +01:00
Mathias Vorreiter Pedersen
46ce228bce
C++: Add instruction for CheckedConvertOrNull and handle it in alias analysis and data flow
2020-01-28 17:36:17 +01:00
Mathias Vorreiter Pedersen
928b0c50d2
C++: Add test demonstrating false negative when using dynamic_cast
2020-01-28 17:31:53 +01:00
Sauyon Lee
aa33595b0f
Address review comments
2020-01-28 08:26:37 -08:00
Rasmus Wriedt Larsen
4ca72de4cd
Python: Fix recommended module for deprecated posixfile
...
$ python2 -W default -c 'import posixfile'
-c:1: DeprecationWarning: The posixfile module is deprecated; fcntl.lockf() provides better locking
https://docs.python.org/2.7/library/posixfile.html
2020-01-28 16:44:47 +01:00
Rasmus Wriedt Larsen
6c7cddf258
Python: py/import-deprecated-module handle backwards compatible code
2020-01-28 16:36:47 +01:00
Rasmus Wriedt Larsen
e92d6c0459
Python: Stop py/import-deprecated-module from double alerting
...
This changes the location from the import statement, to the actual expression
2020-01-28 16:15:46 +01:00
Rasmus Wriedt Larsen
7949acc3ef
Python: Autoformat
2020-01-28 16:15:21 +01:00
Rasmus Wriedt Larsen
194228850a
Python: Add tests for py/import-deprecated-module
2020-01-28 16:15:21 +01:00
Calum Grant
6b377d7ad4
C#: Analysis change notes
2020-01-28 14:59:25 +00:00
Geoffrey White
fc1816cbd7
C++: Update change note.
2020-01-28 14:53:18 +00:00
Geoffrey White
f02ffcbbd2
C++: Modify ParameterIndex to account for varargs.
2020-01-28 14:53:18 +00:00
Geoffrey White
d66f608d41
C++: Taint from FormattingFunction varargs.
2020-01-28 14:53:18 +00:00
Geoffrey White
8b215c155e
C++: Correct a few test comments.
2020-01-28 14:51:46 +00:00
Geoffrey White
b1f66ae825
C++: Fix warnings.
2020-01-28 14:51:46 +00:00
yo-h
95d138bf00
Merge pull request #2659 from aschackmull/java/remove-parexpr
...
Java: Update dbscheme for ParExpr removal.
2020-01-28 09:50:06 -05:00
Erik Krogh Kristensen
aea365c424
adjust API naming
2020-01-28 15:09:31 +01:00
Calum Grant
0b3821c828
C#: Remove false positive for out params
2020-01-28 13:59:33 +00:00
Jonas Jensen
24a50fceef
Merge pull request #2709 from MathiasVP/ql-tests-taint-tracking-fixup
...
C++: Fix annotations in testcase file
2020-01-28 14:52:55 +01:00
Erik Krogh Kristensen
cb16116b4d
adjust type-tracking on custom EventEmitters
2020-01-28 14:00:26 +01:00
Mathias Vorreiter Pedersen
287af2bdec
C++: Fix annotations in testcase file
2020-01-28 13:51:36 +01:00
