Joe Farebrother
5a4316d945
Add test cases for exponential redos query
2022-05-04 15:41:35 +01:00
Joe Farebrother
457cf41825
Support more escaped characters
2022-05-04 15:41:35 +01:00
Joe Farebrother
4b845d5dac
Move test cases to their own directory to avoid conflict
2022-05-04 15:41:35 +01:00
Joe Farebrother
9f4da65030
Improve calculation of locations of regex terms
2022-05-04 15:41:35 +01:00
Joe Farebrother
dd200e29d4
Improve char set depth calculation
2022-05-04 15:41:35 +01:00
Joe Farebrother
e797d2195c
Topologically sort RegexString
2022-05-04 15:41:34 +01:00
Joe Farebrother
bc109521aa
Simplify octal handling
2022-05-04 15:41:34 +01:00
Joe Farebrother
9e88c67c19
Add more test cases; make some fixes
2022-05-04 15:41:34 +01:00
Joe Farebrother
aa1337db86
Apply style suggestions from code review
2022-05-04 15:41:34 +01:00
Joe Farebrother
e954db293a
Convert snake case predicates to camel case
2022-05-04 15:41:34 +01:00
Joe Farebrother
5b61de67de
Implement style/doc suggestions from code review
2022-05-04 15:41:33 +01:00
Joe Farebrother
28649da187
Add parser tests; fix some parser issues.
...
[temporarily renamed existing regex/Test.java during rebasing to avoid conflict]
2022-05-04 15:41:33 +01:00
Joe Farebrother
8e1918216e
Add PrintAst support for regex terms
2022-05-04 15:41:33 +01:00
Joe Farebrother
ca422a2186
Use explicit this
2022-05-04 15:41:33 +01:00
Joe Farebrother
f9f7a01f57
Add Java ReDoS libraries to identical-files.json
2022-05-04 15:41:33 +01:00
Joe Farebrother
11e465f2ac
Implement remaining syntax differences
2022-05-04 15:41:33 +01:00
Joe Farebrother
7530902ad7
Add approximate support for nested character classes.
...
This shouldn't fail to parse on any correctly formed character class; but may give incorrect contents when nested classes are involved.
2022-05-04 15:41:33 +01:00
Joe Farebrother
d04c99b0be
Support quote sequences
2022-05-04 15:41:32 +01:00
Joe Farebrother
59945cd8b3
Add dataflow logic to PolynomialRedDoS
2022-05-04 15:41:30 +01:00
Joe Farebrother
37240f01d2
Copy Redos queries from python
...
Todo: Implement dataflow for polynomialredos; update docs to reference java rather than python
2022-05-04 15:40:58 +01:00
Joe Farebrother
a8f7a4459e
Port redos libraries from Python
2022-05-04 15:40:56 +01:00
Tom Hvitved
8e33653d25
Merge pull request #9017 from hvitved/dataflow/subpaths-perf
...
Data flow: Speedup `subpaths` predicate
2022-05-04 16:37:52 +02:00
Erik Krogh Kristensen
0d8bef7e92
Merge pull request #6736 from erik-krogh/polyReplace
...
JS: track flow through string replace calls that just replace single chars for js/polynomial-redos
2022-05-04 16:30:20 +02:00
Erik Krogh Kristensen
8425eaf919
Merge pull request #8549 from erik-krogh/unreachableJoin
...
JS: fix bad join in js/unreachable-method-overloads
2022-05-04 16:28:06 +02:00
Erik Krogh Kristensen
b4d4b51bc7
Merge pull request #8147 from erik-krogh/cacheReg
...
JS: cache RegExpCreationNode::getAReference
2022-05-04 16:25:25 +02:00
Arthur Baars
c7b2da5e39
JS: exclude ATM folder from labeler
2022-05-04 16:16:19 +02:00
Erik Krogh Kristensen
8e2b00d209
make the big disjunctions more readable by using a set literal
2022-05-04 16:15:17 +02:00
Erik Krogh Kristensen
31a4de902e
add missing security severity
2022-05-04 16:15:17 +02:00
Erik Krogh Kristensen
7530923af3
add missing qldoc
2022-05-04 16:14:59 +02:00
Erik Krogh Kristensen
d8cc82bdb1
add change-note
2022-05-04 16:14:59 +02:00
Erik Krogh Kristensen
df4bfef8c7
expand the qhelp for js/actions/injection
2022-05-04 16:14:59 +02:00
Erik Krogh Kristensen
48fb01f9f7
set js/actions/injection as a high precision warning query
2022-05-04 16:14:54 +02:00
Erik Krogh Kristensen
2a65d1d3ec
move js/actions/injection out of experimental
2022-05-04 16:14:19 +02:00
Erik Krogh Kristensen
fc6eedd07a
generalize the file pattern for github/actions related YAML
2022-05-04 16:14:19 +02:00
Erik Krogh Kristensen
bc470b89f1
leave a deprecated alias for Actions.qll
2022-05-04 16:14:19 +02:00
Erik Krogh Kristensen
9db67d4988
move the Actions API out of experimental
2022-05-04 16:14:19 +02:00
Rasmus Wriedt Larsen
7bd7bedb1b
Ruby: Simplify isLocalSourceNode implementation
...
The need for `SynthReturnNode` goes away if we don't restrict the nodes
that can't be reached from another entry definition or expression to be
`ExprNode`s
2022-05-04 16:12:20 +02:00
Nick Rolfe
5f59e96fa9
Merge pull request #8975 from github/nickrolfe/flow_summary_joins
2022-05-04 14:24:45 +01:00
Alex Ford
1af5c680fa
ruby: drop the CallableCfgNode classes
2022-05-04 14:07:04 +01:00
Alex Ford
687602b6f1
ruby: drop a TODO
2022-05-04 14:06:37 +01:00
Alex Ford
4210973ade
ruby: drop unnecessary getExpr
...
Co-authored-by: Arthur Baars <aibaars@github.com >
2022-05-04 14:04:34 +01:00
Tom Hvitved
9cb63c0a5e
Data flow: Sync files
2022-05-04 14:49:26 +02:00
Tom Hvitved
7f7742216c
Address review comment
...
This reverts commit 2b4fde74bb
2022-05-04 14:49:03 +02:00
Nick Rolfe
276f8d40f9
Ruby: add comments to address review feedback
2022-05-04 12:07:46 +01:00
Mathias Vorreiter Pedersen
f499f8e946
Merge pull request #9029 from redsun82/swift-codeowners
...
Swift: set @github/codeql-c as owner
2022-05-04 11:34:51 +01:00
Tony Torralba
2d3b15f936
Add more taint models
2022-05-04 12:32:59 +02:00
Michael Nebel
5f1a176a02
Java: Sync CaptureModels implementation to only allow at most two reads and two stores.
2022-05-04 12:29:57 +02:00
Michael Nebel
a488d6b80c
C#: Add an initial flow state to the model generator.
2022-05-04 12:27:34 +02:00
Tony Torralba
8601137602
Fix bad join order by moving WebViewRef::getAnAccess from callsites into predicates
2022-05-04 11:58:47 +02:00
Owen Mansel-Chan
570d3f47c4
Use os.Stat instead of os.File.Stat
2022-05-04 10:11:53 +01:00
