Nick Rolfe
348ad95fc0
Ruby: fix defining every dataflow node as a command execution sink
2022-07-11 15:06:27 +01:00
Paolo Tranquilli
93d06daf67
Swift: allow skipping fields in cppgen
...
Some fields of base classes pose some problems with diamond hierarchies,
and we don't use them any way as we are emitting them using directly
trap entries instead of structured C++ classes.
This introduces a `cpp_skip` pragma to skip generation of those fields
in structured generated C++ classes, and applies it to `is_unknown` and
`location`.
2022-07-11 15:59:21 +02:00
Paolo Tranquilli
39406436bf
Swift: extract IfConfigDecl
...
This also adds `UnresolvedDeclRefExpr` tests, as `IfConfigDecl`
consistently introduces those.
2022-07-11 15:11:13 +02:00
Ben Rodes
a6048dd594
Merge branch 'github:main' into main
2022-07-11 08:49:13 -04:00
Jeroen Ketema
93a4a32527
Merge pull request #9786 from jketema/lossy
...
C++: LossyFunctionResultCast updates
2022-07-11 14:14:33 +02:00
Robert Marsh
bbd7e62341
Merge pull request #9793 from jketema/nullness
...
C++: Add tests for `AnalysedExpr::isNullCheck` and `AnalysedExpr::isValidCheck`
2022-07-11 08:07:24 -04:00
Ian Lynagh
28a8999b74
Java: Add an upgrade script
2022-07-11 12:09:48 +01:00
Ian Lynagh
aa07600f5a
Java: Update stats
2022-07-11 12:09:48 +01:00
Erik Krogh Kristensen
9ed7aa9fae
exclude variables in .vue files form js/unused-local-variable
2022-07-11 12:52:23 +02:00
Chris Smowton
74641ccfee
Simplify test for no-arg constructor
2022-07-11 11:01:19 +01:00
Jeroen Ketema
6b2154eb8b
C++: Add tests for AnalysedExpr::isNullCheck and AnalysedExpr::isValidCheck
2022-07-11 11:54:48 +02:00
Paolo Tranquilli
7d5dd384c3
Swift: extract UnresolvedPatternExpr
2022-07-11 10:59:00 +02:00
Paolo Tranquilli
7c3cadc9b6
Swift: extract OpenedArchetypeType
2022-07-11 10:48:21 +02:00
thiggy1342
e8e8da1b31
fix lib test expect for ActionController
2022-07-08 19:01:01 +00:00
thiggy1342
5d3232c614
refactor to use data flow
2022-07-08 18:53:24 +00:00
thiggy1342
96e66c4a50
move tests
2022-07-08 18:39:04 +00:00
thiggy1342
0435105d16
Merge remote-tracking branch 'upstream/main' into experimental-strong-params
2022-07-08 18:36:09 +00:00
thiggy1342
6aab970a9e
refactor query to use cfg and dataflow
2022-07-08 18:32:54 +00:00
thiggy1342
bd50fd7f1e
format fix
2022-07-08 17:20:41 +00:00
thiggy1342
11e39aa030
Add changelog
2022-07-07 21:40:16 +00:00
thiggy1342
940254d251
update framework tests
2022-07-07 19:39:59 +00:00
thiggy1342
b4869158f2
expand query tests for cwe-089
2022-07-07 19:23:57 +00:00
thiggy1342
2f1cfa816f
Add annotate arguments as sqli sink
2022-07-07 19:23:06 +00:00
Raul Garcia
f8994d04d6
Clean up
2022-07-07 11:49:05 -07:00
REDMOND\brodes
4379aa4398
Adding Initializer in condition as an occurance of isDef
2022-07-07 10:32:36 -04:00
Raul Garcia
01da877d0e
Moving the new query to experimental. It was added to the wrong folder initially.
2022-07-06 14:07:14 -07:00
Jeroen Ketema
0b471c2007
C++: Improve LossyFunctionResultCast join order
...
Before on wireshark:
```
Tuple counts for #select#ff@eca61bf2:
180100 ~2% {2} r1 = SCAN Type::Type::getUnderlyingType#dispred#f0820431#ff OUTPUT In.1, In.0
84 ~2% {2} r2 = JOIN r1 WITH project#Type::FloatingPointType#class#2e8eb3ef#fffff ON FIRST 1 OUTPUT Lhs.1, Rhs.0
2021 ~0% {2} r3 = JOIN r2 WITH Function::Function::getType#dispred#f0820431#fb_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1
2437 ~0% {2} r4 = JOIN r3 WITH Call::FunctionCall::getTarget#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Rhs.1
2150 ~0% {2} r5 = r4 AND NOT LossyFunctionResultCast::whiteListWrapped#377b528a#f(Lhs.1)
2150 ~0% {2} r6 = SCAN r5 OUTPUT In.1, In.0
313 ~0% {3} r7 = JOIN r6 WITH exprconv ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
313 ~0% {3} r8 = JOIN r7 WITH Cast::Conversion#class#1f33e835#b ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2
148 ~3% {2} r9 = JOIN r8 WITH Expr::Expr::isCompilerGenerated#f0820431#b ON FIRST 1 OUTPUT Lhs.2, Lhs.1
148 ~1% {3} r10 = JOIN r9 WITH Expr::Expr::getActualType#dispred#f0820431#bf ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
21 ~0% {3} r11 = JOIN r10 WITH Type::IntegralType#class#2e8eb3ef#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.0
21 ~0% {3} r12 = JOIN r11 WITH Element::ElementBase::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
21 ~0% {2} r13 = JOIN r12 WITH Element::ElementBase::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, ("Return value of type " ++ Lhs.2 ++ " is implicitly converted to " ++ Rhs.1 ++ " here.")
return r13
```
After:
```
Tuple counts for #select#ff@a5a185eg:
20 ~0% {2} r1 = SCAN project#Type::FloatingPointType#class#2e8eb3ef#fffff OUTPUT In.0, In.0
20 ~0% {2} r2 = JOIN r1 WITH project#Type::FloatingPointType#class#2e8eb3ef#fffff ON FIRST 1 OUTPUT Lhs.1, Lhs.0
84 ~2% {2} r3 = JOIN r2 WITH Type::Type::getUnderlyingType#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1
2021 ~0% {2} r4 = JOIN r3 WITH Function::Function::getType#dispred#f0820431#fb_10#join_rhs ON FIRST 1 OUTPUT Rhs.1, Lhs.1
2437 ~0% {2} r5 = JOIN r4 WITH Call::FunctionCall::getTarget#dispred#f0820431#ff_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Rhs.1
2150 ~0% {2} r6 = r5 AND NOT LossyFunctionResultCast::whiteListWrapped#377b528a#f(Lhs.1)
2150 ~0% {2} r7 = SCAN r6 OUTPUT In.1, In.0
313 ~0% {3} r8 = JOIN r7 WITH exprconv ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
313 ~0% {3} r9 = JOIN r8 WITH Cast::Conversion#class#1f33e835#b ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2
148 ~3% {2} r10 = JOIN r9 WITH Expr::Expr::isCompilerGenerated#f0820431#b ON FIRST 1 OUTPUT Lhs.2, Lhs.1
148 ~1% {3} r11 = JOIN r10 WITH Expr::Expr::getActualType#dispred#f0820431#bf ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.0
21 ~0% {3} r12 = JOIN r11 WITH Type::IntegralType#class#2e8eb3ef#ff ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.0
21 ~0% {3} r13 = JOIN r12 WITH Element::ElementBase::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
21 ~0% {2} r14 = JOIN r13 WITH Element::ElementBase::toString#dispred#f0820431#ff ON FIRST 1 OUTPUT Lhs.1, ("Return value of type " ++ Lhs.2 ++ " is implicitly converted to " ++ Rhs.1 ++ " here.")
return r14
```
2022-07-06 21:53:12 +02:00
Jeroen Ketema
7d6fb7f91a
C++: Rename LossyFunctionResultCast tests to be correctly named
2022-07-06 21:52:13 +02:00
REDMOND\brodes
74ff579dbc
Fixing logic bug with LogicalAndExpr
2022-07-06 15:19:36 -04:00
Raul Garcia
dd1a9a22e3
Update UnsafeUsageOfClientSideEncryptionVersion.qhelp
2022-07-05 13:58:38 -07:00
Raul Garcia
f5c6b45014
Update UnsafeUsageOfClientSideEncryptionVersion.qhelp
2022-07-05 13:58:11 -07:00
Raul Garcia
56060e0610
Update csharp/ql/src/experimental/Security Features/CWE-327/Azure/UnsafeUsageOfClientSideEncryptionVersion.qhelp
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-07-05 13:57:28 -07:00
ihsinme
8967f57bbc
Update DangerousUseMbtowc.ql
2022-07-04 11:17:12 +03:00
ihsinme
4e28887689
Create test3.cpp
2022-07-04 11:13:07 +03:00
ihsinme
1ce42dcd30
Create test2.cpp
2022-07-04 11:12:34 +03:00
ihsinme
6d800de377
Create test1.cpp
2022-07-04 11:11:49 +03:00
ihsinme
f53adca108
Update DangerousUseMbtowc.ql
2022-07-04 11:10:02 +03:00
Mathias Vorreiter Pedersen
3bacb18315
Merge pull request #9770 from MathiasVP/nomagic-use-in-own-init
...
C++: Add `nomagic` to `VariableAccessInInitializer`
2022-07-02 16:35:45 +01:00
Chris Smowton
4d45a2ca87
Merge pull request #9775 from smowton/smowton/fix/accessors-respect-private-member-exclusion
...
Kotlin: don't extract private setters of external classes
2022-07-02 10:27:06 +01:00
Raul Garcia
e43e5810cf
New queries to detect unsafe client side encryption in Azure Storage
2022-07-01 17:08:35 -07:00
Mathias Vorreiter Pedersen
e98bdbf73f
Merge pull request #9773 from geoffw0/stringlengthconflation4
...
Swift: More improvements to swift/string-length-conflation
2022-07-01 17:46:04 +01:00
Geoffrey White
e38254c05e
Swift: Fix typo.
2022-07-01 17:00:36 +01:00
Ian Lynagh
1730ec22d9
Kotlin: Extract an ErrorType if we fail to correctly extract a type
2022-07-01 16:33:43 +01:00
Chris Smowton
b499ba5aa8
Kotlin: don't extract private setters of external classes
...
Previously these would get extracted unlike other private methods even if the class was a standard library or other external class. This could cause inconsistencies because if we also compiled the class from source we could end up deciding different names for the property's setter: setXyz$private when seen from source, and setXyz without a
suffix when seen as an external .class file. Avoiding extracting these functions from the external perspective both restores consistency with other kinds of method and avoids these consistency problems.
2022-07-01 15:44:17 +01:00
Paolo Tranquilli
c393c9b03e
Revert "Fix change note check to accept changes to itself"
...
This reverts commit 2dca78295d
2022-07-01 16:41:09 +02:00
Paolo Tranquilli
2dca78295d
Fix change note check to accept changes to itself
...
The file is not removed from the triggers, as we still want to check
that the workflow file itself is correct.
2022-07-01 16:35:30 +02:00
Paolo Tranquilli
e88cc31468
Swift: disable change note checking for now
2022-07-01 16:16:21 +02:00
Paolo Tranquilli
563d27333a
Merge pull request #9772 from github/redsun82/swift-extraction
...
Swift: extract ImportDecl and ModuleDecl
2022-07-01 16:14:23 +02:00
Geoffrey White
34ffd1aac5
Swift: Support String.Index and flow through * /.
2022-07-01 14:59:50 +01:00
Geoffrey White
d60d2457c2
Swift: Add String.Index.init as a source as as well.
2022-07-01 14:59:50 +01:00
