Rasmus Wriedt Larsen
91795b8577
Python: Add simple test of Xxe/XmlBomb
...
Note that most of the testing happens in the framework specific tests,
with an inline-expectation test
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
e45f9d69cc
Python: Adjust Xxe/XmlBomb for Python
...
I changed a few QLdocs so they fit the style we have used in Python...
although I surely do regret having introduced a new style for how these
QLDocs look :D
2022-03-31 09:52:54 +02:00
Rasmus Wriedt Larsen
65907c9762
Python: Copy Xxe/XmlBomb queries from JS
...
After internal discussion, these will replace the `XmlEntityInjection`
query, so we can have separate severities on DoS and the other (more
serious) attacks.
Note: These clearly don't work, since they are verbatim copies of the JS
code, but I split it into multiple commits to clearly highlight what
changes were made.
2022-03-31 09:52:54 +02:00
Erik Krogh Kristensen
67e1ffdd3e
fix isKnownStepSrc such that it actually includes taint/dataflow-steps
2022-03-31 09:46:01 +02:00
Erik Krogh Kristensen
e038baed36
add .gitignore ignoring test dbs
2022-03-31 09:45:28 +02:00
Chuan-kai Lin
1ff0fda5d1
QLdoc check: handle new languages gracefully
2022-03-30 14:58:13 -07:00
Erik Krogh Kristensen
1218c4f4ed
fix ql/name-casing, and drive-by QL-for-QL typo fix
2022-03-30 22:59:14 +02:00
Erik Krogh Kristensen
1847a5713b
remove TODO
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
7ca6426ea5
revert the Taint stage, as it caused an alert for ql/abstract-class-import
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
7e4ab4c60b
Revert "import all the frameworks that extend RegexString"
...
This reverts commit 84bc9042de4e876685f8f5ffdd88893383d1cfdc.
It caused ql/abstract-class-import alerts
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
3b9335c051
nomagic on containsInScope
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
5caff81ff9
import all the frameworks that extend RegexString
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
b959705531
revert changes in MRO.qll
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
b74852ffd6
cache a bit more (again)
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
d9ced55e2c
make private predicates private
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
040196f40d
cache more basicblock predicates
2022-03-30 22:54:01 +02:00
Erik Krogh Kristensen
79713e0ef8
a bit more caching
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
7643aac207
revert bad nomagic
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
35c7fa58a7
joiner order fixes
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
88e896992e
cache the remainder of the pointsto layer
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
79da0970cc
various join order fixes
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
3e9ee887d4
fix bad mistake
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
758a5d7a85
few join order fixes
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
6eca4ba2d3
get around identical files by adding the ref() call somewhere else
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
4089788629
revert caching of some large predicates that caused the DB size to increase too much
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
0da80f90d3
rename the SSA stages to AST
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
c9e3a62953
cached stages iteration 5
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
a8f9a91e38
cached stages iteration 4
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
f68357a063
cached stages iteration 3.5
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
37a9b41e26
cached stages iteration 3
2022-03-30 22:54:00 +02:00
Erik Krogh Kristensen
60b5af215f
cached stages iteration 2
2022-03-30 22:53:59 +02:00
Erik Krogh Kristensen
71eacea90b
add the cached stages pattern to Python
2022-03-30 22:53:59 +02:00
Chuan-kai Lin
48015e5a2e
Merge pull request #8597 from cklin/run-js-ml-tests
...
JS: Fix expected test output for ATM queries
2022-03-30 13:10:02 -07:00
Chuan-kai Lin
a8dabb238d
JS: Fix expected test output for ATM queries
2022-03-30 11:35:17 -07:00
Robert Marsh
3ce7c521d1
C++: fix IR global var init for string constants
2022-03-30 14:01:59 -04:00
Robert Marsh
e01799827a
C++: add test for string global var inits in IR
2022-03-30 13:38:25 -04:00
Robert Marsh
fb0a848e5a
C++: fix inconsistency with global var constructor
2022-03-30 13:32:02 -04:00
Robert Marsh
9d4aac61fd
C++: add IR tests for global var with constructor
2022-03-30 13:20:26 -04:00
Chris Smowton
19cd97e426
Java: Clarify the meaning of getRuleExpression/Statement
2022-03-30 17:58:11 +01:00
Ian Lynagh
46c27dd20f
Merge pull request #8514 from github/post-release-prep/codeql-cli-2.8.4
...
Post-release preparation for codeql-cli-2.8.4
2022-03-30 16:36:14 +01:00
Ian Lynagh
e9acb4f8e8
Merge pull request #706 from github/post-release-prep/codeql-cli-2.8.4
...
Post-release preparation for codeql-cli-2.8.4
2022-03-30 16:35:29 +01:00
Nick Rolfe
fa1bb82701
Merge pull request #8610 from github/nickrolfe/re-fix-location-join-order
...
Ruby: undo accidental revert of #8538
2022-03-30 16:31:52 +01:00
Nick Rolfe
10b75bff76
Ruby: undo accidental revert of 13be9919
2022-03-30 16:02:12 +01:00
Chris Smowton
9675f34cf5
Merge pull request #8257 from luchua-bc/java/insecure-webview-resource-response
...
Java: CWE-200 Query to detect insecure WebResourceResponse implementation
2022-03-30 15:56:27 +01:00
haby0
1e6893e230
Update python/ql/src/experimental/semmle/python/security/injection/CsvInjection.qll
...
Co-authored-by: yoff <lerchedahl@gmail.com >
2022-03-30 22:54:30 +08:00
Arthur Baars
031d183bdf
Merge pull request #8532 from aibaars/regex-refactor-2
...
JS/Ruby/Python: rename RegExpTreeView.qll to ReDoSUtilSpecific.qll
2022-03-30 16:38:47 +02:00
Robert Marsh
417b0b5353
C++: accept test changes for updated extractor
2022-03-30 10:23:17 -04:00
Owen Mansel-Chan
79e6f7876b
Merge pull request #710 from owen-mc/delete-consistency
...
Delete unused file DataFlowImplConsistency
2022-03-30 15:15:55 +01:00
Michael Nebel
8238c99199
C#: Only include APIs that has a proper namespace.
2022-03-30 15:22:32 +02:00
Michael Nebel
5c13391580
C#: Add test cases for operators.
2022-03-30 15:09:44 +02:00
