Rasmus Wriedt Larsen
a271e17f04
Python: Move dataflow call-graph to new qll file
...
Seems like all other languages use a file called `DataFlowDispatch`. I
want to introduce a setup where we have (old) points-to based approach
in one file, and can develop a type-tracking based approach in another
file, so that's the reason for the naming differing slightly.
For which predicates go in which files, I have taken mostly inspiration
from C# and Ruby.
2022-04-13 15:56:57 +02:00
Rasmus Wriedt Larsen
3d15205084
Python: Autoformat
2022-04-13 15:36:16 +02:00
Rasmus Wriedt Larsen
ded4e9250c
Python: Move IterableUnpacking to own file
2022-04-13 15:36:05 +02:00
Rasmus Wriedt Larsen
c740894408
Python: Move MatchUnpacking to own file
...
I had hoped that git would be able to see this as a rename, and
therefore I haven't done autoformat
2022-04-13 15:36:05 +02:00
AlexDenisov
058ac5bcae
Merge pull request #8717 from AlexDenisov/alexdenisov/swift-ql-ci
...
Swift: enable QL tests on CI
2022-04-13 14:42:27 +02:00
Geoffrey White
be0df1662c
C++: Rename the query file.
2022-04-13 13:20:02 +01:00
Geoffrey White
ffbe724040
C++: Remove unfinished parts for now.
2022-04-13 13:18:23 +01:00
Jean Helie
407a8a7715
ML: fix ATM expected tests outputs
2022-04-13 14:02:12 +02:00
Rasmus Wriedt Larsen
2e60172bfa
Python: Delete old dataflow readme
2022-04-13 12:09:38 +02:00
Rasmus Wriedt Larsen
6235dc5039
Python: Handle find_library assignment to temp variable
2022-04-13 11:44:15 +02:00
Rasmus Wriedt Larsen
c87b3087be
Python: Add test for Django FileField upload_to
...
The output from running the test script is:
```
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/%2e%2e%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%c0%afbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
```
I didn't add a `.py` extension, so it wasn't extracted, since we don't
actually care about what we model in that file.
2022-04-13 11:27:18 +02:00
Rasmus Wriedt Larsen
304713ca87
Python: Handle django v4 as well in tests
2022-04-13 11:21:44 +02:00
Paolo Tranquilli
6166f0601c
Merge pull request #8727 from redsun82/bazel_workspace_rename
...
Bazel: rename workspace to codeql
2022-04-13 10:51:10 +02:00
Alex Denisov
60c6241382
Swift: run QL tests on macOS
2022-04-13 10:35:15 +02:00
Rasmus Wriedt Larsen
bdadf2b445
Python: Fix warnings
2022-04-13 10:30:59 +02:00
Asger Feldthaus
a5ad4c8263
QL: Update printAst output
...
Annotations are not longer their own children/parent.
2022-04-13 10:29:21 +02:00
Rasmus Wriedt Larsen
4927f0018b
Merge branch 'main' into django-filefield-uploadto
2022-04-13 10:22:28 +02:00
Erik Krogh Kristensen
41bdd8f4da
minor fixes
2022-04-13 10:11:07 +02:00
Erik Krogh Kristensen
b13e7c055b
move the sanitizer-guard to the Query.qll file
2022-04-13 09:58:33 +02:00
Erik Krogh Kristensen
96e4633dfe
remove more code that did nothing
2022-04-13 09:57:32 +02:00
Erik Krogh Kristensen
a9595af01e
update expected output
2022-04-13 09:43:21 +02:00
Erik Krogh Kristensen
d35604ed82
remove the length sanitizer from loop-bound-injection - it did nothing
2022-04-13 09:43:21 +02:00
Erik Krogh Kristensen
dd28157d0a
add test of a length check
2022-04-13 09:43:21 +02:00
Erik Krogh Kristensen
8e47a9b242
add sanitizer step for .length in js/resource-exhaustion
2022-04-13 09:30:09 +02:00
Stephan Brandauer
fb66ccff39
handlebars taint step: conservatively assume unknown templates have no flow to helpers
2022-04-13 09:27:59 +02:00
Asger Feldthaus
c1827cfd30
QL: Add test for getAStringValue
2022-04-13 08:45:25 +02:00
Asger Feldthaus
4c72c31a5a
QL: Add InlineExpectationsTest
2022-04-13 08:45:25 +02:00
Asger Feldthaus
b0801c9b2f
QL: Add some missing qldoc
2022-04-13 08:45:25 +02:00
Asger Feldthaus
8188e2876c
QL: Autoformat
2022-04-13 08:45:25 +02:00
Asger Feldthaus
6632b7da1c
QL: Add FrameworkCoverage query
2022-04-13 08:45:25 +02:00
Alex Denisov
b8c1f1a6e1
Swift: run QL tests on Linux
2022-04-13 07:44:19 +02:00
Geoffrey White
cdce72b87c
C++: Better join order for reachesWithoutAssignment.
2022-04-12 17:34:02 +01:00
Porcupiney Hairs
785dc1af3c
Include changes from review
2022-04-12 21:17:39 +05:30
Paolo Tranquilli
141ba2e039
Bazel: rename workspace to codeql
2022-04-12 17:37:29 +02:00
Robert Marsh
0e3e35f233
C++: don't dump global vars without initializers
2022-04-12 11:21:41 -04:00
Paolo Tranquilli
03ebf8b049
Merge pull request #8700 from redsun82/swift-skeleton
...
Swift: first skeleton extractor
2022-04-12 17:14:42 +02:00
Paolo Tranquilli
8ef28787b6
Swift: do not fail pack creation if dir does not exist
2022-04-12 17:05:26 +02:00
Erik Krogh Kristensen
a2d2626c9c
add security severity
2022-04-12 16:34:00 +02:00
Erik Krogh Kristensen
d64df30724
reintroduce the reverted qhelp
2022-04-12 16:33:06 +02:00
Erik Krogh Kristensen
ebf9ba7250
remove the type-overloaded new Buffer() as a sink
2022-04-12 16:29:58 +02:00
Erik Krogh Kristensen
e2b7f7d05d
reintroduce the number sinks
2022-04-12 16:26:10 +02:00
Erik Krogh Kristensen
029459cc35
reorganize CWE-770 tests
2022-04-12 16:15:40 +02:00
Paolo Tranquilli
6440242268
Swift+Bazel: apply review comments
2022-04-12 16:03:20 +02:00
Erik Krogh Kristensen
688b2b6898
use the Query.qll pattern
2022-04-12 15:52:52 +02:00
Erik Krogh Kristensen
8fb54c3f32
move js/resource-exhaustion out of experimental
2022-04-12 15:51:36 +02:00
Asger Feldthaus
4b74fa628c
QL: Add global flow and type-tracking
2022-04-12 15:25:09 +02:00
Asger Feldthaus
0ffb558e48
QL: Support local flow via unification
2022-04-12 15:25:06 +02:00
Asger Feldthaus
49d5b662ff
QL: Add Node.getEnclosingPredicate
2022-04-12 15:25:03 +02:00
Asger Feldthaus
2b8454001a
QL: Add scoped variable nodes
2022-04-12 15:24:59 +02:00
Asger Feldthaus
2d640e7e95
QL: Add basic data flow nodes
2022-04-12 15:24:55 +02:00
