Taus
09a11f4166
Python: Update ImpliesDataflow test
...
Turns out that now we can resolve the convoluted imports. Hurray!
2021-11-26 14:47:25 +00:00
Michael Nebel
d4f3a6d4bb
C#: Review comments. Keep the TContent type pribate
2021-11-26 15:38:33 +01:00
Taus
6c3aabe1df
Python: Support flow through import *
...
Adds result for `ModuleVariableNode::getARead` corresponding to reads
that go through (chains of) `import *`.
This required a bit of a change to _which_ module variables we define.
Previously, we only included variables that were accessed elsewhere in
the same file, but now we must ensure to also include variables that may
be accessed through `import *`.
2021-11-26 13:49:08 +00:00
Taus
c3e495efe9
Python: Refactor built-ins and import * logic
...
Moves this from the API graphs implementation into separate files.
2021-11-26 13:49:08 +00:00
Taus
03b6ee3833
Python: Add import * test
...
This test shows off a few things:
- transitive chains of `import *`
- multiple modules exporting the same name (to test for cross-talk)
2021-11-26 13:49:08 +00:00
Erik Krogh Kristensen
6ff8d4de5c
add all remaining explicit this
2021-11-26 13:50:10 +01:00
Anders Schack-Mulligen
00ee34c0a0
Merge pull request #7237 from hvitved/dataflow/consistency-config
...
Data flow: Introduce `ConsistencyConfiguration` class
2021-11-26 12:49:25 +01:00
Anders Schack-Mulligen
57fd397cb3
Merge pull request #7239 from smowton/smowton/fix/useless-comparison-surrogates
...
Range analysis and useless-comparison query: don't treat all unicode surrogates as if they are U+FFFD
2021-11-26 09:00:36 +01:00
Chris Smowton
d3a4dadc7d
Merge pull request #7240 from smowton/smowton/admin/derecognise-xxe-secure-processing
...
Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE
2021-11-25 19:31:06 +00:00
Henry Mercer
aa9a8a0e22
Merge pull request #7244 from github/henrymercer/atm-specify-ml-models-globs
...
JS: [Internal only] Add ML models specification to ATM query pack definition
2021-11-25 18:20:45 +00:00
Chris Smowton
36bb84d97f
Copyedit change note
2021-11-25 12:55:55 -05:00
Jonathan Leitschuh
1ddf5fb133
Java: Ratpack HTTP Framework Additional Modeling
...
Adds models for `ratpack.func.Pair`, and `ratpack.exec.Result`.
Improve moels for `ratpack.exec.Promise`.
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com >
2021-11-25 12:55:32 -05:00
Henry Mercer
29eb66d772
JS: Add ML models to .gitignore
2021-11-25 17:06:37 +00:00
Henry Mercer
2af509595b
JS: Add ML models specification to ATM query pack definition
...
This will allow us to resolve the ATM machine learning models that will
be distributed within this pack.
2021-11-25 16:42:38 +00:00
Chris Smowton
7ac5791c49
Update charLiterals.expected
2021-11-25 16:13:06 +00:00
Geoffrey White
f96968975b
C++: Change note.
2021-11-25 15:49:41 +00:00
Geoffrey White
e98ab5d2c2
C++: Add security-severity tag and provisional precision.
2021-11-25 15:49:40 +00:00
Geoffrey White
e9ce29664e
C++: Qldoc.
2021-11-25 15:48:12 +00:00
Chris Smowton
ce63549425
Apply review comments
2021-11-25 15:20:35 +00:00
Chris Smowton
db39c0b8be
CharacterLiteral.getCodePointValue: fix handling of surrogates
2021-11-25 14:07:21 +00:00
Geoffrey White
1d358c5f77
C++: Change note.
2021-11-25 14:04:47 +00:00
Anders Schack-Mulligen
a06642944f
Merge pull request #7232 from aschackmull/dataflow/perf
...
Data flow: Performance tuning
2021-11-25 15:01:01 +01:00
Geoffrey White
f5b40731d6
C++: Add security-severity tag and provisional precision.
2021-11-25 13:59:21 +00:00
Arthur Baars
e801d9636a
Ruby: add ruby/ruby to the dataset-measure CI job
2021-11-25 14:10:15 +01:00
Tom Hvitved
dc0b0445ed
Merge pull request #7185 from hvitved/csharp/ssa/consistency-queries
...
C#: Enable SSA consistency queries
2021-11-25 14:04:01 +01:00
Chris Smowton
9540beeda9
Update java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2021-11-25 12:52:08 +00:00
Arthur Baars
8b0bc677f4
Remove PatternGuard class
2021-11-25 13:50:19 +01:00
Arthur Baars
dca1e34cd8
Temporarily allow CFG inconsistencies
2021-11-25 13:42:59 +01:00
Arthur Baars
16e1e97ff0
Add test data for case-in expressions
2021-11-25 13:25:33 +01:00
Arthur Baars
af4c3122ca
Test case for **nil parameter
2021-11-25 13:25:00 +01:00
Arthur Baars
078a2aa03b
Update AST library
2021-11-25 13:24:51 +01:00
Chris Smowton
9eb9eb606e
Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE
2021-11-25 12:22:48 +00:00
Arthur Baars
ec0bd24b64
Update diagnostic tests
2021-11-25 12:55:50 +01:00
Arthur Baars
5b560b12e9
Create upgrade script
2021-11-25 12:55:43 +01:00
Anders Schack-Mulligen
609d6011a2
Merge pull request #7229 from smowton/smowton/admin/document-xxe-sanitisation-policy
...
Document XXE sanitisation policy
2021-11-25 10:55:25 +01:00
Tom Hvitved
6cb00992e8
Data flow: Introduce ConsistencyConfiguration class
2021-11-25 10:01:47 +01:00
haby0
04a3f76a8b
Eliminate false positives of Mybatis Configuration Variable
2021-11-25 15:47:37 +08:00
haby0
d36a7ed10e
add test case
2021-11-25 15:47:32 +08:00
haby0
99c8b291b2
add sink
2021-11-25 15:47:32 +08:00
haby0
b8732859de
Add isSanitizerGuard, verify file path
2021-11-25 15:47:31 +08:00
haby0
31400df0d4
Modify sink and improve SQL injection detection
2021-11-25 15:47:30 +08:00
haby0
69690a2509
Modify sinks
2021-11-25 15:47:30 +08:00
haby0
4438f8c58c
Add MyBatis Mapper Sql Injection
2021-11-25 15:47:29 +08:00
CodeQL CI
d3da790191
Merge pull request #6873 from erik-krogh/explicit-this
...
Approved by esbena
2021-11-24 15:23:35 -08:00
Chris Smowton
3c8f6e3c07
Merge pull request #6717 from luchua-bc/java/thread-resource-abuse
...
Java: CWE-400 - Query to detect uncontrolled thread resource consumption
2021-11-24 18:59:41 +00:00
Geoffrey White
4c5faaf985
C++: Autoformat result not checked query.
2021-11-24 18:26:39 +00:00
Geoffrey White
8abaf1247a
C++: Clean up result not checked query.
2021-11-24 18:26:39 +00:00
Geoffrey White
5ffbf563b8
C++: Add metadata for result not checked query.
2021-11-24 18:26:38 +00:00
Geoffrey White
72a03257e7
C++: Add qhelp for result not checked query.
2021-11-24 18:26:38 +00:00
Geoffrey White
5eb814fd8b
C++: Prototype SSL result not checked query.
2021-11-24 18:26:37 +00:00
