Tamás Vajk
7013663d13
Merge pull request #10881 from tamasvajk/kotlin-constant-expr
...
Kotlin: Exclude constructs in serialization constructors from `java/evaluation-to-constant`
2022-10-25 15:00:58 +02:00
erik-krogh
e8dce25cc2
fix rb/code-injection
2022-10-25 14:44:23 +02:00
Geoffrey White
b59f01f968
Swift: Use UnknownFile.
2022-10-25 13:44:13 +01:00
Mathias Vorreiter Pedersen
6a7bcd384a
Merge pull request #10939 from rdmarsh2/rdmarsh2/cpp/modulus-analysis-comments
...
C++: additional comments for modulus analysis
2022-10-25 14:29:54 +02:00
Karim Ali
18dd0f650c
update iterations threshold to most recent OWASP recommendation
...
which is at least 120,000 iterations for secure password hashing
2022-10-25 14:01:40 +02:00
Tamas Vajk
80fa45fd8e
Fix expected fest file after rebase
2022-10-25 13:52:25 +02:00
Tamas Vajk
f1e6b756e3
Add integration test with constant expression in a generated constructor
2022-10-25 13:52:25 +02:00
Tamas Vajk
eaa04b72f1
Apply code review findings
2022-10-25 13:49:54 +02:00
Tamas Vajk
78c23c2657
Kotlin: Exclude constructs in serialization constructors from java/evaluation-to-constant
2022-10-25 13:49:54 +02:00
Tamás Vajk
30fc6acb19
Merge pull request #10961 from tamasvajk/kotlin-abstract-collection-cast
...
Kotlin: Improve `java/abstract-to-concrete-cast` to handle `when` branches
2022-10-25 13:27:19 +02:00
Karim Ali
408c7bebe5
fix .expected file
2022-10-25 13:24:37 +02:00
Karim Ali
e8f55b9f0d
update output message
2022-10-25 13:24:37 +02:00
Karim Ali
c0ac29db16
clarify qhelp + add references to it
2022-10-25 13:24:37 +02:00
Karim Ali
4b7cb706f6
fix error in checking # of iterations
...
plus also simplify the pattern matching of the sink classes
2022-10-25 13:24:37 +02:00
Karim Ali
0d2e7d43b9
add expected output
2022-10-25 13:24:37 +02:00
Karim Ali
5179a99abb
fix test cases to use the correct class name
2022-10-25 13:24:37 +02:00
Karim Ali
c4b2519e6c
initial draft of the Swift query for CWE-916
2022-10-25 13:24:37 +02:00
Henry Mercer
7e2c06de80
Merge pull request #10963 from github/codeql-ci/js/ml-powered-pack-release-0.3.6
...
JS: Bump version numbers of ML-powered packs after 0.3.6 release
2022-10-25 12:12:15 +01:00
yoff
9d542f1be9
Merge pull request #10887 from Sim4n6/TarSlipImprov
...
Python: Add TarSlip Improv query
2022-10-25 13:02:52 +02:00
Chris Smowton
b9f4856d47
Merge pull request #10876 from smowton/smowton/feature/kotlin-default-method-auto-mad
...
Java models-as-data: infer Kotlin $default models from that of its parent function
2022-10-25 11:58:54 +01:00
Paolo Tranquilli
a4258ea390
Merge pull request #10953 from github/redsun82/cmake-generator
...
Bazel/CMake: make cmake runnable from outside the workspace
2022-10-25 12:47:10 +02:00
Chris Smowton
c4ba644dfd
Merge pull request #10952 from smowton/smowton/fix/java-interface-redeclares-tostring
...
Kotlin: extract interface redeclarations of `Object` methods
2022-10-25 11:29:10 +01:00
Henry Mercer
1dc14bcaee
Merge branch 'main' into codeql-ci/js/ml-powered-pack-release-0.3.6
2022-10-25 10:54:08 +01:00
github-actions[bot]
caf3a098c8
JS: Bump version of ML-powered library and query packs to 0.3.7
2022-10-25 09:12:00 +00:00
Tamas Vajk
0e4287e378
Kotlin: Exclude .kt files from java/unreachable-catch-clause
2022-10-25 11:06:51 +02:00
Tamas Vajk
4b042f9770
Kotlin: Add test cases for java/unreachable-catch-clause
2022-10-25 11:06:15 +02:00
github-actions[bot]
5d100c8036
JS: Bump patch version of ML-powered library and query packs
2022-10-25 09:00:40 +00:00
Tamas Vajk
a0490f454b
Kotlin: Improve java/abstract-to-concrete-cast to handle when branches
2022-10-25 10:17:47 +02:00
Tamas Vajk
690d6517d7
Kotlin: Add abstract to concrete type cast guarded by when
2022-10-25 10:16:40 +02:00
Jami Cogswell
1a1245343d
remove getNodeIntValue
2022-10-24 17:09:24 -04:00
Daniel Santos
3051903037
Merge branch 'github:main' into main
2022-10-24 15:47:11 -05:00
Jami Cogswell
c742a09def
remove AlgoSpec class
2022-10-24 16:15:18 -04:00
Jami Cogswell
d569f93e78
update getAlgoSpec
2022-10-24 16:05:57 -04:00
Jami Cogswell
09829d7f7a
simplify instanceof usage
2022-10-24 15:49:41 -04:00
Jami Cogswell
8bc0a64863
remove KeyGenInitMethodAccess class
2022-10-24 15:42:36 -04:00
Philip Ginsbach
b9f1cc5c6f
Merge pull request #10929 from github/ginsbach/TypeSignatureDocumentation
...
documentation for type signature members
2022-10-24 20:41:25 +01:00
Jami Cogswell
eb69b98dff
remove separators
2022-10-24 15:28:31 -04:00
Jami Cogswell
2ee23f004e
update qldoc for AlgorithmParameterSpec
2022-10-24 15:22:33 -04:00
Jami Cogswell
4c8e0a7648
update qldoc of JavaSecurityKeyPairGenerator and JavaSecurityAlgoParamGenerator
2022-10-24 15:05:05 -04:00
Chris Smowton
d171decad7
Accept test changes
...
All of java.util.{Collection,List,Map} redeclare `boolean equals(Object)` in order to add documentation, as a side-effect creating a real symbol that can be used as a dispatch target.
2022-10-24 19:49:29 +01:00
Chris Smowton
843f847960
Merge pull request #10921 from smowton/smowton/fix/ignore-enhanced-nullability
...
Kotlin: ignore enhanced nullability when extracting primitive types
2022-10-24 19:43:04 +01:00
Chris Smowton
7a0bded2ac
Kotlin: support argument-range specifications for $default methods
2022-10-24 19:31:03 +01:00
Chris Smowton
8d10b1b77b
Convert test to inline-expectation test
2022-10-24 19:15:35 +01:00
Paolo Tranquilli
89ca7e26fe
Merge pull request #10955 from github/redsun82/swift-fix-missing-bodies
...
Swift: fix missing extraction of function bodies in SPM builds
2022-10-24 20:00:02 +02:00
Geoffrey White
6f77e14aef
C++: Fix rare performance issue on cpp/comma-before-misleading-indentation.
2022-10-24 18:21:10 +01:00
Erik Krogh Kristensen
ef5132b0ae
Merge pull request #10883 from erik-krogh/codeSink
...
RB: don't flag code-injection for dynamic loading where an attacker only controls a substring
2022-10-24 18:59:36 +02:00
erik-krogh
aafef382dc
refactor StringPercentCall#getFormatArgument
2022-10-24 18:57:24 +02:00
Daniel Santos
5ab068a3cc
Update python/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql
...
Co-authored-by: Taus <tausbn@github.com >
2022-10-24 11:55:21 -05:00
Daniel Santos
be8780742b
Update python/ql/src/experimental/Security/CWE-340/TokenBuiltFromUUID.ql
...
You are totally right! I just scanned the module's document and assumed it would implement it all. Pasting the documentation here for future reference https://docs.python.org/3/library/uuid.html?highlight=uuid#uuid.UUID .
Co-authored-by: Taus <tausbn@github.com >
2022-10-24 11:49:17 -05:00
Paolo Tranquilli
d419749eb2
Swift: fix missing extraction of function bodies in SPM builds
...
For some reason `-experimental-skip-non-inlinable-function-bodies-without-types`
is passed to the frontend, which will skip extraction of most bodies.
By suppressing that option the problem goes away.
2022-10-24 17:11:13 +02:00
