Nick Rolfe
fdca896614
Ruby: improve handling of [g]sub!
...
rb/incomplete-sanitization has a few cases where we find flow from one
one string substitution call to another, e.g.
a.sub(...).sub(...)
But this didn't find typical chained uses of the destructive variants,
e.g.
a.sub!(...)
a.sub!(...)
We now handle those cases by tracking flow from the post-update node for
the receiver of the first call.
2022-04-13 17:19:25 +01:00
Jean Helie
1e39a9caae
ML: update regression test output following fix to getAnUnknown predicate
2022-04-13 18:14:16 +02:00
Jean Helie
f87cd164ce
ML: add defensive check to ensure Unknown endpoints cannot also be NotASink
2022-04-13 18:14:16 +02:00
Jean Helie
f2b813a6e7
ML: add regression test for effective sink that is also NotASink
2022-04-13 18:14:16 +02:00
Henry Mercer
6603f8ab94
Merge pull request #8734 from github/henrymercer/non-extending-subtypes-minor-fixes
...
Docs: Fix typo and formatting in "Non-extending subtypes"
2022-04-13 17:11:33 +01:00
Nick Rolfe
bbb8177176
Ruby: add rc/incomplete-sanitization query
2022-04-13 16:48:43 +01:00
Henry Mercer
54b3d4d0d7
Docs: Fix typo and formatting in "Non-extending subtypes"
...
- Fix typo `select any(Foo f) would yield bar` -> `select any(Foo f).foo() would yield bar`
- Fix inline code formatting
- Change `foo_method` to `fooMethod` to follow QL style guide
2022-04-13 16:12:42 +01:00
Geoffrey White
2ad81e63a5
C++: Change note.
2022-04-13 16:11:14 +01:00
AlexDenisov
df2cc181a0
Merge pull request #8726 from redsun82/swift-prebuilt-fetching
...
Swift: fetch prebuilt swift and link against it
2022-04-13 16:58:36 +02:00
Geoffrey White
dfd846bb7b
C++: Changes to the qhelp.
2022-04-13 15:53:13 +01:00
Paolo Tranquilli
aaf9e7da2f
turn off universal_binaries for now
2022-04-13 16:45:23 +02:00
Paolo Tranquilli
9e3401ce59
make self repository name parametric
...
In a workspace macro we must use the exact repository name, and this
can be different when importing the workspace (it is different in
semmle-code).
2022-04-13 16:22:27 +02:00
Paolo Tranquilli
73d5691d91
update swift package
2022-04-13 16:22:27 +02:00
Paolo Tranquilli
e68172f4b0
Swift: fetch prebuilt swift and link against it
...
This is known to break linux integration in sembuild.
2022-04-13 16:22:27 +02:00
Geoffrey White
d83aea5ea3
C++: Copy the qhelp from Javascript.
2022-04-13 15:16:01 +01:00
Geoffrey White
b149666f45
C++: Query metadata (precision is provisional, might up it to 'high' later).
2022-04-13 15:15:28 +01:00
Rasmus Wriedt Larsen
a271e17f04
Python: Move dataflow call-graph to new qll file
...
Seems like all other languages use a file called `DataFlowDispatch`. I
want to introduce a setup where we have (old) points-to based approach
in one file, and can develop a type-tracking based approach in another
file, so that's the reason for the naming differing slightly.
For which predicates go in which files, I have taken mostly inspiration
from C# and Ruby.
2022-04-13 15:56:57 +02:00
Rasmus Wriedt Larsen
3d15205084
Python: Autoformat
2022-04-13 15:36:16 +02:00
Rasmus Wriedt Larsen
ded4e9250c
Python: Move IterableUnpacking to own file
2022-04-13 15:36:05 +02:00
Rasmus Wriedt Larsen
c740894408
Python: Move MatchUnpacking to own file
...
I had hoped that git would be able to see this as a rename, and
therefore I haven't done autoformat
2022-04-13 15:36:05 +02:00
AlexDenisov
058ac5bcae
Merge pull request #8717 from AlexDenisov/alexdenisov/swift-ql-ci
...
Swift: enable QL tests on CI
2022-04-13 14:42:27 +02:00
Geoffrey White
be0df1662c
C++: Rename the query file.
2022-04-13 13:20:02 +01:00
Geoffrey White
ffbe724040
C++: Remove unfinished parts for now.
2022-04-13 13:18:23 +01:00
Jean Helie
407a8a7715
ML: fix ATM expected tests outputs
2022-04-13 14:02:12 +02:00
Rasmus Wriedt Larsen
2e60172bfa
Python: Delete old dataflow readme
2022-04-13 12:09:38 +02:00
Rasmus Wriedt Larsen
6235dc5039
Python: Handle find_library assignment to temp variable
2022-04-13 11:44:15 +02:00
Rasmus Wriedt Larsen
c87b3087be
Python: Add test for Django FileField upload_to
...
The output from running the test script is:
```
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/bar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/%2e%2e%2fbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
'rootdir/foo%c0%afbar'
[13/Apr/2022 09:20:36] "POST /app/file-test/ HTTP/1.1" 200 2
```
I didn't add a `.py` extension, so it wasn't extracted, since we don't
actually care about what we model in that file.
2022-04-13 11:27:18 +02:00
Rasmus Wriedt Larsen
304713ca87
Python: Handle django v4 as well in tests
2022-04-13 11:21:44 +02:00
Paolo Tranquilli
6166f0601c
Merge pull request #8727 from redsun82/bazel_workspace_rename
...
Bazel: rename workspace to codeql
2022-04-13 10:51:10 +02:00
Alex Denisov
60c6241382
Swift: run QL tests on macOS
2022-04-13 10:35:15 +02:00
Rasmus Wriedt Larsen
bdadf2b445
Python: Fix warnings
2022-04-13 10:30:59 +02:00
Asger Feldthaus
a5ad4c8263
QL: Update printAst output
...
Annotations are not longer their own children/parent.
2022-04-13 10:29:21 +02:00
Rasmus Wriedt Larsen
4927f0018b
Merge branch 'main' into django-filefield-uploadto
2022-04-13 10:22:28 +02:00
Erik Krogh Kristensen
41bdd8f4da
minor fixes
2022-04-13 10:11:07 +02:00
Erik Krogh Kristensen
b13e7c055b
move the sanitizer-guard to the Query.qll file
2022-04-13 09:58:33 +02:00
Erik Krogh Kristensen
96e4633dfe
remove more code that did nothing
2022-04-13 09:57:32 +02:00
Erik Krogh Kristensen
a9595af01e
update expected output
2022-04-13 09:43:21 +02:00
Erik Krogh Kristensen
d35604ed82
remove the length sanitizer from loop-bound-injection - it did nothing
2022-04-13 09:43:21 +02:00
Erik Krogh Kristensen
dd28157d0a
add test of a length check
2022-04-13 09:43:21 +02:00
Erik Krogh Kristensen
8e47a9b242
add sanitizer step for .length in js/resource-exhaustion
2022-04-13 09:30:09 +02:00
Stephan Brandauer
fb66ccff39
handlebars taint step: conservatively assume unknown templates have no flow to helpers
2022-04-13 09:27:59 +02:00
Asger Feldthaus
c1827cfd30
QL: Add test for getAStringValue
2022-04-13 08:45:25 +02:00
Asger Feldthaus
4c72c31a5a
QL: Add InlineExpectationsTest
2022-04-13 08:45:25 +02:00
Asger Feldthaus
b0801c9b2f
QL: Add some missing qldoc
2022-04-13 08:45:25 +02:00
Asger Feldthaus
8188e2876c
QL: Autoformat
2022-04-13 08:45:25 +02:00
Asger Feldthaus
6632b7da1c
QL: Add FrameworkCoverage query
2022-04-13 08:45:25 +02:00
Alex Denisov
b8c1f1a6e1
Swift: run QL tests on Linux
2022-04-13 07:44:19 +02:00
Geoffrey White
cdce72b87c
C++: Better join order for reachesWithoutAssignment.
2022-04-12 17:34:02 +01:00
Porcupiney Hairs
785dc1af3c
Include changes from review
2022-04-12 21:17:39 +05:30
Paolo Tranquilli
141ba2e039
Bazel: rename workspace to codeql
2022-04-12 17:37:29 +02:00
