Robert Marsh
0e3e35f233
C++: don't dump global vars without initializers
2022-04-12 11:21:41 -04:00
Paolo Tranquilli
03ebf8b049
Merge pull request #8700 from redsun82/swift-skeleton
...
Swift: first skeleton extractor
2022-04-12 17:14:42 +02:00
Paolo Tranquilli
8ef28787b6
Swift: do not fail pack creation if dir does not exist
2022-04-12 17:05:26 +02:00
Erik Krogh Kristensen
a2d2626c9c
add security severity
2022-04-12 16:34:00 +02:00
Erik Krogh Kristensen
d64df30724
reintroduce the reverted qhelp
2022-04-12 16:33:06 +02:00
Erik Krogh Kristensen
ebf9ba7250
remove the type-overloaded new Buffer() as a sink
2022-04-12 16:29:58 +02:00
Erik Krogh Kristensen
e2b7f7d05d
reintroduce the number sinks
2022-04-12 16:26:10 +02:00
Erik Krogh Kristensen
029459cc35
reorganize CWE-770 tests
2022-04-12 16:15:40 +02:00
Paolo Tranquilli
6440242268
Swift+Bazel: apply review comments
2022-04-12 16:03:20 +02:00
Erik Krogh Kristensen
688b2b6898
use the Query.qll pattern
2022-04-12 15:52:52 +02:00
Erik Krogh Kristensen
8fb54c3f32
move js/resource-exhaustion out of experimental
2022-04-12 15:51:36 +02:00
Asger Feldthaus
4b74fa628c
QL: Add global flow and type-tracking
2022-04-12 15:25:09 +02:00
Asger Feldthaus
0ffb558e48
QL: Support local flow via unification
2022-04-12 15:25:06 +02:00
Asger Feldthaus
49d5b662ff
QL: Add Node.getEnclosingPredicate
2022-04-12 15:25:03 +02:00
Asger Feldthaus
2b8454001a
QL: Add scoped variable nodes
2022-04-12 15:24:59 +02:00
Asger Feldthaus
2d640e7e95
QL: Add basic data flow nodes
2022-04-12 15:24:55 +02:00
Asger Feldthaus
c9b9751894
QL: Add NodeNumbering library
2022-04-12 15:24:52 +02:00
Asger Feldthaus
60a22b71b4
QL: Remove redundant union part
2022-04-12 15:24:48 +02:00
Asger Feldthaus
f02912bdf5
QL: Add VarDef.getAnAccess
2022-04-12 15:24:45 +02:00
Asger Feldthaus
85403cd4de
QL: Fix up parent-child relation in tree
2022-04-12 15:24:42 +02:00
Erik Krogh Kristensen
df295e69d6
add change-note
2022-04-12 14:37:51 +02:00
Erik Krogh Kristensen
bca4d14129
rename files
2022-04-12 14:37:43 +02:00
Erik Krogh Kristensen
591fcda862
various improvements to the js/missing-origin-verification query
2022-04-12 14:20:41 +02:00
Erik Krogh Kristensen
2d6d304d7c
add InclusionTest to PostMessageEventSanitizer
2022-04-12 14:12:36 +02:00
Chris Smowton
a8eeef6ef8
Merge pull request #718 from owen-mc/fix-incorrect-integer-conversion-for-type-assertions
...
Integer conversion should ignore type assertions
2022-04-12 12:44:43 +01:00
Paolo Tranquilli
f2f99611bd
.gitignore CLion project files
2022-04-12 12:41:00 +02:00
Paolo Tranquilli
a205b465ba
Bazel: reorganization
...
* fixed 5.0.0 as bazel version
* made dependencies better loadable
* moved `//swift/install` to `//swift:create-extractor-pack` (following
the clearer ruby naming)
* renamed `extractor_pack` to `extractor-pack` for consistency with Ruby
2022-04-12 12:40:59 +02:00
Paolo Tranquilli
13b2442fed
Bazel: code reorganization
2022-04-12 12:40:59 +02:00
Paolo Tranquilli
664d5ba0a9
Swift: moved install to a separate package
...
When importing the workspace from semmle-code, we do not need nor want
to instantiate `@util`, so that must be in a separate bazel package.
2022-04-12 12:40:59 +02:00
Paolo Tranquilli
95dbf2d666
Swift: first skeleton extractor
...
This adds a first dummy extractor for swift.
Running `bazel run //swift:install` will create an `extractor_pack`
directory in `swift`. From that moment providing `--search-path=swift`
will pick up the extractor.
2022-04-12 12:40:59 +02:00
Owen Mansel-Chan
f9f21e9891
Integer conversion should ignore type assertions
2022-04-12 10:58:07 +01:00
Erik Krogh Kristensen
e2badab251
update expected output after test reorganization
2022-04-12 10:39:28 +02:00
Erik Krogh Kristensen
ec9c308d06
reorganize the tests in CWE-020
2022-04-12 10:39:28 +02:00
Erik Krogh Kristensen
18532bae54
move js/missing-postmessageorigin-verification out of experimental
2022-04-12 10:39:27 +02:00
CodeQL CI
a43f3a21a8
Merge pull request #8550 from erik-krogh/classJoin
...
Approved by asgerf
2022-04-12 09:23:58 +01:00
Erik Krogh Kristensen
34abef8a6c
Merge branch 'main' into dragAndDrop
2022-04-11 23:59:46 +02:00
bananabr
57fac949fd
included ClipboardEvent and DragEvent as XSS sources
2022-04-11 16:37:00 -05:00
luchua-bc
7029802f3b
Add sinks for getClass() and getClassLoader()
2022-04-11 21:03:48 +00:00
Erik Krogh Kristensen
aafa8ddc9f
add support for domNode.onpaste for copy-paste events
2022-04-11 20:10:56 +02:00
Erik Krogh Kristensen
6713b2c671
add support for domNode.ondrop for drag-and-drop events
2022-04-11 20:06:12 +02:00
bananabr
121aad7fd2
updated change notes
2022-04-11 12:45:37 -05:00
Geoffrey White
cb211f8844
Merge pull request #8599 from 4B5F5F4B/main
...
C++: refactor some code, and add access_ok cases
2022-04-11 15:57:27 +01:00
Mathias Vorreiter Pedersen
e86b6b182f
C++: Remove TC from 'Element.getRootCause'.
2022-04-11 15:27:10 +01:00
Bas van Schaik
c3912b2f29
Update README to clarify license explanation
2022-04-11 14:30:56 +01:00
CodeQL CI
9c8dee2a4d
Merge pull request #8687 from asgerf/js/missing-flow-fixes
...
Approved by erik-krogh
2022-04-11 14:08:15 +01:00
Bas van Schaik
422255b859
Update CODEOWNERS for documentation and license
...
To make sure the right people are pinged when a change like #5893 is made
2022-04-11 12:33:23 +01:00
Marcono1234
bc5dc6ad50
Java: Remove TODO comment for getRuleExpression() behavior
...
Predicate behavior has been fixed on `main`.
2022-04-10 18:24:26 +02:00
Marcono1234
7bed14bbf0
Merge remote-tracking branch 'remotes/origin/main' into marcono1234/statement-expression
2022-04-10 18:23:45 +02:00
Marcono1234
348a186df8
Java: Make JumpStmt a concrete class again
...
Public abstract classes can be error-prone, when users unintentionally
implement a new subclass instead of refining the set of existing subclasses.
2022-04-10 17:54:47 +02:00
bananabr
0f1582f3f6
included JavaScript drag and drop API Xss sources
2022-04-09 22:33:30 -05:00
