Slavomir
f3a61ed65c
Add MarshalFunction and UnmarshalFunction classes to EncodingXml module.
2020-09-14 13:10:25 +02:00
Slavomir
b4ff653071
Add taint-tracking for encoding/xml
2020-09-14 13:10:25 +02:00
Slavomir
e7fc3c5039
Add taint-tracking for encoding/pem
2020-09-14 13:10:25 +02:00
Slavomir
669ed91b0b
Move EncodingJson to stdlib; add Escape class.
2020-09-14 13:10:25 +02:00
Slavomir
24c23ba333
Add taint-tracking for encoding/json
2020-09-14 13:10:25 +02:00
Slavomir
f5fc9494fc
Remove old EncodingHex module
2020-09-14 13:10:25 +02:00
Slavomir
74fdfba85c
Add taint-tracking for encoding/hex
2020-09-14 13:10:25 +02:00
Slavomir
7a42992850
Add taint-tracking for encoding/gob
2020-09-14 13:10:25 +02:00
Slavomir
57518c7e3d
Add taint-tracking for encoding/csv
2020-09-14 13:10:25 +02:00
Slavomir
df55bb459f
Add taint-tracking for encoding/binary
2020-09-14 13:10:25 +02:00
Slavomir
20b4826e8e
Add taint-tracking for encoding/base64
2020-09-14 13:10:25 +02:00
Slavomir
7060367de5
Add taint-tracking for encoding/base32
2020-09-14 13:10:24 +02:00
Slavomir
ba78eda277
Add taint-tracking for encoding/asn1
2020-09-14 13:10:24 +02:00
Slavomir
412ba1263b
Add taint-tracking for encoding/ascii85
2020-09-14 13:10:24 +02:00
Slavomir
a47842d1c3
Add taint-tracking for package encoding
2020-09-14 13:10:24 +02:00
Slavomir
27ba893ba2
Add taint-tracking for context package
2020-09-14 13:09:45 +02:00
Slavomir
eb3a18f172
Add taint-tracking for package sort
2020-09-14 13:08:54 +02:00
Slavomir
71dbb244f9
Move existing Regexp module to stdlib
2020-09-14 13:08:16 +02:00
Slavomir
7f3a911f86
Add taint-tracking for package regexp
2020-09-14 13:08:16 +02:00
Slavomir
c2fc26a96a
Remove Range method on sync.Map
2020-09-14 13:04:52 +02:00
Slavomir
d51518f411
Add taint-tracking for sync/atomic package
2020-09-14 13:04:52 +02:00
Slavomir
e47715b2a9
Add taint-tracking for sync package
2020-09-14 13:04:52 +02:00
Chris Smowton
86ed037fd3
Port codeql#4238 (Dataflow: small fixes for naming in taint tracking) to Go's local copy of the dataflow libs
2020-09-14 12:01:30 +01:00
Slavomir
d929e8313a
Build syscall.StringSlicePtr only on non-windows OS
2020-09-14 12:49:41 +02:00
Slavomir
702a984dc0
Comment out test for syscall.StringSlicePtr because it's not present on windows.
2020-09-14 12:49:41 +02:00
Slavomir
72ef65f257
Add taint-tracking for syscall
2020-09-14 12:49:41 +02:00
Chris Smowton
362d210bc5
Merge pull request #330 from smowton/smowton/admin/standard-lib-pt-21-with-sanitiser
...
Move `strconv` and `strings` packages' taint-tracking to stdlib, and expand them + sanitise substrings of the HTTP Authorization header
2020-09-14 11:25:57 +01:00
Tom Hvitved
0fb9dc5bac
C#: Adjust caching of tuple types
2020-09-14 11:24:46 +02:00
Geoffrey White
6b035df660
C++: Repair taint flow from previous.
2020-09-14 10:21:43 +01:00
Tom Hvitved
e549377561
C#: Construct File::TransformedPathLazy lazily
...
This avoids calling the path transformer for `GeneratedFile`s.
2020-09-14 11:03:00 +02:00
Chris Smowton
b9b306aade
CleartextLogging: sanitize strings.Split(authheader, ":")[0] and similar
...
These can represent a username, method name or other non-sensitive component of an Authorization header. For greater precision we could split the query into one investigating Authorization headers and one investigating other sources of sensitive data that can't be sanitized by splitting this way.
2020-09-14 09:46:14 +01:00
Slavomir
cf29f9dede
Remove taint-tracking on single bytes and runes
2020-09-14 09:46:14 +01:00
Slavomir
6d3e6ded26
Fix: the Append* functions do not modify the dst slice argument.
2020-09-14 09:46:14 +01:00
Slavomir
9293bcde1d
Fix ql/test/library-tests/semmle/go/frameworks/TaintSteps/TaintStep.expected: calls to strings.NewReader are a step now.
2020-09-14 09:46:14 +01:00
Slavomir
3075294cd8
Move strings module to stdlib, and add more taint-tracking classes to it.
2020-09-14 09:46:13 +01:00
Slavomir
42c7f8cc0d
Add taint-tracking for strconv package; rename module StrConv to Strconv and move into stdlib
2020-09-14 09:44:25 +01:00
Max Schaefer
b8d36b936e
Merge pull request #321 from gagliardetto/standard-lib-pt-14
...
Add taint-tracking for packages inside `mime/*`
2020-09-14 09:26:29 +01:00
Tom Hvitved
19746023d9
C#: Tidy code for constructing underlying tuple structs
2020-09-14 10:08:58 +02:00
Erik Krogh Kristensen
6fb534f178
fix catastrophic join order in UnsafeJQueryPlugin
2020-09-14 09:59:48 +02:00
Erik Krogh Kristensen
9502869e3c
improve join-order for aliasPropertyPresenceStep
2020-09-14 09:59:22 +02:00
Jonas Jensen
021aa647c1
Merge pull request #4142 from MathiasVP/mathiasvp/read-step-without-memory-operands
...
C++: Use IR alias analysis for field flow
2020-09-14 09:37:27 +02:00
Mathias Vorreiter Pedersen
78b24b76a0
C++: Remove the problematic taint tracking rule. It seems like we get the flows from dataflow already now.
2020-09-14 09:26:41 +02:00
Mathias Vorreiter Pedersen
34a57e2bd4
Merge pull request #4252 from jbj/normalize-bounds
...
C++: SimpleRangeAnalysis: Always normalize bounds after a computation
2020-09-14 09:16:32 +02:00
Faten Healy
6f20516f84
Update broken_crypto.py to AES instead of Blowfish
2020-09-13 21:07:28 +10:00
Faten Healy
826fc0a630
Update BrokenCryptoAlgorithm - Blowfish to AES
2020-09-13 21:04:07 +10:00
Asger Feldthaus
1d92cbb655
JS: Bump extractor version string
2020-09-12 09:22:12 +01:00
Taus Brock-Nannestad
e0f5b208da
Python: Fix broken test of global typetracker flow
...
The missing `global g` annotation meant `g = x` was interpreted as a
local assignment.
2020-09-11 18:17:25 +02:00
lcartey@github.com
eb5782d908
C++: Support customizable ranges for RangeSsaDefinitions.
2020-09-11 17:12:10 +01:00
Geoffrey White
b404a339a4
C++: Correct isQualifierObject -> isQualifierAddress.
2020-09-11 16:15:47 +01:00
Max Schaefer
c10942d044
Merge pull request #320 from gagliardetto/standard-lib-pt-24
...
Add taint-tracking for packages inside `text/*`
2020-09-11 15:57:14 +01:00
