Asger F
e47deaffbf
Ruby: More QLDoc police
2022-09-28 10:49:34 +02:00
Asger F
7737e75427
Update some QLDoc comments
2022-09-28 10:49:34 +02:00
Asger F
576e320bf5
Python: sync
2022-09-28 10:49:34 +02:00
Asger F
cbf16579ed
Ruby: tweak pipeline a bit
2022-09-28 10:49:33 +02:00
Asger F
b13b2ce319
Ruby: fix join order when building append relation
2022-09-28 10:49:33 +02:00
Asger F
3498a04b89
Ruby: associate ContentSets with store/load edges in type tracker
2022-09-28 10:49:33 +02:00
Asger F
497258eda5
Ruby: reuse Content type
2022-09-28 10:49:33 +02:00
Asger F
ac1b7eb0b9
Remove SetterMethodCall in MkAttribute
2022-09-28 10:49:33 +02:00
Asger F
a64f7cd146
Ruby: simplify getSetterCallAttributeName
2022-09-28 10:49:33 +02:00
Asger F
a51a540582
Ruby: add content edges to API graph
...
Fixes
2022-09-28 10:49:33 +02:00
Asger F
d5e2b93554
Ruby: add API graph label for content
2022-09-28 10:49:33 +02:00
Asger F
e104b65106
Python: sync TypeTracker.qll and adapt accordingly
...
fixup python
2022-09-28 10:49:33 +02:00
Asger F
cd9cddf45a
Ruby: generate type-tracking steps from simple summary specs
2022-09-28 10:49:33 +02:00
Asger F
f1b99e867c
Ruby: use IPA type for type tracker contents
...
fixup qldoc in OptionalTypeTrckerContent
2022-09-28 10:49:33 +02:00
Asger F
53ef054c53
Ruby: Add getACallSimple and use it for arrays and hashes
2022-09-28 10:49:24 +02:00
Asger F
182d7d38a8
Update ruby/ql/lib/codeql/ruby/experimental/Rbi.qll
...
Co-authored-by: Alex Ford <alexrford@users.noreply.github.com >
2022-09-28 10:36:09 +02:00
Geoffrey White
1fb54ad3e3
Swift: make QLDoc style check happy.
2022-09-28 09:28:48 +01:00
Tamas Vajk
463173eae4
Accept integration test changes
2022-09-28 10:26:58 +02:00
Geoffrey White
9780dffa79
Merge pull request #10596 from geoffw0/swifturl
...
Swift: URL is a struct, not a class
2022-09-28 09:15:29 +01:00
Tamas Vajk
13fb032b1c
Kotlin: Remove unbound symbol owner lookup
2022-09-28 09:47:10 +02:00
Tom Hvitved
92a38b30cf
Data flow: Update documentation on array flow modeling
2022-09-28 09:32:52 +02:00
Harry Maclean
adb8368e07
Add change note
2022-09-28 12:16:12 +13:00
Harry Maclean
24a10aa5ff
Recognise send_file as a FileSystemAccess
...
This method is available in ActionController actions, and sends the file
at the given path to the client.
2022-09-28 12:14:22 +13:00
Harry Maclean
eada74a15c
Add change note
2022-09-28 11:43:31 +13:00
Robert Marsh
82bbe67267
Merge pull request #10593 from MathiasVP/fix-fp-on-cwe-193
...
C++: Fix FPs on `cpp/invalid-pointer-deref`
2022-09-27 17:38:17 -04:00
Jami Cogswell
61e24a888f
remove stubs/android directory and update options files
2022-09-27 14:55:08 -04:00
Tom Hvitved
31806b84ba
Ruby: Add more flow summaries tests
...
The tests highlight the differences between `(With|Without)?Element[1]` and
`(With|Without)?Element[1!]`.
2022-09-27 20:16:31 +02:00
Tom Hvitved
2351c0288a
Ruby: Fix spurious flow through reverse stores
2022-09-27 20:16:31 +02:00
Harry Maclean
28a23209a5
Ruby: Identify ActionController::Metal controllers
...
Subclasses of `ActionController::Metal` are stripped-down controllers.
We want to recognise them as ActionController controllers.
There are some common ActionController methods that are not available in
Metal, but these are not likely to be used anyway as they would throw an
exception, so I don't think there's much harm in including them in the
modelling.
2022-09-28 07:10:09 +13:00
Tom Hvitved
fea1e47daa
Ruby: Add data-flow test for spurious flow through a reverse store
2022-09-27 20:05:35 +02:00
Tom Hvitved
df2b586e7c
Merge pull request #10577 from hvitved/dataflow/get-a-read-content-fan-in
...
Data flow: Fix bad join-order when getAReadContent has large fan-in
2022-09-27 20:04:58 +02:00
Geoffrey White
1248810e35
Swift: Add model for URL.resourceBytes and URL.lines.
2022-09-27 18:58:56 +01:00
Geoffrey White
fa5e03a53d
Swift: Add tests of URL.resourceBytes and URL.lines.
2022-09-27 18:58:56 +01:00
Geoffrey White
69dd2c0eec
Swift: Add a test of taint sources.
2022-09-27 18:58:56 +01:00
Geoffrey White
3ffb2a3ee6
Swift: Fix.
2022-09-27 18:39:03 +01:00
Geoffrey White
286fcb672c
Swift: Additional test results.
2022-09-27 18:31:43 +01:00
Geoffrey White
d2c74913c8
Swift: Repair UnsafeWebViewFetch query via taint summary.
2022-09-27 18:25:32 +01:00
Geoffrey White
13b2b1f304
Swift: Repair CleartextTransmission query.
2022-09-27 18:25:32 +01:00
Geoffrey White
62aa5de781
Swift: URL is a struct not a class.
2022-09-27 18:25:31 +01:00
Mathias Vorreiter Pedersen
485568331a
Swift: Add a class that's the union of struct and class.
2022-09-27 17:52:12 +01:00
Harry Maclean
6e60a6ff2e
Apply suggestions from code review
...
Co-authored-by: Nick Rolfe <nickrolfe@github.com >
2022-09-28 05:51:28 +13:00
Nora Dimitrijević
cacf78838c
C++: Tests (w/ FPs) from MRVA top 1000 run
2022-09-27 18:48:32 +02:00
Jami
56e3334c6d
Merge pull request #10479 from jcogs33/android-service-sources
...
Java: add Android service sources
2022-09-27 12:40:18 -04:00
Andrew Eisenberg
aefd51601c
Re-order query suite descriptions
...
Add a pull quote and apply some suggestions from code review.
2022-09-27 09:22:46 -07:00
Mathias Vorreiter Pedersen
549eca1b17
C++: Fix 'implicit use of this'.
2022-09-27 16:29:30 +01:00
Mathias Vorreiter Pedersen
e4305948ef
C++: Fix FP on CWE-193 by blocking flow through back-edges of phi nodes.
2022-09-27 16:28:03 +01:00
Nick Rolfe
8ca1e1b2d1
Ruby: add changenote for XXE improvements
2022-09-27 16:11:41 +01:00
Jami Cogswell
7e0c61de2c
switch to hasName
2022-09-27 10:45:52 -04:00
Tamas Vajk
847a64c03b
Kotlin: extract call target even if it's unbound
2022-09-27 15:30:38 +02:00
Tony Torralba
be9509ceb9
Merge pull request #9199 from luchua-bc/java/unsafe-url-forward-dispatch-load
...
Java: CWE-552 Query to detect unsafe resource loading in Java Spring applications
2022-09-27 15:27:51 +02:00
