Rasmus Lerchedahl Petersen
58cfac27d2
Python: adjust expectations to new spelling
2022-09-13 10:10:17 +02:00
erik-krogh
03a325ca31
autoformat
2022-09-13 10:06:35 +02:00
Erik Krogh Kristensen
dd5da79e46
recognize setters and getters of a class as exported
...
Co-authored-by: Asger F <asgerf@github.com >
2022-09-13 10:04:02 +02:00
Rasmus Lerchedahl Petersen
c1ab66181b
Python: format
2022-09-13 08:08:04 +02:00
erik-krogh
dd5db2e6d7
add to isSanitizerGuard
2022-09-13 07:27:51 +02:00
erik-krogh
3eb7675292
rename to DenyListInclusionGuard
2022-09-13 07:27:31 +02:00
Sebastian Bauersfeld
f95663cdfb
Java: Added change note.
2022-09-13 11:38:15 +07:00
Sebastian Bauersfeld
0468b3a361
Java: Track taint through constructor arguments of java.net.URI.
2022-09-13 11:35:04 +07:00
Raul Garcia
0df2b64355
Merge branch 'main' into Token_validation
2022-09-12 18:31:00 -07:00
Raul Garcia
9e63a3d30b
Fixing a couple of bug from PR comments
2022-09-12 18:22:13 -07:00
Rasmus Lerchedahl Petersen
03c243175b
Python: fix QL alerts
2022-09-12 23:53:42 +02:00
Andrew Eisenberg
68f0505c39
Apply suggestions from code review
2022-09-12 14:49:41 -07:00
Rasmus Lerchedahl Petersen
2e9c60de6c
Python: remove ressurected file
2022-09-12 23:38:44 +02:00
Rasmus Lerchedahl Petersen
56dcfc2161
Python: --max-import-depth=0
...
to avoid nodes in the extracted stdlib
Was there a reason for this depth to be 1?
2022-09-12 23:25:48 +02:00
Rasmus Lerchedahl Petersen
bf16e220a0
Python: adjust expectations
2022-09-12 22:43:03 +02:00
erik-krogh
a567c132c1
fix all ql/unmentioned-guard
2022-09-12 22:42:46 +02:00
erik-krogh
9446cad32e
add ql/unmentioned-guard class
2022-09-12 22:39:20 +02:00
Andrew Eisenberg
a9202b5c37
Tweak the query suites documentation
...
- Add examples to filter on `@id`
- Add examples that include regexes
- Add examples that include both lists and single elements
- Add some `import` examples
- Remove mention of `eval` since it is not a user-facing instruction
2022-09-12 13:07:32 -07:00
Rasmus Lerchedahl Petersen
e3280c8a3e
Python: handle TODO
...
although this is not actually tested,
so we may have to adjust once we use it.
But the _very_ generic implementation is modeled on the Ruby code.
2022-09-12 21:03:56 +02:00
intrigus
894a0f1c3b
Add string to int sanitizer.
2022-09-12 21:02:18 +02:00
Rasmus Lerchedahl Petersen
78d4dc3123
Python: sync files
2022-09-12 21:01:57 +02:00
Rasmus Lerchedahl Petersen
203481ad3e
Python: rearrange to minimize diff
...
also fix typo
2022-09-12 20:07:32 +02:00
Rasmus Lerchedahl Petersen
efc5cfb852
Merge branch 'main' of github.com:github/codeql into python-dataflow/flow-summaries-from-scratch
2022-09-12 19:56:16 +02:00
Arthur Baars
e07e6c9053
Merge pull request #10382 from RasmusWL/ruby-typo-fix
...
Ruby: Fix typo in QLDoc
2022-09-12 19:04:37 +02:00
Tony Torralba
f412f433bf
Add thymeleaf steps
2022-09-12 17:52:38 +02:00
Erik Krogh Kristensen
bb3753a682
Merge pull request #10317 from erik-krogh/py-unqueryable
...
PY: deprecate a bunch of unused code
2022-09-12 17:44:59 +02:00
erik-krogh
ceda5f69fc
recognize returning an instanceof of a class as exporting that class
2022-09-12 17:31:51 +02:00
Mathias Vorreiter Pedersen
6e4b3c242f
Merge pull request #10377 from geoffw0/deprecate-pointsto
...
C++: Put a warning on the PointsTo library.
2022-09-12 16:25:40 +01:00
Andrew Eisenberg
abdc79b009
Update the example codeql-workspace.yml
...
Add a better example for `registries`.
2022-09-12 08:22:51 -07:00
Andrew Eisenberg
361dba17de
Add information about the registries block in codeql-workspace.yml
2022-09-12 08:22:51 -07:00
Edward Minnix III
eadb8a3988
Merge pull request #10106 from egregius313/egregius313/android-backup-allowed
...
Java: Query to detect Android backup allowed
2022-09-12 11:14:03 -04:00
Rasmus Wriedt Larsen
41ce1c2016
Python: getStarArg gives first *args argument
...
I couldn't see any reason that we should give up altogether if there are
multiple `*args` arguments. Including the first one looks like a win to
me!
2022-09-12 17:02:31 +02:00
Mathias Vorreiter Pedersen
d2b150eaf5
C++: Fix QLDoc on the model predicates used by the new experimental use-use code.
2022-09-12 16:00:49 +01:00
Mathias Vorreiter Pedersen
bb1c088fe0
C++: Undo changes to iterator models.
2022-09-12 15:58:49 +01:00
James Fletcher
47480acba5
Apply suggestions from code review
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2022-09-12 15:53:54 +01:00
Paolo Tranquilli
43e5abac39
Swift: do not extract unresolved things from IfConfigDecl
...
This avoids extracting things that are unresolved within an
`IfConfigDecl` instance:
* all conditions
* all inactive code blocks
This is meant to test out the hypothesis that this should solve some
extractor issues. If going through with it we should definitely change
the schema model for this.
Also, tests have not been updated and are expected to fail.
2022-09-12 16:34:28 +02:00
Cornelius Riemenschneider
a8a7909d33
Merge pull request #10364 from github/criemen/remove-legacy-tracing-specs
...
Go: Remove the legacy tracer configuration files.
2022-09-12 15:55:12 +02:00
Tamás Vajk
4569b9585f
Merge pull request #10313 from tamasvajk/kotlin-fix-vararg
...
Kotlin: Fix `vararg` extraction outside of method call
2022-09-12 15:54:50 +02:00
Tamás Vajk
ed772e54d1
Merge pull request #10328 from tamasvajk/kotlin-kfunction-fix
...
Kotlin: fix `KFunctionX.invoke` extraction
2022-09-12 15:54:33 +02:00
erik-krogh
05ef76cbca
add change-note
2022-09-12 15:41:28 +02:00
erik-krogh
87fb01d55b
apply another suggestion from doc review
2022-09-12 15:36:02 +02:00
Geoffrey White
842af4bf74
C++: Specifically suggest DataFlow as an alternative.
2022-09-12 14:25:45 +01:00
AlexDenisov
be21b26d46
Merge pull request #10045 from github/alexdenisov/swift-cwe-757
...
Swift: CWE-757: insecure TLS configuration
2022-09-12 15:25:15 +02:00
Erik Krogh Kristensen
818601b612
Merge pull request #10285 from erik-krogh/paramClass
...
ReDoS: convert RelevantState to a class in the PrefixConstruction module
2022-09-12 15:23:19 +02:00
Rasmus Lerchedahl Petersen
0f95992b2f
Python: remove NonLibraryDataFlowCallable
...
this required managing parameters and their pre-update nodes a bit
2022-09-12 15:17:29 +02:00
Rasmus Wriedt Larsen
4296ac1ac0
Python: Allow CallNode.getArgByName for keyword args after **kwargs
2022-09-12 15:03:13 +02:00
Rasmus Wriedt Larsen
03cc4a2f7a
Ruby: Fix typo in QLDoc
2022-09-12 14:35:20 +02:00
Tony Torralba
79a32f1a3e
Tainting the freemarker dataModel isn't exploitable
2022-09-12 14:22:06 +02:00
AlexDenisov
568eb3a118
Update swift/ql/src/queries/Security/CWE-757/InsecureTLS.qhelp
...
Co-authored-by: hubwriter <hubwriter@github.com >
2022-09-12 14:00:29 +02:00
erik-krogh
98243118b2
recognize a list of bad strings as a sanitizer for js/prototype-polluting-assignment
2022-09-12 13:41:07 +02:00
