Chris Smowton
8f985e0045
Java: restrict test to source classes
2023-10-13 20:30:28 +01:00
Chris Smowton
0510b0c825
Java: restrict test to source methods
...
Otherwise it finds standard library methods that depend on stdlib internals as to what happens to get extracted. In particular the extractor bump to JDK21 led to MethodHandles being in scope and a new method being found; seems better to avoid considering the standard library at all.
2023-10-13 20:30:28 +01:00
Geoffrey White
cea87a53e0
Swift: Fix LocalTaint.expected.
2023-10-13 18:19:26 +01:00
Ed Minnix
3356261031
Static IV refactor to MaD
2023-10-13 12:50:49 -04:00
Geoffrey White
e2ac3769bc
Swift: Change note.
2023-10-13 17:42:14 +01:00
Geoffrey White
aa0db1426d
Swift: Simplify the QL a bit further.
2023-10-13 17:42:14 +01:00
Geoffrey White
d0f214a9a7
Swift: Widen the model to include things that are not strictly RawRepresentable but which appear similar. This fixes the XXE test cases. Unclear whether xmlParserOption in the test should in fact extend RawRepresentable, or not.
2023-10-13 17:35:05 +01:00
Joe Farebrother
9097d93ac7
Add shared library for filepath normalization
2023-10-13 17:07:47 +01:00
Jeroen Ketema
d56a9f0781
Merge pull request #14424 from jketema/rewrite-cgi-xss
...
C++: Rewrite `cpp/cgi-xss` to not use default taint tracking
2023-10-13 17:57:04 +02:00
Mathias Vorreiter Pedersen
fb0016e4f6
Merge pull request #14485 from geoffw0/logging
...
Swift: Add more sinks to `swift/cleartext-logging`
2023-10-13 16:09:19 +01:00
Mathias Vorreiter Pedersen
9a2ac65f53
Merge pull request #14394 from geoffw0/sqlpathinject3
...
Swift: Add sinks for sqlite3 and SQLite.swift to swift/hardcoded-key
2023-10-13 16:07:09 +01:00
Robert Marsh
b832fc8e32
Swift: additional QLDoc around closures
2023-10-13 14:54:38 +00:00
Mathias Vorreiter Pedersen
140ff537c0
C++: Split 'defaultViableCallable' and 'viableCallable'.
2023-10-13 15:47:02 +01:00
Geoffrey White
4e29ed5ff0
Swift: Model RawRepresentable.
2023-10-13 15:00:49 +01:00
Geoffrey White
228aaee0bf
Swift: Add data flow tests for RawRepresentable, OptionSet.
2023-10-13 14:34:05 +01:00
Joe Farebrother
915352861d
Check for generic base types in Missing Function Level Access Control and Insecure Direct Object Reference.
2023-10-13 14:22:45 +01:00
erik-krogh
69c3e62965
add change-note
2023-10-13 15:16:39 +02:00
Geoffrey White
9e473ebda4
Swift: Remove the 'rawValue' step as well.
2023-10-13 14:02:15 +01:00
Geoffrey White
da14f428e2
Swift: Remove now redundant additional taint step. from the XXE query.
2023-10-13 13:57:54 +01:00
Tamas Vajk
15ec0a10c9
Code quality improvements
2023-10-13 14:09:58 +02:00
Calum Grant
192c16bbb3
C++: Format QL and delete note
2023-10-13 13:07:43 +01:00
Jeroen Ketema
61676277e8
C++: Fix barrier in cpp/cgi-xss
2023-10-13 14:05:47 +02:00
Geoffrey White
33f83a2089
Swift: Add some failing data flow test cases.
2023-10-13 12:24:43 +01:00
Calum Grant
552221868f
C++: Expand ImplicitThisFieldAccess
2023-10-13 12:05:20 +01:00
Tony Torralba
0cea3f8531
Remove library annotations
2023-10-13 12:46:56 +02:00
Harry Maclean
1297acf5b1
Merge pull request #14216 from hmac/hmac-graphql-enum
...
Ruby: Restrict GraphQL remote flow sources
2023-10-13 11:31:50 +01:00
erik-krogh
9080e84fc9
add support for extracting .jsp files
2023-10-13 12:09:27 +02:00
Tamas Vajk
791a6422b3
C#: Fix params attribute argument extraction
2023-10-13 11:30:02 +02:00
Tamas Vajk
e730815f41
C#: Add test case for params arguments in attributes
2023-10-13 11:29:32 +02:00
Tony Torralba
5e921784fb
Merge pull request #14399 from ebickle/fix/thread-resource-arithmetic
...
Java: Flow taint through arithmetic expressions for java/thread-resource-abuse experimental query
2023-10-13 10:06:33 +02:00
Erik Krogh Kristensen
b1ad61e27d
Merge pull request #14481 from erik-krogh/proper-codepoints
...
ReDoS: use the new codePointAt and codePointCount methods instead of regex hacks
2023-10-13 09:35:55 +02:00
Felicity Chapman
2ddcd1d9cc
Merge pull request #14489 from github/felicitymay-typo-fix
...
Fix typo in link
2023-10-12 21:45:30 +01:00
Felicity Chapman
8f70b55158
Fix typo in link
2023-10-12 20:53:44 +01:00
Ian Lynagh
2edc70da79
Merge pull request #14390 from igfoo/igfoo/compr
...
Kotlin: Improve support for TRAP compression options
2023-10-12 20:22:10 +01:00
Robert Marsh
dd71204128
Swift: update test expectations for for-in locations
2023-10-12 18:59:36 +00:00
Geoffrey White
fe57cd0784
Merge pull request #14488 from geoffw0/strlentest
...
Swift: Additional test cases for `swift\string-length-conflation`
2023-10-12 19:39:43 +01:00
AlexDenisov
6ab2de10e3
Merge pull request #14437 from github/alexdenisov/ignore-unavailable-declarations
...
Swift: skip declarations marked as unavailable
2023-10-12 20:08:18 +02:00
Ian Lynagh
ed9502fd0b
Kotlin: Enhance the TRAP compression test
2023-10-12 18:13:07 +01:00
Ian Lynagh
adb47399c7
Kotlin: Improve support for TRAP compression options
...
While you could control compression with
CODEQL_EXTRACTOR_JAVA_OPTION_TRAP_COMPRESSION
before, most TRAP files used gzip regardless for compatibility with the
Java extractor. Now Java understands the option too we can use it for
shared TRAP files.
2023-10-12 18:13:06 +01:00
Mathias Vorreiter Pedersen
3c34638438
Merge pull request #14486 from MathiasVP/simplify-overrun-write
...
C++: Remove unnecessary `FlowState` from `cpp/overrun-write`
2023-10-12 17:48:52 +01:00
Geoffrey White
9f683b8630
Swift: Remove duplicate results.
2023-10-12 17:38:58 +01:00
Geoffrey White
cf7f355fc4
Swift: Additional test cases.
2023-10-12 17:11:56 +01:00
Stephan Brandauer
bcde466d6c
use of characteristics
2023-10-12 17:22:05 +02:00
Stephan Brandauer
1bbf88f208
Java: basic version of automodel extraction queries
2023-10-12 17:07:46 +02:00
Ed Minnix
31c04b50f7
Change note
2023-10-12 09:58:09 -04:00
Ed Minnix
4eeaf84133
Sync NumericCastTaintedQuery
2023-10-12 09:58:08 -04:00
Ed Minnix
ec84f072eb
Sync ArithmeticTaintedLocalQuery
2023-10-12 09:58:08 -04:00
Ed Minnix
da933fb77a
Sync ExternallyControlledFormatStringLocalQuery
2023-10-12 09:58:08 -04:00
Ed Minnix
f1886320e5
Sync ImproperValidationOfArrayIndexLocalQuery
2023-10-12 09:58:08 -04:00
Ed Minnix
69531b9f7c
Sync ResponseSplittingLocalQuery
2023-10-12 09:58:08 -04:00
