erik-krogh
28f8c1cc11
update doc example to not use isBarrierGuard
2023-10-09 09:14:51 +02:00
github-actions[bot]
7c332a31a8
Add changed framework coverage reports
2023-10-09 00:16:19 +00:00
amammad
ad2631202d
fix comments
2023-10-08 21:32:04 +02:00
amammad
6c8cc79b4d
v1
2023-10-08 21:24:54 +02:00
Geoffrey White
8a7325268a
Swift: Change note.
2023-10-07 23:19:24 +01:00
Geoffrey White
c492b5f2dd
Swift: Model sinks.
2023-10-07 23:19:09 +01:00
Geoffrey White
8bf6fd67d1
Swift: Add a test for GRDB hardcoded key sinks.
2023-10-07 23:07:32 +01:00
erik-krogh
4bc4e0845d
delete the deprecated isBarrierGuard predicate from the shared dataflow library, and its uses
2023-10-07 21:48:49 +02:00
erik-krogh
d261cec3cd
add change-note
2023-10-07 15:41:08 +02:00
Marcono1234
f3e5045259
Java: Add predicate MemberRefExpr::getReceiverExpr
2023-10-07 14:53:07 +02:00
erik-krogh
56e9eda2b9
fix performance by caching getArgument
2023-10-07 13:06:45 +02:00
Marcono1234
b8f6877aba
Merge branch 'main' into patch-1
2023-10-07 03:46:12 +02:00
Marcono1234
2c0dcd3a2d
Java: Adjust ClassInstanceExpr type argument predicates docs
...
The type arguments which these predicates have as result are for the
type of the created instance.
Previously the documentation said "provided to the constructor", which
is misleading / incorrect. Type arguments provided to the constructor
are specified directly after the `new` keyword:
```
class C {
<T> C() {
}
}
new <String> C();
```
And those are not part of the results of these predicates.
2023-10-07 03:43:58 +02:00
Eric Bickle
4dca396106
Add change notes for ThreadResourceAbuse ArithExpr fix
2023-10-06 14:31:37 -07:00
Eric Bickle
000c1f7ec8
Java: Flow taint through ArithExpr for ThreadResourceAbuse
...
Ensure that tainted values flow through arithmetic operations when
checking for ThreadResourceAbuse vulnerabilities.
For example, multiplying 'number of seconds' by 1000 as an input
to Thread.Sleep, which accepts milliseconds, is a common scenario.
2023-10-06 14:24:37 -07:00
amammad
13577f71d6
fix tests, add more comments
2023-10-06 22:34:31 +02:00
Robert Marsh
30a9656ebb
Swift: change note for autoclosure cfg
2023-10-06 20:19:35 +00:00
Robert Marsh
cb749bd973
Swift: CFG for normal autoclosure exprs
2023-10-06 20:14:49 +00:00
Robert Marsh
661da76838
Swift: add function call autoclosure tests
2023-10-06 19:49:33 +00:00
erik-krogh
7ca0996912
add a taint-tracking tests for calls to tagged template strings
2023-10-06 21:39:42 +02:00
erik-krogh
9b6501787a
add API-graph test for the new tagged template calls
2023-10-06 21:25:34 +02:00
Geoffrey White
0918e50b05
Swift: Switch pragma to inline_late.
2023-10-06 20:23:51 +01:00
erik-krogh
18e6a5491c
recognize tagged templates as DataFlow::CallNode
2023-10-06 21:14:00 +02:00
erik-krogh
951ed01d6b
combine the library-tests/CallGraphs/FullTest tests into one file
2023-10-06 20:57:09 +02:00
amammad
21f477a674
revert go/vendor/ :(
2023-10-06 19:39:18 +02:00
amammad
d4b2ca5cee
add vendor for tests, update test results, revert go/vendor/modules.txt :(
2023-10-06 19:34:13 +02:00
Geoffrey White
7c28528eac
Swift: Change note.
2023-10-06 18:26:21 +01:00
Geoffrey White
676179620a
Swift: Get sqlite3 C API results (model Data.withUnsafeBytes, Data.withUnsafeMutableBytes, permit flow out of collections at the query sink)
2023-10-06 18:26:20 +01:00
Geoffrey White
bc9d8cc40f
Swift: Get another SQLite.swift result.
2023-10-06 18:26:20 +01:00
Geoffrey White
691665fca8
Swift: Add models for SQLite.swift.
2023-10-06 18:26:19 +01:00
Geoffrey White
bece2e8689
Swift: Add models for sqlite3 C API.
2023-10-06 18:26:19 +01:00
Geoffrey White
9a628d4165
Swift: Add test for sqlite3 C API.
2023-10-06 18:26:18 +01:00
Geoffrey White
8006996f46
Swift: Add test for SQLite.swift.
2023-10-06 18:26:18 +01:00
Geoffrey White
9ad1749957
Swift: Hide OpenExistentialExpr from the AST instead.
2023-10-06 17:55:29 +01:00
amammad
31cae204f6
make DecompressionBombs module and extention points
2023-10-06 18:14:05 +02:00
Geoffrey White
76db1c5c8b
Swift: Add the same code to the AST test as well.
2023-10-06 17:13:49 +01:00
Robert Marsh
85587413d0
Swift: fix QLDoc formatting for getSequence
2023-10-06 15:29:56 +00:00
Robert Marsh
c281db6b5b
Swift: improve QLDoc for getSequence
2023-10-06 15:23:58 +00:00
Robert Marsh
ec292ca4e1
Swift: Split for-each change note into two lines
2023-10-06 15:21:55 +00:00
Ian Lynagh
d34b85cf03
Kotlin: Remove 1.4 compatibility
...
We now only build with >= 1.5
2023-10-06 15:17:32 +01:00
amammad
7d36c23d59
fix qhelp and PascalCase issues
2023-10-06 16:14:10 +02:00
Jeroen Ketema
b6132d2a0f
C++: Rewrite cpp/cgi-xss to not use default taint tracking
2023-10-06 16:11:13 +02:00
Michael Nebel
dca39348ab
Java: Add change note.
2023-10-06 15:09:16 +02:00
Michael Nebel
fb10af9042
Jave: Remove the local threat model from the default configuration.
2023-10-06 14:58:48 +02:00
amammad
7d73808d60
fix a test mistake, add comments for JWT extension points
2023-10-06 13:31:09 +02:00
amammad
aa127b1662
do review improvements
2023-10-06 13:22:43 +02:00
Michael B. Gale
0b13da35eb
Go: Update newer-go-version-needed test
...
- Use a version that is accepted by Go tooling
- Run is no longer successful with Go 1.21
2023-10-06 11:57:47 +01:00
Michael B. Gale
01a1d814f4
Do not call EmitNewerGoVersionNeeded for v1.21+
2023-10-06 11:57:37 +01:00
Michael B. Gale
c63f6807c4
Go: Run go version with GOTOOLCHAIN=local
2023-10-06 11:57:26 +01:00
Michael B. Gale
76781e5d75
Go: Add GoVersionInfo type
...
Refactors `tryReadGoDirective` to return this instead of a pair.
This will make it easier to return multiple versions.
2023-10-06 11:57:08 +01:00
