am0o0
e85ca79d77
add tests for brotli
2024-09-03 12:28:16 +02:00
Tom Hvitved
26c5e7b2d1
Merge pull request #17308 from hvitved/dataflow/flow-through-restriction
...
Data flow: Reduce non-linear recursion in `fwdFlow0`
2024-09-03 11:30:57 +02:00
Simon Friis Vindum
78068a488f
C++: Make realloc a data-flow function
2024-09-03 11:25:18 +02:00
Cornelius Riemenschneider
2dfca8ab20
Merge branch 'main' into criemen/rename-java
2024-09-03 11:04:29 +02:00
Paolo Tranquilli
59423c692f
Swift: upgrade prebuilt toolchain to 5.10.1
2024-09-03 10:38:58 +02:00
Tom Hvitved
07fcd81e7e
Address review comments
2024-09-03 10:13:09 +02:00
Michael Nebel
6365e5edff
Java: Initial implementation of content based model generation.
2024-09-03 09:45:11 +02:00
Michael Nebel
4bdf21b022
Java: Add Content Flow module.
2024-09-03 09:45:07 +02:00
am0o0
49eaaf55a5
Merge branch 'amammad-cpp-bombs' of https://github.com/am0o0/codeql into amammad-cpp-bombs
2024-09-03 09:13:08 +02:00
am0o0
8c1c537150
finilize tests for zlib
2024-09-03 09:12:54 +02:00
am0o0
89e842b147
finilize tests for zlib
2024-09-03 09:12:13 +02:00
Porcupiney Hairs
e2dd126962
Python: Pycurl SSL Disabled
2024-09-03 03:41:23 +05:30
Porcupiney Hairs
f86570f6e7
WIP: Python: CORS Bypass
...
This PR adds a query to detect a Cross Origin Resource Sharing(CORS) policy bypass due to an incorrect check.
This PR attempts to detect the vulnerability pattern found in CVE-2022-3457
```python
if request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
origin = request.headers.get('Origin', None)
if origin and not origin.startswith(request.base):
raise cherrypy.HTTPError(403, 'Unexpected Origin header')
```
In this case, a value obtained from a header is compared using `startswith` call. This comparision is easily bypassed resulting in a CORS bypass. Given that similar bugs have been found in other languages as well, I think this PR would be a great addition to the exisitng python query pack.
The databases for CVE-2022-3457 can be downloaded from
```
https://filetransfer.io/data-package/i4Mfepls#link
https://file.io/V67T4SSgmExF
```
2024-09-03 03:11:35 +05:30
Jeroen Ketema
ffab199ea8
Merge pull request #17348 from jketema/test-fix
...
C++: Update expected test results after #17347
2024-09-02 21:53:13 +02:00
Jeroen Ketema
ae7bf6c97d
C++: Update expected test results after #17347
2024-09-02 21:17:55 +02:00
Tom Hvitved
1057bb443f
Data flow: Simplify FwdFlowIn interface
2024-09-02 16:10:34 +02:00
Simon Friis Vindum
ee6c255a7c
Merge pull request #17328 from paldepind/tweak-unbounded-barrier
...
C++: Tweak the `bounded` barrier
2024-09-02 14:30:44 +02:00
Simon Friis Vindum
e294c8e68f
Merge pull request #17347 from paldepind/test-for-uninitialized-local
...
C++: Add test for cpp/uninitialized-local and va_copy
2024-09-02 14:00:34 +02:00
Geoffrey White
c082c256a2
Merge pull request #17244 from geoffw0/swiftdoc2
...
Swift: Work around some QHelp rendering issues.
2024-09-02 12:26:23 +01:00
Simon Friis Vindum
660869e834
C++: Add test for cpp/uninitialized-local and va_copy
2024-09-02 13:25:02 +02:00
Tamás Vajk
39a73303d1
Merge pull request #17333 from github/criemen/rename-csharp
...
C#: Rename integration test directories.
2024-09-02 13:04:58 +02:00
Henry Mercer
4ebfafbec2
Merge pull request #17336 from github/henrymercer/rc-3.15-mergeback
...
Merge `rc/3.15` back into `main`
2024-09-02 11:43:19 +01:00
Michael Nebel
4f4c7bfbb9
C#: Update expected test output.
2024-09-02 11:13:16 +02:00
Michael Nebel
6e81d74558
C#: Add support for synthetic fields in MaD for C#.
2024-09-02 11:13:11 +02:00
Michael Nebel
0d343c5ce1
C#: Add external flow tests for synthetic fields.
2024-09-02 11:13:06 +02:00
Kevin Stubbings
326eb6946e
Added
2024-08-30 18:17:38 -07:00
Kevin Stubbings
5c8c99d31f
Add header support for bottle and tornado
2024-08-30 18:16:01 -07:00
Paolo Tranquilli
885e89a927
Rust: first running tests
2024-08-30 17:45:51 +02:00
Tom Hvitved
642ec38589
Merge pull request #17340 from hvitved/csharp/ssa-exclude-enums
2024-08-30 16:31:38 +02:00
Paolo Tranquilli
7e1290aa74
Rust: reuse shared rust trap library
2024-08-30 16:08:37 +02:00
Joe Farebrother
ec7ad84cd1
Update formatting
2024-08-30 13:51:33 +01:00
Joe Farebrother
5360192a58
Apply review suggestions - change = to in
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-08-30 13:25:59 +01:00
Jeroen Ketema
4945943732
C++: Support C11 _Generic expressions
2024-08-30 14:24:03 +02:00
Paolo Tranquilli
4f0fe1ce3a
Rust: bazel packaging
2024-08-30 13:05:46 +02:00
Tom Hvitved
4ef4ede0b1
C#: Do not calculate field-based SSA for enums
2024-08-30 11:19:07 +02:00
Tom Hvitved
a9b5faa6ab
C#: Add SSA test for enums
2024-08-30 11:19:06 +02:00
Jeroen Ketema
30335ab81e
C++: Add C11 _Generic IR tests
2024-08-30 10:50:49 +02:00
Paolo Tranquilli
3da6cee6ef
Merge branch 'main' into rust-experiment
2024-08-30 10:30:43 +02:00
Cornelius Riemenschneider
321820e758
Java: Rename integration test directories.
...
We are no longer bound to the platform-specific directories, so simplify the test organization.
If you don't want this change, just skip merging this PR. It's purely optional.
I kept the platform-specific directories around under `kotlin`,
but you could also easily merge all these together if you find them unhelpful.
I'll leave that change to you.
2024-08-30 10:28:25 +02:00
Paolo Tranquilli
04753b286f
Rust: tweak trap_key
2024-08-30 10:12:20 +02:00
Michael Nebel
89c387cf5c
Merge pull request #17326 from michaelnebel/shared/contentflowtaint
...
DataFlow: Bugfix in content flow state for value preservation.
2024-08-30 09:23:50 +02:00
Andrew Eisenberg
13705531b5
Update .github/pull_request_template.md
...
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com >
2024-08-29 14:47:54 -07:00
Henry Mercer
3490067316
Merge branch 'main' into henrymercer/rc-3.15-mergeback
2024-08-29 19:48:01 +01:00
Henry Mercer
d5bccd5373
Reapply "C#: Add support for flow through side-effects on static fields"
...
This reverts commit ea6092ad3f
2024-08-29 19:47:53 +01:00
Cornelius Riemenschneider
092ce01d93
C#: Rename integration test directories.
...
We are no longer bound to the platform-specific directories, so simplify the test organization.
If you don't want this change, just skip merging this PR. It's purely optional.
This is not very invasive for C#, I'm just dropping the `only`
suffix. You could also merge all the platform-specific test dirs,
or all test dirs into the top-level directory. I'll leave that up to you.
2024-08-29 19:06:56 +02:00
Cornelius Riemenschneider
72e2910d17
Merge pull request #17315 from github/criemen/pytest-java
...
Java: Port all integration tests to pytest
2024-08-29 18:05:52 +02:00
Paolo Tranquilli
590a146b49
Rust: some basic extraction of function names (with locations!)
2024-08-29 17:58:50 +02:00
Cornelius Riemenschneider
5ecc6f9dc8
Merge remote-tracking branch 'origin/main' into criemen/pytest-java
2024-08-29 16:43:46 +02:00
Cornelius Riemenschneider
dd7f757281
Address review.
2024-08-29 16:43:27 +02:00
Michael Nebel
ff31aa540c
Address review comments.
2024-08-29 15:54:04 +02:00
