Asger F
16df2c31bb
Create DataFlowImplConsistency.qll
2023-10-13 12:42:41 +02:00
Asger F
3ef478669b
JS: Collapse some cached stages
2023-10-13 12:42:41 +02:00
Asger F
9fef8803ed
JS: Avoid BarrierGuardNode's range from depending on Configuration
2023-10-13 12:42:41 +02:00
Asger F
e31ae3a1bf
JS: Model JSON.stringify with "deep" read operators
2023-10-13 12:42:41 +02:00
Asger F
0c2e52baba
JS: Summary/steps for iterators and generators
2023-10-13 12:42:41 +02:00
Asger F
da3a0de814
JS: Port String#replace to flow summary
2023-10-13 12:42:41 +02:00
Asger F
f0c2afe39e
JS: Add flow summaries for maps and sets
2023-10-13 12:42:40 +02:00
Asger F
5054c43b18
JS: Add flow summaries/steps for promises and async/await
2023-10-13 12:42:40 +02:00
Asger F
4319b07798
JS: Add flow summaries for Arrays
2023-10-13 12:42:40 +02:00
Asger F
a31e251529
JS: Add flow summaries for core methods
2023-10-13 12:42:40 +02:00
Asger F
46fec8ea7e
JS: Add AdditionalFlowInternal
...
This provides access to more features than we want to expose publicly at the moment, but is useful for modelling certain language features.
2023-10-13 12:42:40 +02:00
Asger F
3f20d71a9b
JS: Add legacy post-update step
...
This is to ensure getALocalSource() can be replaced by getPostUpdateNode() as the base of a store
2023-10-13 12:42:40 +02:00
Asger F
6037ff553c
JS: Add LegacyPreUpdateStep
...
This contributes to both LegacyFlowStep and SharedTypeTrackingStep.
That is, this is for steps that are used by type-tracking and the old data flow library, but not the new data flow library.
2023-10-13 12:42:40 +02:00
Asger F
27c7d5004a
JS: Do the same for additional taint steps
2023-10-13 12:42:40 +02:00
Asger F
1afe06e3a5
JS: Add "additional" and "legacy" steps
...
See the comment at the top of AdditionalFlowSteps.qll
2023-10-13 12:42:40 +02:00
Asger F
c24a0e00f5
JS: Move SharedTaintStep to AdditionalTaintSteps.qll
...
NOTE that this commit only moves around code. There are no changes.
2023-10-13 12:42:40 +02:00
Asger F
5bccc652c8
JS: Move SharedFlowStep to AdditionalFlowSteps.qll
...
NOTE that this commit only moves around code. There are no changes.
2023-10-13 12:42:40 +02:00
Asger F
293899d648
JS: Add 'Awaited' token
2023-10-13 12:42:40 +02:00
Asger F
32070abb27
JS: Implicitly treat array steps as taint steps
2023-10-13 12:42:40 +02:00
Asger F
60101f5e6a
JS: Instantiate flow summary library
2023-10-13 12:42:40 +02:00
Asger F
8dc0800526
JS: Add the shared FlowSummaryImpl.qll file
2023-10-13 12:42:40 +02:00
Asger F
f316da78d2
JS: Add FunctionSelfReferenceNode
2023-10-13 12:42:40 +02:00
Asger F
760873c01c
JS: Basic instantiation of shared library
2023-10-13 12:42:40 +02:00
Asger F
3455463e71
JS: Add instantiation boilerplate
...
Note that this commit won't compile on its own, but putting the boilerplate in its own commit
2023-10-13 12:42:40 +02:00
Asger F
c839822eb9
JS: Add PostUpdateNode
2023-10-13 12:42:40 +02:00
Asger F
01952f17bf
JS: Add some missing getContainer() predicates
2023-10-13 12:42:40 +02:00
Asger F
21300eef4c
JS:Add ConstructorThisArgumentNode
2023-10-13 12:42:40 +02:00
Asger F
b499c6075a
JS: Add Contents.qll
2023-10-13 12:42:40 +02:00
Asger F
79e7aae9f6
JS: Add TEarlyStageNode
2023-10-13 12:42:39 +02:00
Asger F
51ef0e5836
JS: Move TNode into a cached module
2023-10-13 12:42:39 +02:00
Asger F
60b179bda2
Shared: add DeduplicatePathGraph
...
Note that there is a separate PR open with this library
2023-10-13 12:42:39 +02:00
Harry Maclean
1297acf5b1
Merge pull request #14216 from hmac/hmac-graphql-enum
...
Ruby: Restrict GraphQL remote flow sources
2023-10-13 11:31:50 +01:00
erik-krogh
9080e84fc9
add support for extracting .jsp files
2023-10-13 12:09:27 +02:00
Tamas Vajk
791a6422b3
C#: Fix params attribute argument extraction
2023-10-13 11:30:02 +02:00
Tamas Vajk
e730815f41
C#: Add test case for params arguments in attributes
2023-10-13 11:29:32 +02:00
Tony Torralba
5e921784fb
Merge pull request #14399 from ebickle/fix/thread-resource-arithmetic
...
Java: Flow taint through arithmetic expressions for java/thread-resource-abuse experimental query
2023-10-13 10:06:33 +02:00
Erik Krogh Kristensen
b1ad61e27d
Merge pull request #14481 from erik-krogh/proper-codepoints
...
ReDoS: use the new codePointAt and codePointCount methods instead of regex hacks
2023-10-13 09:35:55 +02:00
Felicity Chapman
2ddcd1d9cc
Merge pull request #14489 from github/felicitymay-typo-fix
...
Fix typo in link
2023-10-12 21:45:30 +01:00
Felicity Chapman
8f70b55158
Fix typo in link
2023-10-12 20:53:44 +01:00
Ian Lynagh
2edc70da79
Merge pull request #14390 from igfoo/igfoo/compr
...
Kotlin: Improve support for TRAP compression options
2023-10-12 20:22:10 +01:00
Robert Marsh
dd71204128
Swift: update test expectations for for-in locations
2023-10-12 18:59:36 +00:00
Geoffrey White
fe57cd0784
Merge pull request #14488 from geoffw0/strlentest
...
Swift: Additional test cases for `swift\string-length-conflation`
2023-10-12 19:39:43 +01:00
AlexDenisov
6ab2de10e3
Merge pull request #14437 from github/alexdenisov/ignore-unavailable-declarations
...
Swift: skip declarations marked as unavailable
2023-10-12 20:08:18 +02:00
Ian Lynagh
ed9502fd0b
Kotlin: Enhance the TRAP compression test
2023-10-12 18:13:07 +01:00
Ian Lynagh
adb47399c7
Kotlin: Improve support for TRAP compression options
...
While you could control compression with
CODEQL_EXTRACTOR_JAVA_OPTION_TRAP_COMPRESSION
before, most TRAP files used gzip regardless for compatibility with the
Java extractor. Now Java understands the option too we can use it for
shared TRAP files.
2023-10-12 18:13:06 +01:00
Mathias Vorreiter Pedersen
3c34638438
Merge pull request #14486 from MathiasVP/simplify-overrun-write
...
C++: Remove unnecessary `FlowState` from `cpp/overrun-write`
2023-10-12 17:48:52 +01:00
Geoffrey White
9f683b8630
Swift: Remove duplicate results.
2023-10-12 17:38:58 +01:00
Geoffrey White
cf7f355fc4
Swift: Additional test cases.
2023-10-12 17:11:56 +01:00
Stephan Brandauer
bcde466d6c
use of characteristics
2023-10-12 17:22:05 +02:00
Stephan Brandauer
1bbf88f208
Java: basic version of automodel extraction queries
2023-10-12 17:07:46 +02:00
