Maiky
d45d046fa7
Add test file and .expected
2023-05-28 17:29:34 +02:00
Maiky
d8bc818d5a
add Change note
2023-05-28 16:50:36 +02:00
Harry Maclean
e515981c81
Ruby: Remove unused examples
2023-05-27 12:01:00 +00:00
Harry Maclean
562065f29e
Ruby: Add change note
2023-05-27 01:20:09 +00:00
Harry Maclean
b8c3cba4ff
Ruby: Consolidate unsafe deserialization queries
...
Merge the experimental YAMLUnsafeDeserialization and
PlistUnsafeDeserialization queries into the generate
UnsafeDeserialization query in the default suite.
These queries look for some specific sinks that we now find in the
general query.
Also apply some small code and comment refactors.
2023-05-27 01:20:04 +00:00
amammad
d727d573d5
v4.2 write exact version of yaml.load default loader change
2023-05-27 01:15:29 +00:00
amammad
40e24b6b94
v4.1 fix file names in qhelp
2023-05-27 01:15:29 +00:00
amammad
335441ce04
v4: make variable names camelCase, some inhancement, remove some duplicates
2023-05-27 01:15:29 +00:00
amammad
e76ed9454a
v3 add global taint steps for to_ruby of YAML/Psych
2023-05-27 01:15:24 +00:00
amammad
ad7e107ff5
add the new YAML/PLIST sinks into the existing rb/unsafe-deserialization query
2023-05-27 01:14:36 +00:00
amammad
b9296d3df8
v2.1 fix file names
2023-05-27 01:14:36 +00:00
amammad
4360a56b45
v2 add plist.parse_xml as a dangerous sink and enhancements on documents
2023-05-27 01:14:36 +00:00
amammad
0521ffe175
v1.4 correct dirs uppercase issue
2023-05-27 01:14:36 +00:00
amammad
0e343e5a12
v1.3
2023-05-27 01:14:36 +00:00
amammad
d96153a05e
v1.2 change to PascalCase
2023-05-27 01:14:36 +00:00
amammad
e4b8a0e06d
v1.1
2023-05-27 01:14:36 +00:00
amammad
486a5ac96f
v1
2023-05-27 01:14:36 +00:00
Jami Cogswell
24fc4ba2d4
Java: add tests
2023-05-26 18:55:13 -04:00
Jami Cogswell
f255b6acb8
Java: fix typos
2023-05-26 18:55:13 -04:00
Jami Cogswell
7e6913af62
Java: update provenance to 'hq-manual'
2023-05-26 18:55:13 -04:00
Jami Cogswell
60b07083c3
Java: add 'sink' kind
2023-05-26 18:55:13 -04:00
Jami Cogswell
65dd7eb8e7
Java: add neutral models discovered with path-inj and ssrf heuristics
2023-05-26 18:55:13 -04:00
Mathias Vorreiter Pedersen
9828af45a1
C++: Change separator from ':' to '|'.
2023-05-26 15:23:48 -07:00
Mathias Vorreiter Pedersen
0f08642653
C++: Fix join in 'pointerArithOverflow0'.
2023-05-26 11:16:44 -07:00
Robert Marsh
d18fb646d1
C++: handle cast arrays properly in off-by-one query
2023-05-26 13:16:21 -04:00
Robert Marsh
5bc844c4c6
Merge pull request #13207 from MathiasVP/use-equiv-class-in-getInstruction
...
C++: Reduce memory pressure from `getInstruction`
2023-05-26 13:13:57 -04:00
Robert Marsh
6e230e10f8
C++: include stack-allocated arrays in off-by-one query
2023-05-26 13:04:51 -04:00
Robert Marsh
b2fb2aa0d1
Merge pull request #13045 from rdmarsh2/rdmarsh2/cpp/improve-constant-off-by-one
...
C++: stitch paths and ignore cast arrays in constant off-by-one query
2023-05-26 12:47:08 -04:00
Maiky
dfbf259e2d
typo
2023-05-26 18:14:49 +02:00
Maiky
9ab6eabd15
add filterTaintStep, qhelp file and test files
2023-05-26 18:13:58 +02:00
Philip Ginsbach
ded98c5a5f
Merge pull request #13304 from github/ginsbach/SmallSpecificationFixes
...
two small QL specification fixes
2023-05-26 16:18:36 +01:00
Taus
227c5fab40
Java: Get location ordering without toString
2023-05-26 14:52:08 +00:00
Paolo Tranquilli
ddf45b27ca
Merge pull request #13300 from github/redsun82/swift-fix-autobuild-corner-case
...
Swift: exclude unknown type targets ending in `Tests` or `Test` from autobuilding
2023-05-26 16:49:01 +02:00
Philip Ginsbach
47a0d4b774
more explicit mentioning of QLL files
2023-05-26 15:03:34 +01:00
Philip Ginsbach
ba51ded516
bindingset is not really a pragma
2023-05-26 15:03:34 +01:00
Geoffrey White
32c113bc38
Swift: Fix following merge with main.
2023-05-26 14:41:48 +01:00
Geoffrey White
68354c09bf
Merge branch 'main' into sqlpathinject
2023-05-26 14:33:05 +01:00
Paolo Tranquilli
15047368e8
Swift: add a warning to unmangled types
2023-05-26 15:12:21 +02:00
Paolo Tranquilli
3f7c4dec25
Swift: add a header comment to SwiftMangler
2023-05-26 15:05:40 +02:00
Asger F
3831dc7785
Merge pull request #13288 from asgerf/rb/super-and-flow-through
...
Ruby: two bug fixes
2023-05-26 15:04:52 +02:00
Paolo Tranquilli
d81dc274f6
Swift: make a TODO more assertive as there is a draft PR already
2023-05-26 14:45:29 +02:00
Asger F
cfaa27ab5d
Ruby: change note
2023-05-26 14:44:00 +02:00
Paolo Tranquilli
05ed66ad8f
Swift: remove debugging print
2023-05-26 14:42:02 +02:00
Paolo Tranquilli
c5cee0d419
Swift: exclude targets ending in Tests or Test from autobuilding
2023-05-26 14:19:07 +02:00
Stephan Brandauer
efe539eb32
Java: better sampling of negative examples
2023-05-26 14:15:32 +02:00
Asger F
c637b6f59a
JS: Update test for RegExpAlwaysMatches
2023-05-26 14:10:26 +02:00
Asger F
9df9ca2916
JS: Update test and expectations for MissingRegExpAnchor
2023-05-26 14:07:34 +02:00
Asger F
40daa9c906
JS: Update RegExpInjection test and expectations
2023-05-26 14:05:36 +02:00
Rasmus Lerchedahl Petersen
9cb83fcdc9
python: add summaries for
...
copy, pop, get, getitem, setdefault
Also add read steps to taint tracking.
Reading from a tainted collection can be done in two situations:
1. There is an acces path
In this case a read step (possibly from a flow summary)
gives rise to a taint step.
2. There is no access path
In this case an explicit taint step (possibly via a flow
summary) should exist.
2023-05-26 14:04:15 +02:00
Jami
6867e94ed5
Merge pull request #13158 from jcogs33/jcogs33/update-csharp-sink-kinds
...
C#: update MaD sink kinds
2023-05-26 08:03:21 -04:00
