Joe Farebrother
|
1208195d8a
|
Align alert messages across languages.
|
2025-09-23 15:46:53 +01:00 |
|
Joe Farebrother
|
2cffb21604
|
Update and fix tests
|
2025-09-23 15:41:09 +01:00 |
|
Chad Bentz
|
46d330cb21
|
Merge branch 'ruby-framework-grape' of github.com:felickz/codeql into ruby-framework-grape
|
2025-09-23 10:40:46 -04:00 |
|
Chad Bentz
|
37e0c30842
|
Add expected output for VariablesConsistency test case
|
2025-09-23 10:40:30 -04:00 |
|
Kasper Svendsen
|
f02da68c55
|
Overlay: Discard base XML entities in overlay extracted files
|
2025-09-23 12:27:51 +02:00 |
|
Kasper Svendsen
|
718c0abdb6
|
Overlay: Discard base config entities in overlay extracted files
|
2025-09-23 12:27:51 +02:00 |
|
Joe Farebrother
|
d28e8004fd
|
Add sensitive data heuristic
|
2025-09-23 10:08:08 +01:00 |
|
Chad Bentz
|
7a9a259c03
|
Merge branch 'main' into ruby-framework-grape
|
2025-09-22 19:29:36 -04:00 |
|
Chad Bentz
|
89fd9694ce
|
codeql query format
|
2025-09-22 19:25:05 -04:00 |
|
Chad Bentz
|
6e56c549b2
|
Refactor Grape method call classes to simplify handling of API instance calls for headers, request, route_param, and cookies
|
2025-09-22 19:21:23 -04:00 |
|
Chad Bentz
|
0665c39a07
|
Refactor GrapeHelperMethod constructor to reuse getHelperSelf to traverse dataflow instead of AST
- add tests to check for nested helpers
|
2025-09-22 19:08:34 -04:00 |
|
Tom Hvitved
|
1183e50435
|
Update rust/ql/lib/change-notes/2025-09-19-parameter-mad.md
|
2025-09-22 19:45:34 +02:00 |
|
Geoffrey White
|
5ad332e37f
|
Merge pull request #20432 from github/copilot/fix-f50317f8-0a91-4bb4-a01b-353dcf0f6f3f
Rust: Implement new query for non-HTTPS URLs (CWE-319)
|
2025-09-22 18:03:52 +01:00 |
|
Chad Bentz
|
ecd0ce65fe
|
Refactor GrapeHeadersBlockCall and GrapeCookiesBlockCall to simplify method call checks
|
2025-09-22 12:52:30 -04:00 |
|
Geoffrey White
|
266624dd0f
|
Rust: The test needs to have Source tags now.
|
2025-09-22 17:12:52 +01:00 |
|
Geoffrey White
|
86c8c3c8c0
|
Rust: Fix warning by making the query a path-problem.
|
2025-09-22 17:01:12 +01:00 |
|
Geoffrey White
|
6362884d16
|
Rust: Autoformat.
|
2025-09-22 16:59:11 +01:00 |
|
Geoffrey White
|
43ac75ed62
|
Rust: Address another tiny suggestion from review.
|
2025-09-22 16:58:07 +01:00 |
|
Geoffrey White
|
5b4632b432
|
Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
|
2025-09-22 16:55:43 +01:00 |
|
Geoffrey White
|
cc9c4149d7
|
Apply suggestions from code review
|
2025-09-22 16:54:08 +01:00 |
|
Geoffrey White
|
3de191177c
|
Rust: Change note.
|
2025-09-22 16:12:30 +01:00 |
|
Geoffrey White
|
ae9025334e
|
Rust: Add the new query to suite lists.
|
2025-09-22 16:12:29 +01:00 |
|
Geoffrey White
|
4662e42584
|
Rust: Add examples as tests (and fix them).
|
2025-09-22 16:12:27 +01:00 |
|
Geoffrey White
|
bd07350bc3
|
Rust: Add qhelp and examples.
|
2025-09-22 16:12:26 +01:00 |
|
Geoffrey White
|
94afc82304
|
Rust: Fix an issue with the local flow.
|
2025-09-22 16:12:25 +01:00 |
|
Geoffrey White
|
a3ed83bfff
|
Rust: Make state transition / barrier nodes more reliable.
|
2025-09-22 16:12:23 +01:00 |
|
Geoffrey White
|
2654affeee
|
Rust: Account for the 'secure' and 'partitioned' attributes.
|
2025-09-22 16:12:22 +01:00 |
|
Geoffrey White
|
257a1b0179
|
Rust: Refactor sources, sinks into an extensions source file.
|
2025-09-22 16:09:30 +01:00 |
|
Geoffrey White
|
eadf922280
|
Rust: Use models-as-data, add source/sink/flow models.
|
2025-09-22 16:04:56 +01:00 |
|
Geoffrey White
|
d52b668149
|
Rust: Add security-severity tag.
|
2025-09-22 16:04:54 +01:00 |
|
Geoffrey White
|
7e75c1d242
|
Rust: Add very basic query prototype.
|
2025-09-22 16:04:53 +01:00 |
|
Geoffrey White
|
513ae2ab54
|
Rust: Add tests for insecure cookies.
|
2025-09-22 16:04:52 +01:00 |
|
Chad Bentz
|
b837c56bec
|
Refactor RootApi and GrapeApiClass constructors for improved readability; add getHelperSelf method to retrieve self parameter in helpers block.
|
2025-09-22 10:13:33 -04:00 |
|
Simon Friis Vindum
|
45b84ffb31
|
Rust: Ensure singleton
|
2025-09-22 14:23:50 +02:00 |
|
Simon Friis Vindum
|
4244a6569c
|
Rust: Add change note
|
2025-09-22 14:19:01 +02:00 |
|
Simon Friis Vindum
|
a4c61f6945
|
Rust: Accept test changes
|
2025-09-22 14:18:59 +02:00 |
|
Simon Friis Vindum
|
7d6e2060e5
|
Adapt all languages to changes in shared library
|
2025-09-22 14:18:58 +02:00 |
|
Simon Friis Vindum
|
265e8b3623
|
Shared: Pass SummaryComponentStack to isSource and getSourceType
|
2025-09-22 14:18:54 +02:00 |
|
Simon Friis Vindum
|
014c27ee8a
|
Rust: Discard sources with spaces in inline flow tests
|
2025-09-22 14:13:39 +02:00 |
|
Simon Friis Vindum
|
05a58323c1
|
Rust: Add Warp test to request forgery query tests
|
2025-09-22 14:13:38 +02:00 |
|
Simon Friis Vindum
|
cd807533f2
|
Rust: Add tests for parameter in source model
|
2025-09-22 14:13:37 +02:00 |
|
Joe Farebrother
|
463f79bed2
|
Merge pull request #20263 from joefarebrother/python-qual-exceptions
Python: Modernize the Unreachable Except Block query
|
2025-09-22 09:42:09 +01:00 |
|
Tom Hvitved
|
be260befd4
|
Merge pull request #20497 from hvitved/rust/missing-model
Rust: Add missing model
|
2025-09-22 10:30:25 +02:00 |
|
Napalys Klicius
|
a0ea0c9e47
|
Merge pull request #20492 from Napalys/js/graph-ql-obj-type
JS: mark `GraphQLObjectType` resolvers args as remote sources
|
2025-09-22 09:59:20 +02:00 |
|
Tom Hvitved
|
78641b4dde
|
Rust: Reduce size of unqualifiedPathLookup
|
2025-09-22 09:46:28 +02:00 |
|
Tom Hvitved
|
b5b6f06005
|
Rust: Fix bad join
```
Evaluated relational algebra for predicate _PathResolution::CrateItemNode.getName/0#dispred#91b4dd6b_PathResolution::SourceFileItemNode#bd8f490__#antijoin_rhs@e84aee8k with tuple counts:
35406180 ~0% {3} r1 = JOIN PathResolution::SourceFileItemNode#bd8f4905 WITH `PathResolution::CrateItemNode.getName/0#dispred#91b4dd6b` CARTESIAN PRODUCT OUTPUT Lhs.0, Rhs.1, Rhs.0
8455 ~2% {4} | JOIN WITH `PathResolution::declaresDirectly/3#7d0350fb_021#join_rhs` ON FIRST 2 OUTPUT Rhs.2, Lhs.0, Lhs.2, Lhs.1
3259 ~0% {3} | JOIN WITH num#PathResolution::TTypeNamespace#4897e416 ON FIRST 1 OUTPUT Lhs.1, Lhs.2, Lhs.3
return r1
```
|
2025-09-22 09:38:43 +02:00 |
|
Tom Hvitved
|
b2cc01c490
|
Rust: Visibility check for qualified path resolution
|
2025-09-22 09:38:30 +02:00 |
|
Kasper Svendsen
|
97d62950a8
|
Merge pull request #20484 from kaspersv/kaspersv/future-proof-java-discarding
Overlay: Future-proof Java config & XML discard predicates
|
2025-09-22 08:16:44 +02:00 |
|
Chad Bentz
|
1bf6101967
|
Remove redundant exclusion of base Grape::API module from GrapeApiClass
- should not impact extracted application code
|
2025-09-21 20:52:28 -04:00 |
|
Chad Bentz
|
50bf9ae756
|
Refactor RootApi class to use getAnImmediateDescendent for clarity
|
2025-09-21 20:44:46 -04:00 |
|