Erik Krogh Kristensen
3000486b35
add more isRelevant calls
2020-03-25 09:42:24 +01:00
yo-h
116c13eb18
Merge pull request #3106 from aschackmull/java/getstmtbody-type
...
Java: Sharpen return type of LambdaExpr.getStmtBody().
2020-03-24 19:20:57 -04:00
Erik Krogh Kristensen
1d8e103322
autoformat
2020-03-25 00:19:23 +01:00
Mathias Vorreiter Pedersen
f92dd3c565
C++: Autoformat
2020-03-24 22:28:55 +01:00
Mathias Vorreiter Pedersen
077c282cd3
C++: Add field flow and accept tests
2020-03-24 22:28:54 +01:00
Mathias Vorreiter Pedersen
a5f08e1ea6
C++: Split parameter node class into an explicit and implicit version
2020-03-24 22:28:54 +01:00
Mathias Vorreiter Pedersen
22381f3ee6
C++: Demonstrate amount of field flow already present
2020-03-24 22:28:54 +01:00
yo-h
ac68b62b48
Merge pull request #3115 from aschackmull/java/experimental-dir
...
Java: Fix directory structure in experimental.
2020-03-24 16:50:28 -04:00
Aditya Sharad
a6e039b284
Java: Add tests for Jackson taint steps.
...
Add stubs for jackson-databind-2.10.
Based on http://fasterxml.github.io/jackson-databind/javadoc/2.10 .
Test taint through Jackson serialization APIs.
2020-03-24 12:59:24 -07:00
Aditya Sharad
7de8b48692
Java: Add taint steps through Jackson serialization methods.
2020-03-24 12:59:14 -07:00
Dave Bartolomeo
2b69cc9738
C#: Make IRConfiguration.qll just forward to the implementation
...
Just like C++ already does.
2020-03-24 13:33:50 -04:00
Max Schaefer
efbcec09ef
JavaScript: Add type tracking to Postgres model.
2020-03-24 17:30:07 +00:00
Anders Schack-Mulligen
75523e4eb8
Java: Fix directory structure in experimental.
2020-03-24 16:47:55 +01:00
Jonas Jensen
8f419d1676
C++: Fix conflated-memory sanity query
...
I had included `InitializeNonLocal` in the recursion because it made
everything look better in the presence of a bug that's since been fixed.
Taking it out means the sanity test is again aligned with the old
`isChiForAllAliasedMemory`.
2020-03-24 16:46:59 +01:00
Jonas Jensen
4e588869d8
C++: Sync identical files
2020-03-24 16:46:42 +01:00
Dave Bartolomeo
cc76782545
Merge remote-tracking branch 'upstream/master' into codeql-c-analysis/34-Bad-Overlap
2020-03-24 11:38:39 -04:00
semmle-qlci
ce0b72f949
Merge pull request #3093 from erik-krogh/MorePathSinks
...
Approved by asgerf
2020-03-24 14:26:41 +00:00
Anders Schack-Mulligen
d8edae96df
Java: Add test.
2020-03-24 15:24:17 +01:00
Rasmus Wriedt Larsen
05ecfc83f7
Python: Add test-case with swapped decorator order
2020-03-24 14:18:46 +01:00
Jonas Jensen
27832148a9
C++: Phi-node conflation is not about vvars
2020-03-24 13:56:42 +01:00
Jonas Jensen
95a8dcb3fd
C++: failing test for non-conflated escaped var
2020-03-24 13:31:08 +01:00
Taus
fe00d1cbf4
Merge pull request #2888 from RasmusWL/python-tarslip-sanitizer
...
Python: Improve tarslip sanitizer
2020-03-24 12:59:20 +01:00
Rasmus Wriedt Larsen
3ed48aae4c
Python: remove leftover arg in test code
2020-03-24 11:49:08 +01:00
Rasmus Wriedt Larsen
5ec0716cb0
Python: Add points-to regression when using @classmethod decorators
...
Specifically a problem when using a second decorator
2020-03-24 11:39:08 +01:00
Erik Krogh Kristensen
36981f385a
Merge branch 'master' of git.semmle.com:Semmle/ql into MorePathSinks
2020-03-24 11:20:33 +01:00
Rasmus Wriedt Larsen
49fa7c8589
Python: update 1.24 changelog
2020-03-24 10:15:36 +01:00
Rasmus Wriedt Larsen
4b8020b98d
Python: Autoformat Command.qll
2020-03-24 10:11:57 +01:00
semmle-qlci
4c9a6b73ee
Merge pull request #3107 from erik-krogh/FArgs
...
Approved by esbena
2020-03-24 08:32:56 +00:00
Erik Krogh Kristensen
fa710c5864
Merge remote-tracking branch 'upstream/master' into UrlSearch
2020-03-24 00:23:15 +01:00
Erik Krogh Kristensen
5b4f091257
add test for remote flow sources in WebSockets
2020-03-23 23:58:20 +01:00
Erik Krogh Kristensen
6a1491d83d
add SockJS to the existing WebSocket model
2020-03-23 23:56:11 +01:00
Erik Krogh Kristensen
9a18dc32c1
autoformat WebSocket tests
2020-03-23 23:49:26 +01:00
Erik Krogh Kristensen
7b7eddff1e
remove previous SockJS implementation, and move example to WebSocket test
2020-03-23 23:45:05 +01:00
Asger F
a1e032bee6
Merge pull request #3098 from kyprizel/master
...
Experimental SockJS support
2020-03-23 22:39:10 +00:00
yo-h
d315864383
Merge pull request #3108 from aschackmull/java/finalizemethod
...
Java: Fixup FinalizeMethod definition.
2020-03-23 18:27:57 -04:00
Dave Bartolomeo
bebf89fed5
C++: Accept test diffs
...
All changes look like real improvements.
2020-03-23 17:20:19 -04:00
kyprizel
dec1b8b070
Update javascript/ql/src/experimental/SockJS/SockJS.qll
...
Fix comments
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com >
2020-03-23 22:59:48 +03:00
kyprizel
b90ff5e84d
Update javascript/ql/src/experimental/SockJS/SockJS.qll
...
do not import specific libs
Co-Authored-By: Erik Krogh Kristensen <erik-krogh@github.com >
2020-03-23 22:59:23 +03:00
Jonas Jensen
29c4c8c0b2
C#: Fixup to follow C++ changes
2020-03-23 20:39:43 +01:00
Jonas Jensen
999051d20e
C++: QLDoc terminology: object -> mem allocation
2020-03-23 20:32:47 +01:00
Dave Bartolomeo
c5ac357bfc
C++/C#: Fix bad overlap sanity failures
...
`Instruction.getDefinitionOverlap()` depends on `SSAConstruction::getMemoryOperandDefinition()`, which in turn depends on `SSAConstruction::hasMemoryOperandDefinition()`. When the definition in question came from a `Chi` instruction, `hasMemoryOperandDefinition()` incorrectly bound `overlap` to the overlap relationship between the original (non-`Chi`) instruction and the use. The fix is to make use of the `actualDefLocation` parameter to `getDefinitionOrChiInstruction()`, which specifies the location for the result of the `Chi` in that case.
2020-03-23 14:57:41 -04:00
Jonas Jensen
b0d3c9ee6b
C++: Fix getExtentOverlap for entire allocation
2020-03-23 19:49:39 +01:00
Dave Bartolomeo
a2741da8e2
C++/C#: Add sanity test for invalid overlap from getDefinitionOverlap()
...
The result of `getDefinitionOverlap()` should never be `MayPartiallyOverlap`, because if that were the case, we should have inserted as `Chi` instruction and hooked the definition up to that instead.
There are quite a few existing failures.
2020-03-23 14:37:06 -04:00
Rasmus Wriedt Larsen
b567205579
Python: Model fabric v1.x command injection sinks
2020-03-23 17:49:56 +01:00
Rasmus Wriedt Larsen
a57eadaeb6
Python: Model fabric/invoke command injection sinks
2020-03-23 17:33:41 +01:00
Anders Schack-Mulligen
f29f0f418f
Dataflow: Exclude flow param-param flow through with identical params.
2020-03-23 17:27:53 +01:00
semmle-qlci
e5590091a0
Merge pull request #3109 from max-schaefer/js/performance-fixes
...
Approved by asgerf
2020-03-23 16:08:07 +00:00
Rasmus Wriedt Larsen
d475bb998e
Python: Add abstract class CommandSink
...
I'm going to add more in a sec, and listing *all* of them in CommandInjection.ql
started to be silly
2020-03-23 17:04:08 +01:00
Max Schaefer
55e7b22cdf
JavaScript: Autoformat.
2020-03-23 14:37:04 +00:00
kyprizel
49e5a22cab
Fixed code style for SockJS
...
also fixed appCreation, thanks to Erik Krogh.
2020-03-23 17:16:17 +03:00
