Anders Schack-Mulligen
33f6392be5
Java: Add some more taint-getter-setter tests.
2020-02-27 10:47:25 +01:00
Asger Feldthaus
fefcf1a7a6
JS: Autoformat everything
2020-02-27 09:41:01 +00:00
Anders Schack-Mulligen
0c30d7cced
Java: Update test output.
2020-02-27 10:28:12 +01:00
Erik Krogh Kristensen
9c06c48dc7
Merge pull request #2884 from esbena/js/practically-exploitable-redos
...
JS: add query js/exploitable-polynomial-redos
2020-02-27 10:19:17 +01:00
Anders Schack-Mulligen
a09e479033
Java: Change relevantNode to a class, and add two more checks.
2020-02-27 10:14:14 +01:00
Esben Sparre Andreasen
1b73cee692
JS: add js/exploitable-polynomial-redos
2020-02-27 08:42:43 +01:00
Rebecca Valentine
fe2bb8fb4b
Adds preliminary modernization
2020-02-26 22:01:31 -08:00
Rebecca Valentine
057fed2cb8
Fixes erroneus naming
2020-02-26 21:55:02 -08:00
Rebecca Valentine
84875d70ff
Adds preliminary modernization
...
This will overlapp with/depend on changes to CallArgs and ObjectAPI that are already in the WrongNamedArgumentInCall PR
2020-02-26 21:42:52 -08:00
yo-h
63adc63597
CONTRIBUTING.md: add paragraph on maintaining backwards compatibility
2020-02-26 18:39:23 -05:00
yo-h
aeb8793197
Update docs/experimental.md
...
Break sentence down into shorter ones, as per review comment.
2020-02-26 18:38:42 -05:00
Robert Marsh
95a762c987
Merge master for submodule update
2020-02-26 13:44:26 -08:00
Robert Marsh
4333fe7905
Merge branch 'master' into rdmarsh/cpp/ir-flow-through-outparams
2020-02-26 13:15:27 -08:00
yo-h
62f8bf2b2e
Java: add release note for Customizations.qll
2020-02-26 14:36:27 -05:00
yo-h
bd91bc0b29
Java: add Customizations.qll
2020-02-26 13:18:13 -05:00
Rebecca Valentine
b0493458d6
Combine and clean up the test files
2020-02-26 09:04:14 -08:00
Rebecca Valentine
ba1f3c46b8
Removes obsolete asBuiltin predicate
2020-02-26 08:17:45 -08:00
Geoffrey White
427b440389
Merge pull request #2918 from jbj/UnsignedGEZero-recursion
...
C++: Fix performance of UnsignedGEZero.ql
2020-02-26 15:49:03 +00:00
Taus Brock-Nannestad
5c3109a324
Python: Fix bug in multi_assignment_points_to.
...
This turned out to be a fairly simple but easy to make bug. When we want to
figure out the value pointed-to in a multi-assignment, we look at the left hand
side to see what value from the right hand side we should assign. Unfortunately,
we accidentally attempted to look up this information in the _left hand side_ of
the assignment, resulting in no points-to information at all. The only thing
needed to fix this was to properly link up the left and right hand sides: using
the left hand side to figure out what index to look at, and then looking up the
points-to information for the corresponding place in the right hand side.
2020-02-26 16:11:43 +01:00
Taus
85f5ad2231
Merge pull request #2904 from RasmusWL/python-http-clients
...
Python: Model outgoing HTTP client requests
2020-02-26 15:49:41 +01:00
Anders Schack-Mulligen
ce70b86604
Java: Add data-flow consistency checks.
2020-02-26 14:17:07 +01:00
Rasmus Wriedt Larsen
771dfecf6d
Python: Add sanitized edges for urlsplit test
2020-02-26 14:10:30 +01:00
Rasmus Wriedt Larsen
0b31cb1716
Python: Show that we have initial taint in urlsplit test
2020-02-26 14:09:02 +01:00
Rasmus Wriedt Larsen
400a8ffae5
Python: Use slightly better name than foobar
...
I intended to rename before committing, but woops
2020-02-26 14:08:10 +01:00
Anders Schack-Mulligen
508b6050a8
Java: Remove some irrelevant bounds from TypeFlow.
2020-02-26 13:51:25 +01:00
Taus
dce121b565
Merge pull request #2916 from BekaValentine/python-objectapi-to-valueapi-callargsandothers
...
Python: ObjectAPI to ValueAPI: CallArgs and Others
2020-02-26 12:51:18 +01:00
semmle-qlci
326522c250
Merge pull request #2846 from erik-krogh/CVE481
...
Approved by asgerf, esbena
2020-02-26 11:16:41 +00:00
Mathias Vorreiter Pedersen
1bee0ffe3b
C++: Autoformat
2020-02-26 12:09:21 +01:00
Jonas Jensen
5f6d07dd57
C++: Fix performance of UnsignedGEZero.ql
...
This query used two fastTC operations that were already somewhat
inefficient on their own but could send the evaluator into an OOM loop
when run in parallel without enough RAM.
The fix is to recurse manually, starting just from the expressions that
are potential candidates for alerts.
2020-02-26 11:32:41 +01:00
Rasmus Wriedt Larsen
4330d4e289
Python: Remove unused import in test
2020-02-26 10:26:30 +01:00
Rasmus Wriedt Larsen
5fae3a8d0a
Python: Explain complexity of HTTPConnection.request
2020-02-26 10:26:30 +01:00
Rasmus Wriedt Larsen
b213db03fd
Python: Consolidate stdlib http client tests
...
Move the stdlib tests from test/{2,3}/library-tests/ into /test/library-tests/,
and deal with version by using sys.version_info (results should be the same for
both versions).
six tests were moved from /library-tests/web/client/stdlib => /library-tests/web/client/six
2020-02-26 10:26:30 +01:00
Rasmus Wriedt Larsen
be187bcc0a
Python: Make Client::HttpRequest extend ControlFlowNode
...
Taus poitned out that the reuqest being send off, doesn't *need* to happen on a
CallNode. Someone *could* use a __setattr__ or property :\
2020-02-26 10:26:30 +01:00
Rasmus Wriedt Larsen
e25079acc2
Python: Remove unnecessary cast
2020-02-26 10:26:30 +01:00
Rasmus Wriedt Larsen
cd5399d43e
Python: Model outgoing http client requests
2020-02-26 10:26:30 +01:00
Mathias Vorreiter Pedersen
d942a3b54a
C++: Change definition of isChiForAllAliasedMemory to recurse through inexact PhiInstructions
2020-02-26 10:21:27 +01:00
yo-h
21dd8757dd
Update docs/experimental.md
...
Co-Authored-By: Felicity Chapman <felicitymay@github.com >
2020-02-25 23:11:29 -05:00
Rebecca Valentine
2fb722b04e
Removes the general versions of the query.
2020-02-25 14:55:55 -08:00
Rebecca Valentine
15aeeb1e50
Removes erroneous expected result for py3
2020-02-25 14:54:52 -08:00
Rebecca Valentine
e07a003f75
Swaps overridden_call globally
2020-02-25 11:02:18 -08:00
Rebecca Valentine
50c91b99da
Swaps correct_args_if_called_as_method globally
2020-02-25 11:01:51 -08:00
Rebecca Valentine
fb0cae76cf
Swaps wrong_args globally
2020-02-25 11:00:39 -08:00
Rebecca Valentine
3a764ade8d
Swaps too_many_args globally
2020-02-25 10:59:55 -08:00
Rebecca Valentine
3b0be46377
Swaps too_few_args globally
2020-02-25 10:59:16 -08:00
Rebecca Valentine
2c32a859cc
Swaps illegally_named_parameter globally
2020-02-25 10:58:08 -08:00
Rebecca Valentine
4857a947ac
Swaps get_function_or_initializer globally
2020-02-25 10:51:40 -08:00
Rebecca Valentine
cf4b7e1270
Swaps arg_count globally
2020-02-25 10:50:30 -08:00
Rebecca Valentine
c2a3af7e67
Adds objectapi suffix to private predicates
2020-02-25 10:48:29 -08:00
Rebecca Valentine
930228acc5
Un-autoformats
2020-02-25 09:52:46 -08:00
Rebecca Valentine
3e53e462d6
changes indents to 4
2020-02-25 09:46:21 -08:00
