Tom Hvitved
85e6b24c49
C#: Remove false positives for cs/useless-assignment-to-local
2020-02-05 20:12:39 +01:00
Tom Hvitved
d9f9fc510f
C#: Add more tests for cs/useless-assignment-to-local
2020-02-05 20:11:22 +01:00
Dave Bartolomeo
4c31c038b8
Merge from master
2020-02-05 11:23:14 -07:00
Dave Bartolomeo
4362bdb626
C++: Accept new test output
2020-02-05 10:56:40 -07:00
Dave Bartolomeo
1b6de4b32f
C++: Fix formatting
2020-02-05 10:55:49 -07:00
Jonathan Leitschuh
60f2fa9eb9
Update java/ql/src/Security/CWE/CWE-113/NettyResponseSplitting.ql
2020-02-05 12:45:47 -05:00
Jonas Jensen
a0e2d59c01
C++: Add tests for global-var support
2020-02-05 16:31:13 +01:00
Jonas Jensen
f40acc19d2
C++: Use VariableNode in DefaultTaintTracking
2020-02-05 16:29:13 +01:00
Jonas Jensen
6d081a997a
C++: Add VariableNode
2020-02-05 16:29:13 +01:00
Jonas Jensen
73e34f1447
C++: Refactor to separate out InstructionNode
...
This commit prepares the IR data-flow library for having more than one
type of data-flow node.
2020-02-05 16:29:13 +01:00
Jonas Jensen
cdfcee3ae9
Merge remote-tracking branch 'upstream/master' into ir-crement-load
...
Conflicts:
cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir.expected
cpp/ql/test/library-tests/ir/ssa/aliased_ssa_ir_unsound.expected
2020-02-05 16:13:21 +01:00
Anders Schack-Mulligen
ba86dea657
Java: Improve taint step modeling to use postupdate nodes.
2020-02-05 15:33:29 +01:00
Anders Schack-Mulligen
07482abed7
Java/C++/C#: Sync.
2020-02-05 15:17:20 +01:00
Anders Schack-Mulligen
274919ca08
Java: Fix recent perf regressions.
2020-02-05 15:15:15 +01:00
yo-h
b5f3d776bf
Merge pull request #2759 from aschackmull/java/taint-tests
...
Java: Move some taint tests.
2020-02-05 09:09:43 -05:00
semmle-qlci
163285bee7
Merge pull request #2735 from asger-semmle/prototype-pollution-manual-dataflow
...
Approved by esbena
2020-02-05 12:52:59 +00:00
Ian Lynagh
67d7e83c17
Merge pull request #2727 from matt-gretton-dann/codeql-c-extractor/7-edg-60-upgrade
...
Update expected results for changes in Extractor FE
2020-02-05 12:23:02 +00:00
Erik Krogh Kristensen
da28d3b971
add "hash" and "search" to URL taint step
2020-02-05 12:44:10 +01:00
Felicity Chapman
d0e7bfce28
Merge pull request #2738 from aschackmull/java/ldapinjection-changenote
...
Java: Add change note for LDAP injection query.
2020-02-05 11:29:29 +00:00
semmle-qlci
a5e183bde3
Merge pull request #2619 from asger-semmle/ts-monorepo-deps
...
Approved by erik-krogh, max-schaefer
2020-02-05 10:57:55 +00:00
semmle-qlci
53763c789f
Merge pull request #2741 from esbena/js/split-and-slice-for-tainted-path
...
Approved by erik-krogh
2020-02-05 10:53:39 +00:00
Jonas Jensen
2928f9e5b2
Merge pull request #2703 from rdmarsh2/connect-ir-dataflow-models
...
C++: IR dataflow through modeled functions
2020-02-05 11:28:48 +01:00
semmle-qlci
52f34d7178
Merge pull request #2715 from erik-krogh/PrivateFields
...
Approved by asgerf
2020-02-05 10:20:28 +00:00
Erik Krogh Kristensen
88bb1dc23d
bind this in each of the step methods of UrlSearchParamsTaintStep
2020-02-05 10:58:13 +01:00
Erik Krogh Kristensen
30d5eb5a13
update docstrings
2020-02-05 10:53:34 +01:00
Erik Krogh Kristensen
ffc6fddddd
update expected test output
2020-02-05 10:52:40 +01:00
Asger F
cf18bd7bb8
Update javascript/ql/src/Security/CWE-400/PrototypePollutionUtility.ql
...
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com >
2020-02-05 09:48:16 +00:00
Asger Feldthaus
fd9975db85
JS: Address comments
2020-02-05 09:47:51 +00:00
Esben Sparre Andreasen
f6ad22dd1f
Merge pull request #2758 from asger-semmle/js/string-concat-concat
...
JS: Model concat() calls as string concatenation
2020-02-05 10:41:02 +01:00
Erik Krogh Kristensen
ec9c37075c
address review feedback
2020-02-05 10:31:53 +01:00
Erik Krogh Kristensen
35a7e15a2f
remove private modifer on isUrlSearchParams
2020-02-05 10:30:31 +01:00
Erik Krogh Kristensen
76aca02752
change the pseudo-property on URL to a two-stage process
2020-02-05 10:27:03 +01:00
Matthew Gretton-Dann
b601908577
CPP: Update for changes in EDG IL.
2020-02-05 09:11:23 +00:00
Matthew Gretton-Dann
1b67f47918
C++: Update with improved location information
...
EDG 6.0 gives better location in some circumstances changing the results
of these tests for the better.
2020-02-05 09:11:23 +00:00
Matthew Gretton-Dann
cec6646846
C++: Update for EDG 6.0 behaviour change
...
EDG 6.0 has changed how much information it gives about invalid
expressions. Changing the output of this test.
2020-02-05 09:11:23 +00:00
Erik Krogh Kristensen
e525cf0959
generalize isAdditionalLoadStoreStep such that it loads and stores different properties
2020-02-05 09:40:16 +01:00
Anders Schack-Mulligen
7d19eb7c05
Java: Add LICENSE.txt
2020-02-05 09:38:16 +01:00
Dave Bartolomeo
73ad2e9658
Merge from master
2020-02-04 18:33:10 -07:00
Dave Bartolomeo
a23d5afc6c
C++: Add test case to demonstrate string literl aliasing change
...
Also fixed a minor bug where we should have been treating `AllNonLocalMemory` as _totally_ overlapping an access to a non-local variable, rather than _partially_ overlapping it. This fix is exhibited both in the new test case and in a couple existing test functions in `ssa.cpp`.
2020-02-04 18:24:08 -07:00
Jonathan Leitschuh
832a4f2e07
Add DefaultFullHttpResponse to Netty Check
2020-02-04 15:40:59 -05:00
Robert Marsh
1576bcfa3f
C++: remove unused predicates
2020-02-04 12:08:03 -08:00
Jonas Jensen
c77a921b06
Merge pull request #2695 from rdmarsh2/default-taint-tracking-diff-test
...
C++: add diff tests for DefaultTaintTracking
2020-02-04 20:57:55 +01:00
Robert Marsh
ac2e89317b
C++: autoformat
2020-02-04 10:41:30 -08:00
Robert Marsh
861d5eb86b
C++: update tests after merge
2020-02-04 10:29:52 -08:00
Robert Marsh
785d54ac67
Merge branch 'master' into default-taint-tracking-diff-test
2020-02-04 09:50:05 -08:00
Asger Feldthaus
b4df03767d
JS: Ignore obvious Array.prototype.concat calls
2020-02-04 16:36:41 +00:00
Asger Feldthaus
db2212e33e
TS: Only print number of errors if there were any
2020-02-04 15:31:30 +00:00
Erik Krogh Kristensen
8d37c03209
using pseudo-properties to model URL parsing
2020-02-04 16:30:07 +01:00
Anders Schack-Mulligen
cf815351a9
Java: Elaborate change note.
2020-02-04 16:18:35 +01:00
Asger Feldthaus
3ccdaa94ad
JS: Expose argumentPassing as DataFlow::argumentPassingStep
2020-02-04 15:06:45 +00:00
