Arthur Baars
061c2a754f
Java: tests for android database flow steps
2020-09-30 12:42:19 +02:00
Arthur Baars
a13e845127
Java: tests for android database sinks
2020-09-30 12:42:19 +02:00
Arthur Baars
39f5284dcc
Java: add stubs for some android database classes
2020-09-30 12:33:33 +02:00
Arthur Baars
449fb24ef6
Java: android add taint and SQL sink for ContentProvider/Resolver
2020-09-30 12:33:32 +02:00
Arthur Baars
efd5b6ff66
Java: SQLite: make classes private
2020-09-30 12:32:27 +02:00
Arthur Baars
28c965765b
Move query sinks into SQLite.qll
2020-09-30 12:32:27 +02:00
Arthur Baars
b3aae276ba
Add types to SQLite.qll
2020-09-30 12:32:24 +02:00
Arthur Baars
6db4f839cb
Java: add Android database taint and SQL injection sinks
2020-09-30 12:31:11 +02:00
Rasmus Lerchedahl Petersen
30d048f9d4
Python: Support unpacking of keyword arguments.
2020-09-30 11:55:27 +02:00
Rasmus Lerchedahl Petersen
e02cfbf6b0
Python: Support keyword overflow arguments
2020-09-30 11:55:27 +02:00
Rasmus Lerchedahl Petersen
27af9bbae8
Python: Support overflow positional arguments
...
Currently ignoring starred arguments
2020-09-30 11:55:26 +02:00
Rasmus Lerchedahl Petersen
8f2ef94b3e
Python: Hook up keyword arguments
2020-09-30 11:55:26 +02:00
Rasmus Lerchedahl Petersen
f5244aab8c
Python: Add testfiles
2020-09-30 11:54:40 +02:00
Rasmus Wriedt Larsen
1595fed2d6
Python: Add preliminary taint tests for pathlib
2020-09-30 11:44:37 +02:00
Rasmus Wriedt Larsen
0542c3b91e
Python: Model os.path.join and add taint-step
2020-09-30 11:42:36 +02:00
Rasmus Wriedt Larsen
efa2484718
Python: Add taint test for os.path.join
...
Surprisingly the first two just worked, due to our very general handling of any
`join` methods :D
2020-09-30 11:35:21 +02:00
Rasmus Wriedt Larsen
aa6fad558c
Python: Minor cleanup in taint-step tests
2020-09-30 11:15:53 +02:00
Erik Krogh Kristensen
e0b25798ff
remove type-tracking from getAReference, and rewrite qldocs
2020-09-30 10:36:08 +02:00
Rasmus Wriedt Larsen
b3efa28277
Merge branch 'main' into python-command-execution-modeling
2020-09-30 10:24:11 +02:00
Jonas Jensen
68f6d93325
C++: Autoformat fixup
2020-09-30 09:49:56 +02:00
Anders Schack-Mulligen
8d4f7e2db7
Merge pull request #4366 from joefarebrother/field-rvalue-lvalue
...
Java: Make `FieldRead` and `FieldWrite` extend `RValue` and `LValue`
2020-09-30 07:55:24 +02:00
Ian Lynagh
d5f8cbc50c
C++: Accept test changes in unnamed entity naming
2020-09-29 17:30:33 +01:00
Erik Krogh Kristensen
65441705ef
renamings based on review
2020-09-29 18:23:10 +02:00
Erik Krogh Kristensen
c3f5a6dcac
introduce API::Node::getACall()
2020-09-29 18:23:10 +02:00
Erik Krogh Kristensen
69f4ac25c4
renamings based on review
2020-09-29 18:23:10 +02:00
Erik Krogh Kristensen
1596436f7e
rename getASourceUse to getAReference
2020-09-29 18:23:10 +02:00
Erik Krogh Kristensen
adc05022f3
update comment in test case
...
Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com >
2020-09-29 18:21:41 +02:00
Joe
be07d27a4c
Java: Improve tests
2020-09-29 16:36:34 +01:00
Erik Krogh Kristensen
3857331657
avoid .getReturn().getAUse().(DataFlow::InvokeNode) in the SQL model
2020-09-29 17:08:09 +02:00
Erik Krogh Kristensen
deae9256dd
add convenience method to API graphs
2020-09-29 17:08:00 +02:00
Joe
efc3a25237
Java: Don't pass taint through the format methods of Console
2020-09-29 16:02:51 +01:00
Joe Farebrother
eccfa5d26a
Fix documentation typo
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2020-09-29 15:34:05 +01:00
Joe
d184aa7c06
Make FieldRead and FieldWrite extend LValue and RValue
2020-09-29 15:24:51 +01:00
yoff
60c310d1bf
Merge pull request #4361 from RasmusWL/python-new-flask-perf-fix
...
Python: Hotfix performance problem with flask methods
2020-09-29 15:41:14 +02:00
CodeQL CI
d7add29dc2
Merge pull request #4359 from erik-krogh/cookieWrites
...
Approved by esbena
2020-09-29 06:32:01 -07:00
CodeQL CI
910c19e613
Merge pull request #4348 from erik-krogh/needle
...
Approved by esbena
2020-09-29 02:57:32 -07:00
Erik Krogh Kristensen
51f1f03f5f
add change note for js/missing-token-validation
2020-09-29 11:56:10 +02:00
CodeQL CI
11f39a9d88
Merge pull request #4342 from erik-krogh/track-where-prop
...
Approved by asgerf
2020-09-29 02:09:53 -07:00
Rasmus Wriedt Larsen
fee279f952
Python: Hotfix performance problem with flask methods
...
This improves runtime for command injection query on
https://lgtm.com/projects/g/alibaba/funcraft from +200 seconds (I did not care
to wait more) down to ~55 seconds on my machine.
This type of tracking predicate with string as additional argument apparently
causes trouble :|
2020-09-29 11:00:57 +02:00
Erik Krogh Kristensen
89195d7ada
add change note for needle
2020-09-29 10:13:48 +02:00
Erik Krogh Kristensen
52d94f6177
use getABoundCallbackParameter instead of getCallback and getParameter.
2020-09-29 10:12:46 +02:00
Rasmus Wriedt Larsen
e859a804c4
Update docs on CodeQL design patterns
2020-09-29 09:05:18 +02:00
CodeQL CI
060c19a063
Merge pull request #4352 from erik-krogh/destructing-redirect
...
Approved by esbena
2020-09-28 12:31:42 -07:00
Erik Krogh Kristensen
e04404b713
also recognize cookie writes are leading to cookie access
2020-09-28 21:17:25 +02:00
Max Schaefer
dfc4436012
JavaScript: Teach API graphs to recognise arguments supplied in partial function applications.
2020-09-28 17:52:57 +01:00
Geoffrey White
6de29a6dd3
C++: Provide std::pair constructor initializers.
2020-09-28 17:52:33 +01:00
Ian Lynagh
8a76195f04
Merge pull request #4356 from github/igfoo/front_end
...
C++: accept test changes from extractor frontend upgrade
2020-09-28 17:27:37 +01:00
Geoffrey White
8059230bbc
Update cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2020-09-28 16:59:28 +01:00
Geoffrey White
773bc48a91
C++: Use a more modern make_pair.
2020-09-28 16:54:41 +01:00
Geoffrey White
759324ca1b
Update cpp/ql/src/semmle/code/cpp/models/implementations/StdPair.qll
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2020-09-28 16:51:21 +01:00
