Asger Feldthaus
b867512db4
JS: Update test
2020-06-25 11:01:10 +01:00
Rasmus Wriedt Larsen
e60af68b29
Python: Move lxml.etree library stub (so merge is easy)
2020-06-25 11:54:34 +02:00
Rasmus Wriedt Larsen
994db060c7
Python: Use CWE-091 for XSLT
...
As indicated here https://www.zaproxy.org/docs/alerts/90017/
2020-06-25 11:53:12 +02:00
Calum Grant
4642bb2767
Merge pull request #3774 from hvitved/csharp/tripleticks
...
C#: Enable syntax highlighting in QLDoc snippets
2020-06-25 10:31:50 +01:00
Rasmus Wriedt Larsen
b36c23ef63
Merge pull request #3500 from yoff/UnmatchableDollar
...
Python: Regexp: Handle repetions {n} (with no ,)
2020-06-25 11:26:52 +02:00
Rasmus Wriedt Larsen
0b36cd44b8
Merge pull request #3522 from porcupineyhairs/pythonXpath
...
Python : Add Xpath injection query
2020-06-25 11:21:45 +02:00
Calum Grant
6e3609696a
C#: Address review comments.
2020-06-25 09:59:59 +01:00
Taus Brock-Nannestad
9f06e13313
Python: Fix incomplete renaming in Thrift.qll.
2020-06-25 10:48:26 +02:00
Rasmus Lerchedahl Petersen
415e0c4aac
Python: add suggestion for test cases
2020-06-25 10:46:33 +02:00
Erik Krogh Kristensen
2d7feb794f
Refactor Promises.qll to use PreCallGraphStep
2020-06-25 10:41:08 +02:00
Rasmus Lerchedahl Petersen
5973fe8411
Python: scaffold for testing data flow coverage
2020-06-25 10:32:10 +02:00
Tom Hvitved
b8ae4b7f64
C#: Move async data-flow tests from local to global
2020-06-25 10:04:18 +02:00
Tom Hvitved
3f91aa3b55
C#: More data-flow collection tests
2020-06-25 09:48:52 +02:00
Dave Bartolomeo
06a5242d76
Merge pull request #3793 from rdmarsh2/rdmarsh/cpp/ir-range-analysis-experimental
...
C++: move IR range analysis to experimental
2020-06-24 20:51:07 -04:00
Dave Bartolomeo
2685aa4b8b
C++: Use fewer words
2020-06-24 20:42:02 -04:00
Dave Bartolomeo
8b02f121d6
C++: QLDoc for all of Instruction.qll
...
I think I've now documented every class and public predicate in `Instruction.qll` I've tried to include detailed semantics of each instruction where appropriate.
2020-06-24 20:29:31 -04:00
Robert Marsh
362fbd12dc
C++: QLDoc for PrintAST.qll
2020-06-24 16:45:20 -07:00
Robert Marsh
39aaccc1ac
C++: Add QLDoc for AST range analysis libraries
2020-06-24 16:29:20 -07:00
Robert Marsh
3e6a19843d
Merge pull request #3727 from jbj/tainted-format-string-high
...
C++: Raise cpp/tainted-format-string* precisions to high
2020-06-24 15:06:13 -07:00
Calum Grant
d32199cccc
C#: QLdoc for CIL instructions.
2020-06-24 22:01:33 +01:00
Calum Grant
262a20cea0
C#: Add qldocs for Concurrency.qll, Documentation.qll, cil.qll and dotnet.qll.
2020-06-24 22:01:33 +01:00
Taus Brock-Nannestad
02363d76c1
Python: Document Comment.qll.
...
I didn't do the `toString` methods in this commit. I'm thinking
they're better to do in a separate commit. (There are 48 undocumented
instances!)
2020-06-24 22:43:59 +02:00
Taus Brock-Nannestad
fe78e68fd0
Python: Document a bunch of hasLocationInfo methods.
...
If only we had been _somewhat consistent in how we named the
parameters for these...
2020-06-24 22:38:03 +02:00
Rasmus Wriedt Larsen
155bbbdec9
Python: Add annotated call-graph tests
...
See the added README for in-depth details
2020-06-24 22:15:39 +02:00
Taus Brock-Nannestad
682e1b6040
Python: Document Comparisons.qll.
2020-06-24 22:13:46 +02:00
Asger F
090a685d86
Merge pull request #3751 from toufik-airane/master
...
[javascript] CWE-347: JWT Missing Secret Or Public Key Verification
2020-06-24 21:09:41 +01:00
Taus Brock-Nannestad
b8e744eade
Python: Document Class.qll.
2020-06-24 22:07:47 +02:00
Taus Brock-Nannestad
25122c9fb5
Python: Document (parts of) ExternalArtifact.qll.
...
I don't think there's any need to document the parts specific to
metrics or defects, as I don't believe these are used anywhere.
2020-06-24 21:53:37 +02:00
Robert Marsh
fb6e578618
C++: move IR range analysis to experimental
2020-06-24 12:50:14 -07:00
Mathias Vorreiter Pedersen
8c6753a3cc
C++: Accept consistency tests.
2020-06-24 21:13:38 +02:00
dilanbhalla
0552f9b0cc
memory unsafe scan functions
2020-06-24 11:47:34 -07:00
Geoffrey White
7af79abdbc
C++: Use the ArrayFunction model in Dereferenced.qll.
2020-06-24 19:06:05 +01:00
Geoffrey White
d258aaff26
C++: Extend the memcpy model to include 'bcopy'.
2020-06-24 19:05:38 +01:00
Geoffrey White
d259e8e8df
C++: Correct StrCpy.hasTaintFlow.
2020-06-24 18:34:02 +01:00
Geoffrey White
c3d275d0e7
C++: Clean up SprintfBW and comment Sprintf.
2020-06-24 18:34:02 +01:00
Geoffrey White
c681e6999d
C++: Refine the strcat and strcpy models, have BufferWrite depend on them so that information isn't duplicated.
2020-06-24 18:34:02 +01:00
ubuntu
d9a0dc0982
Remove check for console().getAMethodCall
2020-06-24 19:31:23 +02:00
Robert Marsh
38067b5b34
Merge pull request #3777 from rdmarsh2/rdmarsh/csharp/autobuilder-lang-name
...
C#/C++: Use CODEQL_EXTRACTOR_<LANG>_* in autobuilder
2020-06-24 10:18:26 -07:00
ubuntu
65eba0272d
Merge remote-tracking branch 'upstream/master' into loginjection
2020-06-24 19:15:27 +02:00
Mathias Vorreiter Pedersen
5190c26635
C++: Accept tests.
2020-06-24 18:28:41 +02:00
Mathias Vorreiter Pedersen
7530dc2132
C++: Hide operand nodes from path explanations to make the review diff smaller.
2020-06-24 18:28:23 +02:00
Mathias Vorreiter Pedersen
5aa1b13136
C++: Make the pre update node for ExplicitFieldStoreQualifierNode an operand node. This fixes the IR dataflow consistency errors.
2020-06-24 18:27:53 +02:00
Mathias Vorreiter Pedersen
470ee0059d
C++: Alternate dataflow between operands and instructions
2020-06-24 18:27:12 +02:00
Mathias Vorreiter Pedersen
d7a9d3d8bc
C++: Introduce operand dataflow node
2020-06-24 18:26:17 +02:00
luchua-bc
0779aab28f
Clean up the QL code
2020-06-24 15:02:16 +00:00
Anders Schack-Mulligen
791f31fa65
Merge pull request #3595 from luchua-bc/j2ee-server-directory-listing
...
Java: Add check for J2EE server directory listing
2020-06-24 16:45:34 +02:00
semmle-qlci
daeb13d9fd
Merge pull request #3779 from asger-semmle/js/metric-queries
...
Approved by esbena
2020-06-24 15:37:03 +01:00
Asger Feldthaus
42f32bf76c
JS: Recognize calls to .item and .namedItem
2020-06-24 15:11:18 +01:00
Geoffrey White
ff0a9bfc48
C++: QLDoc Stmt.qll, Block.qll.
2020-06-24 13:57:29 +01:00
Geoffrey White
ed32250636
C++: Deprecate Member.qll.
2020-06-24 13:57:28 +01:00
