Rasmus Wriedt Larsen
f35ffa5632
Python: Add support for x in ["safe", "also_safe"] (and not in)
2020-11-23 10:42:24 +01:00
Rasmus Wriedt Larsen
431aab45f7
Python: Add support for x != "safe" BarrierGuard
2020-11-23 10:36:55 +01:00
Rasmus Wriedt Larsen
18041fd059
Python: Expand string-const-compare tests
...
Also moved file to reflect that. Added tests of
+ `!=`
+ `in`
+ `not in`
2020-11-23 10:36:49 +01:00
Erik Krogh Kristensen
234730419b
restrict computation of ConcatenationRoot::getConstantStringParts to results that are less than 1 million chars long
2020-11-23 10:29:47 +01:00
Tamás Vajk
7d38b2dd17
Merge pull request #4623 from tamasvajk/feature/csharp9-type-param-nullability
...
C#: Add type parameter ref/value type tests
2020-11-23 09:58:56 +01:00
Rasmus Lerchedahl Petersen
777100f25c
Python: rename file, package, and class
2020-11-23 09:17:40 +01:00
Tom Hvitved
c571e42cd5
C#: Move internal CFG logic into separate file
2020-11-21 19:49:17 +01:00
Mathias Vorreiter Pedersen
a7644db762
C++: Use the new names in IR dataflow. Turns out DataFlowCall had its own implementation of getArgument already (which didn't handle qualifiers). The predicate wasn't used anywhere, so I simply removed it, as a better predicate is now available on the base class of DataFlowCall.
2020-11-21 01:00:59 +01:00
Mathias Vorreiter Pedersen
61bbceb201
C++/C#: Sync identical files
2020-11-21 00:55:07 +01:00
Mathias Vorreiter Pedersen
f173dc71c0
C++: Use shorter names for new IR predicates. This should hopefully guide users to use these predicates by default.
2020-11-21 00:54:50 +01:00
Geoffrey White
cc8d4b4c75
Merge branch 'main' into modelchanges2
2020-11-20 20:33:52 +00:00
Geoffrey White
fddd353155
C++: Updated autoformat.
2020-11-20 20:15:45 +00:00
Henning Makholm
a2a4938f60
Remove unit tests for duplicate-code detection, take II
...
In #4689 I forgot to remove the `.expected` files too, but they are
now of course useless.
2020-11-20 21:07:42 +01:00
Asger F
adc7bbfa4d
Merge pull request #4694 from asgerf/js/flow-to-external-api
...
JS: Add UntrustedDataToExternalAPI query
2020-11-20 15:56:04 +00:00
Asger Feldthaus
f894cf2074
JS: Add support for react-hot-loader
2020-11-20 15:28:32 +00:00
Mathias Vorreiter Pedersen
6ead6c6d38
Merge branch 'main' into qualifier-as-parameter-for-callee
2020-11-20 16:17:10 +01:00
Tamas Vajk
0fa3cf7912
Simplify test predicates
2020-11-20 16:05:12 +01:00
Asger Feldthaus
16429c8ca4
JS: followed -> followed by
2020-11-20 14:44:25 +00:00
james
dcf52f3ee3
improve lists in metadata section
2020-11-20 13:59:12 +00:00
Mathias Vorreiter Pedersen
fd4f8c557c
Merge branch 'main' into unsafe-use-of-this-query
2020-11-20 14:54:51 +01:00
Jonas Jensen
14aa6427ca
Merge pull request #4696 from MathiasVP/get-result-memory-location-join-order-fix
...
C++: Fix bad join order in AliasedSSA::getResultMemoryLocation
2020-11-20 14:50:35 +01:00
Tamas Vajk
3e836ef671
C#: Add type parameter ref/value type tests
2020-11-20 13:08:38 +01:00
Tamás Vajk
77afd5a617
Merge pull request #4633 from tamasvajk/feature/csharp9-native-int
...
C#: Add test cases for native integers
2020-11-20 12:58:11 +01:00
james
f5ae00865f
rebase on rc/1.26 branch
2020-11-20 11:51:35 +00:00
Mathias Vorreiter Pedersen
c7efc91676
C++: Use the new predicates in IR dataflow.
2020-11-20 12:24:39 +01:00
Mathias Vorreiter Pedersen
f3b5d7b830
C++/C#: Sync identical files
2020-11-20 12:23:34 +01:00
Mathias Vorreiter Pedersen
416431a7c1
C++: Add convenience predicates for working with qualifiers as parameters.
2020-11-20 12:22:37 +01:00
Rasmus Wriedt Larsen
08bcba98e6
Python: Add BarrierGuard test with exception inside unsafe branch
2020-11-20 11:55:07 +01:00
Rasmus Wriedt Larsen
34f78d4211
Python: Add BarrierGuard test with return inside unsafe branch
2020-11-20 11:52:36 +01:00
Jonas Jensen
3342fac83e
Merge pull request #4688 from criemen/printast-performance
...
C++: Speed up PrintAST.
2020-11-20 11:45:42 +01:00
Asger Feldthaus
7536c49c6f
JS: Use getAParameter and not getReceiver instead of getASuccessor
2020-11-20 10:34:30 +00:00
Tamas Vajk
52680cd1dc
C#: Add test cases for native integers
2020-11-20 11:31:20 +01:00
Asger F
405f07720a
Apply suggestions from code review
...
Co-authored-by: Max Schaefer <54907921+max-schaefer@users.noreply.github.com >
2020-11-20 10:21:19 +00:00
Asger Feldthaus
b34df9ff33
JS: Autoformat
2020-11-20 10:15:35 +00:00
Cornelius Riemenschneider
1afd32c033
C++: Add comment, rename class.
2020-11-20 10:49:12 +01:00
yoff
b478a51d4e
Apply suggestions from code review
...
Thanks for doing the work for me :-)
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2020-11-20 10:46:04 +01:00
Rasmus Wriedt Larsen
6c8937c5a9
Python: Add StringConstCompare to new data-flow queries
...
In the future, I could imagine we would have something like this, but for now,
I'm just keeping it simple.
```codeql
/**
* A collection of common guards that ensure the checked value cannot have arbitrary
* values.
*
* Currently only supports comparison with constant string value, but could also
* include checking whether all characters are alphanumeric, or whether a regex is
* matched against the value.
*
* Such guards will be useful for many taint-tracking queries, but not necessarily
* all, which is why you need to opt into these manually.
*/
class CommonNonArbitraryGuard extends BarrierGuard {
CommonNonArbitraryGuard() {
this instanceof StringConstCompare
}
override predicate checks(ControlFlowNode node, boolean branch) {
this.(StringConstCompare).checks(node, branch)
}
}
```
2020-11-20 10:44:50 +01:00
Rasmus Wriedt Larsen
12b36b2245
Python: Highlight that safe or also_safe doesn't clear taint :(
2020-11-20 10:43:46 +01:00
Rasmus Wriedt Larsen
1a52f17da3
Python: Add StringConstCompare BarrierGuard
2020-11-20 10:40:04 +01:00
Rasmus Wriedt Larsen
a82936c904
Python: Enable test for sanitizer-guard and logic expressions
...
`not` is not working properly, but otherwise pretty good
2020-11-20 10:06:25 +01:00
Cornelius Riemenschneider
eeece5937d
C++: One more speedup, address review.
2020-11-20 09:56:08 +01:00
Tamás Vajk
056b0c2627
Merge pull request #4626 from tamasvajk/feature/stats
...
C#: Add stats file from the jenkins job
2020-11-20 09:16:56 +01:00
Mathias Vorreiter Pedersen
490bba5c9f
C++: Fix bad join order in AliasedSSA::getResultMemoryLocation.
2020-11-19 17:40:41 +01:00
Rasmus Wriedt Larsen
b3d3d6e142
Python: Move logical test of sanitizers
...
Don't know why it would ever have been under default sanitizers :D
2020-11-19 16:46:07 +01:00
Rasmus Lerchedahl Petersen
7cbbf3bbf7
Python: slightly nicer test
2020-11-19 16:20:57 +01:00
Rasmus Wriedt Larsen
4c7c940273
Python: Add example of Code Injection FP
2020-11-19 15:05:51 +01:00
Rasmus Wriedt Larsen
7e407d43d2
Python: Change (single) test to match codeql database create
2020-11-19 14:56:18 +01:00
Rasmus Wriedt Larsen
8ffcff0824
Python: Add example of top-level module shadowing stdlib
...
Although this test is added under the `wrong` folder, the current results from
this CodeQL test is actually correct (compared with the Python
interpreter). However, they don't match what the extractor does when invoked
with `codeql database create`.
Since I deemed it "more than an easy fix" to change the extractor behavior for
`codeql database create` to match the real python behavior, and it turned out to
be quite a challenge to change the extractor behavior for all tests, I'm just
going to make THIS ONE test-case behave like the extractor will with `codeql
database create`...
This is a first commit, to show how the extractor works with qltest by default.
Inspired by the debugging in https://github.com/github/codeql/issues/4640
2020-11-19 14:56:17 +01:00
Asger Feldthaus
f737f34dcd
JS: Add UntrustedDataToExternalApi query
2020-11-19 13:42:25 +00:00
luchua-bc
a311462791
Move to query-test folder and update qldoc
2020-11-19 13:12:42 +00:00
