Rasmus Wriedt Larsen
67c5c590d2
Python: Expose getParameter on ParameterNode
2020-10-07 12:28:35 +02:00
Rasmus Wriedt Larsen
6d7f4a048b
Python: Attempt to model invoke.task decorator
2020-10-07 12:26:49 +02:00
Rasmus Wriedt Larsen
c9219b3744
Clean module imports
2020-10-07 12:21:30 +02:00
Rasmus Wriedt Larsen
ebff1794fc
Python: Model invoke.context.Context
2020-10-07 12:16:53 +02:00
Rasmus Wriedt Larsen
4ef5202382
Python: Add simple model for invoke.run and invoke.sudo
...
and I sorted the list in Frameworks.qll, that kinda makes sense :)
2020-10-07 12:13:59 +02:00
Rasmus Wriedt Larsen
300a8cdf7d
Python: Add tests for the 'invoke' package
2020-10-07 11:55:26 +02:00
Tamas Vajk
d2d8d009eb
Sync Bound between C# and Java
2020-10-07 11:43:30 +02:00
Tamas Vajk
40a7f5aa1f
Java: Minor fix to modulus analysis to handle constant expressions and not only compile time constants
2020-10-07 11:42:42 +02:00
Tamas Vajk
5688210249
Java: add test for modulus analysis
2020-10-07 11:41:55 +02:00
Rasmus Wriedt Larsen
7721db206e
Python: Don't double report paths for platform.popen and popen2.*
...
I was a bit surprised that we hadn't double reported for popen2, but it turns
out that the implementation (at least on unix) looks like:
```
def popen2(cmd, bufsize=-1, mode='t'):
... = Popen3(cmd, False, bufsize)
...
```
but since the modeling I did only considers calls to `Popen3` only if it has
been imported from the `popen2` module, we don't consider that call as a sink.
2020-10-07 10:57:31 +02:00
Tamas Vajk
94dc11c45a
Revert getNonIntegerValue unification
2020-10-07 10:56:01 +02:00
Rasmus Wriedt Larsen
36812af2c2
Python: Add test for Python2 specific command injection
2020-10-07 10:54:03 +02:00
Rasmus Wriedt Larsen
737b2b896f
Python: Fix QLDoc for popen2 module
2020-10-07 10:49:22 +02:00
Rasmus Wriedt Larsen
d8a9eacd02
Python: Remove TODO comment for popen2 module
2020-10-07 10:47:28 +02:00
Gulshan Singh
7233ffa50f
Address review comments
2020-10-07 00:21:06 -07:00
Dave Bartolomeo
22638fdfc7
Merge remote-tracking branch 'upstream/main' into work
2020-10-06 18:33:14 -04:00
Dave Bartolomeo
80b832eb49
Fix test expectations
2020-10-06 18:27:33 -04:00
Erik Krogh Kristensen
1ed026fcce
add a RemoteFlowSource for serverless handlers
2020-10-06 22:36:21 +02:00
Erik Krogh Kristensen
050ed97d9c
add node-serialize as a js/code-injection sink
2020-10-06 22:35:38 +02:00
Tom Hvitved
6ddda1fa1d
Merge pull request #4330 from tamasvajk/feature/upgrade-to-dotnet31
...
C#: Upgrade to .net core app 3.1
2020-10-06 20:59:00 +02:00
Rasmus Wriedt Larsen
6c4fd7c1ff
Python: Model Python 2 only platform.popen command execution
2020-10-06 20:25:03 +02:00
Rasmus Wriedt Larsen
12e4e07cae
Python: Model Python 2 only module popen2
2020-10-06 20:25:02 +02:00
Rasmus Wriedt Larsen
8c2f55fbd0
Python: Model Python 2 only os.popen2, popen3, popen4 functions
2020-10-06 20:25:01 +02:00
Rasmus Wriedt Larsen
6ec7ab2fd9
Python: Add test of Python 2 specific SystemCommandExecution
2020-10-06 20:25:00 +02:00
Taus Brock-Nannestad
b905a3d5e3
Python: Attribute access API
2020-10-06 16:36:29 +02:00
Max Schaefer
98ab38a630
JavaScript: Add yet another API-graph test with re-exports.
2020-10-06 15:32:21 +01:00
Tamas Vajk
4f56a97244
C#: Adjust expected files for .net 3.1 upgrade
2020-10-06 16:01:14 +02:00
Tamas Vajk
56604e005a
C#: Upgrade to .net core app 3.1
2020-10-06 16:01:14 +02:00
Jonas Jensen
984194d308
Merge pull request #4406 from geoffw0/set
...
C++: Models for std::set and std::unordered_set
2020-10-06 15:43:12 +02:00
Jonas Jensen
1d9acbfca9
C++: Demonstrate overflowing guard bounds
2020-10-06 15:31:34 +02:00
Max Schaefer
1d8051eee0
JavaScript: Further improve handling of re-exports in API graphs.
2020-10-06 14:22:55 +01:00
Max Schaefer
d054206004
JavaScript: Improve handling of re-exports in API graphs.
2020-10-06 14:22:51 +01:00
Max Schaefer
96bf82e1ca
JavaScript: Make new source-node classes in API graphs more general and more useful.
2020-10-06 14:21:36 +01:00
Max Schaefer
95b6b16b57
JavaScript: Add another API-graph test with re-exports.
2020-10-06 14:20:41 +01:00
CodeQL CI
4e116ba0db
Merge pull request #4419 from erik-krogh/jsxFactory
...
Approved by asgerf
2020-10-06 06:13:21 -07:00
CodeQL CI
0753c8a31b
Merge pull request #4247 from erik-krogh/CVE760-reexport
...
Approved by asgerf
2020-10-06 06:10:21 -07:00
CodeQL CI
ef703e72d8
Merge pull request #4401 from asgerf/js/angular-prerequisites
...
Approved by erik-krogh
2020-10-06 06:09:48 -07:00
Asger Feldthaus
396f353397
JS: Reapply fixed to javadoc
2020-10-06 14:06:10 +01:00
CodeQL CI
5bc7e19c44
Merge pull request #4414 from yoff/SharedDataflow_Conditionals
...
Approved by RasmusWL
2020-10-06 05:46:24 -07:00
Anders Schack-Mulligen
021435292b
Merge pull request #4341 from joefarebrother/location-tostring
...
Java: Include column numbers in Location.toString
2020-10-06 14:42:35 +02:00
Rasmus Lerchedahl Petersen
f9c5b864bb
Python: Fix test of parenthesized form
2020-10-06 13:12:12 +02:00
CodeQL CI
7e6fa7b4be
Merge pull request #4392 from erik-krogh/flask
...
Approved by asgerf
2020-10-06 03:41:36 -07:00
Arthur Baars
3c41548aa6
Merge pull request #4336 from aibaars/android-database
...
Java: add Android database taint and SQL injection sinks
2020-10-06 12:31:17 +02:00
Erik Krogh Kristensen
f7f82ffe4e
Merge branch 'main' into CVE760-reexport
2020-10-06 12:28:44 +02:00
CodeQL CI
bc1d3de8fe
Merge pull request #4376 from erik-krogh/simpParam
...
Approved by asgerf
2020-10-06 03:24:43 -07:00
Erik Krogh Kristensen
99213b94f5
detect uses of jsxFactory and jsxFragmentFactory in js/unused-local-variable
2020-10-06 12:23:15 +02:00
Joe
8e82687ab6
Java: Include column numbers in Location.toString
2020-10-06 11:16:06 +01:00
CodeQL CI
75d55c87b3
Merge pull request #4412 from RasmusWL/python-typetracking-across-modules
...
Approved by yoff
2020-10-06 03:15:12 -07:00
Asger Feldthaus
5374b66029
JS: Make CachedOperation private
2020-10-06 11:13:04 +01:00
Asger F
433e3e7e4e
JS: Expand doc string in installFromTarballurl
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2020-10-06 11:13:04 +01:00
