Jonathan Leitschuh
49985a77e3
Apply suggestions from code review
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2021-02-10 10:51:37 -05:00
Rasmus Wriedt Larsen
ca0d345987
Django: Model any class used in django route setup as view class
2021-02-10 16:26:25 +01:00
Rasmus Wriedt Larsen
b428945bc2
Django: Fix DjangoRouteHandler char-pred
...
Before it the class would contain _all_ functions xD
2021-02-10 16:21:51 +01:00
Rasmus Wriedt Larsen
78a3206fce
Python: Add test with unkown view class in django
2021-02-10 15:56:33 +01:00
Anders Schack-Mulligen
b74911204a
Merge pull request #4945 from intrigus-lgtm/java/insecure-jxbrowser
...
Java: Insecure JXBrowser
2021-02-10 15:48:17 +01:00
Rasmus Wriedt Larsen
42eceb80bd
Python: Handle view functions with decorators
2021-02-10 15:47:55 +01:00
Erik Krogh Kristensen
f76018c039
add taint step for the markdown-table library
2021-02-10 15:11:41 +01:00
Erik Krogh Kristensen
b4704f7016
add taint-step for the marked library
2021-02-10 14:51:08 +01:00
Erik Krogh Kristensen
91f7d33044
add change note
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
101d4358a9
detect DOM nodes from event callbacks
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
be9636491b
add source for react-hook-form in xss-through-dom
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
65d93c9061
detect for DOM elements from DOM events in React
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
458dda9d25
add xss-through-dom source from react-final-form
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
ff3950ce98
add model for formik
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
d1087d4e41
move sources from XssThroughDom into a customizations file
2021-02-10 14:17:49 +01:00
Erik Krogh Kristensen
4969a1ef4f
add change note
2021-02-10 14:16:31 +01:00
Erik Krogh Kristensen
0ca2310594
add model for htmlparser2
2021-02-10 14:16:31 +01:00
Erik Krogh Kristensen
e2a66bf3ed
add model for xml-js
2021-02-10 14:16:31 +01:00
Erik Krogh Kristensen
73f7cd149f
add model for sax
2021-02-10 14:16:31 +01:00
Erik Krogh Kristensen
c43025d7b3
add model for xml2js
2021-02-10 14:16:30 +01:00
Erik Krogh Kristensen
44ca2e26a6
add taint-step to XML parsers
2021-02-10 14:16:08 +01:00
intrigus
5c82ff83de
Java: Fix qhelp, fix CWE reference
2021-02-10 13:57:51 +01:00
Anders Schack-Mulligen
3a6fa9d99b
Java: Add support for framework modelling through csv data.
2021-02-10 13:25:03 +01:00
Alvaro Muñoz
645b021845
Add support for the Preconditions Class in the Guava framework
2021-02-10 13:20:29 +01:00
Alvaro Muñoz
0cf3a29429
Add support for Apache Commons Lang ArrayUtils
2021-02-10 13:09:57 +01:00
Shati Patel
18225fa254
Merge pull request #4997 from github/shati-patel/cwe-coverage-docs
...
Docs: Add outline for CWE coverage page
2021-02-10 11:45:09 +00:00
Alvaro Muñoz
3b4357792b
Remove sanitizing condition which does not prevent
...
vulnerability.
2021-02-10 12:21:48 +01:00
Anders Schack-Mulligen
66d0bf6b5e
Merge pull request #5128 from hvitved/dataflow/exploration-clears-content
...
Data flow: Take `clearsContent()` into account in flow exploration
2021-02-10 11:52:24 +01:00
yoff
9930d59aca
Merge pull request #5124 from RasmusWL/typetracking-with-decorator
...
Python: Add test for type-tracking through decorators
2021-02-10 09:34:54 +01:00
Tom Hvitved
1f9b42f9ab
Data flow: Sync files
2021-02-09 20:10:23 +01:00
Tom Hvitved
e5970f4c65
Data flow: Take clearsContent() into account in flow exploration
2021-02-09 20:09:24 +01:00
Geoffrey White
d475e55ec0
Update cpp/ql/test/README.md
...
Co-authored-by: hubwriter <hubwriter@github.com >
2021-02-09 15:20:03 +00:00
Geoffrey White
cc031118dd
Update CONTRIBUTING.md
...
Co-authored-by: hubwriter <hubwriter@github.com >
2021-02-09 15:19:30 +00:00
yo-h
e5331a4735
Java: accept changes in expected output
2021-02-09 09:17:35 -05:00
yo-h
e194411cfa
Java: fix javac errors in test code
2021-02-09 09:16:57 -05:00
luchua-bc
cb01613aa6
Exclude FP token patterns
2021-02-09 13:53:23 +00:00
Tamas Vajk
9854b95c30
Fix query performance
2021-02-09 14:45:22 +01:00
Alexander Eyers-Taylor
1c43505d30
Merge pull request #5121 from alexet/fix-js-jdoc
...
Javascript Extractor: Update <tt> tages to <code>
2021-02-09 13:07:19 +00:00
CodeQL CI
475d216f8e
Merge pull request #5087 from erik-krogh/immutable
...
Approved by asgerf
2021-02-09 12:43:19 +00:00
Rasmus Wriedt Larsen
1d25184b32
Python: Add test for type-tracking through decorators
...
In general, if there is _some_ decorator on a function, it might not be safe to
track content out of it (since the decorator could do anything), but in this
case, we can see what the decorator does, so we should be able to handle it (but
we don't right now).
By my understanding of how type-tracking works, if we track content through
`my_decorator`, then we would also track content to the result of
`unrelated_func()`, which I wanted to make sure our tests would catch.
I found out the core of the problem seems to come from our lack of being able to
track to the inner scope, and added an explicit test for that.
2021-02-09 13:43:10 +01:00
Rasmus Wriedt Larsen
eb7e30d472
Python: Add test of django view handler with decorator
...
Which we currently don't handle :(
Also added a bit more explanatory comments
2021-02-09 13:25:12 +01:00
Geoffrey White
d1910a3f5c
Update CONTRIBUTING.md
...
Co-authored-by: Jonas Jensen <jbj@github.com >
2021-02-09 12:12:24 +00:00
alexet
8dd5a7e7c7
Javascript Extractor: Update <tt> tages to <code>
2021-02-09 12:10:09 +00:00
Remco Vermeulen
3818971b79
Add redirect sinks
...
Both the familiy of `Accepted` and `Created` method set the location
header based on provided input. If this is untrusted input this can
result in an URL redirect attack.
2021-02-09 13:09:02 +01:00
Alexander Eyers-Taylor
bed10ad562
Merge pull request #5113 from github/alexet/fix-var-decls-spec
...
Update the language specification to allow empty var_decls
2021-02-09 11:08:23 +00:00
CaptainFreak
503b339a1f
remove hbs specific checks
2021-02-09 07:35:35 +05:30
Raul Garcia (MSFT)
f114ef1f06
Adding unit tests
2021-02-08 16:57:49 -08:00
Geoffrey White
8bf9fc6111
Consistent capitalisation.
2021-02-08 20:29:46 +00:00
Geoffrey White
07b263bb2f
Typo.
2021-02-08 20:27:28 +00:00
Geoffrey White
bd255617d8
Three copies of a link is too much.
2021-02-08 20:25:35 +00:00
