Erik Krogh Kristensen
b2d6982318
add change note
2021-03-17 19:17:23 +01:00
Erik Krogh Kristensen
3995ff322d
add models for koa-route and koa-router
2021-03-17 19:17:20 +01:00
Jaroslav Lobačevski
7b6773c96a
Update javascript/ql/src/experimental/semmle/javascript/Actions.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-03-17 19:49:03 +02:00
CodeQL CI
1d9f8c2d37
Merge pull request #5427 from RasmusWL/use-new-builtin-modeling
...
Approved by yoff
2021-03-17 09:07:36 -07:00
Jaroslav Lobačevski
e3bf308952
Removed positive lookbehind
2021-03-17 17:32:10 +02:00
Mathias Vorreiter Pedersen
834e35f192
C++: Add change-note.
2021-03-17 16:26:15 +01:00
Asger Feldthaus
ae410aabd6
JS: Add change note
2021-03-17 15:24:10 +00:00
Asger Feldthaus
e4d891cab5
JS: Add tests for flow through replace
2021-03-17 15:20:40 +00:00
Asger Feldthaus
9cfbb90591
JS: Add test case for insufficient replace-sanitizer
2021-03-17 15:20:40 +00:00
Asger Feldthaus
198bdcab26
JS: Make XSS MetacharEscapeSanitizer more precise
2021-03-17 15:20:40 +00:00
Asger Feldthaus
effa52f9e1
JS: Step through string replace callbacks
2021-03-17 15:15:49 +00:00
CodeQL CI
7c20c4a664
Merge pull request #5396 from asgerf/js/shared-taint-step
...
Approved by erik-krogh, esbena
2021-03-17 08:07:20 -07:00
Mathias Vorreiter Pedersen
a3f806bb1d
Use GVN in AV rule 79.
2021-03-17 16:01:49 +01:00
Rasmus Wriedt Larsen
d426f1efaf
Docs: Highlight need for explicit import of DataFlow lib
...
at least in some langauges
2021-03-17 16:01:20 +01:00
yoff
514c9efcdd
Merge pull request #5426 from RasmusWL/insecure-default-protocl-tests-are-also-py3
...
Python: Also test py/insecure-default-protocol on Python 3
2021-03-17 15:59:00 +01:00
Rasmus Wriedt Larsen
4f63584179
Docs: Highlight that Configuration is not DataFlow::Configuration
...
I made that mistake when just reading it over (DOH). I think that calling it
MyConfiguration makes it a bit more clear that this is a configuration class you
wrote yourself :D
2021-03-17 15:55:58 +01:00
Rasmus Wriedt Larsen
27032af2eb
Python: Use API graphs for io.open
2021-03-17 15:50:02 +01:00
Rasmus Wriedt Larsen
d52d328587
Python: Use new API::builtin in stdlib modeling
2021-03-17 15:50:01 +01:00
Asger Feldthaus
bf5259096e
JS: Update cheat sheet
2021-03-17 14:34:30 +00:00
Rasmus Lerchedahl Petersen
b3ff3f7ee7
PythonÆ adjust test expectations
...
I suspect it has to do with ParameterNode being a LocalSourceNode,
but I really have no idea...
2021-03-17 15:11:17 +01:00
Rasmus Lerchedahl Petersen
8f467003d2
Python: More review suggestions
2021-03-17 15:11:17 +01:00
yoff
63b732ce1f
Apply suggestions from code review
...
Co-authored-by: Taus <tausbn@github.com >
2021-03-17 15:11:17 +01:00
Rasmus Lerchedahl Petersen
4d856d4461
Python: Add small api enhancements
...
determined useful during documentation work.
2021-03-17 15:11:17 +01:00
Rasmus Lerchedahl Petersen
f04ac87091
Python, doc: Include new section in toc
2021-03-17 15:04:07 +01:00
Rasmus Wriedt Larsen
315127d888
Python: Also test py/insecure-default-protocol on Python 3
2021-03-17 14:53:36 +01:00
Rasmus Lerchedahl Petersen
135a6713e8
Python, doc: References to section on API graphs.
2021-03-17 14:42:50 +01:00
CodeQL CI
d95b295e52
Merge pull request #5400 from erik-krogh/replaceCallbacks
...
Approved by asgerf
2021-03-17 06:42:34 -07:00
Rasmus Lerchedahl Petersen
7e9cf03f4d
Merge branch 'python-document-api-graphs' of https://github.com/tausbn/codeql into tausbn-python-document-api-graphs
2021-03-17 14:36:16 +01:00
Tom Hvitved
5b2d5ee010
Merge pull request #4940 from hvitved/csharp/base-ssa-phi-input
...
C#: Take phi nodes into account in `Steps::getARead()`
2021-03-17 14:33:59 +01:00
Asger Feldthaus
ccc879dc5c
JS: Autoformat
2021-03-17 13:29:17 +00:00
Asger Feldthaus
e1bfc6cd38
JS: Add qldoc to deprecated class member
2021-03-17 13:29:17 +00:00
Asger Feldthaus
ab1947a028
JS: Add comment explaining how to add new steps
2021-03-17 13:29:17 +00:00
Asger Feldthaus
c2764069b5
JS: Mention why we cache predicates outside the class
2021-03-17 13:29:17 +00:00
Asger Feldthaus
a97d3452a7
JS: Add DataFlow::SharedFlowStep to future-proof the tutorial
2021-03-17 13:29:17 +00:00
Asger Feldthaus
d74e84abd8
JS: Remove or update some mentions of AdditionalTaintStep
2021-03-17 13:29:17 +00:00
Asger Feldthaus
c0b5a9ad0c
JS: Deprecate AdditionalTaintStep
2021-03-17 13:29:17 +00:00
Asger Feldthaus
332ee40984
JS: Autoformat
2021-03-17 13:29:17 +00:00
Asger Feldthaus
0675066ab9
JS: Fixup UriLibraries test
2021-03-17 13:29:17 +00:00
Asger Feldthaus
443b59e676
JS: Fixup bad merge in HeapTaintStep
2021-03-17 13:29:17 +00:00
Asger Feldthaus
80bc5d921b
JS: Update Vue test
2021-03-17 13:29:16 +00:00
Asger Feldthaus
d52ff3e4f6
JS: Autoformat and add qldoc
2021-03-17 13:29:16 +00:00
Asger Feldthaus
96c6e4d8d8
JS: Update with new AdditionalTaintStep subclasses
2021-03-17 13:29:16 +00:00
Asger Feldthaus
561b9d09b3
JS: Put in same stage as RemoteFlowSource
2021-03-17 13:29:16 +00:00
Asger Feldthaus
e4a75b42e9
JS: Autoformat
2021-03-17 13:29:16 +00:00
Asger Feldthaus
8542c7172e
JS: Fix promiseStep documentation
2021-03-17 13:29:16 +00:00
Asger Feldthaus
f95c799d6e
JS: Cache taint steps in same stage
2021-03-17 13:29:16 +00:00
Asger Feldthaus
e847043307
JS: Move React steps into React library
2021-03-17 13:29:16 +00:00
Asger Feldthaus
6324c4f22a
JS: Add arrayStep but ignore overlap with heapStep for now
2021-03-17 13:29:15 +00:00
Asger Feldthaus
0bdf67f8aa
JS: Remove duplicate await step
2021-03-17 13:29:15 +00:00
Asger Feldthaus
4116c1ec66
JS: Add category for promise steps
2021-03-17 13:29:15 +00:00
