edvraa
1682e993bc
Merge with Main
2021-07-12 11:32:47 +03:00
Tom Hvitved
db4c8dfd3c
Merge pull request #6208 from hvitved/csharp/query-modules
...
C#: Add `Query` suffix to libraries that should only be imported by queries
2021-07-12 10:26:45 +02:00
Anders Schack-Mulligen
0e913a19aa
Merge pull request #6220 from github/workflow/coverage/update
...
Update CSV framework coverage reports
2021-07-12 09:54:18 +02:00
github-actions[bot]
56419bc74b
Add changed framework coverage reports
2021-07-12 00:06:55 +00:00
edvraa
40e8a900de
Apply changes from code review
2021-07-12 02:08:23 +03:00
edvraa
6393dca22f
Apply changes from code review
2021-07-12 01:13:41 +03:00
edvraa
3de7b280e4
AuthCookie.qll moved to experimental
2021-07-12 01:13:40 +03:00
edvraa
02f0d81830
delete unused predicate
2021-07-12 01:13:40 +03:00
edvraa
3723f7f132
comments
2021-07-12 01:13:40 +03:00
edvraa
2c9d6827ad
comments
2021-07-12 01:13:40 +03:00
edvraa
74cb61a475
Autoformat
2021-07-12 01:13:40 +03:00
edvraa
65fb46af3d
fix help files
2021-07-12 01:13:40 +03:00
edvraa
d0e9a01edc
Rename files
2021-07-12 01:13:40 +03:00
edvraa
5c9a3d5ce7
Single Secure query
2021-07-12 01:13:39 +03:00
edvraa
07327984b0
Single HttpOnly query
2021-07-12 01:13:39 +03:00
edvraa
dea4d67ebd
Extract to predicate isCookieWithSensitiveName
2021-07-12 01:13:39 +03:00
edvraa
7e723e90f1
Remove redundant iResponse.getAppendMethod() = mc.getTarget(), it is already covered by higher level exists
2021-07-12 01:13:39 +03:00
edvraa
98261a63c5
typo accessibe -> accessible
2021-07-12 01:13:39 +03:00
edvraa
89c4102462
HttpOnly and Secure cookie queries
2021-07-12 01:13:39 +03:00
Erik Krogh Kristensen
440e4b9a92
enable unicode support in the Python ReDoS query
2021-07-11 21:28:40 +02:00
Artem Smotrakov
c98f1a479e
Better taint propagation in UnsafeTypeConfig
2021-07-09 10:24:15 +02:00
Artem Smotrakov
476843a278
Added comments for Jackson in UnsafeDeserialization.qll
2021-07-09 10:24:15 +02:00
Artem Smotrakov
e9731cd212
Minor improvements for Jackson in UnsafeDeserialization.qll
2021-07-09 10:24:15 +02:00
Artem Smotrakov
704cc77bb5
Added a change note for Jackson
2021-07-09 10:24:14 +02:00
Artem Smotrakov
24e4b68b9c
Removed getAnAccess() calls for Jackson
2021-07-09 10:24:14 +02:00
Artem Smotrakov
aefd21075b
Added tests for UnsafeDeserialization.ql and Jackson
2021-07-09 10:24:10 +02:00
Artem Smotrakov
ea0991c980
Added Jackson to UnsafeDeserialization.qhelp
2021-07-09 10:17:29 +02:00
Artem Smotrakov
97fca620fa
Cover attacker-controlled types for deserialization with Jackson
2021-07-09 10:16:04 +02:00
Artem Smotrakov
3eb2af1bc2
First draft of sinks for unsafe deserialization with Jackson
2021-07-09 10:16:01 +02:00
ihsinme
eedcb0171d
Add files via upload
2021-07-05 11:14:51 +03:00
ihsinme
b10bdf1475
Add files via upload
2021-07-05 11:13:05 +03:00
haby0
e8d0827916
Add tornado source
2021-07-05 10:42:15 +08:00
Tom Hvitved
4de4753c67
C#: Remove Query.qll top-level modules
2021-07-04 09:35:27 +02:00
Tom Hvitved
c812d4e4e8
C#: Add Query suffix to libraries that should only be imported by queries
2021-07-04 09:35:26 +02:00
Taus
a65d40e36f
Merge branch 'main' into python-add-typetrackingnode
2021-07-02 20:55:37 +02:00
Taus
55d822cc56
Python: Add TypeTrackingNode
...
Splits `ModuleVariableNode` away from `LocalSourceNode`, instead
creating a class `TypeTrackingNode` that encapsulates both of these.
This means we no longer have module variable nodes as part of
`LocalSourceNode` (which is good, since they have no "local" aspect to
them), and hence we can have `LocalSourceNode` inherit directly from
`ExprNode` (which makes the API a bit nicer).
Unfortunately these are breaking changes, so we can't actually fulfil
the above two desiderata until the `track` and `backtrack` methods on
`LocalSourceNode` have been fully deprecated. For this reason, we
preserve the present implementation of `LocalSourceNode`, and instead
lay the foundation for switching over in the future, by deprecating
`track` and `backtrack` on `LocalSourceNode`.
2021-07-02 18:00:33 +00:00
Geoffrey White
dc2cb9bd62
C++: Fix numbering.
2021-07-02 18:33:36 +01:00
Geoffrey White
bc3b347569
C++: Another test case to consider.
2021-07-02 18:32:46 +01:00
Geoffrey White
a53b161afb
C++: Move some variant tests to a case we definitely do want to flag the base case of.
2021-07-02 18:18:11 +01:00
Geoffrey White
c3cd1359d6
C++: Mark the cases we're not sure about.
2021-07-02 18:18:10 +01:00
Geoffrey White
cf8fa830a9
C++: Clarify the note about file descriptors.
2021-07-02 18:18:10 +01:00
Geoffrey White
d86a0ab7a5
C++: Add test cases involving file descriptor versions.
2021-07-02 18:17:59 +01:00
CodeQL CI
1d56748eed
Merge pull request #6200 from yoff/pythonJS-make-expbtlib-private
...
Approved by RasmusWL, esbena
2021-07-02 09:09:18 -07:00
Joe Farebrother
4d459f24d9
Fix up tests and update models
2021-07-02 14:46:33 +01:00
Joe Farebrother
fc017b7934
Use ArrayElement of in flow step specifications
2021-07-02 14:46:31 +01:00
Joe Farebrother
15415931ce
Use Argument ranges in CSV rows
2021-07-02 14:46:03 +01:00
Joe Farebrother
5325622813
Convert sql-related flow steps to CSV
2021-07-02 14:46:03 +01:00
Anders Schack-Mulligen
3c6604daa7
Java: Fix subtypes interpretation.
2021-07-02 14:43:56 +02:00
Anders Schack-Mulligen
6813a79423
Java: Add test for override of Map.put highlighting problem.
2021-07-02 14:41:59 +02:00
Anders Schack-Mulligen
55ebbc3e01
Java: Add signature to Map.put.
2021-07-02 14:41:32 +02:00
