33872 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
luchua-bc	e4699f7fa9	Optimize the query	2021-05-18 16:12:22 +00:00
luchua-bc	d664aa6d6a	Include more scenarios and update qldoc	2021-05-18 16:12:22 +00:00
luchua-bc	852bcfb5c7	Refactor the ScriptEngine query and the Rhino code injection query into one	2021-05-18 16:12:22 +00:00
luchua-bc	b0b5338359	Rhino code injection	2021-05-18 16:12:22 +00:00
Mathias Vorreiter Pedersen	26c4a66dc4	C++: Add range analysis to fix FPs.	2021-05-18 17:54:30 +02:00
Mathias Vorreiter Pedersen	df9981de4f	C++: Add testcases with false positives.	2021-05-18 17:53:20 +02:00
Ethan Palm	9deaace756	Merge pull request #5898 from ethanpalm/go-build-commands ... Docs: Document Go tracer support	2021-05-18 11:49:31 -04:00
Ethan Palm	610e041e28	Add reviewer feedback ... Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com>	2021-05-18 11:42:08 -04:00
Chris Smowton	4230869ee2	Merge pull request #5819 from luchua-bc/java/jpython-injection ... Java: CWE-094 Jython code injection	2021-05-18 16:38:40 +01:00
Chris Smowton	71f540a755	Merge pull request #5844 from haby0/SpringRedirects ... [Java] CWE-601 Spring url redirection detect	2021-05-18 16:37:40 +01:00
Geoffrey White	cdf261b54b	C++: In fact it's just not good enough to get additional evidence from the declaring type.	2021-05-18 14:31:19 +01:00
Geoffrey White	88dc0861ac	C++: Fix copy-paste error.	2021-05-18 14:27:31 +01:00
Geoffrey White	c7382ee06d	C++: Repair for function call macros.	2021-05-18 14:27:08 +01:00
Geoffrey White	012840e602	C++: Add more test cases.	2021-05-18 14:26:12 +01:00
Geoffrey White	3d8513c1e0	C++: Add 'MAC' as additional evidence.	2021-05-18 13:24:51 +01:00
Geoffrey White	da83e9142b	C++: Replace getAnExpandedElement with getAGeneratedElement as it's all we really need.	2021-05-18 13:23:49 +01:00
luchua-bc	2a0721b2ae	Optimize the sink and update method name	2021-05-18 12:18:14 +00:00
CodeQL CI	1d120824ac	Merge pull request #5920 from erik-krogh/clone ... Approved by esbena	2021-05-18 05:13:57 -07:00
Rasmus Wriedt Larsen	97fadd9970	Merge branch 'main' into port-weak-crypto-algorithm	2021-05-18 14:04:18 +02:00
Rasmus Wriedt Larsen	6c755024ac	Python: Refactor code, inline some type-tracking	2021-05-18 14:03:36 +02:00
Rasmus Wriedt Larsen	770429fd68	Python: Autoformat	2021-05-18 14:02:46 +02:00
haby0	e46de44473	Solve errors caused by private ownership	2021-05-18 19:56:32 +08:00
Erik Krogh Kristensen	06514a2bb6	move clone model to Extend.qll	2021-05-18 13:16:41 +02:00
haby0	caf5f4d605	modified comment	2021-05-18 19:10:03 +08:00
Erik Krogh Kristensen	1435ac715a	add support for the clone library	2021-05-18 12:46:34 +02:00
Nick Rolfe	b9b6ffe53e	Merge pull request #178 from github/cfg_cleanup ... Clean up CFG implementation	2021-05-18 10:53:44 +01:00
Rasmus Wriedt Larsen	9156316b14	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2021-05-18 11:53:11 +02:00
Rasmus Wriedt Larsen	0ade23ab2a	Python: Apply suggestions from code review ... Co-authored-by: yoff <lerchedahl@gmail.com>	2021-05-18 11:49:59 +02:00
Erik Krogh Kristensen	cac0ab299b	add writes to textContent on a <script /> as a sink for code-injection	2021-05-18 10:25:25 +02:00
Tony Torralba	34a55e77ef	Add missing subtype test	2021-05-18 09:38:35 +02:00
Anders Schack-Mulligen	9b0e3b1950	Merge pull request #5814 from JLLeitschuh/feat/JLL/jackson_as_taint_step ... [Java] Add taint tracking through Jackson deserialization	2021-05-18 09:31:16 +02:00
haby0	a0cd551bae	Add filtering of String.format	2021-05-18 11:05:10 +08:00
luchua-bc	e652d8771c	Update method name and qldoc	2021-05-17 20:36:15 +00:00
Chris Smowton	ef410b9984	Update java/change-notes/2021-05-14-close-resource-leaks-improvements.md	2021-05-17 19:27:10 +01:00
Henry Mercer	0ad69d11a8	Code Scanning selectors: Include diagnostic queries	2021-05-17 18:39:33 +01:00
Tony Torralba	347bd2ebc2	Added change note	2021-05-17 17:51:07 +02:00
Nick Rolfe	778de741d0	Merge remote-tracking branch 'origin/main' into cfg_cleanup	2021-05-17 16:26:28 +01:00
Geoffrey White	3b29920255	C++: Replace getAChild with getAnArgument().	2021-05-17 16:10:39 +01:00
Tony Torralba	1815656a02	Use set literals for OGNL packages	2021-05-17 16:56:37 +02:00
Tony Torralba	8d682000b4	Fix QLDocs	2021-05-17 16:53:30 +02:00
Geoffrey White	09d00b133e	C++: Acknowledge another not detected result in tests.	2021-05-17 15:53:03 +01:00
Tony Torralba	ed13c17ea8	Fix qhelp file	2021-05-17 16:52:08 +02:00
Geoffrey White	930b9fe3e5	C++: Add triple-DES to the bad algorithms list.	2021-05-17 15:51:17 +01:00
Geoffrey White	57354def9e	C++: Real world diffs suggest that 'Cipher' should be an encryption word as well.	2021-05-17 15:36:27 +01:00
Geoffrey White	9e75f53798	C++: Prefer matches to regexpMatch.	2021-05-17 15:35:19 +01:00
Nick Rolfe	f3d831c25e	Remove unnecessary superclass prefix	2021-05-17 15:26:53 +01:00
Nick Rolfe	9a2523e2f9	Make EndBlockTree extend StmtSequenceTree	2021-05-17 15:24:20 +01:00
Tom Hvitved	ae6326b1f3	Merge pull request #5882 from hvitved/csharp/autobuilder/shared-compilation	2021-05-17 16:05:08 +02:00
Tony Torralba	bc2370ae1d	Use InlineExpectationsTest for tests	2021-05-17 15:58:33 +02:00
Nick Rolfe	6d395230d4	Make BraceBlockTree extend StmtSequenceTree	2021-05-17 14:54:11 +01:00