Commit Graph

33872 Commits

Author SHA1 Message Date
Mark Shannon
816938369e Python: Add tests for clear-text storage and logging. 2019-08-22 15:27:48 +01:00
Mark Shannon
15bb8b5f70 Python add new queries for clear-text logging and storage. 2019-08-22 15:27:48 +01:00
Mark Shannon
79ebd5652a Python: Add library support for cookies. Update and extend sensitive data library. 2019-08-22 15:27:48 +01:00
Taus Brock-Nannestad
b9ef8a0526 Python: Extend hasAttribute to unknown-but-defined module variables. 2019-08-22 16:22:53 +02:00
james
110b02a556 docs: improve scaling behaviour, fix fonts and headings
docs: better responsive behaviour

docs: improve c/c++ slides

docs: titles and fonts

docs: tidy up layout and css

docs: update layout to scale font-size by slide height

docs: tidy up templates and fix font headings
2019-08-22 14:59:08 +01:00
james
a35241e4cd docs: 2nd round of suggestions 2019-08-22 14:58:29 +01:00
james
feb4d26de8 docs: address first round of review comments on other slides and add intro to ql decks 2019-08-22 14:58:29 +01:00
james
4c714981f0 docs: address comments on bad overflow guard slides 2019-08-22 14:58:28 +01:00
james
a9a0b9a5d0 docs: fix some errors picked up by vale linter 2019-08-22 14:58:28 +01:00
james
c97f5829a2 docs: rationalize images and slide backgrounds 2019-08-22 14:58:28 +01:00
james
b0ff09b04d docs: further css tweaks 2019-08-22 14:58:27 +01:00
james
1d31a78d27 docs: rename QL training sphinx project 2019-08-22 14:58:27 +01:00
james
819f308010 docs: add several cpp training slides 2019-08-22 14:58:27 +01:00
Matthew Gretton-Dann
855ce8dd9d C++: Add support for UsingEntry.getEnclosingElement 2019-08-22 14:23:38 +01:00
Taus Brock-Nannestad
f9c002e441 Python: Support short mode flags (e.g. re.M) in regexes. 2019-08-22 14:53:58 +02:00
Tom Hvitved
0801e51175 Merge pull request #1790 from jbj/tainttracking-cross-language
C++/C#/Java: Shared TaintTrackingImpl.qll
2019-08-22 14:17:23 +02:00
Jonas Jensen
d38dbf0f63 C++: Workaround for lambda expression locations
See CPP-427.
2019-08-22 11:52:56 +02:00
Anders Schack-Mulligen
3aedadcb35 Java: Add localExprFlow and localExprTaint. 2019-08-22 11:25:23 +02:00
Taus
ae2a68b988 Merge pull request #1791 from markshannon/python-revert-tests
Python: Revert and update tests removed in #1767
2019-08-22 11:20:24 +02:00
Jonas Jensen
ad9ee54b65 C++/C#/Java: defaultAdditionalTaintStep 2019-08-22 11:14:06 +02:00
Tom Hvitved
ef6cf57597 C#: Add change note 2019-08-22 10:51:31 +02:00
Tom Hvitved
d2f8b0bc20 C#: Handle constructors with member initializers and base() calls in CFG 2019-08-22 10:34:23 +02:00
Tom Hvitved
e6ba282e05 C#: Revert a few changes 2019-08-22 09:26:13 +02:00
Ziemowit Laski
f3fc1be6fc [CPP-387] Address review comments; some line reordering. 2019-08-21 17:14:14 -07:00
Robert Marsh
1b6339528c Merge pull request #1783 from jbj/taint-fields-structs
C++: Don't propagate taint between field and struct [CPP-410]
2019-08-21 11:20:26 -07:00
yh-semmle
9012c3240f Merge pull request #1789 from aschackmull/java/autoformat
Java: Autoformat.
2019-08-21 12:36:55 -04:00
Taus
c595d0f27b Merge pull request #1784 from markshannon/python-move-essa-together
Python: Move all ESSA related code into one folder.
2019-08-21 17:51:45 +02:00
Tom Hvitved
5d140930d0 C#: Add field initializers to CFG for constructors
This commit adds field initializers to the CFG for non-static constructors. For
example, in

```
class C
{
    int Field1 = 0;
    int Field2 = Field1 + 1;
    int Field3;

    public C()
    {
        Field3 = 2;
    }

    public C(int i)
    {
        Field3 = 3;
    }
}
```

the initializer expressions `Field1 = 0` and `Field2 = Field1 + 1` are added
to the two constructors, mimicking

```
public C()
{
    Field1 = 0;
    Field2 = Field1 + 1;
    Field3 = 2;
}
```

and

```
public C()
{
    Field1 = 0;
    Field2 = Field1 + 1;
    Field3 = 3;
}
```

respectively. This means that we no longer have to synthesize calls, callables,
parameters, and arguments in the data flow library, so much of the work from
d1755500e4 can be simplified.
2019-08-21 16:21:38 +02:00
Tom Hvitved
a2ffddec5f Merge pull request #1785 from jbj/dataflow-recursion-prevention-shared
C++/C#/Java: Pyrameterize ConfigurationRecursionPrevention
2019-08-21 15:56:50 +02:00
Mark Shannon
e77ae09a86 Python tests: Update test results to account for better handling of branches in finally blocks. 2019-08-21 14:47:57 +01:00
Mark Shannon
714fecbf5e Python: Revert tests removed in #1767. 2019-08-21 14:39:53 +01:00
semmle-qlci
ddc716d2d3 Merge pull request #1768 from asger-semmle/ts-debugging
Approved by esben-semmle, xiemaisi
2019-08-21 14:21:45 +01:00
Felicity Chapman
4e355ce497 Merge pull request #1786 from jf205/gtm-sphinx
Sphinx docs: update references on `layout.html`
2019-08-21 14:17:21 +01:00
Jonas Jensen
25701f203d C++/C#/Java: Shared TaintTrackingImpl.qll
This file is now identical in all languages. Unifying this file led to
the following changes:
- The documentation spelling fixes and example from the C++ version
  were copied to the other versions and updated.
- The steps through `NonLocalJumpNode` from C# were abstracted into a
  `globalAdditionalTaintStep` predicate that's empty for C++ and Java.
- The `defaultTaintBarrier` predicate from Java is now present but empty
  on C++ and C#.
- The C++ `isAdditionalFlowStep` predicate on
  `TaintTracking::Configuration` no longer includes `localFlowStep`.
  That should avoid some unnecessary tuple copying.
2019-08-21 14:55:54 +02:00
jf205
79477a45cf Merge pull request #1748 from asger-semmle/type-tracking-tutorial
JS: Type tracking tutorial
2019-08-21 13:47:53 +01:00
james
419d07e1e5 docs: remove HS, GA, add GTM ref 2019-08-21 13:45:54 +01:00
Asger F
fd7cfedf4b JS: Add AdditionalTypeTrackingStep 2019-08-21 13:44:03 +01:00
Anders Schack-Mulligen
629c19e719 Java: Autoformat. 2019-08-21 14:38:17 +02:00
Pavel Avgustinov
cb3551b4d6 Merge commit '76982404' into attribute 2019-08-21 12:44:07 +01:00
Jonas Jensen
863bf523d6 C++/C#/Java: Autoformat 2019-08-21 13:24:01 +02:00
Asger F
d5f43fb7cb Update docs/language/learn-ql/javascript/type-tracking.rst
Co-Authored-By: jf205 <42464962+jf205@users.noreply.github.com>
2019-08-21 12:23:09 +01:00
Anders Schack-Mulligen
b4856e928b Merge pull request #1780 from jbj/simpleLocalFlowStep
C++/C#/Java: Split localFlowStep predicate in two
2019-08-21 13:16:58 +02:00
Jonas Jensen
846e3734ce C++: Change note for recursion prevention 2019-08-21 13:12:48 +02:00
Jonas Jensen
fdd3b901f7 C/C#/Java: Share ConfigurationRecursionPrevention
This class was copy-pasted in all `DataFlowN.qll` files without using
the identical-files system to keep the copies in sync. The class is now
moved to the `DataFlowImplN.qll` files.

This also has the effect of preventing recursion through first data flow
library copy for C/C++. Such recursion has been deprecated for over a
year, and some forms of recursions are already ruled out by the library
implementation.
2019-08-21 13:04:10 +02:00
Mark Shannon
857cd9196b Merge pull request #1782 from taus-semmle/python-pruning-nomagic
Python: Prevent bad magic during pruning.
2019-08-21 11:55:59 +01:00
Asger F
0785c1b17b JS: Address comments 2019-08-21 11:48:05 +01:00
Asger F
17573afa0c JS: Hyphenate type-tracking when used as adjective 2019-08-21 11:47:58 +01:00
Jonas Jensen
2f4ed45dac C++: No taint between field and struct
To compensate for the lack of field flow, the taint tracking library has
previously considered taint to flow from fields to their containing
structs and back again from the structs to any of their fields. This
leads to false flow between unrelated fields and is not needed now that
we have proper flow through fields.
2019-08-21 11:57:12 +02:00
Jonas Jensen
6fc3a62edb C++/C#/Java: Change another caller of localFlow
There was also a use of `localFlowStep` in `DataFlowImplCommon` that
should now be `simpleLocalFlowStep`.
2019-08-21 10:20:15 +02:00
Jonas Jensen
ec2cc5a80e C#: Refactor how simpleLocalFlowStep is called
`localFlowStep` is no longer an alias because it should not have the
same QLDoc as `simpleLocalFlowStep`.
2019-08-21 10:05:54 +02:00