Rasmus Wriedt Larsen
515b824b3c
Python: Add lxml positive test
2022-03-03 09:42:19 +01:00
Jeroen Ketema
f80372b837
C++: Update the DB scheme stats file
2022-03-03 09:02:37 +01:00
Jeroen Ketema
3fc2f2f3dc
Merge pull request #8309 from jketema/taint-join-order
...
C++: Fix join order in the IR dataflow library
2022-03-03 09:00:42 +01:00
ihsinme
01f9114a80
Update test.cpp
2022-03-03 10:57:11 +03:00
ihsinme
bec4170bdf
Update ImproperCheckReturnValueScanf.expected
2022-03-03 10:39:19 +03:00
ihsinme
8e0c0ad200
Update test.cpp
2022-03-03 10:37:31 +03:00
ihsinme
25b3aba823
Update test.cpp
2022-03-03 10:21:38 +03:00
ihsinme
2dc85e183c
Update test.cpp
2022-03-03 10:20:41 +03:00
ihsinme
547342cd61
Update test.cpp
2022-03-03 10:16:00 +03:00
ihsinme
1a30b8d467
Apply suggestions from code review
...
Co-authored-by: Jeroen Ketema <93738568+jketema@users.noreply.github.com >
2022-03-03 10:14:22 +03:00
Jeroen Ketema
2fd950caad
C++: Fix join order in the IR dataflow library
...
Not having this fixed caused problems when updating the database
scheme stats file.
2022-03-03 07:42:52 +01:00
Jonathan Leitschuh
fea50065f5
Fix duplicated comment
2022-03-02 19:54:04 -05:00
Jonathan Leitschuh
85de9f305e
Fix naming of OSCheck method
2022-03-02 19:41:46 -05:00
Jonathan Leitschuh
a7adbb7291
Refactor more system property access logic
2022-03-02 19:33:05 -05:00
Harry Maclean
4a43731b83
Ruby: Use SimpleSummarizedCallable
...
This simplifies some String flow summaries.
2022-03-03 10:49:44 +13:00
Robert Marsh
9fb94d85b4
C++: performance tweaks for InsufficientKeySize
2022-03-02 15:59:42 -05:00
Arthur Baars
692fc4cb02
Update ruby/ql/lib/change-notes/2022-02-28-regex-string-literals.md
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2022-03-02 21:13:23 +01:00
Jonathan Leitschuh
3c53a05e16
Add OS Checks based upon separator or path separator
2022-03-02 14:15:56 -05:00
Jonathan Leitschuh
82d3cd8924
Improve system property lookup
2022-03-02 12:51:15 -05:00
Jonathan Leitschuh
dad9a02fbd
Update TempDirInfoDisclosure with new OS Guards
2022-03-02 12:51:15 -05:00
Jonathan Leitschuh
5913c9acad
Refactor OS Guard Checks
2022-03-02 12:51:14 -05:00
Jonathan Leitschuh
fd63107edf
Update OS Check from Review Feedback
2022-03-02 12:51:12 -05:00
Jonathan Leitschuh
9f5022ee95
Review fixup and add test for apache SystemUtils
2022-03-02 12:50:38 -05:00
Jonathan Leitschuh
49513443f2
Update java/ql/lib/semmle/code/java/os/OSCheck.qll
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2022-03-02 12:50:37 -05:00
Jonathan Leitschuh
3cdfc00542
Cleanup from review feedback
2022-03-02 12:50:37 -05:00
Jonathan Leitschuh
39828fd596
Apply OS guard checks to TempDirLocalInformationDisclosure
2022-03-02 12:50:37 -05:00
Jonathan Leitschuh
cd073a2173
Java: Add Guard Classes for checking OS
2022-03-02 12:50:35 -05:00
Rasmus Lerchedahl Petersen
6946ae931a
python: missed a spot..
2022-03-02 17:12:48 +01:00
Michael Nebel
b39f383d45
Merge pull request #8230 from michaelnebel/csharp/autobuilder-buildless
...
C#: Buildless extractor option.
2022-03-02 15:53:02 +01:00
Rasmus Wriedt Larsen
7f7758b83d
Python: rewrite xml sax modeling
2022-03-02 15:22:11 +01:00
Rasmus Wriedt Larsen
6dd776b2de
Python: Only produce one alert per vulnerable XML sink
...
This made it much easier to debug the current alerts on tests at least.
Notice that it's important that we have `strictconcat` and not just
`concat`, since `concat` will also allow flow to sinks that are not
vulnerable to any kind of XML vulnerability :|
2022-03-02 15:22:11 +01:00
Michael Nebel
938902dc89
C#: Include example fragment in the release note on, how to invoke the extractor with the optional parameter.
2022-03-02 14:28:25 +01:00
Michael Nebel
fc89888c74
C#: Add pattern that only accepts 'true' and 'false' as the buildless option.
2022-03-02 14:28:21 +01:00
Michael Nebel
c5ddf6110f
C#: Address review comments (change description to use true/false instead of yes/no).
2022-03-02 14:27:45 +01:00
Rasmus Wriedt Larsen
16e482bf6f
Python: Improve QLDoc for XML parsing/parsers
2022-03-02 14:25:12 +01:00
Rasmus Wriedt Larsen
aaf55b21c4
Python: Add XMLVulnerabilityKind
...
This gives some freedom in changing the name presented, and not worrying about whether you have made a typo that makes everything break :|
2022-03-02 14:25:12 +01:00
Rasmus Wriedt Larsen
ee23c05489
Python: XML: Expose vuln kind on sink
2022-03-02 14:25:12 +01:00
Michael Nebel
8d9999a8c4
C#: Change note describing the buildless extractor option.
2022-03-02 14:25:11 +01:00
Michael Nebel
3859b62554
C#: Autobuilder should use standalone in case buildless options is provided.
2022-03-02 14:25:11 +01:00
Michael Nebel
c973693bee
C#: Introduce buildless extractor option.
2022-03-02 14:25:06 +01:00
Rasmus Wriedt Larsen
500e0aced6
Python: Rewrite sax XML tests
...
The tests for type-trackers were not that interesting, since they did
not have XML input in both cases, which is the problem we were trying
hard to solve.
I did keep the test-case of not-user-supplied url alive as well though
👍
I added OK/NOT OK annotations.
Notice that we report all 4 kinds of vulnerabilities on line 93
2022-03-02 14:24:46 +01:00
Michael Nebel
fff42501fc
Merge pull request #8167 from michaelnebel/csharp/extractor-option-compress
...
C# Extractor Option for specifying compression.
2022-03-02 14:22:52 +01:00
Michael Nebel
23fbfbc3b7
C#: Performance optimization of the GVN implementation.
2022-03-02 13:48:33 +01:00
Michael Nebel
a0a2cde6fa
C#: Update relase note to include example fragment on, how to invoke the extractor with the optional parameter.
2022-03-02 13:17:20 +01:00
Rasmus Lerchedahl Petersen
143e9ee954
Merge branch 'main' of github.com:github/codeql into python/promote-xpath-injection
2022-03-02 13:14:08 +01:00
Rasmus Lerchedahl Petersen
ee45e79948
python: Create XML modulein Concepts
...
to prepare for XXE and other XML related modelling
2022-03-02 13:10:23 +01:00
Rasmus Lerchedahl Petersen
80be767a7a
python: implement stdlib xpath support
2022-03-02 12:59:34 +01:00
Rasmus Lerchedahl Petersen
06e0f140c5
python: add tests for stdlib xpath
2022-03-02 12:58:37 +01:00
Erik Krogh Kristensen
62f2614f72
move hasDominatingWrite to the TypeTracking stage
2022-03-02 11:30:05 +01:00
Erik Krogh Kristensen
1db6a644a5
only block flow for dominated reads when the property name is known
2022-03-02 11:30:05 +01:00
