Erik Krogh Kristensen
3d49b8cb91
consider quoted string concatenations as sanitizers for js/shell-command-injection-from-environment
2021-03-25 15:17:02 +01:00
yo-h
0fe4baec34
Merge pull request #5525 from aschackmull/java/cleanup
...
Java: Delete filter queries, code duplication library, and precision tag from metric queries.
2021-03-25 10:09:41 -04:00
Tom Hvitved
aad5d133d0
Merge pull request #161 from github/hvitved/cfg-remove-is-hidden
...
CFG: Remove `isHidden()` predicate
2021-03-25 15:08:17 +01:00
Rasmus Wriedt Larsen
09fbf480db
Python: Remove precision tag from metric queries
2021-03-25 15:06:47 +01:00
Rasmus Wriedt Larsen
e3b2e0a1de
Python: Delete filter queries
2021-03-25 15:06:46 +01:00
Erik Krogh Kristensen
3b82452d76
detect fs modules that pass through a reduce call
2021-03-25 14:47:43 +01:00
Tom Hvitved
0bb5007103
Reintroduce hidden then/else/do in AST; include all in CFG
2021-03-25 14:22:35 +01:00
Anders Schack-Mulligen
75afa011ff
Java: Add metadata to several more experimental queries.
2021-03-25 13:09:26 +01:00
CodeQL CI
e90035a5a5
Merge pull request #5439 from erik-krogh/topPack
...
Approved by esbena
2021-03-25 11:49:03 +00:00
Mathias Vorreiter Pedersen
24360d3a4c
C++: Fix join order in AV rule 79 by joining with GVN after the recursive call.
2021-03-25 12:00:49 +01:00
Erik Krogh Kristensen
77ba7b473d
Merge branch 'main' into topPack
2021-03-25 11:52:58 +01:00
CodeQL CI
0511e72520
Merge pull request #5458 from erik-krogh/shellTrue
...
Approved by asgerf
2021-03-25 10:49:24 +00:00
luchua-bc
57bd3f3c14
Optimize the taint flow source
2021-03-25 10:44:26 +00:00
Tom Hvitved
6bfc49c069
C#: Address review comments
2021-03-25 11:43:25 +01:00
yoff
32b264bdee
Apply suggestions from code review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2021-03-25 10:48:59 +01:00
Anders Schack-Mulligen
d53c334488
Merge branch 'java/fix-experimental-query-metadata' into java/cleanup
2021-03-25 10:36:36 +01:00
Anders Schack-Mulligen
28ff3f412d
Java: Add severity and precision metadata to experimental queries.
2021-03-25 10:29:47 +01:00
Cornelius Riemenschneider
867471b122
C++: Delete old queries.
2021-03-25 10:23:17 +01:00
CodeQL CI
9d52db3ca7
Merge pull request #5507 from erik-krogh/joins
...
Approved by asgerf
2021-03-25 09:18:26 +00:00
Anders Schack-Mulligen
5b905cfe18
Java: Add change note for code duplication library removal.
2021-03-25 10:12:58 +01:00
Anders Schack-Mulligen
1564aee57a
Java: Add change note for filter query removal.
2021-03-25 10:11:30 +01:00
Anders Schack-Mulligen
c82b5eb040
Java: Remove code duplication library.
2021-03-25 10:06:10 +01:00
Asger Feldthaus
dbc6cf63c2
JS: Fix bad join order in PropertyProjection
2021-03-25 09:00:10 +00:00
Asger Feldthaus
bd3f6d1234
JS: Add o[o.length] = y taint step
2021-03-25 09:00:10 +00:00
Asger Feldthaus
51f489211b
JS: Support react-native-base64
2021-03-25 09:00:10 +00:00
Asger Feldthaus
5d9778c64d
JS: Step through babel.transform
2021-03-25 09:00:10 +00:00
Asger Feldthaus
3e67ebacb0
JS: Support lodash-es
2021-03-25 09:00:10 +00:00
Erik Krogh Kristensen
3b6b40489f
Merge branch 'main' into topPack
2021-03-25 09:58:15 +01:00
Tom Hvitved
58ecd771d3
AST: Exclude empty then/else/do statements
2021-03-25 09:53:55 +01:00
Anders Schack-Mulligen
4b7440d4d5
Java: Remove precision tag from metric queries.
2021-03-25 09:52:05 +01:00
Tom Hvitved
419fbe77ab
C#: Remove @precision tags from metric queries
2021-03-25 09:50:24 +01:00
Tom Hvitved
b83da2255c
C#: Add change note
2021-03-25 09:50:24 +01:00
Tom Hvitved
b94c189946
C#: Remove VulnerablePackage.ql query
2021-03-25 09:50:24 +01:00
Tom Hvitved
7e33b571c9
C#: Add change note
2021-03-25 09:50:24 +01:00
Tom Hvitved
eeb8c74666
C#: Remove filter and external queries
...
These are legacy queries that are no longer used.
2021-03-25 09:50:01 +01:00
Anders Schack-Mulligen
70824b3f0b
Java: Delete filter queries.
2021-03-25 09:47:31 +01:00
Esben Sparre Andreasen
801eb538db
Merge pull request #5514 from github/aibaars/fix-javascript-metadata
...
Javascript: remove bad QLDoc tag
2021-03-25 08:56:08 +01:00
luchua-bc
fe0e7f5eac
Change method check to taint flow
2021-03-25 01:45:13 +00:00
luchua-bc
08c3bf26d5
Update the query to accommodate more cases
2021-03-24 23:32:27 +00:00
Taus Brock-Nannestad
0ae8b69102
Python: Prevent joining on scope in PointsToContext::appliesTo
...
One of those cases where I _wish_ `pragma[inline]` also meant "don't
join on the stuff inside this predicate -- it's inlined for a reason".
Unsurprisingly, joining on the scope first works poorly.
2021-03-24 23:12:48 +01:00
Taus Brock-Nannestad
28d6cad3d0
Python: Prevent joining on name as the first thing
...
Many instances of `lookup` are restricted by the presence of
`attributeRequired`, but this does not work well if we join on
`name`. A few instances of `only_bind_into` prevents this.
2021-03-24 23:11:09 +01:00
yo-h
72ae902e0d
Merge pull request #5371 from aschackmull/java/framework-coverage
...
Java: Add query for CSV framework coverage.
2021-03-24 17:36:13 -04:00
Erik Krogh Kristensen
c146b27c1a
Merge branch 'main' into shellTrue
2021-03-24 20:09:23 +01:00
CodeQL CI
8ff9c98d26
Merge pull request #5449 from erik-krogh/asExec
...
Approved by esbena
2021-03-24 19:04:30 +00:00
Aditya Sharad
32dc894d54
Merge pull request #5516 from github/adityasharad/actions/remove-docs-review-workflow
...
Actions: Remove docs-review workflow
2021-03-24 11:48:03 -07:00
Aditya Sharad
a0465d20cb
Actions: Remove docs-review workflow
...
Being replaced by internal automation that polls the repo for open labelled PRs, since this workflow currently cannot tag the docs team in a comment.
2021-03-24 11:26:00 -07:00
Taus Brock-Nannestad
ed8ffab356
Python: Prevent potentially bad join order
...
This has no effect on the current compilation (indeed,
`ssa_filter_definition_bool` is not currently inlined), but will
prevent this from ever occurring, should the heuristics for inlining
ever change...
2021-03-24 19:20:19 +01:00
Cornelius Riemenschneider
47530d7526
C++: Fix query metadata warnings.
2021-03-24 18:01:21 +01:00
Tom Hvitved
ca7c0584c7
CFG: Remove isHidden() predicate
2021-03-24 17:22:05 +01:00
Arthur Baars
b25dc03dac
Javascript: remove bad QLDoc tag
2021-03-24 16:47:27 +01:00
