Erik Krogh Kristensen
055275b971
change stats file
2021-02-24 11:12:31 +01:00
Anders Schack-Mulligen
add960bc4d
Merge pull request #4880 from luchua-bc/java/sensitive-query-with-get
...
Java: Sensitive GET Query
2021-02-24 11:08:47 +01:00
Asger Feldthaus
bb858d38c4
JS: Tweak ExprNode
2021-02-24 10:03:45 +00:00
Tamas Vajk
380058a4bd
C#: Fix merge conflict (with + refactoring)
2021-02-24 10:50:51 +01:00
yoff
8262f0343b
Merge pull request #5208 from RasmusWL/flask-clean-models
...
Python: Cleanup Flask models now that we have API graphs
2021-02-24 10:36:30 +01:00
Erik Krogh Kristensen
16150a6419
update printAst expected output
2021-02-24 10:29:29 +01:00
Erik Krogh Kristensen
ed47697c09
update expected output
2021-02-24 10:29:12 +01:00
Geoffrey White
358a8fee7d
C++: 'side-effect free'.
2021-02-24 09:25:11 +00:00
Taus Brock-Nannestad
af644a0adb
Python: Decrease import depth in regex tests
...
These were increased because of the indirection needed to get to the
regex flags, but as we no longer rely on this, we can make do with a
smaller import depth.
2021-02-24 10:23:01 +01:00
Rasmus Wriedt Larsen
5bb4a1a45a
Python: Use explicit argument specification instead of getAnArg
...
I've seen quite a few places where `getAnArg` leads to wrong behavior, and I
generally just don't like it.
2021-02-24 10:19:34 +01:00
Taus Brock-Nannestad
e77c1059a3
Python: Use source nodes and prevent bad join order
2021-02-24 10:18:54 +01:00
Taus Brock-Nannestad
cac6c4acc9
Python: Add deprecation notice to mode_from_mode_object
2021-02-24 10:18:21 +01:00
Rasmus Wriedt Larsen
0b9a65d234
Python: Accept RequestWithoutValidation expected output change
...
I have no clue why this changed, but since it's only the `..` part, I guess
we'll live with it
2021-02-24 10:13:25 +01:00
Rasmus Wriedt Larsen
cef37d19ce
Python: Split CWE-295 tests
...
Mostly just because it's nice. But now we can avoid having the same `options`
files for the tests.
2021-02-24 10:12:45 +01:00
Rasmus Wriedt Larsen
0ffc801f9b
Python: Remove options for InsecureTemporaryFile tests
2021-02-24 09:57:51 +01:00
Erik Krogh Kristensen
5091bb652f
bump extractor version
2021-02-24 09:39:09 +01:00
Erik Krogh Kristensen
971ce83f8e
add change note
2021-02-24 09:34:54 +01:00
Erik Krogh Kristensen
bcb3d5aec2
add tests for nested type unions through aliases
2021-02-24 09:34:54 +01:00
Erik Krogh Kristensen
85ed402b1a
add test for union types
2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
5ae3c5952c
support abstract signatures
2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
f385c55f2c
add support for rest types elements in the middle of a tuple
2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
74630b0fd8
fix file lookup for exclude patterns
2021-02-24 09:34:53 +01:00
Erik Krogh Kristensen
8cf28c6186
update TypeScript to 4.2
2021-02-24 09:34:47 +01:00
yoff
c3d2001e85
Merge pull request #5251 from tausbn/python-port-missing-host-key-validation-query
...
Python: Port missing host key validation query
2021-02-24 08:43:52 +01:00
yo-h
1d654febfd
Merge pull request #5195 from aschackmull/java/cwe-548-test
...
Java: Add empty file to test.
2021-02-23 21:12:40 -05:00
Taus Brock-Nannestad
2942a11a69
Python: Import API graphs privately
2021-02-23 22:45:39 +01:00
Taus Brock-Nannestad
f241dbabab
Python: Clean up query a bit
2021-02-23 22:33:18 +01:00
Taus Brock-Nannestad
002d0fe565
Python: Port missing host key query
2021-02-23 22:26:03 +01:00
Taus Brock-Nannestad
e812eb777d
Python: Port URL sanitisation queries to API graphs
...
Really, this boils down to "Port `re` library model to use API graphs
instead of points-to", which is what this PR actually does.
Instead of using points-to to track flags, we use a type tracker. To
handle multiple flags at the same time, we add additional flow from
`x` to `x | y` and `y | x`
and, as an added bonus, the above with `+` instead of `|`, neatly
fixing https://github.com/github/codeql/issues/4707
I had to modify the `Qualified.ql` test slightly, as it now had a
result stemming from the standard library (in `warnings.py`) that
points-to previously ignored.
It might be possible to implement this as a type tracker on
`LocalSourceNode`s, but with the added steps for the above operations,
this was not obvious to me, and so I opted for the simpler
"`smallstep`" variant.
2021-02-23 22:02:35 +01:00
Rasmus Wriedt Larsen
358ade67e5
Merge pull request #5248 from tausbn/python-port-insecure-temporary-file
...
Python: Port `py/insecure-temporary-file`
2021-02-23 21:37:59 +01:00
Tamás Vajk
91928fa098
Merge pull request #5220 from tamasvajk/feature/limit-codescanning-csharp
...
Limit C# codeql analysis to the csharp folder
2021-02-23 21:05:38 +01:00
Tamás Vajk
e6532cbd75
Merge pull request #4695 from tamasvajk/feature/csharp9-with-expr
...
C#: Extract 'with' expressions
2021-02-23 21:04:51 +01:00
Geoffrey White
431a004127
C++: QLDoc.
2021-02-23 19:10:03 +00:00
Taus Brock-Nannestad
b8ce5e969e
Python: Port py/insecure-temporary-file
2021-02-23 20:02:22 +01:00
yoff
9eed17f647
Merge pull request #5152 from RasmusWL/improve-pyyaml-support
...
Python: Improve pyyaml support
2021-02-23 19:58:04 +01:00
Rasmus Lerchedahl Petersen
6abbb5040c
Python: add change note
2021-02-23 19:54:09 +01:00
Rasmus Lerchedahl Petersen
b28544da9c
Python: Port insecure default protocol
...
- use API graphs
- update .qlhelp-file
- limit to versions below 3.4
- move tests to its own directory to only test on old version
2021-02-23 19:41:36 +01:00
Joe Farebrother
e13c779f0f
Add additional unit tests
2021-02-23 16:17:13 +00:00
Nick Rolfe
37253fd1f1
Update stats for dbscheme change to interpolation_child
2021-02-23 16:08:24 +00:00
Nick Rolfe
6c84f2c3dc
Add test case for multiple statements in interpolation
2021-02-23 15:52:11 +00:00
Nick Rolfe
672148e5b4
Add support for multiple statements in interpolations
2021-02-23 15:36:14 +00:00
CodeQL CI
c5ae8d2c53
Merge pull request #5210 from erik-krogh/barrierPerf
...
Approved by asgerf
2021-02-23 07:29:27 -08:00
luchua-bc
56e3b301e9
Resolve ambiguous method access
2021-02-23 15:18:07 +00:00
Rasmus Wriedt Larsen
a09f8c4b4a
Python: Port bind-to-all-interfaces to type-tracking
2021-02-23 16:01:24 +01:00
Rasmus Wriedt Larsen
4026d54095
Python: Expand bind-to-all-interfaces tests slightly
2021-02-23 15:53:47 +01:00
luchua-bc
45f9125bfa
Update test program
2021-02-23 14:41:44 +00:00
luchua-bc
9eb8ec7da5
Create a separate file for EJB check
2021-02-23 14:38:15 +00:00
Joe Farebrother
ee651da23f
Remove TODO comment
2021-02-23 14:27:11 +00:00
Joe Farebrother
459c0afc55
Add change note
2021-02-23 14:26:12 +00:00
Joe Farebrother
a3b8d4ab2d
Switch to inline test expectations; fix failing test outputs
2021-02-23 14:26:12 +00:00
