github
/
codeql
зеркало из https://github.com/github/codeql.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность
72 033 коммитов 1 534 Ветки 130 Теги 467 MiB
Граф коммитов

1667 Коммитов

Автор SHA1 Сообщение Дата
Esben Sparre Andreasen 5e31f3a34e JS: polish js/disabling-certificate-validation 2020-06-18 09:07:08 +02:00
Erik Krogh Kristensen 7a1c161e9e Merge branch 'js-team-sprint' into https-fix 2020-06-17 21:04:44 +02:00
Erik Krogh Kristensen 218338b4f1 Merge branch 'js-team-sprint' into bad-random-polish 2020-06-17 21:04:00 +02:00
Erik Krogh Kristensen 73f26956a6 Merge branch 'js-team-sprint' into priv-file-polish 2020-06-17 21:03:09 +02:00
Erik Krogh Kristensen bdda587247 Merge branch 'js-team-sprint' into build-leaks 2020-06-17 19:51:30 +02:00
Erik Krogh Kristensen 6d6f29eb85
Merge pull request #3726 from erik-krogh/bad-code-polish 
JS: Bad code polish
 2020-06-17 19:45:37 +02:00
Erik Krogh Kristensen 7aa911b9f4 add reference to cwe-116 in change-note 2020-06-17 17:20:46 +02:00
Erik Krogh Kristensen 345283fe34 add change note 2020-06-17 10:48:27 +02:00
Jonas Jensen e0ba23d2c7 C++: @precision high for tainted-format-string* 
I think these queries have excellent results on lgtm.com. Many of the
results come from projects that use `sprintf` like it's a templating
engine, trusting that values from `argv` or `getenv` contain the correct
number of `%s`. I think we want to flag that.

The structure of the change note is modeled after 91af51cf46.
 2020-06-17 09:03:13 +02:00
Erik Krogh Kristensen 02c825351c add change note for js/bad-code-sanitization 2020-06-16 16:25:30 +02:00
Erik Krogh Kristensen cb5b946546 add changenote for yargs 2020-06-16 14:37:53 +02:00
Erik Krogh Kristensen 696879653a add qhelp to js/biased-cryptographic-random 2020-06-16 11:10:09 +02:00
Asger Feldthaus 824054ba62 JS: Change note and updated help 2020-06-15 17:34:36 +01:00
Erik Krogh Kristensen 23223fc5fb change-note 2020-06-15 17:22:11 +02:00
Erik Krogh Kristensen dc09a68eb4 add change-note 2020-06-15 14:30:34 +02:00
Erik Krogh Kristensen 8682918779 add change note 2020-06-15 13:47:43 +02:00
Asger Feldthaus 91d98c0d00 JS: Change note 2020-06-12 13:12:55 +01:00
yoff e5480e471a
Merge pull request #3591 from RasmusWL/python-taintkind-fixup 
Python: Fix some problems in TaintKind useage
 2020-06-05 16:03:18 +02:00
Erik Krogh Kristensen 58f4f7129e change-note 2020-06-04 16:25:26 +02:00
Erik Krogh Kristensen e47770281a
update change-note 
Co-authored-by: Asger F <asgerf@github.com>
 2020-06-04 11:14:25 +02:00
Erik Krogh Kristensen baee47f3c6 remove mention of fetch from change-note 2020-06-03 13:56:32 +02:00
Erik Krogh Kristensen c80baf981a
simplify change-note 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-06-03 13:33:31 +02:00
Erik Krogh Kristensen 19dd472ee5 change note 2020-06-03 12:19:48 +02:00
Esben Sparre Andreasen f9ed64fc45
Merge branch 'master' into js/membershiptest 2020-06-02 08:54:44 +02:00
Asger F 712c53afe9
Merge pull request #3579 from erik-krogh/fix-change-note-merge 
JS: remove duplicates from change-note
 2020-06-01 13:22:23 +01:00
Geoffrey White 9ee75aaca1 C++: Change note. 2020-05-29 16:22:42 +01:00
Rasmus Wriedt Larsen 59548a523e Python: Add change-note about UntrustedStringKind imports 2020-05-29 13:45:10 +02:00
Erik Krogh Kristensen df3fb842c5 remove duplicates from change-note 2020-05-27 20:36:23 +02:00
Erik Krogh Kristensen 33da82d884 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3566 2020-05-27 12:21:14 +00:00
Erik Krogh Kristensen d05a61c745 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3566 2020-05-27 12:12:08 +00:00
Erik Krogh Kristensen 3ae4e90902 change note 2020-05-27 09:45:49 +00:00
Erik Krogh Kristensen 0c00331527
less -> fewer 
Co-authored-by: Asger F <asgerf@github.com>
 2020-05-26 14:30:29 +02:00
Erik Krogh Kristensen 124c4cb15e Merge branch 'master' of github.com:github/codeql into OptionalSanitizer 2020-05-26 13:59:57 +02:00
semmle-qlci be5b343a0c
Merge pull request #3564 from max-schaefer/js/reflective-argument-access 
Approved by asgerf
 2020-05-26 12:09:13 +01:00
Max Schaefer 5b0a3b9673 JavaScript: Change "Less results" to "Fewer results" in change notes. 2020-05-26 10:49:30 +01:00
Max Schaefer abfcc42133 JavaScript: Re-alphabetise change notes. 2020-05-26 10:49:30 +01:00
Max Schaefer 215682f67c JavaScript: Add change note. 2020-05-26 10:49:30 +01:00
semmle-qlci 4b56229ca0
Merge pull request #3527 from esbena/js/fastify 
Approved by asgerf
 2020-05-26 10:44:59 +01:00
Erik Krogh Kristensen 3f66c04e12 change note 2020-05-26 00:09:11 +02:00
Dave Bartolomeo 12688f80ce
Merge pull request #3559 from jbj/vcs-remove 
C++: Remove VCS.qll and all queries using it
 2020-05-25 14:30:31 -04:00
Jonas Jensen e28ed848a4 C++: Remove VCS.qll and all queries using it 
All these queries have been deprecated since 2018. There is
unfortunately no way to deprecate a library, but it's been years since
we populated any databases using the VCS library, so nobody should be
using it.
 2020-05-25 19:28:06 +02:00
Jonas Jensen bc09720704
Merge pull request #3479 from geoffw0/fp2762 
C++: Allow equality to block taint (security taint tracking)
 2020-05-25 15:11:10 +02:00
semmle-qlci b9ecf1a304
Merge pull request #3447 from erik-krogh/LibCmdInjection 
Approved by asgerf, mchammer01
 2020-05-22 17:10:57 +01:00
Erik Krogh Kristensen b79b25ef87 correct cwe-78 to cwe-078 2020-05-21 12:38:44 +00:00
Esben Sparre Andreasen a76c70d2d7 JS: model fastify 2020-05-21 13:42:27 +02:00
semmle-qlci c15d22d9f8
Merge pull request #3516 from asger-semmle/js/typescript-3.9.2 
Approved by erik-krogh
 2020-05-20 11:31:57 +01:00
semmle-qlci 2bbc1c2af0
Merge pull request #3478 from erik-krogh/PromiseAll 
Approved by asgerf, esbena
 2020-05-20 11:03:05 +01:00
semmle-qlci 29b8a0db92
Merge pull request #3508 from asger-semmle/js/shared-data-flow-node 
Approved by esbena
 2020-05-20 10:58:09 +01:00
Tom Hvitved e9839198f4
Merge pull request #3484 from calumgrant/cs/index-initializers 
C#: Extract indexed initializers correctly
 2020-05-20 09:22:47 +02:00
semmle-qlci 26dfca80f6
Merge pull request #3510 from max-schaefer/cull-boring-queries 
Approved by asgerf, esbena
 2020-05-19 15:41:53 +01:00
Max Schaefer a803120414 Lower precision for a number of queries. 
These queries are currently run by default, but don't have their results displayed.

Looking through results on LGTM.com, they are either false positives (e.g., `BitwiseSignCheck` which flags many perfectly harmless operations and `CompareIdenticalValues` which mostly flags NaN checks) or harmless results that developers are unlikely to care about (e.g., `EmptyArrayInit` or `MisspelledIdentifier`).

With this PR, the only queries that are still run but not displayed are security queries, where different considerations may apply.
 2020-05-19 13:43:17 +01:00
Geoffrey White 7d630c458e Merge branch 'master' into fp2762 2020-05-19 11:43:50 +01:00
Asger Feldthaus 0db0ddf476 JS: Add a change note 2020-05-19 11:07:35 +01:00
Asger Feldthaus f49b36aec7 JS: Change note 2020-05-19 09:52:26 +01:00
semmle-qlci 0c081a8e87
Merge pull request #3497 from esbena/js/yield-and-local-objects 
Approved by asgerf, erik-krogh
 2020-05-19 09:02:22 +01:00
Erik Krogh Kristensen aa396a39d3 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3478 2020-05-18 20:57:51 +00:00
Asger F 96d6115452
Merge branch 'master' into js/sql-type-tracking 2020-05-18 15:58:42 +01:00
Erik Krogh Kristensen 70a28f60e3 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3478 2020-05-18 14:05:37 +00:00
Max Schaefer bdd778f989 JavaScript: Add change note. 2020-05-18 12:08:36 +01:00
Esben Sparre Andreasen a9ba6ac659 JS: make LocalObjects::isEscape aware of `yield` 2020-05-18 12:43:46 +02:00
Erik Krogh Kristensen bd3c4d4077 Merge branch 'master' of https://github.com/github/codeql into pr/erik-krogh/3478 2020-05-18 07:51:19 +00:00
Esben Sparre Andreasen ddb545c182 JS: introduce MembershipTests.qll and use in two locations 2020-05-18 09:50:00 +02:00
semmle-qlci 6041d52936
Merge pull request #3424 from asger-semmle/js/express-param-handler 
Approved by esbena
 2020-05-18 08:48:24 +01:00
semmle-qlci 0230b79efc
Merge pull request #3391 from erik-krogh/SplitFPs 
Approved by esbena
 2020-05-18 08:46:26 +01:00
Erik Krogh Kristensen dfdecf1450 add change note 2020-05-17 10:32:27 +02:00
semmle-qlci 8d41ce1630
Merge pull request #3480 from erik-krogh/moreSlip 
Approved by esbena
 2020-05-16 21:17:27 +01:00
Asger Feldthaus 435f9ea09f JS: Change note 2020-05-15 17:27:30 +01:00
Asger Feldthaus e311cc7689 JS: Change note 2020-05-15 13:06:37 +01:00
Calum Grant 53ca3ccf53 C#: Update changenotes 2020-05-15 13:06:17 +01:00
Geoffrey White 48f3db3fbe Merge branch 'master' into fp2762 2020-05-15 09:55:30 +01:00
Erik Krogh Kristensen 4eb96848a6 add change note for bluebird and "Promise" 2020-05-15 09:58:33 +02:00
Erik Krogh Kristensen 7df35a6bab update change note 2020-05-15 09:52:59 +02:00
semmle-qlci a536069059
Merge pull request #3408 from esbena/js/unsafe-html-expansion 
Approved by asgerf, mchammer01
 2020-05-15 08:24:12 +01:00
Geoffrey White 6579c71866 C++: Change note. 2020-05-14 18:44:06 +01:00
Geoffrey White df5e16c45d C++: Add a 1.25 change note file (didn't we used to have templates for these?). 2020-05-14 18:41:14 +01:00
semmle-qlci 23532ae49a
Merge pull request #3467 from erik-krogh/tarSlip 
Approved by esbena
 2020-05-14 14:06:42 +01:00
semmle-qlci 57f44c5a81
Merge pull request #2886 from asger-semmle/js/call-graph-exploration 
Approved by erik-krogh, esbena
 2020-05-14 14:01:23 +01:00
Erik Krogh Kristensen 422ade16db
Apply suggestions from code review 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-05-14 10:05:59 +02:00
Erik Krogh Kristensen ce5356f592 change note 2020-05-14 09:48:50 +02:00
Calum Grant f5daeea618
Merge pull request #3421 from hvitved/csharp/dataflow/change-note 
C#/Java/C++: Add change note for #3110
 2020-05-13 13:53:01 +01:00
Esben Sparre Andreasen c6fa88af28 JS: change notes 2020-05-13 12:56:33 +02:00
Esben Sparre Andreasen 7722d77c86 JS: add the NoSQL $where as a sink for js/code-injection 2020-05-13 08:30:22 +02:00
Esben Sparre Andreasen 20cf04442c JS: model marsdb and minimongo 2020-05-13 08:28:59 +02:00
Erik Krogh Kristensen 83d34b939c change note 2020-05-12 14:24:04 +02:00
Erik Krogh Kristensen 8b3e86c4f8 change note 2020-05-11 13:40:59 +02:00
Tom Hvitved c837ab7d1a
Apply suggestions from code review 
Co-authored-by: Jonas Jensen <jbj@github.com>
 2020-05-11 11:42:50 +02:00
Tom Hvitved 948c2f7f7e C++: Add change note 2020-05-07 16:01:55 +02:00
Tom Hvitved 0b85f3fed4 Address review comments 2020-05-07 15:58:46 +02:00
Erik Krogh Kristensen a3fb13882b Merge branch 'master' into SplitFPs 2020-05-07 10:51:11 +02:00
Tom Hvitved f19b1045d6 Java: Add change note 2020-05-06 15:52:49 +02:00
Tom Hvitved ddd62a56cc C#: Add change note for #3110 2020-05-06 14:28:47 +02:00
semmle-qlci 9210660ea0
Merge pull request #3401 from erik-krogh/jsonLike 
Approved by esbena
 2020-05-06 08:00:44 +01:00
Tom Hvitved 3d37a49ccd C#: Add change note 2020-05-05 14:28:13 +02:00
Erik Krogh Kristensen a4eee7e88e
more -> additional 
Co-authored-by: Esben Sparre Andreasen <esbena@github.com>
 2020-05-05 14:01:39 +02:00
Erik Krogh Kristensen bffb12725b add test and change-note to prototype-polution 2020-05-05 13:49:11 +02:00
Erik Krogh Kristensen 38db731e0b add change note and new test for js/incomplete-url-scheme-check 2020-05-05 13:38:27 +02:00
Erik Krogh Kristensen f56915d99f add change note for js/xss 2020-05-05 13:36:50 +02:00
Erik Krogh Kristensen 9a7f8d97d2 change note 2020-05-04 09:49:20 +02:00
Erik Krogh Kristensen ffdbe31a30 change-note 2020-05-04 09:08:46 +02:00
Esben Sparre Andreasen 04b5a794f1
Merge pull request #3313 from esbena/js/typical-bad-sanitizer 
New query: Incomplete HTML attribute sanitization
 2020-04-27 14:31:13 +02:00
semmle-qlci cbe417f5eb
Merge pull request #3336 from erik-krogh/MoarJQuery 
Approved by esbena
 2020-04-25 15:17:55 +01:00
Esben Sparre Andreasen f0a05f6a6c JS: change notes 2020-04-24 09:18:16 +02:00
Jonas Jensen d98e956c2b
Merge pull request #3322 from felicitymay/merge-124-master 
Merge rc/1.24 into master
 2020-04-24 08:48:54 +02:00
Erik Krogh Kristensen e7d8cd8e8c Merge remote-tracking branch 'upstream/master' into MoarJQuery 2020-04-23 14:10:53 +02:00
Erik Krogh Kristensen 67443718c0 change note 2020-04-23 13:55:37 +02:00
Erik Krogh Kristensen 5382976195 change note 2020-04-23 11:52:16 +02:00
semmle-qlci da3292606c
Merge pull request #3191 from erik-krogh/XssDom 
Approved by esbena, mchammer01
 2020-04-23 09:17:07 +01:00
Felicity Chapman 89bf35cd43 Merge branch 'rc/1.24' into merge-124-master 
Conflicts:
	change-notes/1.24/analysis-javascript.md
    Resolved in favor of the rc/1.24 branch
 2020-04-22 19:01:47 +01:00
Felicity Chapman 523f1068b8 Editorial suggestions 
We don't hyphenate "QL-library" and there were a few typos. Feel free to further revise this if I've changed the meaning too much.

As discussed separately, I was unable to raise this as a PR in GitHub.com and had to resort to a direct commit.

(cherry picked from commit e29468135d)
 2020-04-22 18:15:43 +01:00
Taus ac8cca37e8 Apply suggestions from code review 
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
(cherry picked from commit 44b570f7b6)
 2020-04-22 18:15:43 +01:00
Taus Brock-Nannestad 63234aae40 Python: Finalise change notes for 1.24. 
(cherry picked from commit e97d88c158)
 2020-04-22 18:15:42 +01:00
Felicity Chapman e29468135d
Editorial suggestions 
We don't hyphenate "QL-library" and there were a few typos. Feel free to further revise this if I've changed the meaning too much.

As discussed separately, I was unable to raise this as a PR in GitHub.com and had to resort to a direct commit.
 2020-04-22 15:48:01 +01:00
Taus 44b570f7b6
Apply suggestions from code review 
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
 2020-04-22 16:03:20 +02:00
Taus Brock-Nannestad e97d88c158 Python: Finalise change notes for 1.24. 2020-04-22 14:31:04 +02:00
Erik Krogh Kristensen ac44cb425e
Merge branch 'master' into js/call-graph-exploration 2020-04-22 10:49:26 +02:00
Erik Krogh Kristensen a5bbfa30d1 add change note 2020-04-22 10:23:07 +02:00
Asger Feldthaus 18188b659c JS: Add 1.25 change note 2020-04-21 10:53:37 +01:00
Felicity Chapman dc83ac61b5
Fix error in 3287 
@jbj - apologies for the over-eager merge of #3287. This should fix the error you highlighted.
 2020-04-20 15:12:43 +01:00
Erik Krogh Kristensen aee7cc117d add change-note 2020-04-20 13:08:51 +02:00
Felicity Chapman 962f13ee13
Merge pull request #3287 from felicitymay/1.24/SD-61-Cpp-finalize-notes 
1.24 release: finalize change notes for C/C++
 2020-04-20 09:07:58 +01:00
Felicity Chapman 3bfcd618c0
Merge pull request #3286 from felicitymay/1.24/SD-61-JS-finalize-notes 
1.24 release: finalize change notes for JavaScript
 2020-04-20 09:07:47 +01:00
Erik Krogh Kristensen 2632699397 Merge branch 'master' of git.semmle.com:Semmle/ql into Mispelled 2020-04-18 17:58:57 +02:00
semmle-qlci 243dea706e
Merge pull request #3269 from erik-krogh/Promisify 
Approved by esbena
 2020-04-18 13:02:42 +01:00
yo-h 26f624d2d4
Merge pull request #3285 from felicitymay/1.24/SD-61-Java-finalize-notes 
1.24 release: finalize change notes for Java
 2020-04-17 17:04:38 -04:00
Felicity Chapman 05d0d844bd Editorial changes 2020-04-17 14:44:14 +01:00
Calum Grant dbff9b6fc7
Merge pull request #3284 from felicitymay/1.24/SD-61-CS-finalize-notes 
1.24 release: finalize change notes for C#
 2020-04-17 14:13:39 +01:00
Felicity Chapman d5145d9f0a Sort table alphabetically 2020-04-17 14:05:21 +01:00
Felicity Chapman c1323886b6
Update change-notes/1.24/analysis-javascript.md 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-17 13:30:49 +01:00
Erik Krogh Kristensen cffa911661 retarget change note for 1.25 2020-04-17 14:22:57 +02:00
Erik Krogh Kristensen a2ddf7bf8f retarget change-note for 1.25 2020-04-17 14:19:17 +02:00
Erik Krogh Kristensen 88f600fa34
more -> additional 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-17 14:14:08 +02:00
Erik Krogh Kristensen 225dc4b017 change-note 2020-04-17 13:54:48 +02:00
Felicity Chapman 01a31c1065 Minor editorial changes 2020-04-17 12:50:20 +01:00
Felicity Chapman ee12e6a00b Sort alphabetically 2020-04-17 12:35:33 +01:00
Felicity Chapman 67e8a5c8d8 Minor editorial changes 2020-04-17 12:11:33 +01:00
Erik Krogh Kristensen e72eed1db5
more -> additional 
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
 2020-04-17 13:10:06 +02:00
Felicity Chapman 81b3b4884c Add LGTM info for new queries and comment detail 
Plus minor editorial changes
 2020-04-17 12:09:27 +01:00
Felicity Chapman 08d1a2c5ea Reorder table and remove empty sections 2020-04-17 11:30:18 +01:00
Erik Krogh Kristensen 3b230648d2 change-note 2020-04-17 11:45:08 +02:00
Jonas Jensen 7dab89ef56 C++: More details about lib implementation changes 
This commit mostly restores the previous note about library changes but
avoids mentioning queries in the library section.
 2020-04-17 10:32:28 +02:00
Jonas Jensen 9191190248 C++: Spaceship operator change note 2020-04-17 10:18:17 +02:00
Jonas Jensen 7e67dcca6f C++: Tidy up 1.24 change notes 
- Merged the two notes for `cpp/uncontrolled-allocation-size` into one.
- Added note about renaming of a query id.
- Moved the use of IR in queries from the library section to the queries
  section, rephrasing the note in terms of query results/performance
  rather than library implementation.
- Grouped, without text changes, the three notes about the `Allocation`
  library
- Grouped all the notes about standard-library models, abbreviating them
  to eliminate the common text.
- Removed the note about `strlen` (#2647) since that should no longer
  affect the results of queries or IR data flow after we started using
  unsound IR for data flow.
 2020-04-15 16:08:57 +02:00
Geoffrey White 92187d9e71 C++: Change note. 2020-04-14 14:00:46 +01:00
Jonas Jensen 42e9d1416b
Merge pull request #3206 from geoffw0/newfreefix 
C++: Fix `cpp/new-free-mismatch` false positives
 2020-04-08 08:39:43 +02:00
Geoffrey White 66a0b7884e Merge branch 'master' into alloc-size 2020-04-07 17:12:35 +01:00
semmle-qlci e5d3286ee9
Merge pull request #3183 from asger-semmle/js/bad-url-scheme-check 
Approved by esbena
 2020-04-06 14:53:15 +01:00
Geoffrey White 050e239507 C++: Change note. 2020-04-06 14:39:07 +01:00
Calum Grant 6cce0de9b2
Merge pull request #3124 from hvitved/csharp/dataflow/sources-and-sinks 
C#: Introduce `RemoteFlowSink` class
 2020-04-06 12:36:14 +01:00
Asger Feldthaus 2c6beadf68 JS: Recognize more forms of scheme checks 2020-04-06 12:30:03 +01:00
Jonas Jensen 16c7a35b1c
Merge pull request #3195 from geoffw0/taintstring 
C++: Model taint flow through std::string constructor and c_str()
 2020-04-03 12:05:07 +02:00
Tom Hvitved 08fbd1d2ad C#: Update change notes 2020-04-03 10:25:46 +02:00
Geoffrey White ab716ebe75 C++: Change note. 2020-04-02 19:49:42 +01:00
Geoffrey White 6b5f4d9e12 Merge branch 'master' into av114 2020-04-01 18:23:21 +01:00
semmle-qlci 1975a83cdd
Merge pull request #3116 from max-schaefer/js/postgres-type-tracking 
Approved by asgerf
 2020-03-27 09:23:52 +00:00
semmle-qlci e7fd97e72b
Merge pull request #3119 from erik-krogh/SockJS 
Approved by esbena
 2020-03-25 21:36:29 +00:00
Tom Hvitved 95b6f6aee0 C#: Add change note 2020-03-25 20:05:39 +01:00
Erik Krogh Kristensen f7faaa634f change-note 2020-03-25 11:37:39 +01:00
semmle-qlci ac7c74dcee
Merge pull request #3111 from RasmusWL/python-fabric-command-injection 
Approved by BekaValentine
 2020-03-25 10:07:33 +00:00
Max Schaefer efbcec09ef JavaScript: Add type tracking to Postgres model. 2020-03-24 17:30:07 +00:00
Rasmus Wriedt Larsen 49fa7c8589 Python: update 1.24 changelog 2020-03-24 10:15:36 +01:00
semmle-qlci 4c9a6b73ee
Merge pull request #3107 from erik-krogh/FArgs 
Approved by esbena
 2020-03-24 08:32:56 +00:00
Erik Krogh Kristensen 833183c706 change note 2020-03-23 14:13:30 +01:00
Asger F 6c2842bd49
Merge pull request #2919 from asger-semmle/js/property-barriers 
JS: Make sanitizers no longer block taint inside an object
 2020-03-23 11:43:18 +00:00
Luke Cartey 9eee16b2d6
Merge pull request #3091 from hvitved/csharp/xpath-injection-more-sinks 
C#: Teach XPath injection query about `XPathNavigator`
 2020-03-23 09:39:26 +00:00
semmle-qlci 2c7af72f14
Merge pull request #2858 from RasmusWL/python-support-django2 
Approved by tausbn
 2020-03-23 09:35:46 +00:00
Tom Hvitved fc74a482a4 C#: More XPath injection sinks 2020-03-19 14:13:35 +01:00
Tom Hvitved 0d45700088 C#: Add change note 2020-03-19 13:41:22 +01:00
Asger Feldthaus de7fbce27b JS: Adjust whitespace in change notes 2020-03-18 11:55:13 +00:00
Asger Feldthaus 08ad4f785a JS: Tweak other parts of change note for consistency 2020-03-18 11:55:12 +00:00
Asger Feldthaus ad2b150d05 JS: Add change note 2020-03-18 11:55:12 +00:00
Jonas Jensen f1ad0dafdc
Merge pull request #2849 from geoffw0/model-gets 
C++: Model for gets
 2020-03-18 11:06:23 +01:00
semmle-qlci ea46873bfe
Merge pull request #3065 from erik-krogh/PathSinks 
Approved by esbena
 2020-03-17 13:00:00 +00:00
Erik Krogh Kristensen 9403026fff add change note 2020-03-17 11:48:02 +01:00
Geoffrey White 034f7cc948 Merge branch 'master' into model-gets 2020-03-16 15:12:36 +00:00
Geoffrey White 40db92bfd1 C++: Change note. 2020-03-16 13:22:00 +00:00
semmle-qlci 7e093a8e5c
Merge pull request #3041 from erik-krogh/JQueryAjax 
Approved by esbena
 2020-03-14 22:31:59 +00:00
Esben Sparre Andreasen 4d6aa20990
Merge pull request #3004 from esbena/js/additional-mongodb-and-mongoose-injection-sinks 
JS: Mongoose and MongoDB improvements
 2020-03-14 12:31:43 +01:00
Geoffrey White cecbdae3e1 C++: Change note. 2020-03-13 17:58:31 +00:00
Jonas Jensen 917b984909
Merge pull request #3050 from geoffw0/mismatching_placement_new 
C++: Fix mismatching new/free FP in template code.
 2020-03-12 12:42:29 +01:00
Geoffrey White f84c94b5fb C++: Change note. 2020-03-11 18:11:51 +00:00
Erik Krogh Kristensen 2c18144560 change note 2020-03-11 17:01:41 +01:00
Erik Krogh Kristensen dd261c51f7 add change note 2020-03-11 14:42:57 +01:00
Rasmus Wriedt Larsen 2da1503942 Merge branch 'master' into python-support-django2 2020-03-11 11:21:47 +01:00
Esben Sparre Andreasen 5b1b945c35 JS: distinguishes escapes in strings and regular expression literals 2020-03-10 12:26:20 +01:00
Esben Sparre Andreasen e61f522f30 JS: bump change notes for mongodb 2020-03-10 09:57:45 +01:00
Max Schaefer 3c785ecaa7 JavaScript: Move flow summaries to `experimental`. 
Also update description and change note to call out their experimental character more clearly.
 2020-03-09 12:57:20 +00:00
Asger Feldthaus a9a9c14eea JS: Change note 2020-03-07 15:15:13 +00:00
semmle-qlci 7891f8621e
Merge pull request #2982 from esbena/js/request-model-with-chaining 
Approved by asgerf
 2020-03-06 08:57:42 +00:00
Esben Sparre Andreasen db335ae89b JS: add default/chaining for `request` 2020-03-04 12:36:49 +01:00
Asger Feldthaus 6f2b05932e JS: Change note 2020-03-04 11:18:12 +00:00
Esben Sparre Andreasen 4625217a68 Merge branch 'master' of github.com:Semmle/ql into js/more-fs-modules 2020-03-03 15:07:51 +01:00
semmle-qlci 7f3f629d39
Merge pull request #2913 from asger-semmle/js/prototype-pollution-path 
Approved by erik-krogh
 2020-03-03 10:29:47 +00:00
Esben Sparre Andreasen adddebf039 Merge branch 'master' of github.com:Semmle/ql into js/more-fs-modules 2020-03-03 10:55:16 +01:00
semmle-qlci e1c5449885
Merge pull request #2867 from erik-krogh/UselessCat 
Approved by esbena
 2020-03-03 09:10:25 +00:00
Erik Krogh Kristensen 019266e537 change name of Useless cat 2020-03-02 13:06:08 +01:00
Anders Schack-Mulligen b210009eec
Merge pull request #2923 from yo-h/java-customizations 
Java: add `Customizations.qll`
 2020-03-02 09:58:34 +01:00
Esben Sparre Andreasen a589061bee JS: add type-tracking to the fs-module and model the `original-fs` 2020-02-28 12:54:59 +01:00
Erik Krogh Kristensen ce9cd53bf1 Merge remote-tracking branch 'upstream/master' into UselessCat 2020-02-28 09:56:23 +01:00
Erik Krogh Kristensen 17f1974e05
Apply suggestions from code review 
Co-Authored-By: mc <42146119+mchammer01@users.noreply.github.com>
 2020-02-28 09:43:32 +01:00
Asger Feldthaus 52ebe49a0b JS: Flag deep assignments in prototype pollution query 2020-02-27 12:17:55 +00:00