Python : Add query to detect Server Side Template Injection #3396

porcupineyhairs · 2020-05-03T20:35:43Z

This query adds support for multiple Python templating engines. As of now it covers

I am working on adding a few more. Till then, if possible, I would like a review.

porcupineyhairs · 2020-05-03T20:38:13Z

python/ql/src/semmle/python/templates/DjangoTemplate.qll

+class DjangoTemplateEngineSink extends SSTISink {
+  override string toString() { result = "argument to Django.template()" }
+
+  // HELP : This does resolve `from_string`


@RasmusWL @tausbn Can you please help me figure out why codeql fails to detect the from_string call here?

I'm not sure if the code changed since you posted your comment, but Value::named("") doesn't make much sense. It tries to return the Value corresponding to the built-in with the name "", but there is no such built-in.

The value was django.template.Engine.from_string. I think I also get why codeql failed to recognize that. Since the django.template.Enginemodule is not directly imported, the indirect reference is not recognized by codeql. Can you please confirm this?

I think the issue here is that django.template.Engine is not a module but a class. The Value::named(...) interface is rather limited, in that it always assumes everything before the last . is the name of the module, and so django.template.Engine.from_string tries to match the from_string attribute in the django.template.Engine module (which doesn't exist).
Instead, what you probably want to do is pull out the Engine class separately as a ClassValue, and then take the from_string attribute on that, using the attr method.

tausbn

I think what you have so far looks reasonable. 👍

One point, though: You should move these library additions (and the eventual query) into the experimental directory, as mentioned in our Contributing guidelines

(This has nothing to do with your changes specifically. At present, we are asking all external contributors to go through the experimental directory, so we can properly vet queries before including them in our standard set of queries.)

tausbn · 2020-05-20T14:51:44Z

python/ql/src/semmle/python/templates/DjangoTemplate.qll

+  // HELP : This does resolve `from_string`
+  DjangoTemplateEngineSink() {
+    exists(CallNode call, FunctionValue f |
+      f = Value::named("") and


This still looks a bit strange. Did you try what I suggested in https://github.com/github/codeql/pull/3396/files#r420638851?

Unfortunately, that didn't work. I have forced pushed the new code. PTAL.

porcupineyhairs · 2020-05-28T23:20:01Z

@tausbn I have added support for airspeed and chevron too. I still can't detect the code I mentioned earlier. Plus, I couldn't properly track flow from a kwarg argument while modelling chevron. Can you please help me with these two issues?

porcupineyhairs · 2020-05-28T23:21:08Z

python/ql/src/experimental/semmle/python/templates/Chevron.qll

+    // HELP: this should detect :-
+    // import chevron
+    // args = {
+    //   'template': 'sink',
+    //   'data': {
+    //     'mustache': 'World'
+    //   }
+    // }
+    // chevron.render(**args)
+    exists(Dict dict, Call call, KeyValuePair kv |
+      call.getFunc().getAFlowNode() = theChevronRenderFunc().getAReference() and
+      dict.getAnItem().contains(kv) and
+      dict = call.getKwargs() and
+      kv.getKey().toString() = "template" and
+      kv.getValue().getAFlowNode() = this
+    )


I need help with this too.

porcupineyhairs · 2020-06-24T18:53:15Z

@tausbn Per our slack conversation, I have marked the above two cases as TODO's. Due to limitation's in the tracking lib, they can't be added for now.

tausbn

There are a few documentation changes that are needed here and there, but otherwise the code looks good to me.

When running the tests, it seems two of them that are currently failing:
JinjaSSTISinks.ql currently finds more results than the .expected file indicates:

| Jinja2Templates.py:6:25:6:30 | argument to Jinja2.from_string() |
| Jinja2Templates.py:6:25:6:30 | argument to Jinja2.template() |
| Jinja2Templates.py:11:25:11:30 | argument to Jinja2.from_string() |
| Jinja2Templates.py:11:25:11:30 | argument to Jinja2.template() |
| Jinja2Templates.py:16:25:16:37 | argument to Jinja2.from_string() |
| Jinja2Templates.py:16:25:16:37 | argument to Jinja2.template() |

experimental/CWE-074/TemplateInjection.qlref currently doesn't find any results at all, which is a bit alarming. I assume this must have worked at some point. Can you verify if the test still passes on your computer?

Finally, ql/python/ql/src/experimental/CWE-074/TemplateInjection.ql needs to be autoformatted. It is currently failing our code formatting check.

python/ql/test/experimental/semmle/python/templates/TemplateInjection.ql

python/ql/src/experimental/CWE-074/TemplateInjection.ql

python/ql/src/experimental/semmle/python/templates/Airspeed.qll

python/ql/src/experimental/semmle/python/templates/FlaskTemplate.qll

python/ql/src/experimental/semmle/python/templates/TRender.qll

porcupineyhairs · 2020-07-17T16:13:37Z

@tausbn I have included the changes from the review.

For me the tests run all fine. I have attached the screenshot of the test runner below.

RasmusWL · 2020-07-21T09:51:03Z

The problems with the tests are that the CI system runs them as if the changes had been merged into master (which is good). Since we have changed some things in master since this branch was created, tests are passing locally when the tip of this PR is checked out, but they would not pass if merged into master.

I made a PR to fix the underlying problem in porcupineyhairs#1.

It's a good idea to keep your branch up-to date with master. We have started just merging in an updated master to keep the commit history a bit more authentic, but it's also possible to rebase your own commits on top of an updated master and force pushing.

P.S. In general I'm more in favor of incremental commits instead of squashing and force pushing when fixing things. By using incremental commits it's easy to come back to a PR and see what had changed since last review. By squashing and force pushing, I have absolutely no clue what changes were made after Taus review 😕

Without a concrete ExternalStringKind class, there will be no flow for ExternalStringKind by default.

porcupineyhairs · 2020-07-21T12:37:17Z

@RasmusWL Thanks for helping me out with this here. I have merged your other PR and pushed the changes again. Sorry I had to force push again for some reason.

The tests are now pass on my local node.

RasmusWL

Overall really good work 👍

I found some minor things that I would like to have fixed. If you go to the Files changed tab, you can batch them all up and make a single commit from the web UI (if you agree with my suggested changes of course 😄)

Besides that (and maybe fixing up expected results), we really need a .qhelp file for python/ql/src/experimental/CWE-074/TemplateInjection.ql. I would like it to explain why this is a problem, give a concrete example of vulnerable code for one project (I would go with jinja), explain how this problem can be mitigated, and show code for fixing the concrete example (for jinja, there is a sandboxed environment). It would be great if it could list the libraries supported, but no need to give examples for all of them 😄

I noted that currently python/ql/test/experimental/CWE-074/TemplateInjection.expected doesn't find any results for

python/ql/test/experimental/CWE-074/BottleSsti.py
python/ql/test/experimental/CWE-074/Chameleon.py
python/ql/test/experimental/CWE-074/Genshi.py

But since the sinks all show up nicely in python/ql/test/experimental/semmle/python/templates, I'm all good.

I'm hopeful for python/ql/test/experimental/CWE-074/JinjaSsti.py and python/ql/test/experimental/CWE-074/TRender.py, once the test files has been fixed 😊 (hopeful in the sense that they should be able to give results for TemplateInjection.expected.

Some of the SSTI examples in the other tests files also aren't covered (for example, only 1/3 in django). That's also acceptable, and many of them have even been marked with TODO in the ql code. Very nice to have examples to work from in the future 💪

python/ql/src/experimental/semmle/python/templates/Cheetah.qll

python/ql/src/experimental/semmle/python/templates/Jinja.qll

python/ql/test/experimental/CWE-074/FlaskTemplate.py

python/ql/test/experimental/CWE-074/JinjaSsti.py

python/ql/test/experimental/CWE-074/TRender.py

Co-authored-by: Rasmus Wriedt Larsen <[email protected]>

Moved things around so there is only a single `<example>` tag (and had to rewrite contents a bit).

RasmusWL

Looks good to me now 👍 (pending the tests of course)

RasmusWL · 2020-07-24T18:56:07Z

This PR is ready to be merged, but I can't do it right now, so it'll have to wait until the right people are back from vacation 😅 🌴

porcupineyhairs · 2020-07-24T18:58:48Z

@RasmusWL okay but you only incorporated a few doc changes.

commit 768e5190a1c9d40a4acc7143c461c3b114e7fd59 Merge: e9a36b252 89c2b6dc4 Author: Jonas Jensen <[email protected]> Date: Fri Aug 14 15:59:46 2020 +0200 Merge pull request #4080 from geoffw0/split C++: Split test file stl.cpp commit 89c2b6dc4b7ae899dc63cc4d5ed008efb8e35c49 Merge: a839f1fae e9a36b252 Author: Geoffrey White <[email protected]> Date: Fri Aug 14 14:03:34 2020 +0100 Merge remote-tracking branch 'upstream/master' into split commit e9a36b25243bc92e763511e83764c035611c4968 Merge: 8cbd4974a a1a1218f9 Author: CodeQL CI <[email protected]> Date: Fri Aug 14 13:17:45 2020 +0100 Merge pull request #4062 from tausbn/python-fix-unknown-import-star Approved by yoff commit 8cbd4974ae014db774633df7e716b83301fd23e4 Merge: e01e702f4 955693784 Author: Taus <[email protected]> Date: Fri Aug 14 12:45:55 2020 +0200 Merge pull request #3981 from yoff/SharedDataflow_Classes Python: Dataflow, test magic methods commit e01e702f46ffd4505043f12297828b7a3cacf5ba Merge: 82f982696 a6bcbe797 Author: Jonas Jensen <[email protected]> Date: Fri Aug 14 12:42:12 2020 +0200 Merge pull request #4060 from bgianfo/patch-1 C++: Detect GoogleTest tests cases in FNumberOfTests.ql commit 9556937840999239728c141e6549655b5f599795 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Aug 14 11:29:58 2020 +0200 Python: address review comments commit 8d49ad73252a133262499544a66581b16d2f548e Author: yoff <[email protected]> Date: Fri Aug 14 10:53:37 2020 +0200 Update python/ql/test/experimental/dataflow/coverage/datamodel.py Co-authored-by: Taus <[email protected]> commit 4b336e9b01f589b3d18db8d15cc40ec764795fd0 Author: yoff <[email protected]> Date: Fri Aug 14 10:53:10 2020 +0200 Update python/ql/test/experimental/dataflow/coverage/classes.py Co-authored-by: Taus <[email protected]> commit 82f982696699c12f3b1e6d59d40d0325cab6e436 Merge: ed06604b4 21246624b Author: CodeQL CI <[email protected]> Date: Fri Aug 14 08:34:48 2020 +0100 Merge pull request #4044 from aschackmull/java/xsssink-printwriter-format Approved by aibaars commit ed06604b464f58fee5532b9be1af52fbcb538349 Merge: de87f8fc4 498b350ad Author: Robert Marsh <[email protected]> Date: Thu Aug 13 16:59:47 2020 -0400 Merge pull request #4045 from geoffw0/plus C++: Model more of std::string in models. commit a6bcbe79743426a2bb4cbbfa57b3b4f04a8f7ee1 Author: Brian Gianforcaro <[email protected]> Date: Thu Aug 13 00:13:18 2020 +0000 C++: Detect GoogleTest tests cases in FNumberOfTests.ql Co-authored-by: Jonas Jensen <[email protected]> commit 498b350addaf843b55b85762ff70cb0e5bdd1c00 Merge: 734933300 de87f8fc4 Author: Geoffrey White <[email protected]> Date: Thu Aug 13 18:21:28 2020 +0100 Merge remote-tracking branch 'upstream/master' into plus commit a839f1fae5c5e962bc38c950871b9de90a7dcc8c Author: Geoffrey White <[email protected]> Date: Thu Aug 13 18:17:02 2020 +0100 C++: Split off stringstream.cpp. commit 49d2f66ddbd52981570d5742bbe8c24dd828a2df Author: Geoffrey White <[email protected]> Date: Thu Aug 13 18:08:58 2020 +0100 C++: Tidy up sources and sinks. commit f343eb91431b4369aed484fbf2831cbbdd37e5fc Author: Geoffrey White <[email protected]> Date: Thu Aug 13 17:47:25 2020 +0100 C++: Split stl.cpp into string.cpp and vector.cpp. commit 5d7f771933465e4417ec73561aff2280d0d4507c Author: Geoffrey White <[email protected]> Date: Thu Aug 13 17:43:21 2020 +0100 C++: Split off stl.h from stl.cpp. commit de87f8fc4240e35680343de16af775da851388f3 Merge: 93f95b1c2 f5abf74e0 Author: Robert Marsh <[email protected]> Date: Thu Aug 13 12:33:52 2020 -0400 Merge pull request #4057 from geoffw0/sal C++: SAL.qll QLDoc and cleanup commit 93f95b1c2246effa2a6eaa02a1e92c241cf82880 Merge: ecbbcc2f6 5e5a112c3 Author: Geoffrey White <[email protected]> Date: Thu Aug 13 16:59:31 2020 +0100 Merge pull request #4053 from jbj/SimpleRangeAnalysis-mul C++: SimpleRangeAnalysis: unsigned multiplication commit ecbbcc2f617330ba2a5abafc74387dd768824b54 Merge: 6c60589db cca2d9d82 Author: Anders Schack-Mulligen <[email protected]> Date: Thu Aug 13 16:40:28 2020 +0200 Merge pull request #4066 from Marcono1234/marcono1234/simplify-VarAccess-isLValue [Java] Simplify VarAccess.isLValue() commit 7349333006343c4e9a1768b4a8e25d87b2d6a53e Author: Geoffrey White <[email protected]> Date: Thu Aug 13 14:44:51 2020 +0100 C++: Taint through char append. commit 3c0e7a709f4289cde3222b3705d124279996a407 Author: Geoffrey White <[email protected]> Date: Thu Aug 13 14:22:11 2020 +0100 C++: Add a test of append with CharT. commit 732a8fa4c9c17fa7a463d397d87d1fca353f59b9 Author: Geoffrey White <[email protected]> Date: Thu Aug 13 12:44:54 2020 +0100 C++: Add another member function. commit 6c60589dbde44f2b3be5d3f41844c2edc132d3de Merge: 3469ad7ca 2c7bb8c51 Author: CodeQL CI <[email protected]> Date: Thu Aug 13 14:02:18 2020 +0100 Merge pull request #4063 from erik-krogh/noJsMsg Approved by esbena commit 3469ad7ca624a7b9af7cb05224e16925acbeb842 Merge: 8891ae70b d6e9b07a9 Author: Anders Schack-Mulligen <[email protected]> Date: Thu Aug 13 13:35:52 2020 +0200 Merge pull request #3600 from luchua-bc/java-sensitive-log4j2-logging Add Log4J 2 and a new search string secret commit cca2d9d8253253a8a76f04e548b0169395de489e Author: Marcono1234 <[email protected]> Date: Thu Aug 13 13:12:57 2020 +0200 Simplify VarAccess.isLValue() commit 2c7bb8c51f55795d1820650d1f5940ba79516e51 Author: Erik Krogh Kristensen <[email protected]> Date: Thu Aug 13 11:18:27 2020 +0200 adjust error message when files have been found while extracting commit a1a1218f95f1161aa9f48bf593ff97d8324ea99b Author: Taus Brock-Nannestad <[email protected]> Date: Thu Aug 13 10:50:28 2020 +0200 Python: Ignore `from foo import *` when `foo` is absent. commit dc5c0f8e7a72970698a53525ab27b468a18144e4 Author: Taus Brock-Nannestad <[email protected]> Date: Thu Aug 13 10:49:11 2020 +0200 Python: Add test case for missing modules commit f5abf74e0f3ff43763d2b17dbad5ffaa91d96873 Author: Geoffrey White <[email protected]> Date: Thu Aug 13 09:05:22 2020 +0100 Update cpp/ql/src/Microsoft/SAL.qll Co-authored-by: Robert Marsh <[email protected]> commit 8891ae70b67a2a0fc9d3aa603c57c9aa89f37c3c Merge: 66541f260 6f83c55eb Author: Anders Schack-Mulligen <[email protected]> Date: Thu Aug 13 09:53:57 2020 +0200 Merge pull request #3938 from lcartey/java/untrusted-data-to-external-api Java: Untrusted data used in external APIs commit 5e5a112c364261ff1a01029abe4eabfcab0e01dc Author: Jonas Jensen <[email protected]> Date: Thu Aug 13 08:37:13 2020 +0200 C++: Change note commit 2655616a0a31123dfac52d9fb4db94cd0d18ccec Author: Geoffrey White <[email protected]> Date: Wed Aug 12 16:59:15 2020 +0100 C++: Autoformat. commit 9719da864300d3746073acbf2b6168a1b272ca54 Author: Geoffrey White <[email protected]> Date: Wed Aug 12 16:58:50 2020 +0100 C++: Move a class that looks like it's intended to be public (and is used outside of the library) above the 'Implementation details' threshold. commit d444778535984753d04486154f7be016a7bba762 Author: Geoffrey White <[email protected]> Date: Wed Aug 12 16:57:43 2020 +0100 C++: Make a few things in SAL.qll private where it looks like that was intended (and they're not used outside the file). commit aa6cb51bbac9f2fca2b7d6e558d9f4e1340c0d2f Author: Geoffrey White <[email protected]> Date: Wed Aug 12 16:55:26 2020 +0100 C++: QLDoc SAL.qll. commit 6f83c55ebde327f2444921a65915378ffd5290d5 Author: [email protected] <[email protected]> Date: Wed Aug 12 13:48:59 2020 +0100 Java: Switch to `low` as a precision Code Scanning doesn't support "very-low" commit 66541f260bca41de238ede8d944437504268877e Merge: aa9dfa0d6 656ff9c44 Author: CodeQL CI <[email protected]> Date: Wed Aug 12 13:28:18 2020 +0100 Merge pull request #4012 from erik-krogh/getId Approved by asgerf, esbena commit 56ff8cf0844ad235aacccd66f092db2b88f05434 Author: Luke Cartey <[email protected]> Date: Wed Aug 12 13:12:06 2020 +0100 Apply suggestions from code review Co-authored-by: Felicity Chapman <[email protected]> commit aa9dfa0d6f452ee39125e8220a720ae50cc4063f Merge: e80cc6321 5a3acc231 Author: CodeQL CI <[email protected]> Date: Wed Aug 12 13:07:22 2020 +0100 Merge pull request #4039 from intrigus-lgtm/patch-3 Approved by erik-krogh commit b99ca601543cb4db2fa48ae32dee0b23f99e2fd6 Author: Geoffrey White <[email protected]> Date: Wed Aug 12 12:43:28 2020 +0100 C++: Address review comments. commit b4679cb8cf510a2f56175225690a085a6c98a458 Author: Jonas Jensen <[email protected]> Date: Wed Aug 12 13:09:23 2020 +0200 C++: Autoformat fixup commit 93d8d8eb1dbf13aaf8a92ff7ffa3559e472b0251 Author: Jonas Jensen <[email protected]> Date: Tue Aug 11 16:28:53 2020 +0200 C++: Demonstrate range analysis MulExpr bugs Unless these issues can be reproduced in far less contrived code, I don't think they will cause problems in practice. commit 6b6172fa5bd12d74f258c37b5fd7429d387fbf96 Author: [email protected] <[email protected]> Date: Wed Aug 12 09:21:14 2020 +0100 Java: ExternalAPIs: Further review comments - Extra qldoc - Remove unnecessary module commit 1ee96a4b4f43b249a051c05b1f6c0c40a259cc94 Author: Jonas Jensen <[email protected]> Date: Tue Aug 11 11:55:39 2020 +0200 C++: SimpleRangeAnalysis: unsigned multiplication commit e80cc63219275d2dbcc9ebb77cd12fa8383f8f09 Merge: 0476b97f6 dcfbb8667 Author: Robert Marsh <[email protected]> Date: Tue Aug 11 15:49:31 2020 -0400 Merge pull request #3861 from dilanbhalla/privatedata C++: Private Data File/Buffer Writes commit a655124213f9111b055a07ee012526a2d24f6883 Author: Geoffrey White <[email protected]> Date: Tue Aug 11 17:28:31 2020 +0100 C++: I think this is more correct. commit 50558257fc98a567e2e31288fa8cbf5b06428382 Author: Geoffrey White <[email protected]> Date: Tue Aug 11 17:05:49 2020 +0100 C++: Change note. commit 128b8328b980a49e553b654772bf4ed06ce58578 Author: Geoffrey White <[email protected]> Date: Tue Aug 11 16:16:02 2020 +0100 C++: Autoformat. commit f62ad750481b9d0d72147e3d221a859bf3c1aa5b Author: Geoffrey White <[email protected]> Date: Tue Aug 11 15:25:48 2020 +0100 C++: Taint through std::string operator+=. commit cf6f53082323e133e701c08091508e39476ea165 Author: Geoffrey White <[email protected]> Date: Tue Aug 11 15:02:36 2020 +0100 C++: Taint through std::string operator+. commit a57dfd6b678605d0066ad84bed1569063bebd12f Author: Geoffrey White <[email protected]> Date: Tue Aug 11 11:31:28 2020 +0100 C++: Taint through std::string append. commit f824a893ca6dd7902e8f958a46704b10c8531c48 Author: Geoffrey White <[email protected]> Date: Mon Aug 10 16:46:47 2020 +0100 C++: Add test cases for appending strings. commit 030ab4f626064b5f81395674fb5499f6eaa088ef Author: Geoffrey White <[email protected]> Date: Mon Aug 10 10:56:58 2020 +0100 C++: Add string append operators to the test (changes layout). commit 2ea25b9d90502cf08efa7246762f4db7f4e04a0e Author: Jonas Jensen <[email protected]> Date: Tue Aug 11 16:45:42 2020 +0200 C++: Precise printing of integer bounds The pretty-printing of a QL `float` didn't include enough digits to tell whether a large number had accurate bounds. The `toString` value of a float appears to be more precise. commit e1d4b989239295de2850f8df9e70a12e2afee645 Author: [email protected] <[email protected]> Date: Tue Aug 11 15:28:55 2020 +0100 Java: Add further missing </p> to qhelp commit 8a65dd2cd6551a8b396825960518faa752eb9d47 Author: [email protected] <[email protected]> Date: Tue Aug 11 15:28:06 2020 +0100 Java: Address review comments commit 656ff9c441861021e54b55f9299b3157d8f5163d Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 11 15:40:30 2020 +0200 autoformat commit 21246624b4aa1fee03b6a4088898bc35a8dbfb82 Author: Anders Schack-Mulligen <[email protected]> Date: Tue Aug 11 15:15:39 2020 +0200 Java: Add PrintWriter.format as XSS sink. commit dd4d00293d07f140f53ef524930b4edc62e1728c Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 14:16:02 2020 +0200 Python: remaining class tests commit 394991164fecbe11586432d3d92db1b16c4a7d36 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 13:05:35 2020 +0200 Python: Update test expectations commit f834d71bab3c93d7a6f0cdb929fbffdb468e34a2 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 11:22:11 2020 +0200 Python: split out data model tests commit 2c5de7f50e3f5ee91d06945ffbfad74859e0e31a Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 10:48:23 2020 +0200 Python: fix r/l confusion commit 0476b97f638c558d5bbb87a95f1788fc3598c019 Merge: 1f432dc45 7bd5464b0 Author: Jonas Jensen <[email protected]> Date: Tue Aug 11 10:09:37 2020 +0200 Merge pull request #3789 from dilanbhalla/cpp C++ Memory Unsafe Functions commit 12dfc4afd9673e619a7acc44205c5209f1c452bb Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 08:16:49 2020 +0200 Python: clean up validity check code commit 3929e013505a0a58f3469cfe625990e3a68d1617 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 08:10:46 2020 +0200 Python: tests for async iterators/context managers commit 681657f0706a6583c01c14d53cf6d8b1417e5914 Merge: 5da37f5cf 1f432dc45 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 11 07:24:17 2020 +0200 Merge branch 'master' of github.com:github/codeql into SharedDataflow_Classes commit 5a3acc231efce2442494403ec86e855f59994ac5 Author: intrigus-lgtm <[email protected]> Date: Tue Aug 11 01:01:53 2020 +0200 Fix typo commit 7bd5464b01fc20161f78857b22fc7f810fbe39db Author: dilanbhalla <[email protected]> Date: Mon Aug 10 15:43:16 2020 -0700 Update cpp/ql/src/experimental/Security/CWE/CWE-120/MemoryUnsafeFunctionScan.qhelp Co-authored-by: intrigus-lgtm <[email protected]> commit 4dcaa7be57311a69e9adef640d5d068c19949cee Author: dilanbhalla <[email protected]> Date: Mon Aug 10 15:30:09 2020 -0700 pr fixes commit dcfbb866745ab0fb9d88ecb5a78dfd9687ac8736 Author: dilanbhalla <[email protected]> Date: Mon Aug 10 15:14:12 2020 -0700 pr fixes commit 5da37f5cf4c0797feb8b1394d425c30e1309e4c7 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Mon Aug 10 17:07:00 2020 +0200 Python: Update test expectations commit dc5167bbe7502829bb79910f9d8a048e512422cb Author: Erik Krogh Kristensen <[email protected]> Date: Mon Aug 10 11:52:45 2020 +0000 autoformat commit 1f432dc45fbf809f29dcb3904b2f08f9b48de3f8 Merge: 7c4e10df1 3cf11eca2 Author: Jonas Jensen <[email protected]> Date: Mon Aug 10 12:10:29 2020 +0200 Merge pull request #4023 from geoffw0/loopdir C++: Exclude decrementing unsigned counters from inconsistentLoopDirection.ql commit a963f15100f2fdd5b5d0b217091fb29d2cf6bf0e Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Mon Aug 10 11:54:24 2020 +0200 Python: format strings are unnecessary and mess up For some reason, we got no results when format strings were present. commit 85de5aa16b35d18d78414212269fa286ea97b576 Author: Erik Krogh Kristensen <[email protected]> Date: Mon Aug 10 10:51:21 2020 +0200 add `deprecated` modifier Co-authored-by: Asger F <[email protected]> commit 959c6315c41ae2dfa9a3445d3ee6ca863ad8a1f3 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Mon Aug 10 09:24:45 2020 +0200 Python: update reference to fix tests commit 410b6965625ecb401e759c80caf3de8025045e89 Author: Erik Krogh Kristensen <[email protected]> Date: Mon Aug 10 09:09:29 2020 +0200 add deprecated aliases `getId()` forwarding to `getIdentifier()` commit 639d914a47e014513b82e6d67bac673df518caec Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Mon Aug 10 08:58:16 2020 +0200 Python: test Awaitable, framework for async test commit 7c4e10df1793da354fe720e54f70f104b11690e8 Merge: 5874ecc28 aab2e6f80 Author: CodeQL CI <[email protected]> Date: Mon Aug 10 07:50:21 2020 +0100 Merge pull request #4014 from erik-krogh/stringify Approved by esbena commit 02478774c3f829f4318b205003e5a18d7cf3fbea Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Mon Aug 10 08:11:25 2020 +0200 Python: tests for context managers commit 5b7c7f933cc98a949b75e8840e9d6e6ec2930fe4 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Sat Aug 8 00:31:29 2020 +0200 Python: tests for numeric classes commit f6d6f91a42429be198e7417153c1f3f59ada611a Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Aug 7 23:39:42 2020 +0200 Python: tests for containers commit aff4535965d4cc70b79a45307ebbc7d1bb38122c Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Aug 7 23:07:58 2020 +0200 Python: fix tests for descriptors commit 5874ecc28b0b0c623dbb405a9a619c4d0cabeab3 Merge: 1b0cfc96b b821f918e Author: Arthur Baars <[email protected]> Date: Fri Aug 7 21:39:23 2020 +0200 Merge pull request #3976 from luchua-bc/java-unsecure-basic-auth Java: Insecure basic authentication commit d84294df3d0253d588736868c4d18b316c4b7711 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Aug 7 20:07:02 2020 +0200 Python: Check that tests are valid commit 3cf11eca2af3db744452a236cde1b3484cf4df1d Author: Geoffrey White <[email protected]> Date: Fri Aug 7 17:28:51 2020 +0100 C++: And more test cases. commit aab2e6f803578ccbe8fd0ffaf68ffe54f6966138 Author: Erik Krogh Kristensen <[email protected]> Date: Fri Aug 7 18:20:22 2020 +0200 update name of test file commit 7670e7da979b594aab5e69da9d8e4de94f2f4571 Author: Erik Krogh Kristensen <[email protected]> Date: Fri Aug 7 18:17:46 2020 +0200 retarget change-note for 1.26 commit 7d491afaebca2d869352a1c17105be45a853510e Author: Geoffrey White <[email protected]> Date: Fri Aug 7 17:05:13 2020 +0100 C++: More test cases. commit b7d2e0ca63e086ba296792ef6e99440f06f80b98 Author: Geoffrey White <[email protected]> Date: Fri Aug 7 14:18:28 2020 +0100 C++: Make all the tests meaningful. commit 1b0cfc96b3fca38d4875df6d21ea918d477ac658 Merge: 0ba59210f 67c432028 Author: CodeQL CI <[email protected]> Date: Fri Aug 7 13:44:23 2020 +0100 Merge pull request #4015 from erik-krogh/nonAbstract Approved by asgerf commit 0ba59210fcfaa5aeab57fd78ce18dedc2b2597fd Merge: e3a12c5fe c8911ab97 Author: Geoffrey White <[email protected]> Date: Fri Aug 7 13:41:49 2020 +0100 Merge pull request #4020 from jbj/taint-range-based-for-ast C++: Taint through RangeBasedForStmt (AST only) commit e3a12c5feab46b11ac0ee1b693669716a729910f Merge: c20d76349 0e54b498b Author: Anders Schack-Mulligen <[email protected]> Date: Fri Aug 7 13:06:13 2020 +0200 Merge pull request #4004 from Marcono1234/patch-2 [Java] Clarify Wildcard.hasUpperBound() doc commit c20d763490ccf4ea1ee9f84fca2cd20121587ebf Merge: 77db87efb 3682a902d Author: Tom Hvitved <[email protected]> Date: Fri Aug 7 12:54:10 2020 +0200 Merge pull request #3951 from raulgarciamsft/users/raulgarciamsft/dataset_serialization C#: DataSet serialization commit c8911ab973b4324a73da73c91bd567188f0a71fe Author: Jonas Jensen <[email protected]> Date: Fri Aug 7 12:40:00 2020 +0200 C++: Test range-based-for with std::vector too commit 77db87efb7d632f7fb0f74a42781ac6f7f6516ee Merge: c177eff3d 3ae3a879d Author: Anders Schack-Mulligen <[email protected]> Date: Fri Aug 7 11:57:51 2020 +0200 Merge pull request #3968 from rvermeulen/java-importable-cwe-090 Java: Move LDAP injection sinks, sanitizers, and additional taint steps to importable location commit c177eff3d87bad1bc51339d37d8a76a65f7049f8 Merge: 05e956b37 f9de8eb3b Author: Arthur Baars <[email protected]> Date: Fri Aug 7 10:31:38 2020 +0200 Merge pull request #4027 from aschackmull/java/weak-crypto-precision Java: Update precision of java/weak-cryptographic-algorithm. commit f9de8eb3b452f615ce475c0924ba8f83d07f9318 Author: Anders Schack-Mulligen <[email protected]> Date: Fri Aug 7 09:40:21 2020 +0200 Java: Update precision of java/weak-cryptographic-algorithm. commit 05e956b374633ee3058b5f9aa227aace8dcaf88e Merge: 205dd1aea f16c26339 Author: Anders Schack-Mulligen <[email protected]> Date: Fri Aug 7 09:32:43 2020 +0200 Merge pull request #4022 from aibaars/int-to-long Java: remove security tag from java/integer-multiplication-cast-to-long commit 0e54b498b7f3b4962928e234360c62c5af7edb71 Author: Marcono1234 <[email protected]> Date: Sun Aug 2 15:57:33 2020 +0200 Clarify Wildcard.hasTypeBound() doc commit f477e09190705dcb69a46ec51e2714dab8cf4f4f Author: Marcono1234 <[email protected]> Date: Sun Aug 2 15:02:51 2020 +0200 Clarify Wildcard.hasUpperBound() doc commit 3ae3a879d2491d46032e2f00fb346b1ee7688976 Author: Remco Vermeulen <[email protected]> Date: Thu Aug 6 23:00:03 2020 +0200 Fix qldoc grammar and style mistakes Co-authored-by: intrigus-lgtm <[email protected]> commit 3682a902de4552f3c853c954cf7c57226ef2e0b6 Author: Raul Garcia <[email protected]> Date: Thu Aug 6 12:09:02 2020 -0700 Update csharp/ql/src/experimental/Security Features/Serialization/DataSetSerialization.qhelp Co-authored-by: James Fletcher <[email protected]> commit 6e18be43f3bbbc0cf85872b635caa43daefed2e4 Author: Geoffrey White <[email protected]> Date: Thu Aug 6 19:27:12 2020 +0100 C++: Change note. commit 0281456948fe1fe4b6a65b038efa47dc0fff64e3 Author: Geoffrey White <[email protected]> Date: Thu Aug 6 19:21:06 2020 +0100 C++: Add a 1.26 change note file (what happened to the templates?) commit 0534c69c767cad1fc22c831853da9b511ba742ca Author: Geoffrey White <[email protected]> Date: Thu Aug 6 19:11:46 2020 +0100 C++: Autoformat. commit 0b5b7fa09589fc05de9666cdc02162744d05a8ad Author: Geoffrey White <[email protected]> Date: Thu Aug 6 19:06:42 2020 +0100 C++: Fix another edge case. commit b3f3f6d95ac2b3bd54da9e7395e067e037ccd5fc Author: Geoffrey White <[email protected]> Date: Thu Aug 6 18:58:31 2020 +0100 C++: Fix edge case. commit cbf30e37ed4e47ea3fe63679aa3bf8c196015181 Author: Geoffrey White <[email protected]> Date: Thu Aug 6 18:50:18 2020 +0100 C++: Fix the issue. commit a7564c9e0eb206b84368de663767ca9912f393b5 Author: Geoffrey White <[email protected]> Date: Thu Aug 6 18:28:41 2020 +0100 C++: Add a test of unsigned count-down loops. commit f16c2633935fd4e0caa22cbbf3c31b8fc8b908b8 Author: Arthur Baars <[email protected]> Date: Thu Aug 6 17:42:01 2020 +0200 Java: remove security tag from java/integer-multiplication-cast-to-long commit 3db1ceeb70cbe8dc04dfa90ecd222d9f16f8df73 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Thu Aug 6 15:42:14 2020 +0200 Python: format ql commit 614103c3b6bcea797cdeaeda2733862fa5cad0ec Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Thu Aug 6 15:40:41 2020 +0200 Python: Test calls rather than flows commit 7cc877cbbbf0d9a79e993380ff4f964520a0535c Author: Jonas Jensen <[email protected]> Date: Thu Aug 6 15:34:23 2020 +0200 C++: Taint through RangeBasedForStmt (AST only) commit 408db412dc65a804ac6ed9a53cd500736450a0bf Author: Remco Vermeulen <[email protected]> Date: Thu Aug 6 13:29:02 2020 +0200 Add missing predicate qldoc commit 5a819422c1f369864f1bfce9820887636c54c658 Author: Remco Vermeulen <[email protected]> Date: Thu Aug 6 12:02:34 2020 +0200 Reuse `Unit` class from `TaintTracking` commit 7f7ad88deafa1eeeb85e2a66cd6f156139fc4b34 Author: Remco Vermeulen <[email protected]> Date: Thu Aug 6 11:35:03 2020 +0200 Limit LdapAdditionalTaintStep to Ldap configuration commit 205dd1aeadd6b2647aeab3fac700b13f560338e7 Merge: 5f635aca3 1011325cf Author: Anders Schack-Mulligen <[email protected]> Date: Thu Aug 6 11:21:39 2020 +0200 Merge pull request #3881 from intrigus-lgtm/more-pathcreations Java: Centralize and model additional path creations. commit b821f918e5958d7405a6bf5f2861f3853b384dc4 Author: luchua-bc <[email protected]> Date: Thu Aug 6 01:53:29 2020 +0000 Address issues with matching empty host and host in a concatenated string commit 9a8eed84405d1d42ca1ed298cbdf6fae97e427ab Author: luchua-bc <[email protected]> Date: Wed Aug 5 19:57:31 2020 +0000 Enhance address match commit 1011325cf7d5466057a00e3efa086e11a1ecb8b4 Author: intrigus <[email protected]> Date: Wed Aug 5 21:45:41 2020 +0200 Accept test changes. commit a1411407c18c51ef9ec2857d0af974e277d4f63b Author: Remco Vermeulen <[email protected]> Date: Wed Aug 5 17:07:05 2020 +0200 Consolidate sanitizers into default sanitizer commit 0c09d66d43d60d257492d3c9b121b9e1e7d93b1f Author: Remco Vermeulen <[email protected]> Date: Wed Aug 5 16:53:50 2020 +0200 Consolidate different sinks into a default sink. commit f1dc36244c4733a4634131045b5e15a7e6333126 Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 15:12:59 2020 +0200 update tests and queries that used getId() commit e642808a7576ec49226932bce70d55f84e53b9a5 Author: yoff <[email protected]> Date: Wed Aug 5 15:12:27 2020 +0200 Update python/ql/test/experimental/dataflow/coverage/classes.py Co-authored-by: intrigus-lgtm <[email protected]> commit 5f635aca36fd09d38b366076bfcf1f735fdc40e9 Merge: 9e78341e4 9f5c37cca Author: Jonas Jensen <[email protected]> Date: Wed Aug 5 14:35:05 2020 +0200 Merge pull request #3768 from geoffw0/copymove C++: Clean up ConversionConstructor. commit a89624698d3fccffa34b4cab8c819f7ad0bc0764 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Wed Aug 5 14:28:28 2020 +0200 Python: format ql commit 81ad4552c9e2567c9177079f1411587de3eb85a7 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Wed Aug 5 13:30:30 2020 +0200 Python: full list of magic methods to be tested commit cc5ef4d5e19b282352f5b67d978473618ba734f7 Author: Erik Krogh Kristensen <[email protected]> Date: Wed Aug 5 13:22:41 2020 +0200 rename JsonSerializeCall to JsonStringifyCall commit b43d410ab17b8a8d1c20327017553e39d7f1a965 Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 14:54:34 2020 +0200 add change log for JSON serializers commit f70cb2e7b32453d51f605aa24db52792980cf053 Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 14:48:11 2020 +0200 add test for new JSON serializers commit 5a3f67a68238b6616416154595e8c7b7bca18f6d Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 14:35:09 2020 +0200 introduce model for JSON.stringify and similar libraries commit 9e78341e433ea5e225dfb9598f9cb26d6b5fb952 Merge: 32d9d270f c2733ad22 Author: Anders Schack-Mulligen <[email protected]> Date: Wed Aug 5 10:16:00 2020 +0200 Merge pull request #3928 from rvermeulen/java-importable-cwe-113 Java: Move `HeaderSplittingSink` and `WhitelistedSource` into importable library commit 67c4320287400afcc99ffed5cb7057b2ccfeabea Author: Erik Krogh Kristensen <[email protected]> Date: Wed Aug 5 10:03:46 2020 +0200 make JumpStmt non abstract commit 016bdc161486fd6e1923202e8208f6bf1187f50b Author: Erik Krogh Kristensen <[email protected]> Date: Wed Aug 5 09:59:30 2020 +0200 make ControlStmt non abstract commit 32d9d270fc55bf2706c8ab8ea642875784a118a5 Merge: ea0896c78 c585b2e48 Author: Anders Schack-Mulligen <[email protected]> Date: Wed Aug 5 09:31:01 2020 +0200 Merge pull request #3948 from aibaars/java-3941 Java: stack trace exposure: address false positives commit ea0896c78b95e54584f46d11cbb06b0cd4a8d7dc Merge: 63115a36f 4990d0049 Author: Jonas Jensen <[email protected]> Date: Wed Aug 5 09:11:53 2020 +0200 Merge pull request #3999 from MathiasVP/mathiasvp/range-based-for-loop-taint-tests C++: Add tests for taint through range-based for loops commit aa27eaf7e0dc2dd7f109b4ca2dcc645c84722ab2 Author: Raul Garcia (MSFT) <[email protected]> Date: Tue Aug 4 15:50:58 2020 -0700 Addrssing the comments from https://github.com/github/codeql/pull/3951#discussion_r464894547 that I missed previously commit 9f5c37ccaae688e4317540f0a49f4d984933b860 Merge: c4940aaa8 63115a36f Author: Geoffrey White <[email protected]> Date: Tue Aug 4 15:41:27 2020 +0100 Merge branch 'master' into copymove commit 5727e6f9f8c76bf7f0f797c09ade540ad9457ee1 Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 16:10:49 2020 +0200 make CompoundAssignExpr non-abstract commit cf3f275aa126c25c85a298c4c8620b147592ea3e Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 16:02:32 2020 +0200 make DestructuringPattern non-abstract commit d7c08f732de4296a81a0c315d670a9d5aab41922 Merge: d32e2772a 63115a36f Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Aug 4 16:01:42 2020 +0200 Merge branch 'master' of github.com:github/codeql into SharedDataflow_Classes commit 63115a36f7445e31bb3bacb9c2941c831c8da9b5 Merge: 68441bdf9 07f1e133f Author: Tom Hvitved <[email protected]> Date: Tue Aug 4 14:33:54 2020 +0200 Merge pull request #3994 from hvitved/csharp/dataflow/library-aps-adjust C#: More type-based adjustment of library-flow access paths commit 0867c5567ebfcea5a05ee0ca18cefed05c24c399 Author: Erik Krogh Kristensen <[email protected]> Date: Tue Aug 4 13:22:19 2020 +0200 rename `getId()` to `getIdentifier()` commit 68441bdf99adf0a2ce1ccd7b101dbb94f832e539 Merge: cdea0f05b 5942bc6a4 Author: Anders Schack-Mulligen <[email protected]> Date: Tue Aug 4 12:12:38 2020 +0200 Merge pull request #3987 from Marcono1234/patch-1 [Java] Improve InsecureJavaMail.qhelp references commit 5a96ee1a7bf92f305055b4f3918dc6fb9d2bd5c4 Author: Luke Cartey <[email protected]> Date: Tue Aug 4 09:41:40 2020 +0100 Remove parameter names from signatures Co-authored-by: Marcono1234 <[email protected]> commit 368572f1f066b6237201210d17de95b9903a520e Author: Luke Cartey <[email protected]> Date: Tue Aug 4 09:40:59 2020 +0100 Update java/ql/src/Security/CWE/CWE-020/UntrustedDataToExternalAPI.qhelp Co-authored-by: Marcono1234 <[email protected]> commit 7928a024247bbd26c6ad888ab7856a9d49966444 Author: Luke Cartey <[email protected]> Date: Tue Aug 4 09:40:51 2020 +0100 Add missing full stop. Co-authored-by: Marcono1234 <[email protected]> commit e0c081a2afedcbf1822380f8a8c42280daf5c7ab Author: Luke Cartey <[email protected]> Date: Tue Aug 4 09:40:28 2020 +0100 Add missing `</p>` tag Co-authored-by: Felicity Chapman <[email protected]> commit cdea0f05b0cf780f7aea9157f47532ff540be1b9 Merge: 71933a4d8 b1e604b49 Author: Anders Schack-Mulligen <[email protected]> Date: Tue Aug 4 10:27:22 2020 +0200 Merge pull request #3946 from aibaars/util-collections-2 Java: Clean up ContainerFlow: address outstanding comments commit c52064af78945b2ed0953132797a4eb0fd6ddc38 Author: Raul Garcia (MSFT) <[email protected]> Date: Mon Aug 3 16:39:41 2020 -0700 Fixing problems based on CR feedback. https://github.com/github/codeql/pull/3951#pullrequestreview-458987208 commit 71933a4d8a32d32f085f14b7b44f41d1cdcae2e4 Merge: 8855ab8c8 d1db7b350 Author: Tom Hvitved <[email protected]> Date: Mon Aug 3 19:33:26 2020 +0200 Merge pull request #4009 from hvitved/csharp/extractor-pack-files C#: Add CodeQL extractor pack files commit 8855ab8c8cab2efec26a6a45bb40e26912dd95a7 Merge: a4f8b19ae 3487ec17d Author: CodeQL CI <[email protected]> Date: Mon Aug 3 15:40:05 2020 +0100 Merge pull request #3835 from Raz0r/js/xss-protocol-sinks Approved by erik-krogh commit a4f8b19ae4be4b6943a32e82f644bc83eb7bf173 Merge: c8e5db189 f5cc14f98 Author: CodeQL CI <[email protected]> Date: Mon Aug 3 15:38:51 2020 +0100 Merge pull request #3876 from erik-krogh/CWE078-Correctness Approved by esbena commit d1db7b350fbab7e52fbd2080b730a7a68aed5099 Author: Tom Hvitved <[email protected]> Date: Mon Aug 3 14:36:06 2020 +0200 C#: Add CodeQL extractor pack files commit c8e5db189a3ffb0e5b68ed3e8f21b975711cb7db Merge: 0bbdc70cd 00e900f1b Author: CodeQL CI <[email protected]> Date: Mon Aug 3 13:18:22 2020 +0100 Merge pull request #3913 from erik-krogh/topmost Approved by asgerf commit f5cc14f980a51182bf7bd0fa1829dc08bf12c86b Author: Erik Krogh Kristensen <[email protected]> Date: Mon Aug 3 13:49:21 2020 +0200 fix typo commit 0bbdc70cdb469567faa9ee85c48d8c5914881730 Merge: dd1a8e9b2 ceb19292c Author: CodeQL CI <[email protected]> Date: Mon Aug 3 09:25:17 2020 +0100 Merge pull request #3864 from erik-krogh/exprString Approved by asgerf, esbena commit dd1a8e9b289b6e06a8400bb0356c74e2a10c1905 Merge: 595ab442e 17e256b2c Author: Tamás Vajk <[email protected]> Date: Mon Aug 3 09:52:46 2020 +0200 Merge pull request #3991 from tamasvajk/feature/vscode Add VS Code tasks to build and test the C# bits commit ff0dacf1d76a31970de4a4a6f2fa4c115d51f1cd Author: luchua-bc <[email protected]> Date: Mon Aug 3 00:52:47 2020 +0000 Optimize the TaintTracking commit b65a03330243a4f7565487f2320b305bf16bd03b Author: luchua-bc <[email protected]> Date: Sat Aug 1 03:42:13 2020 +0000 Shorten the regex private domain match commit ff58abb7d3b55a5d56e3214dd3d9039441349a9c Author: luchua-bc <[email protected]> Date: Sat Aug 1 03:25:02 2020 +0000 Revamp the sink code commit 595ab442e66a0911f836ae859faebcd3f4f0177d Merge: c8dc2ee61 3e1305614 Author: Calum Grant <[email protected]> Date: Fri Jul 31 17:45:00 2020 +0100 Merge pull request #3996 from yoff/SharedDataflow_Syntax Python: Test all expressions that incur dataflow commit 3e13056140642d90179d1adb5a312f0d329be1c7 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Jul 31 17:20:58 2020 +0200 Python: Address most review comments commit c8dc2ee611c571d11999e2eb50bacd2b6e559829 Merge: 54ce73b40 0ea5f347f Author: Tamás Vajk <[email protected]> Date: Fri Jul 31 16:59:36 2020 +0200 Merge pull request #3993 from tamasvajk/remove-noise Turn off C# auto-compile on topmost folder commit 17e256b2c7c3c41a0778c3f65a1f5fc5e3d8f299 Author: Tamas Vajk <[email protected]> Date: Fri Jul 24 10:47:12 2020 +0200 C#: Add VS Code tasks to build and test the C# bits commit e8ce62e211b37a24acef3717f295ebd41b6eb73d Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Jul 31 15:28:27 2020 +0200 Python: Fix missing flow annotation commit e13cf2e126be431e69750cf7786e49f382b57604 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Jul 31 14:25:09 2020 +0200 Python: fix formatting commit 54ce73b40e9455bc142932b88fc7b9bfbaf56c76 Merge: 18fa6b613 e08e7cdf3 Author: Tom Hvitved <[email protected]> Date: Fri Jul 31 14:07:35 2020 +0200 Merge pull request #3995 from hvitved/csharp/fix-alerts C#: Fix a few alerts commit 29493f5bd73184e0859c89170d57bc09d19b0268 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Fri Jul 31 12:38:57 2020 +0200 Python: Make the coverage test a path query commit 18fa6b613de4eccb834d29bbc05e1aff6c29ca8f Merge: 7e72ef350 246ae575b Author: CodeQL CI <[email protected]> Date: Fri Jul 31 11:08:58 2020 +0100 Merge pull request #3998 from ceh-forks/ceh-fix-typos Approved by shati-patel commit 4990d004984f1bc17f1c0f218dd8c436984e2581 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Fri Jul 31 09:57:35 2020 +0200 C++: Add taint tests demonstrating lack of taint through range based for loops commit b88ef56cb498a946a5bfdda0748469cbc5b6d7b8 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Fri Jul 31 09:45:32 2020 +0200 C++: Add basic iterator definition that matches STL commit 246ae575be300c800106d43d468a5d061aca3d75 Author: Emil Hessman <[email protected]> Date: Fri Jul 31 06:59:55 2020 +0200 Fix typos commit a5dab4e7685cd8ca597d9185580aa15d9c906382 Author: Raul Garcia (MSFT) <[email protected]> Date: Thu Jul 30 17:05:42 2020 -0700 removing a redundant line commit 81de1b14d91ed7c86e0f36369617c6a9fd2d3623 Author: luchua-bc <[email protected]> Date: Thu Jul 30 19:16:48 2020 +0000 Revamp the source of path query commit 64f4613a3f5db94375fe4fc358fb4b2a6c8c670c Author: Raul Garcia (MSFT) <[email protected]> Date: Thu Jul 30 10:25:15 2020 -0700 Removing the options file as requested commit 9e74c183fef856cd29ea45d42e4d3e93c90c2ada Author: Raul Garcia (MSFT) <[email protected]> Date: Thu Jul 30 10:24:24 2020 -0700 Fixing expected results after adding comments to the unit test .cs file commit 7e72ef350e50bbac69497795d51ee902dcda5bfc Merge: 5b1d25591 5bad003c0 Author: Arthur Baars <[email protected]> Date: Thu Jul 30 18:39:01 2020 +0200 Merge pull request #3975 from aibaars/lgtm-suites CodeQL: complete LGTM suites commit 133e18edd9f697610157c949d065849e02dc3402 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Thu Jul 30 18:13:39 2020 +0200 Python: Annotate missing flow commit 1467d6b419e99987a54abb420747c815f953db5e Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Thu Jul 30 17:51:17 2020 +0200 Python: Test all expressions that incur dataflow commit 5b1d25591ec895db5f42486cd147134de090e1b5 Merge: 437baf160 91762ec27 Author: semmle-qlci <[email protected]> Date: Thu Jul 30 15:10:46 2020 +0100 Merge pull request #3979 from max-schaefer/js/more-comand-injection-models Approved by asgerf commit e08e7cdf34c56e0115657395663df10b2adc8ab4 Author: Tom Hvitved <[email protected]> Date: Thu Jul 30 16:03:36 2020 +0200 C#: Fix a few alerts commit 07f1e133f346fd375b334090e64470835e3ec4b4 Author: Tom Hvitved <[email protected]> Date: Thu Jul 30 14:03:33 2020 +0200 C#: More type-based adjustment of library-flow access paths This change removes the restriction that only access paths of length 1 can have the head adjusted, based on type information from the call to the relevant library-code callable. commit 437baf160ec18ee729b0e88c91e5594bbd8ecf0f Merge: 632713c47 4da74dea2 Author: Shati Patel <[email protected]> Date: Thu Jul 30 14:37:48 2020 +0100 Merge pull request #3973 from shati-patel/sd-189 Add basic LGTM tutorials to CodeQL sphinx project commit 0ea5f347f7be2a894ddcf32152197e6dbca03eab Author: Tamas Vajk <[email protected]> Date: Thu Jul 30 15:23:13 2020 +0200 Turn off C# auto-compile on topmost folder If the C# extension is installed, then it reports 25k+ errors on the C# extractor until it is properly built. This is pure noise because the solution would be opened and built from the correct subdirectory. This commit disables the C# compilation altogether. commit 632713c475aa5d89904f0d4213de277e4b0d51e2 Merge: ddbec50c0 05307b875 Author: Tom Hvitved <[email protected]> Date: Thu Jul 30 14:20:00 2020 +0200 Merge pull request #3986 from hvitved/csharp/null-maybe-null-coalescing-assignment C#: Fix false-positives in `cs/dereferenced-value-may-be-null` commit 05307b8757d9ac38a0e54009414e1323478dadba Author: Tom Hvitved <[email protected]> Date: Thu Jul 30 12:13:56 2020 +0200 C#: Remove more FPs in `cs/dereferenced-value-may-be-null` commit 4f4d9d35be1f9a17276cb1d8eba12cb32b0f02a8 Author: Tom Hvitved <[email protected]> Date: Thu Jul 30 12:13:30 2020 +0200 C#: Add more nullness tests commit 4da74dea288cf55292d8289ae4ee028aba51ead0 Author: Shati Patel <[email protected]> Date: Thu Jul 30 10:57:17 2020 +0100 Update C# example commit 0a4b82843299f646f41b4f66cbea54598f6950c9 Author: Shati Patel <[email protected]> Date: Thu Jul 30 11:55:28 2020 +0200 Update docs/language/learn-ql/java/basic-query-java.rst Co-authored-by: Marcono1234 <[email protected]> commit 9aaf20e6f20a754384ffa65e1d6dfc5de45f430d Author: Shati Patel <[email protected]> Date: Thu Jul 30 11:55:14 2020 +0200 Update docs/language/learn-ql/java/basic-query-java.rst Co-authored-by: Marcono1234 <[email protected]> commit 6f845b00449bf9fa5cc6e957e2c80182d45d0f61 Author: Raul Garcia (MSFT) <[email protected]> Date: Wed Jul 29 18:01:46 2020 -0700 Using CodeQL AutoFormat commit 7923c480afa264d272ccf55b613daba87d31f893 Author: Raul Garcia (MSFT) <[email protected]> Date: Wed Jul 29 17:14:37 2020 -0700 Fixing queries based on suggestions/comments. TODO: Auto-formatting is still pending (need guidance on how to enable it on my environment). Thanks commit 83e9d052d98de459c695d4c17776db6085f015e3 Author: Raul Garcia <[email protected]> Date: Wed Jul 29 16:24:13 2020 -0700 Update csharp/ql/src/experimental/Security Features/Serialization/DataSetSerialization.qll Co-authored-by: Jaroslav Lobačevski <[email protected]> commit ddbec50c07b3b19a8967813f59b10277c3bb1d28 Merge: bec415c5c 978bf3aef Author: Robert Marsh <[email protected]> Date: Wed Jul 29 12:27:29 2020 -0700 Merge pull request #3990 from MathiasVP/mathiasvp/fix-qldoc-SemanticStackVariable C++: Fix QLDoc for `SemanticStackVariable` commit bec415c5c1b544a78cfc9d2c0cfc402fc8fe998d Merge: 4345b167e f91043e08 Author: Tom Hvitved <[email protected]> Date: Wed Jul 29 19:58:54 2020 +0200 Merge pull request #3988 from hvitved/csharp/collection-flow-change-note C#: Add change note commit 5bad003c0c898d335e4d9c221b3ef8e9d6c3c5e3 Author: Arthur Baars <[email protected]> Date: Mon Jul 27 17:45:36 2020 +0200 Add qlpack.yml files for example queries commit 978bf3aefcccd8320abcf9e009d16c3aa56ca466 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Wed Jul 29 15:59:19 2020 +0200 C++: Make QLDoc comment represent a valid C++ template commit d32e2772a0bcebdd7bcaf54905574888a4706361 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Wed Jul 29 15:52:56 2020 +0200 Python: some doc, a generator, and a corotuine commit f91043e08e731596f590e1c1f68728c043be75f7 Author: Tom Hvitved <[email protected]> Date: Wed Jul 29 10:18:03 2020 +0200 C#: Add change note commit 4345b167ece53fb95958aec7b939e437c0a246f8 Merge: c5a4a6be0 3d711b8cd Author: Tom Hvitved <[email protected]> Date: Wed Jul 29 10:04:08 2020 +0200 Merge pull request #3935 from github/henrymercer/fix-broken-doc-link C#: Fix broken link to ECMA-335 commit 5942bc6a438ad0ca2fbf8d14f890a313991bf4e1 Author: Marcono1234 <[email protected]> Date: Wed Jul 29 01:45:27 2020 +0200 Improve InsecureJavaMail.qhelp references commit 488a7f4d0142d1f4b2d48a8afb5cc422e572e8a2 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Jul 28 21:46:45 2020 +0200 Python: update test expectations commit c4041e55ba4596deeb247736cc8cc17e6190cd13 Author: Arthur Baars <[email protected]> Date: Fri Jul 24 18:06:52 2020 +0200 CodeQL: complete LGTM suites commit eab64f125b52a9684229da37ee55a21accdaab8a Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Tue Jul 28 20:32:12 2020 +0200 Python: Dataflow, start on test for classes commit 5520504658b67f6931c4bf2233094d9e86e31000 Author: luchua-bc <[email protected]> Date: Tue Jul 28 15:41:23 2020 +0000 Update expected results commit a91cc9b7ecb9153dededa8a6cd7d800d74e5db53 Author: luchua-bc <[email protected]> Date: Tue Jul 28 15:36:12 2020 +0000 Convert the query to path-problem commit d39a33655f1cb551469e14cfb683ba2d83530baf Author: Tom Hvitved <[email protected]> Date: Tue Jul 28 10:52:15 2020 +0200 C#: Fix false-positives in `cs/dereferenced-value-may-be-null` Dereferencing an expression of a nullable type should only be reported when the expression is not clearly non-null. commit a79f09f1deea6431e224485ecefd221b3afaa333 Author: Shati Patel <[email protected]> Date: Tue Jul 28 15:25:59 2020 +0200 Add basic query for Go commit 8e8c43a25b4c6dca3df2899dad33978ac077b9db Author: Shati Patel <[email protected]> Date: Tue Jul 28 13:54:06 2020 +0200 Add basic query for JavaScript commit 7f911f00eeb0d533fa0d8ab068d226536e8c3225 Author: luchua-bc <[email protected]> Date: Tue Jul 28 11:40:21 2020 +0000 Rename to insecure basic auth commit 9edf1646c913274b9420fff2c876b30dc7a45e79 Author: Shati Patel <[email protected]> Date: Tue Jul 28 12:18:45 2020 +0200 Add basic queries for C#, Java, and Python commit 0f3599039ffa80e11bb63661c0efe0ff643dc3e3 Author: Shati Patel <[email protected]> Date: Tue Jul 28 11:49:17 2020 +0200 Update docs/language/learn-ql/cpp/basic-query-cpp.rst Co-authored-by: James Fletcher <[email protected]> commit ce2368de96a0dc5c6b1ad743862a345646c230ce Author: Tom Hvitved <[email protected]> Date: Tue Jul 28 10:25:25 2020 +0200 C#: Add tests for null-coalescing assignment commit 248628b11e45f559d5b39c3d731b46466773a94f Author: luchua-bc <[email protected]> Date: Mon Jul 27 20:31:07 2020 +0000 Enhance basic auth string search with a recursive method commit 3a23451395d60c38470830928395cdfc3dbb3c96 Author: luchua-bc <[email protected]> Date: Mon Jul 27 18:50:47 2020 +0000 Enhance the query commit 38acea633fefe1dae5d54ca1ef2d39d846e276c9 Author: Rasmus Lerchedahl Petersen <[email protected]> Date: Mon Jul 27 17:58:21 2020 +0200 Python: Dataflow, expand callable to classes commit c5a4a6be05ed7c59ac49c7bfb5b3546cf9b9c6f3 Merge: f40242dc3 7dfc58415 Author: Tom Hvitved <[email protected]> Date: Mon Jul 27 16:51:24 2020 +0200 Merge pull request #3871 from hvitved/csharp/autobuilder/dotnet-delegate C#: Introduce delegate type in autobuilder commit f40242dc3f4293ac206de01864b3acd11c693ef5 Merge: f5c1de8a1 7a71ca3e0 Author: Taus <[email protected]> Date: Mon Jul 27 14:43:39 2020 +0200 Merge pull request #3396 from porcupineyhairs/python-ssti Python : Add query to detect Server Side Template Injection commit 91762ec274ad7b1e1216d787a183fc9b0831c9f9 Author: Max Schaefer <[email protected]> Date: Mon Jul 27 11:42:32 2020 +0100 JavaScript: Add partial model for `opener`. 3.5M weekly downloads. Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL. commit 9aa26fa4bc5248c6a620ecc03cb9b8d9411d8456 Author: Max Schaefer <[email protected]> Date: Mon Jul 27 11:37:06 2020 +0100 JavaScript: Add model for `foreground-child`. >1M weekly downloads, so seems worth doing. commit 2f842042ea1cee4708b1c407ed46fd43aa5b395a Author: Max Schaefer <[email protected]> Date: Mon Jul 27 11:33:24 2020 +0100 JavaScript: Model another `execa` function relevant for command injection. commit f5c1de8a17b575ae46df22381e5f4f8d9e663703 Merge: 09f45ac9f 79f412ff5 Author: Tom Hvitved <[email protected]> Date: Mon Jul 27 11:44:58 2020 +0200 Merge pull request #3960 from calumgrant/cs/tag-inefficient-containskey C#: Fix tags typo commit 09f45ac9fe9bbecfe29179048a707d18705c2973 Merge: bb5b161d7 03cc4e179 Author: Calum Grant <[email protected]> Date: Mon Jul 27 10:43:04 2020 +0100 Merge pull request #3877 from calumgrant/cs/autobuilder-alerts C#: Make fields readonly commit db09ca7b68c092eaed7cef2f96ff04d2d69e6fe3 Author: Shati Patel <[email protected]> Date: Mon Jul 27 09:04:27 2020 +0200 Update queries + outdated note commit 01fb51829c231cbcfd8134789863194d70323114 Author: luchua-bc <[email protected]> Date: Fri Jul 24 20:35:09 2020 +0000 Unsecure basic authentication commit bb05db5c98a283b16ccec4b198749b22ba69816e Author: Shati Patel <[email protected]> Date: Fri Jul 24 11:57:50 2020 +0200 Convert C/C++ article commit 7a71ca3e0fe546b51f2773d34acfa6e73f83d657 Author: Porcupiney Hairs <[email protected]> Date: Fri Jul 24 00:57:19 2020 +0530 fix tests. commit c49311e69efbcd210d715eb16069fd796d7afe45 Author: Rasmus Wriedt Larsen <[email protected]> Date: Thu Jul 23 20:11:27 2020 +0200 Python: Fix JinjaSSTISinks.expected commit 03d22fa8e33aaf90b160436a81ff7452b0c9a2ed Author: Rasmus Wriedt Larsen <[email protected]> Date: Thu Jul 23 17:32:01 2020 +0200 Python: Fix filenames in qhelp commit e283d289fd7e883b410e8954c4173c28b6f8339d Author: Rasmus Wriedt Larsen <[email protected]> Date: Thu Jul 23 17:23:26 2020 +0200 Python: Update TemplateInjection.qhelp Moved things around so there is only a single `<example>` tag (and had to rewrite contents a bit). commit 1e7921e575af461c479ea3445c78a7c39117a87f Author: Porcupiney Hairs <[email protected]> Date: Thu Jul 23 20:04:32 2020 +0530 add qhelp and fix tests. commit 8e85dc755a520434bf612583e3044c14d9958ea6 Author: porcupineyhairs <[email protected]> Date: Thu Jul 23 19:37:40 2020 +0530 Apply suggestions from code review Co-authored-by: Rasmus Wriedt Larsen <[email protected]> commit bb5b161d72a135869b5ab48b53e94c7f74afe17e Merge: 40c998fa1 2326f3174 Author: semmle-qlci <[email protected]> Date: Thu Jul 23 11:30:45 2020 +0100 Merge pull request #3972 from shati-patel/merge-rc Approved by mchammer01 commit 2326f31749f7de9d614b214f2adfc1c2e16ccad5 Merge: 40c998fa1 eaec2d722 Author: Shati Patel <[email protected]> Date: Thu Jul 23 12:18:30 2020 +0200 Merge branch 'rc/1.24' into merge-rc commit a97f942a170de13fa4f7473c41079f0978aa8b13 Author: Rasmus Wriedt Larsen <[email protected]> Date: Thu Jul 23 11:38:34 2020 +0200 Python: Autoformat commit 40c998fa131b0f49707133729c705f92b45ebf4e Merge: a4242bcb5 7840dfce3 Author: Felicity Chapman <[email protected]> Date: Thu Jul 23 10:37:37 2020 +0100 Merge pull request #3969 from alexey-tereshenkov-oxb/master Python: Fix typo in qhelp file commit a4242bcb5df4ff73951a7049c26adcfbe3a50317 Merge: 2e5af6762 0bb6d0c7c Author: Mathias Vorreiter Pedersen <[email protected]> Date: Thu Jul 23 09:21:37 2020 +0200 Merge pull request #3962 from rdmarsh2/ir-barrierguard-checks-expr C++: make IR BarrierGuard::checks match AST commit 7840dfce3b64f3f77e7b428c1b202434381b76f7 Author: Alexey Tereshenkov <[email protected]> Date: Wed Jul 22 20:51:29 2020 +0100 Put the closing tag back commit e2939377e94f8a3e0e588d92d59c3acefa94458e Author: Alexey Tereshenkov <[email protected]> Date: Wed Jul 22 20:07:34 2020 +0100 Update python/ql/src/Expressions/WrongNumberArgumentsForFormat.qhelp Co-authored-by: intrigus-lgtm <[email protected]> commit a6eb3caa5fc3f03cdf52c14bf320c54385c0b932 Author: Alexey Tereshenkov <[email protected]> Date: Wed Jul 22 20:07:27 2020 +0100 Update python/ql/src/Expressions/WrongNumberArgumentsForFormat.qhelp Co-authored-by: Felicity Chapman <[email protected]> commit a5f566b5631b77b485f0bca834e32697c86989d5 Author: Alexey Tereshenkov <[email protected]> Date: Wed Jul 22 15:39:50 2020 +0100 Fix typo commit 3320061178e0e14a890dac6d72a2f280d93844d3 Author: Remco Vermeulen <[email protected]> Date: Wed Jul 22 16:03:52 2020 +0200 Add and adjust QL docs for classes and predicates commit 2c42d3cca5d0556d47a87ff62a58537598cd2a40 Author: Remco Vermeulen <[email protected]> Date: Wed Jul 22 14:52:08 2020 +0200 Extract additional taint steps This is done for logical cohesion. We already have the capability of extending additional taint steps by extending `TaintTracking::AdditionalTaintStep`. commit 57e7411c0a8d52607fce91419c366f658791b924 Author: Remco Vermeulen <[email protected]> Date: Tue Jul 21 14:51:58 2020 +0200 Extract Ldap injection sanitizers to importable lib This includes a new abstract class that represents all the Ldap injection santizers and can be used to add additional santizers through extension. commit 0d5f9113a307371f5cdb14cea25fe631ebf884ba Author: Remco Vermeulen <[email protected]> Date: Tue Jul 21 12:36:18 2020 +0000 Extract ldap injection sink into importable library commit 91e62226629a62179de978924c75fc929dc30521 Author: Rasmus Wriedt Larsen <[email protected]> Date: Tue Jul 21 11:41:16 2020 +0200 Python: Fix SSTI query by importing UntrustedStringKind Without a concrete ExternalStringKind class, there will be no flow for ExternalStringKind by default. commit 9dbd280d3163bafc4cc4c9cb27076544e34579a0 Author: Rasmus Wriedt Larsen <[email protected]> Date: Tue Jul 21 11:40:01 2020 +0200 Python: Fix syntax error commit 49df4169cf448a84178e4c7cf403f13092b1148c Author: Porcupiney Hairs <[email protected]> Date: Mon May 4 01:56:37 2020 +0530 Python : Add query to detect Server Side Template Injection commit 55473c65f1e7ab3047a460a0ee45a80b887dcc5f Author: Raul Garcia (MSFT) <[email protected]> Date: Mon Jul 20 13:54:23 2020 -0700 Improving documentation commit 9d7d6b39cb0b4b9323e4536fe682f980d8769d76 Author: Raul Garcia (MSFT) <[email protected]> Date: Mon Jul 20 11:14:59 2020 -0700 Small fixes based on feedback commit c2733ad22e04d6af507a99e86f232d33f754fa25 Author: Remco Vermeulen <[email protected]> Date: Mon Jul 20 14:55:00 2020 +0200 Apply grammar suggestions Co-authored-by: Anders Schack-Mulligen <[email protected]> commit f94055fa2c66afa2a06cc80a2ef4be5a9eedf540 Author: intrigus <[email protected]> Date: Sun Jul 19 00:19:29 2020 +0200 Move tainted path ad-hoc guard back. commit 33526f61a8bdcdc1d82cc5908b68e5799b14238c Author: intrigus <[email protected]> Date: Sun Jul 19 00:11:04 2020 +0200 Make path creation subclasses private. commit b705f7f3e9fe42db043afd2c56ec2814d2cfae19 Author: intrigus <[email protected]> Date: Sun Jul 19 00:10:39 2020 +0200 Improve "PathCreation" Test. commit 4570444c7ed019b7e95a28c39f42c0a9d8eb17e9 Author: intrigus <[email protected]> Date: Sat Jul 18 23:57:01 2020 +0200 Rename to getAnInput and clarify doc. commit 0bb6d0c7cac607bea6d6d7ba7517a3d25dfc2dd5 Author: Robert Marsh <[email protected]> Date: Tue Jul 14 15:44:03 2020 -0700 C++: make IR BarrierGuard::checks match AST commit 79f412ff54f294c21d3041cc24f4703fa3d65295 Author: Calum Grant <[email protected]> Date: Fri Jul 17 15:30:33 2020 +0100 C#: Fix tags typo commit 5387294168bac38d2cb86f4f09bfb5d566ee7bc0 Author: Raul Garcia (MSFT) <[email protected]> Date: Thu Jul 16 09:32:17 2020 -0700 Moving to experimental as requested commit 2e5af67626d33366f8413706a41a3cc0597f46d8 Merge: c7b668193 289a908eb Author: Geoffrey White <[email protected]> Date: Wed Jul 15 18:11:09 2020 +0100 Merge pull request #3952 from MathiasVP/output-parameter-index-for-UserDefinedFormattingFunction C++: Add getOutputParameterIndex override to UserDefinedFormattingFunction class. commit c7b668193be28f81134b3e038a27e337b39d11ea Merge: 7dd267774 616bad7b5 Author: Nick Rolfe <[email protected]> Date: Wed Jul 15 18:03:26 2020 +0100 Merge pull request #3929 from igfoo/static_assert C++: Give static assertions an enclosing element commit 289a908eb8906aae7ba25d4bc0bbbd744474bc98 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Wed Jul 15 16:24:47 2020 +0200 C++: Update qldoc in reponse to PR comments commit c4b97a3a626e821ef1a71fc14d842685ba71c152 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Wed Jul 15 16:19:51 2020 +0200 C++: Accept more test changes commit c4940aaa8648c2737ee68b34cfa0e464b040060b Merge: 37158f46e 7dd267774 Author: Geoffrey White <[email protected]> Date: Wed Jul 15 15:01:01 2020 +0100 Merge branch 'master' into copymove commit edc33b651603238a55d1cd97914586b428c2da59 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Wed Jul 15 14:45:17 2020 +0200 C++: Add getOutputParameterIndex override to UserDefinedFormattingFunction and accept test changes commit d711c22cd2d38f323b1a951434e7739cf53786f8 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Wed Jul 15 14:42:45 2020 +0200 C++: Add testcase demonstrating lost query results commit 3e0481b889aadf4a9e25dbecf90abb7f71e9523d Author: Raul Garcia (MSFT) <[email protected]> Date: Tue Jul 14 17:54:54 2020 -0700 Queries to help on the detection based on misuse of DataSet and DataTable serialization that could lead to security problems. https://go.microsoft.com/fwlink/?linkid=2132227 commit 7dd26777460894c20807f6f0a86310b227518c1f Merge: dcff87fb2 174b30461 Author: Robert Marsh <[email protected]> Date: Tue Jul 14 14:18:06 2020 -0700 Merge pull request #3950 from MathiasVP/simple-range-analysis-unsigned-multiplication-tests C++: Add test cases for range analysis for unsigned multiplication commit 896cdf9b127d9b4e9b3f9648b5dcbc0cde92aec2 Merge: f051f46ee dcff87fb2 Author: Raul Garcia (MSFT) <[email protected]> Date: Tue Jul 14 11:16:51 2020 -0700 Merge branch 'master' of https://github.com/github/codeql commit 174b30461ad1aae501d5e8ae5bd6a4d96a5206a8 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Tue Jul 14 19:47:21 2020 +0200 C++: Fix syntax error in testfile commit dcff87fb2ea3cca0de5394d293783ed0d2c64a1d Merge: 0bee0687c 9e3a6e8d5 Author: Calum Grant <[email protected]> Date: Tue Jul 14 17:12:29 2020 +0100 Merge pull request #3366 from hvitved/csharp/dataflow/arrays C#: Precise data-flow for collections commit 834ad924537b5c18a723e62be608796816886432 Author: Mathias Vorreiter Pedersen <[email protected]> Date: Tue Jul 14 16:57:47 2020 +0200 C++: Add test cases for unsigned multiplication and fix missing return value in existing tests commit 37158f46ed71d38eaa00c686f425dc6b6eddc2e5 Author: Geoffrey White <[email protected]> Date: Tue Jul 14 15:36:43 2020 +0100 C++: Remove deprecated class from test. commit 0bee0687cbd1ba185949a3b79221064a962e1bf2 Merge: f8c03dcae f1601d643 Author: semmle-qlci <[email protected]> Date: Tue Jul 14 15:33:45 2020 +0100 Merge pull request #3911 from RasmusWL/python-call-graph-tracing Approved by tausbn commit 3f6d8490e059278a112455138d860578b70ae4e1 Author: Geoffrey White <[email protected]> Date: Tue Jul 14 15:09:12 2020 +0100 C++: Autoformat. commit 616bad7b5ce0c09483e236b0e96fa995fc9d09b7 Author: Ian Lynagh <[email protected]> Date: Tue Jul 14 13:53:46 2020 +0100 C++: Add an upgrade script commit c254de464a05f5ace5271ac61cf924d6df601b99 Author: Ian Lynagh <[email protected]> Date: Tue Jul 14 12:25:35 2020 +0100 C++: Update stats following `static_asserts` change commit f1601d643aa46158725dd59dbb3af368170b9977 Author: Rasmus Wriedt Larsen <[email protected]> Date: Tue Jul 14 14:12:56 2020 +0200 Python: autoformat commit 1d9c3b3bcdbdaca6c26ddfad204df7fdf0186e09 Author: Rasmus Wriedt Larsen <[email protected]> Date: Tue Jul 14 14:12:02 2020 +0200 Python: call-graph tracing: callable => callee to use consistent naming commit f8c03dcae6b5bcc869ac5ce0bd98da4b576e63c3 Merge: ee13e87f3 ee42d0839 Author: semmle-qlci <[email protected]> Date: Tue Jul 14 13:03:02 2020 +0100 Merge pull request #3924 from RasmusWL/python-metrics-queries-for-dist-compare Approved by tausbn commit ee42d0839e6a366cfe449f42eebb1023098e2222 Author: Rasmus Wriedt Larsen <[email protected]> Date: Tue Jul 14 11:26:05 2020 +0200 Python: Rename target => callee To use a standardised naming :) commit d913d332892d3b381c15563a01c662338376e106 Author: Rasmus Wriedt Larsen <[email protected]> Date: Tue Jul 14 11:21:55 2020 +0200 Python: Autoformat commit ee13e87f3bc5ed0240c4faa86945ec6920020d17 Merge: 67b601807 dc7d92ba2 Author: Taus <[email protected]> Date: Mon Jul 13 22:10:34 2020 +0200 Merge pull request #3947 from RasmusWL/python-fix-tests Python: Make experimental/library-tests/CallGraph pass for Python 2 commit 67b6018079bf9f13a9513d1fa1ab2eee4a96039d Merge: 651962947 12803f1f5 Author: Arthur Baars <[email protected]> Date: Mon Jul 13 18:04:42 2020 +0200 Merge pull request #3729 from luchua-bc/java-hardcoded-aws-credentials Java: Hardcoded AWS credentials commit dc7d92ba2f6932789284e4346f159fb406de8434 Author: Rasmus Wriedt Larsen <[email protected]> Date: Mon Jul 13 16:20:02 2020 +0200 Python: Autoformat experimental/library-tests/CallGraph/ commit 646efe2a20ecc6e2ab7cc39fa6199c409973a615 Author: Geoffrey White <[email protected]> Date: Mon Jul 13 14:55:52 2020 +0100 C++: Deprecate ConversionConstructor. commit c585b2e4835bd6c49f7393c744c97d3215f75841 Author: Arthur Baars <[email protected]> Date: Mon Jul 13 15:25:00 2020 +0200 Java: stack trace exposure: address false positives commit 61178c533088b5d5b3420f5d84ec1e7143d28818 Merge: 301679810 fe0c5a9ea Author: Geoffrey White <[email protected]> Date: Mon Jul 13 14:11:12 2020 +0100 Merge branch 'master' into copymove commit 83bd14b68705cc47c908b9f0026755dc76edd17d Author: Rasmus Wriedt Larsen <[email protected]> Date: Mon Jul 13 14:52:28 2020 +0200 Python: Make experimental/library-tests/CallGraph pass for Python 2 The import doesn't actually work the intended way, so running ``` $ python python/ql/test/experimental/library-tests/CallGraph/test.py ``` will procude no output. but our extractor will extract the things we need, so for a quick fix this will need to suffice. commit 12803f1f5376b17c487081a49097cc17c01b51c3 Author: luchua-bc <[email protected]> Date: Mon Jul 13 12:22:34 2020 +0000 Merge Hardcoded AWS Credentials check int…

porcupineyhairs commented May 3, 2020

View reviewed changes

porcupineyhairs force-pushed the python-ssti branch from ed995dc to 6990907 Compare May 3, 2020 21:13

RasmusWL added the Python label May 13, 2020

tausbn requested changes May 20, 2020

View reviewed changes

porcupineyhairs force-pushed the python-ssti branch from 6990907 to 4a2f44b Compare May 20, 2020 17:29

porcupineyhairs requested a review from a team as a code owner May 20, 2020 17:29

porcupineyhairs force-pushed the python-ssti branch from 4a2f44b to a99cf9b Compare May 20, 2020 17:35

porcupineyhairs mentioned this pull request May 21, 2020

Python : Add query to detect Server Side Template Injection github/securitylab#93

Closed

porcupineyhairs force-pushed the python-ssti branch from a99cf9b to 26055dd Compare May 28, 2020 23:15

porcupineyhairs commented May 28, 2020

View reviewed changes

porcupineyhairs force-pushed the python-ssti branch from ef90278 to 4ce98df Compare June 24, 2020 19:24

intrigus-lgtm mentioned this pull request Jun 30, 2020

Python: Module not intended for production #3859

Closed

tausbn requested changes Jul 17, 2020

View reviewed changes

porcupineyhairs force-pushed the python-ssti branch from e5af072 to 2513950 Compare July 20, 2020 16:23

RasmusWL mentioned this pull request Jul 21, 2020

Python: Fixes for SSTI query porcupineyhairs/ql#1

Merged

porcupineyhairs and others added 3 commits July 21, 2020 18:01

Python : Add query to detect Server Side Template Injection

49df416

Python: Fix syntax error

9dbd280

Python: Fix SSTI query by importing UntrustedStringKind

91e6222

Without a concrete ExternalStringKind class, there will be no flow for ExternalStringKind by default.

porcupineyhairs force-pushed the python-ssti branch from d098d70 to 91e6222 Compare July 21, 2020 12:32

Python: Autoformat

a97f942

RasmusWL requested changes Jul 23, 2020

View reviewed changes

porcupineyhairs and others added 3 commits July 23, 2020 19:37

Apply suggestions from code review

8e85dc7

Co-authored-by: Rasmus Wriedt Larsen <[email protected]>

add qhelp and fix tests.

1e7921e

Python: Update TemplateInjection.qhelp

e283d28

Moved things around so there is only a single `<example>` tag (and had to rewrite contents a bit).

RasmusWL previously approved these changes Jul 23, 2020

View reviewed changes

Python: Fix filenames in qhelp

03d22fa

RasmusWL dismissed their stale review via 03d22fa July 23, 2020 15:32

RasmusWL previously approved these changes Jul 23, 2020

View reviewed changes

Python: Fix JinjaSSTISinks.expected

c49311e

RasmusWL dismissed their stale review via c49311e July 23, 2020 18:11

RasmusWL previously approved these changes Jul 23, 2020

View reviewed changes

fix tests.

7a71ca3

porcupineyhairs dismissed RasmusWL’s stale review via 7a71ca3 July 23, 2020 19:27

RasmusWL approved these changes Jul 24, 2020

View reviewed changes

RasmusWL requested a review from tausbn July 24, 2020 18:54

tausbn approved these changes Jul 27, 2020

View reviewed changes

tausbn merged commit f40242d into github:master Jul 27, 2020

RasmusWL assigned RasmusWL and tausbn Jul 22, 2021

porcupineyhairs deleted the python-ssti branch November 22, 2021 00:13

joefarebrother mentioned this pull request Nov 6, 2024

Python: Promote Template Injection query from experimental #17922

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Python : Add query to detect Server Side Template Injection #3396

Python : Add query to detect Server Side Template Injection #3396

porcupineyhairs commented May 3, 2020

porcupineyhairs May 3, 2020

tausbn May 4, 2020

porcupineyhairs May 4, 2020

tausbn May 6, 2020

tausbn left a comment

tausbn May 20, 2020

porcupineyhairs May 20, 2020

porcupineyhairs commented May 28, 2020

porcupineyhairs May 28, 2020

porcupineyhairs commented Jun 24, 2020

tausbn left a comment

porcupineyhairs commented Jul 17, 2020

RasmusWL commented Jul 21, 2020

porcupineyhairs commented Jul 21, 2020

RasmusWL left a comment

RasmusWL left a comment

RasmusWL commented Jul 24, 2020

porcupineyhairs commented Jul 24, 2020

Python : Add query to detect Server Side Template Injection #3396

Python : Add query to detect Server Side Template Injection #3396

Conversation

porcupineyhairs commented May 3, 2020

porcupineyhairs May 3, 2020

Choose a reason for hiding this comment

tausbn May 4, 2020

Choose a reason for hiding this comment

porcupineyhairs May 4, 2020

Choose a reason for hiding this comment

tausbn May 6, 2020

Choose a reason for hiding this comment

tausbn left a comment

Choose a reason for hiding this comment

tausbn May 20, 2020

Choose a reason for hiding this comment

porcupineyhairs May 20, 2020

Choose a reason for hiding this comment

porcupineyhairs commented May 28, 2020

porcupineyhairs May 28, 2020

Choose a reason for hiding this comment

porcupineyhairs commented Jun 24, 2020

tausbn left a comment

Choose a reason for hiding this comment

porcupineyhairs commented Jul 17, 2020

RasmusWL commented Jul 21, 2020

porcupineyhairs commented Jul 21, 2020

RasmusWL left a comment

Choose a reason for hiding this comment

RasmusWL left a comment

Choose a reason for hiding this comment

RasmusWL commented Jul 24, 2020

porcupineyhairs commented Jul 24, 2020