Skip to content
Permalink
main

Commits on Jan 6, 2022

  1. Merge pull request #7525 from MathiasVP/remove-rank-in-ssa-internals 

    C++: Remove `rank` aggregate in `SsaInternals`
    @rdmarsh2
    rdmarsh2 committed Jan 6, 2022
    d5682f1

Commits on Oct 7, 2021

  1. Merge pull request #6814 from MathiasVP/fix-qldoc-in-copy-instruction 

    C++/C#: Fix QLDoc of `CopyInstruction`
    @rdmarsh2
    rdmarsh2 committed Oct 7, 2021
    2539e32

Commits on Sep 28, 2021

  1. C++: Update change note date

    @rdmarsh2
    rdmarsh2 committed Sep 28, 2021
    d47c473

Commits on Sep 27, 2021

  1. C++ fix test compilation errors

    @rdmarsh2
    rdmarsh2 committed Sep 27, 2021
    dfb27d1

Commits on Sep 24, 2021

  1. C++: Add QLDoc to subpaths in DefaultTaintTracking

    @rdmarsh2
    rdmarsh2 committed Sep 24, 2021
    3189c57

  2. C++: add subpaths to DefaultTaintTracking

    @rdmarsh2
    rdmarsh2 committed Sep 24, 2021
    c2b356a

Commits on Sep 22, 2021

  1. C++: whitespace fix

    @rdmarsh2
    rdmarsh2 committed Sep 22, 2021
    49f8fd2

  2. C++: Rename SystemFunction and restore QLDoc

    @rdmarsh2
    rdmarsh2 committed Sep 22, 2021
    0c5d642

  3. C++: Accept command injection test changes 

    Making the DefaultTaintTracking configurations inactive removed many
unneeded nodes and edges from the PathGraph predicates.
    @rdmarsh2
    rdmarsh2 committed Sep 22, 2021
    6f03c3e

  4. C++: move ResolveCall.qll out of internal directory

    @rdmarsh2
    rdmarsh2 committed Sep 22, 2021
    8faeab1

  5. Merge branch 'main' into rdmarsh2/improve-exec-tainted 

    Manual fix for conflict in Models.qll
    @rdmarsh2
    rdmarsh2 committed Sep 22, 2021
    21ed5c4

  6. C++: Add additional functions to the SQL models

    @rdmarsh2
    rdmarsh2 committed Sep 22, 2021
    3108817

Commits on Sep 21, 2021

  1. C++: move resolveCall to its own file for perf 

    This avoids a performance issue in DataFlowImpl::localFlowStep when the
DataFlow::Configuration subclasses in DefaultTaintTracking are active
in the same query as other Configuration
subclasses.
ResolveCall.qll is kept internal for the moment.
    @rdmarsh2
    rdmarsh2 committed Sep 21, 2021
    d6fd83d

  2. Merge pull request #6133 from MathiasVP/promote-sql-pqxx 

    C++: Promote `cpp/sql-injection-via-pqxx` out of experimental
    @rdmarsh2
    rdmarsh2 committed Sep 21, 2021
    d62f76a

  3. Merge pull request #6409 from JordyZomer/main 

    cpp: Add query to detect unsigned integer to signed integer conversio…
    @rdmarsh2
    rdmarsh2 committed Sep 21, 2021
    97c2917

Commits on Sep 17, 2021

  1. C++: remove unneed import

    @rdmarsh2
    rdmarsh2 committed Sep 17, 2021
    a9add04

  2. C++: QLDoc for CommandExecution model

    @rdmarsh2
    rdmarsh2 committed Sep 17, 2021
    d3d708b

Commits on Sep 15, 2021

  1. C++: accept changes to new ExecTainted test

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    c85cc14

  2. C++: Refactor models to prevent IR reevaluation

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    1
    a3e1f54

  3. C++: support new subpaths predicate in ExecTainted

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    3
    509a349

  4. C++: Improve performance by restricting isSource

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    09ef8f6

  5. C++: accept test output

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    83cc098

  6. C++: autoformat Printf.qll

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    3cd08bc

  7. C++: add GVN import to fix reevaluation

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    fe1f987

  8. C++: Add path stitching in ExecTainted.ql

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    e874fbb

  9. C++: use TaintTracking2 in ExecTainted.ql

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    5dc6e13

  10. C++: change note for cpp/command-line-injection

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    4d2036f

  11. C++: raise precision of cpp/command-line-injection

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    c30e7ec

  12. C++: Add QLDoc for getOutputArgument

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    181eb80

  13. C++: exclude int/string conversion in ExecTainted

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    37c9217

  14. C++: ExecTainted tests for int/string conversions

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    5e265f4

  15. C++: remove debugging predicates

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    9926892

  16. C++: add some more tests for ExecTainted

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    9c478c5

  17. C++: add comment explaining concatenation logic

    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    562c8b9

  18. C++: Refactor ExecTainted.ql to need concatenation 

    This makes ExecTainted report results only when the tainted value does
not become the start of the string which is eventually run as a shell
command. The theory is that those cases are likely to be deliberate, and
part of the expected threat model of the program (e.g. $CC in make).
This lines up better with the results I considered fixable true
positives in LGTM testing
    @rdmarsh2
    rdmarsh2 committed Sep 15, 2021
    6f408f9
Older