Create SECURITY.dc #3168
Open
Create SECURITY.dc #3168
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
JS: loosen qldoc for `barrierGuardIsRelevant`
Co-Authored-By: Esben Sparre Andreasen <esbena@github.com>
Docs: refactor guidelines for new queries
Approved by esbena
Approved by asgerf
Approved by asgerf
This change introduces a new synthesized `IRVariable` in every varargs function. This variable represents the entire set of arguments passed to the ellipsis by the caller. We give it an opaque type big enough hold all of the arguments passed by the largest vararg call in the database. It is treated just like any other parameter. It is initialized the same, it has indirect buffers, etc. I had to introduce a couple new APIs to `Call` and `Function`. The QLDoc comments should explain these. I added tests for these new APIs as well. The next step will be to change the IR generation for the `va_*` macros to manipulate the ellipsis parameter.
Change 'Set Literals' to 'Set literals'
C++: Fix test expectations for complex literals
…roughFlowCand Data flow: No magic in returnFlowCallableCand
…teps Java: Add taint steps through Jackson serialization methods.
…cking-taint-CP Python: Fix iterable-unpacking taint CP
Modelled after the correponding comment for `DataFlowImpl.qll`.
Data flow: Add module doc comment for `TaintTrackingImpl.qll`
…checks Java: Add data-flow consistency checks.
Approved by asgerf
How could the tests fail because of autoformatting, you may ask? The answer is deprecation warnings. These specify the location of the deprecated entity, and due to autoformatting these moved around.
This consistency check seems to have value for AST data flow, but I've disabled it on the IR for now. This commit also includes two unrelated changes that seem to fix a semantic merge conflict.
…verything Python: Autoformat (almost) all `.qll` files.
…iles Python: Autoformat all `.ql` files.
rewrote the qldoc to explain it as well.
otherwise the helper predicate can (and sometimes will) be evaluated once _per_ instance of that class.
Approved by felicitymay
C++: Remove noise from argHasPostUpdate check
…zer-example Python: Add example for how to write your own sanitizer
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.