Chris Smowton
11b70326fd
Add Jakarta WS url-open sink
2021-06-17 11:58:41 +01:00
Chris Smowton
c531b81ebe
Rename RequestForgery.java -> SanitizationTests.java
2021-06-17 11:43:33 +01:00
Chris Smowton
cb99e17f4d
Split and rename JavaNetHttp and ApacheHttp tests for consistency
2021-06-17 11:43:32 +01:00
Chris Smowton
6c4a909b86
Remove dead code from test
2021-06-17 11:43:32 +01:00
Chris Smowton
08ab5f5546
Remove redundant test
2021-06-17 11:43:32 +01:00
Chris Smowton
74569ce316
Tidy Jax-RS test
2021-06-17 11:43:32 +01:00
Chris Smowton
57ca36baad
Tidy Spring test
2021-06-17 11:43:32 +01:00
Chris Smowton
8b080a94e7
Convert request forgery tests to inline expectations; add missing models revealed by this process.
2021-06-17 11:43:32 +01:00
Chris Smowton
b66dcbe5b6
Factor request-forgery config so it can be used in an inline-expectations test
2021-06-17 11:43:32 +01:00
Chris Smowton
ee872f1752
Add missing tests, add additional models revealed missing in the process, and add stubs to support them all.
2021-06-17 11:43:32 +01:00
Chris Smowton
49bbfc3f4b
Convert SSRF sinks into url-open CSV sinks
...
I also drop the previous approach of taint-tracking through various builder objects in favour of assuming that a URI set in a request-builder object is highly likely to end up requested in some way or another.
This will cause the `java/non-https-url` query to pick the new sinks up too, and fixes a Spring case that had never worked but went unnoticed until now.
2021-06-17 11:43:30 +01:00
Chris Smowton
55c72cebf2
Improve StringBuilder append chain tracking
...
Previously this didn't catch the case of constructors chaining directly into appends, like `StringBuilder sb = new StringBuilder("1").append("2")`
2021-06-17 11:41:06 +01:00
Chris Smowton
1549993565
Update test results to account for changed model structure
...
(Models now have internal nodes in order to allow field flow through them)
2021-06-17 11:41:05 +01:00
Chris Smowton
575198a0e4
Java SSRF query: Server Side -> Server-Side everywhere.
2021-06-17 11:41:04 +01:00
Chris Smowton
77904d9597
Remove failing test
...
The case where something might be exactly a constant is general across all queries, and not handled yet, particularly in the case where the result of `getParameter("uri")` might have changed between the check and the use.
2021-06-17 11:41:04 +01:00
Chris Smowton
6933d06a46
Add exactly the string '/' as a sanitizing prefix.
...
Usually this is ignored for suspicion that it could be taken for a protocol specifier, but on balance the context `(something) + "/" + tainted()` is more likely to be taken for a user-controlled location within a host the user does not control.
2021-06-17 11:41:03 +01:00
Chris Smowton
b5a450b881
SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.
2021-06-17 11:41:03 +01:00
Chris Smowton
487c1db6ed
Promote SSRF query to main query set
2021-06-17 11:41:01 +01:00
Anders Schack-Mulligen
6ca8d69b26
Merge pull request #5881 from haby0/java/UnsafeDeserialization
...
Java: CWE-502 Add UnsafeDeserialization sinks
2021-06-17 12:36:34 +02:00
haby0
363ad5b470
Fix error
2021-06-17 17:36:35 +08:00
haby0
3dd851fffb
expected
2021-06-17 15:20:03 +08:00
haby0
c1ada6d85b
Merge branch 'main' into java/UnsafeDeserialization
2021-06-16 16:37:03 +08:00
Tony Torralba
e2918d55b5
Move tests back from internal repo
2021-06-16 10:09:44 +02:00
Anders Schack-Mulligen
96da85449d
Merge pull request #5823 from atorralba/promote-jexl-injection
...
Java: Promote JEXL Injection query from experimental
2021-06-07 10:03:12 +02:00
Anders Schack-Mulligen
f73960da8f
Merge pull request #5788 from Marcono1234/marcono1234/stmt-toString
...
Java: Override toString() for statements
2021-06-04 12:41:03 +02:00
Marcono1234
e0a45507f8
Java: Adjust toString() for statements
2021-06-03 16:27:36 +02:00
Marcono1234
7e778bc008
Java: Override toString() for statements
...
Additionally remove redundant QLDoc which is inherited anyways.
2021-06-03 16:27:35 +02:00
Anders Schack-Mulligen
bd9e3d0fa9
Merge pull request #5751 from aschackmull/java/collection-flow
...
Java: Convert all collection and array steps from taint flow to value flow.
2021-06-03 15:29:14 +02:00
Tony Torralba
56a429a5f9
Merge branch 'main' into promote-jexl-injection
2021-06-03 11:10:56 +02:00
Anders Schack-Mulligen
8e6dd51f50
Merge pull request #5868 from Marcono1234/marcono1234/ignore-not-closing-char-array-closeable
...
Java: Ignore char array based closeables for CloseReader.ql and CloseWriter.ql
2021-06-02 15:00:59 +02:00
Anders Schack-Mulligen
43d1b0ab27
Java: Update qltests.
2021-06-01 11:47:52 +02:00
Alvaro Muñoz
735e4e4b7b
update failing tests
2021-05-28 15:13:18 +02:00
haby0
60fc607449
Modify ql
2021-05-14 18:17:05 +08:00
Anders Schack-Mulligen
a247ae4357
Merge pull request #5843 from JLLeitschuh/feat/JLL/improve_kryo_support
...
[Java] Fix Kryo FP & Kryo 5 Support
2021-05-12 09:52:24 +02:00
haby0
12f47bcf24
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
Marcono1234
8969da7775
Java: Improve not closing resource query; add tests
2021-05-11 19:32:02 +02:00
Tony Torralba
e78e5b9ee4
Merge branch 'main' into promote-jexl-injection
2021-05-07 12:36:49 +02:00
Tony Torralba
b37b15cea4
Re-structure imports, add some new comments to tests
2021-05-07 12:33:51 +02:00
Tony Torralba
2a501956b3
Mark a MISSING test result as suggested in code review
2021-05-07 11:17:51 +02:00
Tony Torralba
f1fab854c4
Fix tests for XXE, introduced a dependency with jaxen
2021-05-06 12:11:55 +02:00
Tony Torralba
76468559ba
Add safe example for dom4j
2021-05-06 10:17:25 +02:00
Tony Torralba
926fedb7fb
Update java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.java
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-05-06 09:18:50 +02:00
Tony Torralba
00a7576679
Rename XPath Injection test file
2021-05-06 09:18:50 +02:00
Tony Torralba
8af7f4a484
New sinks and test cases
2021-05-06 09:18:49 +02:00
Tony Torralba
ccb3ea4453
Fix XPath Injection tests classpath
2021-05-06 09:18:49 +02:00
Tony Torralba
26c3ff2cee
Move from experimental to standard
2021-05-06 09:18:49 +02:00
Jonathan Leitschuh
67e9f06304
[Java] Fix Kryo FP & Kryo 5 Support
...
Closes #4992
2021-05-05 17:38:34 -04:00
Tony Torralba
e68c6e66a5
Remove qlref file
2021-05-03 17:53:37 +02:00
Tony Torralba
4d5ec87de9
Use InlineTest
2021-05-03 13:27:24 +02:00
Tony Torralba
4bfd34b1fe
Moved from experimental
2021-05-03 13:15:24 +02:00
