Anders Schack-Mulligen
629c19e719
Java: Autoformat.
2019-08-21 14:38:17 +02:00
Pavel Avgustinov
cb3551b4d6
Merge commit '76982404' into attribute
2019-08-21 12:44:07 +01:00
Jonas Jensen
863bf523d6
C++/C#/Java: Autoformat
2019-08-21 13:24:01 +02:00
Jonas Jensen
fdd3b901f7
C/C#/Java: Share ConfigurationRecursionPrevention
...
This class was copy-pasted in all `DataFlowN.qll` files without using
the identical-files system to keep the copies in sync. The class is now
moved to the `DataFlowImplN.qll` files.
This also has the effect of preventing recursion through first data flow
library copy for C/C++. Such recursion has been deprecated for over a
year, and some forms of recursions are already ruled out by the library
implementation.
2019-08-21 13:04:10 +02:00
Jonas Jensen
6fc3a62edb
C++/C#/Java: Change another caller of localFlow
...
There was also a use of `localFlowStep` in `DataFlowImplCommon` that
should now be `simpleLocalFlowStep`.
2019-08-21 10:20:15 +02:00
Jonas Jensen
c9ea5ad9a3
C#/Java: Remove cached from wrapper predicate
2019-08-21 09:43:13 +02:00
Jonas Jensen
4b7813b98e
C++/C#/Java: Split localFlowStep predicate in two
...
There's now a `localFlowStep` predicate for use directly in queries and
other libraries and a `simpleLocalFlowStep` for use only by the global
data flow library. The former predicate is intended to include field
flow, but the latter may not.
This will let Java and C# (and possibly C++ IR) avoid getting two kinds
of field flow at the same time, both from SSA and from the global data
flow library. It should let C++ AST add some form of field flow to
`localFlowStep` without making it an input to the global data flow
library.
2019-08-21 09:27:01 +02:00
Pavel Avgustinov
7176b438c4
Merge commit '7bfed6e517cbcabfe06cf614981baee8cbde5342' into attribute
2019-08-20 14:08:57 +01:00
Tom Hvitved
7ab9c8b90d
Java/C++/C#: flowCandFwdRead() refactor
2019-08-20 14:44:04 +02:00
Tom Hvitved
14378ee41a
Java/C++/C#: Remove some unbind() calls from shared data flow implementation
2019-08-20 13:59:01 +02:00
Jonas Jensen
f1e6e36ce6
Java: Remove wrong definition of taint tracking
...
This explanation, taken from C/C++, was not correct for Java.
2019-08-20 13:45:38 +02:00
Jonas Jensen
9ac0cdd2a2
Java: Don't use the deprecated Configuration2
2019-08-20 13:45:37 +02:00
Jonas Jensen
aeb2323128
Java: Use pyrameterized modules for TaintTracking
2019-08-20 13:45:37 +02:00
Tom Hvitved
a0c834c83d
Java/C++/C#: Improve data flow join orders for field flow
2019-08-20 10:14:08 +02:00
Anders Schack-Mulligen
6ff4fe38ec
Java/C++/C#: Add field flow support for stores in nested fields.
2019-08-19 14:41:06 +02:00
yh-semmle
73d8e16cd0
Java: remove obsolete VCS.qll and associated queries
2019-08-18 14:53:46 -04:00
Pavel Avgustinov
127c33700c
Add Java stubs readme
2019-08-17 18:57:50 +01:00
Pavel Avgustinov
c92eb58300
Add j2objc license
2019-08-17 16:31:18 +01:00
Pavel Avgustinov
b52ea1e21b
Add Apache Shiro third-party notice
2019-08-17 16:31:18 +01:00
Anders Schack-Mulligen
9e4f2f8594
Java: Don't use default dataflow in libs imported by default.
2019-08-16 13:27:53 +02:00
Anders Schack-Mulligen
1938ac4937
Java/C++/C#: Sync.
2019-08-14 10:32:15 +02:00
Anders Schack-Mulligen
0c56f955e8
Java: Fix bad join order.
2019-08-14 10:10:19 +02:00
Anders Schack-Mulligen
411bc16f44
Java/C++/C#: Address review comment.
2019-08-13 16:57:48 +02:00
Anders Schack-Mulligen
9e902066ad
Java/C++/C#: Elaborate qldoc.
2019-08-13 16:57:48 +02:00
Anders Schack-Mulligen
4550175b16
Java/C++/C#: Add support for BarrierGuards.
2019-08-13 16:57:48 +02:00
yh-semmle
5e910a4808
Merge pull request #1724 from aschackmull/java/google-xmlreader
...
Java: Treat SecureJDKXercesXMLReader as a secure XMLReader.
2019-08-13 09:52:32 -04:00
Tom Hvitved
36043d04bd
Merge pull request #1729 from xiemaisi/data-flow-nodes-location
...
Java/C++/C#: Provide path-node locations via `hasLocationInfo`, not `getLocation`.
2019-08-13 12:22:59 +02:00
Max Schaefer
eb8087f4ea
Java/C++/C#: Provide path-node locations via hasLocationInfo, not getLocation.
2019-08-12 12:52:30 +01:00
Anders Schack-Mulligen
41763e6025
Java: Treat SecureJDKXercesXMLReader as a secure XMLReader.
2019-08-09 16:00:41 +02:00
Anders Schack-Mulligen
a50ea54ff6
Java: Fix tests.
2019-08-08 12:03:01 +02:00
Anders Schack-Mulligen
b3e56d5b04
Java: Fix copy-paste typo.
2019-08-08 11:44:44 +02:00
Anders Schack-Mulligen
20e6f5594f
Java: Improve barriers for the CWE-190 Arithmetic* queries.
2019-08-07 15:22:23 +02:00
yh-semmle
033879f5a6
Merge pull request #1639 from aschackmull/java/in-out-barriers
...
Java/C++/C# DataFlow: Add support for in/out barriers on sources and sinks.
2019-08-07 01:07:19 -04:00
yh-semmle
9e4405f385
Merge pull request #1688 from aschackmull/java-cookbook/int-literal-value
...
Java Cookbook: Slight improvement to the IntegerLiteral pattern.
2019-08-05 20:37:58 -04:00
yh-semmle
7e90728c67
Merge pull request #1679 from aschackmull/java/reader-taint
...
Java: Adjust taint steps for Reader::read.
2019-08-05 12:46:12 -04:00
Anders Schack-Mulligen
a80cb262fc
Java/C++/C#: Elaborate qldoc.
2019-08-05 16:28:25 +02:00
Anders Schack-Mulligen
9ebb83497d
Java/C++/C#: Fix small mistake.
2019-08-05 15:34:12 +02:00
Anders Schack-Mulligen
2dc83c539c
Java/C++/C#: Sync dataflow.
2019-08-05 12:07:32 +02:00
Anders Schack-Mulligen
f8804943ee
Java: Change in/out barriers to be explicit in the configuration.
2019-08-05 12:05:12 +02:00
Anders Schack-Mulligen
15c61b57f7
Java Cookbook: Slight improvement to the IntegerLiteral pattern.
2019-08-05 11:03:30 +02:00
Jonas Jensen
73d8bf38a9
Merge pull request #1680 from aschackmull/cookbook/autoformat
...
Cookbook examples: Autoformat
2019-08-05 10:24:56 +02:00
Anders Schack-Mulligen
b1b1ede6b0
Java: Improve the precision of java/hardcoded-credential-api-call.
2019-08-02 16:50:58 +02:00
Anders Schack-Mulligen
9b74e9c4a4
Java: Autoformat cookbook examples.
2019-08-02 15:27:28 +02:00
Anders Schack-Mulligen
4ffc41277a
Java: Adjust taint steps for Reader::read.
2019-08-02 14:21:06 +02:00
Anders Schack-Mulligen
1a779179e7
Merge pull request #1666 from yh-semmle/java-xxe-qhelp
...
Java: update XXE qhelp with note on processing limits
2019-08-01 10:01:53 +02:00
yh-semmle
dc45ba5627
Java: update XXE qhelp with note on processing limits
2019-07-31 15:45:28 -04:00
semmle-qlci
1d806971ed
Merge pull request #1634 from aibaars/cookbook
...
Approved by aschackmull, dave-bartolomeo, hvitved, markshannon, xiemaisi, yh-semmle
2019-07-31 14:31:28 +01:00
yh-semmle
37395877a7
Merge pull request #1633 from aschackmull/java/taint-string-concat
...
Java: Add taint step for String::concat.
2019-07-30 00:21:52 -04:00
Arthur Baars
ccde7cf6cf
Add @id to example queries
2019-07-26 17:47:11 +02:00
Arthur Baars
bdce7d07c1
Move 'snippet' queries to 'snippets' folders
2019-07-26 17:47:11 +02:00
