Anders Schack-Mulligen
c34c667e6b
Java: Adjust to use the qlpack data-flow api.
2023-08-01 13:47:09 +02:00
Anders Schack-Mulligen
d7ea60e137
Java: Move data flow lib.
2023-08-01 13:47:08 +02:00
Michael Nebel
4568cccd71
Java: Add some unit tests for sourceModelKindConfig.
2023-08-01 12:56:13 +02:00
Michael Nebel
a9bc23fa3e
Java: Add threat model configuration related extensible predicates and some initial tuples.
2023-08-01 12:56:13 +02:00
Michael Nebel
a8ccc8d980
Java: Update MaD internal documentation.
2023-08-01 12:03:44 +02:00
Michael Nebel
fc66b6ef9c
Java: Update test comments to reflect the MaD syntax.
2023-08-01 12:03:44 +02:00
Michael Nebel
99ac98bffc
Java: Re-factor a model to use WithElement (this model is already tested in collections/B.java).
2023-08-01 12:03:44 +02:00
Michael Nebel
e97a4a1aea
Java: Update telemetry test expected output.
2023-08-01 12:03:44 +02:00
Michael Nebel
0604a85bb1
Java: Add WithoutElement model for List.clear and add appropriate test.
2023-08-01 12:03:44 +02:00
Michael Nebel
21ec83a197
Java: Add MaD support for With[out]Element.
2023-08-01 12:03:44 +02:00
Tony Torralba
b5d08ade59
Formatting
2023-08-01 09:35:25 +02:00
Anders Schack-Mulligen
e73e312e10
Java: Add change note.
2023-08-01 09:28:56 +02:00
Stephan Brandauer
621c05dc4b
Java: format
2023-08-01 09:19:03 +02:00
Stephan Brandauer
bc3e78f034
Java: add automodel framework mode test case for newly supported interface-method parameter extraction
2023-08-01 09:18:58 +02:00
Stephan Brandauer
058236877e
Java: Drive-by: fix oversight in #13823
...
In PR #13823 , we had rewritten the endpoints that are being considered for framework mode. We used to use `DataFlow::ParameterNode` as endpoints.
However, `ParameterNode`s do not exist for the implicit `this` parameter; they also do not exist for bodiless interface-methods.
In PR #13823 , we forgot to model that `this` only exists for non-static methods and to only consider parameters that we have source code for.
2023-08-01 09:18:58 +02:00
Stephan Brandauer
5ad984f22f
Java: update text expectations after merging #13823
2023-08-01 09:18:58 +02:00
Stephan Brandauer
da87d82d08
Java: fix a comment
2023-08-01 09:18:58 +02:00
Stephan Brandauer
be629b27ed
Java: Automodel package private test case
2023-08-01 09:18:57 +02:00
Stephan Brandauer
f5c4155d63
Java: Automodel tests: update after merging #13818
2023-08-01 09:18:57 +02:00
Stephan Brandauer
44b8ec642e
Java: merge framework mode tests into one
2023-08-01 09:18:57 +02:00
Stephan Brandauer
8cc367c45e
Java: merge application mode tests into one
2023-08-01 09:18:57 +02:00
Stephan Brandauer
37b6b46dbf
Java: update extraction query tests after merging PR #13747
2023-08-01 09:18:57 +02:00
Stephan Brandauer
50603102d1
Java: tests for automodel application mode, test that local calls are not candidates
2023-08-01 09:18:57 +02:00
Stephan Brandauer
457604e37e
Java: tests for automodel framework mode negative example extraction
2023-08-01 09:18:57 +02:00
Stephan Brandauer
938a7a788f
Java: tests for automodel application mode negative example extraction
2023-08-01 09:18:57 +02:00
Stephan Brandauer
abed936556
Java: tests for automodel framework mode positive example extraction
2023-08-01 09:18:57 +02:00
Stephan Brandauer
1bc222ec40
Java: tests for automodel application mode positive example extraction
2023-08-01 09:18:57 +02:00
Stephan Brandauer
2e89a11949
Java: tests for automodel application mode candidate extraction
2023-08-01 09:18:56 +02:00
Stephan Brandauer
18fe587e75
Java: tests for automodel framework mode candidate extraction
2023-08-01 09:18:56 +02:00
github-actions[bot]
b547ae7c2f
Add changed framework coverage reports
2023-08-01 00:18:36 +00:00
Paul Hodgkinson
3bc7cf6ac7
Merge branch 'main' into java/experimental/command-injection
2023-07-31 19:14:55 +01:00
Anders Schack-Mulligen
e87b8ba3d7
Java: Make the barrier in java/potentially-weak-cryptographic-algorithm less restrictive.
2023-07-31 14:28:53 +02:00
Tony Torralba
5488abc512
Merge pull request #13850 from atorralba/atorralba/java/unimportant-generated-models
...
Java: Remove superfluous generated models
2023-07-31 11:25:03 +02:00
Tony Torralba
2cbb7ed296
Java: Add XXE sinks for MDHT
2023-07-31 11:13:17 +02:00
Tony Torralba
41f1315da9
Merge pull request #13772 from atorralba/atorralba/java/inputstream-wrapper-read-step
...
Java: Add taint steps for InputStream wrappers
2023-07-31 11:12:43 +02:00
Tony Torralba
3bd4d34a47
Java: Remove superfluous generated models
2023-07-31 09:48:03 +02:00
Ian Lynagh
01a512b677
Kotlin: Pass on a parentId
2023-07-28 17:46:05 +01:00
Ian Lynagh
e8f4aee1cf
Kotlin: Remove some redundant braces
2023-07-28 17:02:24 +01:00
Stephan Brandauer
40eab180cc
Merge pull request #13823 from github/kaeluka/support-argument-this-in-frameworkmode-metadata-extraction
...
Java: Support Argument[this] and parameters of bodiless interface methods in framework mode metadata extraction
2023-07-28 17:38:39 +02:00
Tony Torralba
08cba7dc5f
Merge pull request #13713 from pwntester/java/struts2_source_taint_inheriting
...
[Java] Implement field taint inheritance for Struts2 unmarshalled objects
2023-07-28 16:46:27 +02:00
Owen Mansel-Chan
a020189895
Merge pull request #13822 from owen-mc/dataflow/mergepathgraph3-signature-fix
...
Dataflow: MergePathGraph3 signature fix
2023-07-28 15:15:43 +01:00
Tony Torralba
2dff0ce5b4
Merge pull request #13712 from pwntester/java/new_struts2_models
...
[Java] New models for Struts2 framework
2023-07-28 14:31:25 +02:00
Stephan Brandauer
8bf960bd44
Java: fix QL-for-QL alert
2023-07-28 14:28:47 +02:00
Stephan Brandauer
021eedfdf1
Java: format
2023-07-28 14:26:34 +02:00
Stephan Brandauer
82fd0e45aa
Java: support Argument[this] in NotAModelApiParameter
2023-07-28 14:04:53 +02:00
Stephan Brandauer
a9d2f43538
Java: use a newtype for framework mode candidates
2023-07-28 13:51:25 +02:00
Stephan Brandauer
8ed773b240
Java: Framework mode extraction now uses a custom class for endpoints, so we can support both Argument[this] and interface-method parameters
2023-07-28 12:56:39 +02:00
Stephan Brandauer
09c64e8fee
Java: Support Argument[this] in framework mode metadata extraction
2023-07-28 12:55:26 +02:00
Ian Lynagh
499bd970d3
Merge pull request #13412 from igfoo/igfoo/json_escape
...
Kotlin: Tweak our JSON escaping
2023-07-28 11:13:51 +01:00
Alvaro Muñoz
c3a2ae2943
Account for public fields/setters
2023-07-28 12:12:07 +02:00
