Stephan Brandauer
8ed773b240
Java: Framework mode extraction now uses a custom class for endpoints, so we can support both Argument[this] and interface-method parameters
2023-07-28 12:56:39 +02:00
Stephan Brandauer
09c64e8fee
Java: Support Argument[this] in framework mode metadata extraction
2023-07-28 12:55:26 +02:00
Stephan Brandauer
08f5774d13
Java: Automodel extraction fix for application mode
2023-07-25 17:11:07 +02:00
Stephan Brandauer
698b8d3c5c
Java: Automodel extraction fix; previously, we treated endpoints that were marked as sinks, as well as summary-neutrals as 'erroneous'
2023-07-25 16:52:27 +02:00
Stephan Brandauer
2582b084f6
Merge pull request #13747 from github/tausbn/exclude-qualifier-argument-for-existing-models
...
Java: Exclude qualifier argument for existing models
2023-07-24 16:26:33 +02:00
Stephan Brandauer
13027a1094
Java: review suggestions from @atorralba
2023-07-24 14:09:10 +02:00
Stephan Brandauer
2f2f507a5d
Java: drive-by change: remove obsolete custom queries from application mode characteristics
2023-07-24 13:55:53 +02:00
Stephan Brandauer
79da723878
Java: only assume that _manual_ MaD sinks have been fully modeled
2023-07-21 10:43:07 +02:00
Stephan Brandauer
5575fc65aa
Merge pull request #13636 from github/tausbn/add-sink-alert-metrics-query
...
Java: Add metric queries for counting sinks coming from models
2023-07-19 13:12:32 +02:00
Taus
6b425f1395
Java: Revert definition of isNeutral
...
Reverts the change made in
daf2743143
2023-07-14 14:45:22 +02:00
Taus
6793bc6c6b
Java: Exclude qualifier argument for existing models
...
Excludes candadites for `Argument[this]` where we already have a model that covers a
different argument of the containing call.
2023-07-14 14:26:21 +02:00
Taus
895e829eb1
Java: Add QLDoc for query predicates
2023-07-14 14:22:10 +02:00
Taus
c4487673e8
Java: Swap input and ext
2023-07-14 14:21:59 +02:00
Taus
49194a2af7
Java: Limit the number of samples extracted in application mode
...
Uses the same trick as for the negative examples, this time with a limit of 7
candidates for each endpoint signature.
As this duplicates some of the logic used in another query, it may be worthwhile
to consider extracting this into a shared parameterized module.
2023-07-12 15:13:10 +02:00
Taus
f666260cd8
Java: Add meta query for metrics gathering
...
Exposes the same information as the existing queries through two query
predicates instead. This makes the downstream data gathering a bit more
convenient to implement.
2023-07-06 16:59:15 +02:00
Taus
36c6c7235c
Java: Move instance counting logic into utility library
2023-07-06 16:59:15 +02:00
Taus
97610d2cac
Java: Add query for counting sink model instances
...
Also adds a more sensible ordering to the existing queries.
2023-07-04 14:24:52 +02:00
Taus
b7e4bd290d
Java: Use an IPA type instead of a string
...
While the string representation is useful for quickly modifying queries, it's
a bit clunky when the data needs to be further parsed. Instead, the two queries
now select all of the columns of the sinkmodel separately (which makes it easy
to pull them out of the relevant output later on).
2023-07-03 23:17:55 +02:00
Michael Nebel
23a119b8c2
Java/C#: Reduce the amount of telemetry being produced.
2023-07-03 16:54:07 +02:00
Taus
6f24d939f6
Java: Also select query id
2023-07-01 15:04:06 +02:00
Taus
dca227389d
Java: Add metric queries for counting sinks coming from models
...
Adds two queries for gathering metrics on the number of alerts (for a selection of queries)
that arise from models with the `ai-generated` provenance.
2023-06-30 15:07:13 +02:00
Koen Vlaswinkel
6806b8750d
Java: Use getSourceDeclaration to handle generic types
2023-06-29 11:49:16 +02:00
Koen Vlaswinkel
fcb2f1082c
Java: Fix external API name for nested types
...
This fixes the name of reported external APIs for nested types.
The `toString()` method of `getSourceDeclaration()` would report the
name of a type, but not the name of the enclosing type. This results
in missing information in the `UnsupportedExternalAPIs.ql` query.
For example, previously it would report:
```
org.zapodot.junit.db.Builder#build()
```
However, the `Builder` class does not exist in the package and is only
a nested type within `EmbeddedDatabaseRule`. The correct name should be:
```
org.zapodot.junit.db.EmbeddedDatabaseRule$Builder#build()
```
This name also matches the format of MaD.
2023-06-27 15:23:55 +02:00
Jean Helie
baf6b74945
use new sink mad kinds and simplify isKnownKind predicate
2023-06-16 13:58:23 +02:00
Jean Helie
daf2743143
only use neutral models of kind "sink"
2023-06-16 13:58:23 +02:00
Stephan Brandauer
b38bc52019
Java: fix bug in ExcludedFromModeling Characteristic
2023-06-09 14:57:56 +02:00
Stephan Brandauer
2921df41da
Java: fix import
2023-06-07 15:22:59 +02:00
Stephan Brandauer
ec3a7e39ad
Java: qldoc style
2023-06-07 14:57:38 +02:00
Stephan Brandauer
715b1351f3
Java: share considerSubtypes predicate between Java modes
2023-06-07 14:55:00 +02:00
Stephan Brandauer
7e77e2ea82
Java: comment why we're using erased types in MaD
2023-06-07 14:42:20 +02:00
Stephan Brandauer
a8799fe981
Java: share getCallable interface between automodel extraction modes
2023-06-07 14:38:52 +02:00
Stephan Brandauer
92ad02a752
Java: update getRelatedLocation qldoc
2023-06-07 14:09:07 +02:00
Stephan Brandauer
be6b1d8aaf
Java: remove SkipFrameworkModeling characteristic in favour of later evaluation
2023-06-07 13:58:56 +02:00
Stephan Brandauer
2e16b71215
Java: update qldoc of ClassQualifierCharacteristic
2023-06-07 13:52:57 +02:00
Stephan Brandauer
1bfbfec1bc
Java: use problem.severity in automodel extraction queries
2023-06-07 13:44:52 +02:00
Stephan Brandauer
5de56db3af
Java: QlDoc for isKnownKind
2023-05-31 14:13:14 +02:00
Stephan Brandauer
03051dde7f
Java: spelling
2023-05-31 14:13:14 +02:00
Taus
ea5c36491b
Java: Improve documentation of sampling strategy
2023-05-31 11:39:54 +00:00
Stephan Brandauer
5a9d09c49e
Java: docs update
...
Co-authored-by: Aditya Sharad <6874315+adityasharad@users.noreply.github.com >
2023-05-31 13:36:58 +02:00
Stephan Brandauer
12ea5e0e90
Java: fix sanitizer bug
2023-05-31 11:53:02 +02:00
Stephan Brandauer
86559317d7
Java: update comments
2023-05-31 11:52:26 +02:00
Stephan Brandauer
96bae2d5ec
Java: avoid downcasting to DollarAtString
2023-05-31 10:41:52 +02:00
Taus
73aa790cdd
Java: Improve sampling strategy
...
Instead of the "random" sampling used before (which could -- in rare circumstances -- end up sampling fewer points than we want) we now sample an equally distributed set of points.
2023-05-30 11:22:26 +00:00
Stephan Brandauer
d4b964c849
add support for sanitizers
2023-05-30 10:25:52 +02:00
Taus
227c5fab40
Java: Get location ordering without toString
2023-05-26 14:52:08 +00:00
Stephan Brandauer
efe539eb32
Java: better sampling of negative examples
2023-05-26 14:15:32 +02:00
Stephan Brandauer
a89378d86d
Java: add extra known frameworks and sample negative samples to manage sarif file sizes
2023-05-26 13:20:04 +02:00
Stephan Brandauer
5ca2221097
remove some of the biggest frameworks from application mode consideration
2023-05-25 17:06:02 +02:00
Stephan Brandauer
db77c6b9a3
Java: mark functional expressions as likely not sinks
2023-05-25 16:39:27 +02:00
Stephan Brandauer
76d731a61d
improve CannotBeTaintedCharacteristic
2023-05-25 16:28:07 +02:00
