Benjamin Muskalla
bc10fd94cb
Support generating only specific models
2021-11-10 16:30:23 +01:00
Benjamin Muskalla
0e9fcc6c39
Only generate models for local supertypes
...
Avoid generating models for classes
implementing external SPI (e.g. `FileFilter`).
Keep `toString` models intact as they're
commonly used as taint-propagation method
(e.g. see `Joiner`).
2021-11-10 16:30:23 +01:00
Benjamin Muskalla
157f56f48a
Capture model for defining interface
...
Instead of modeling individual implementations, take a more general
approach of reuse dataflows for interfaces defined by a library. This allows
tracking flows across all implementations and aligns better with how we
manually model frameworks. This may have some FPs given all possible flows
are modeled for a specific interface but also covers more scenarios where
we don't know which implementation of an interface is used.
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
f36bb8baaf
Exclude models for simpler types
...
Avoid generating models for types that can't really propagate taint
in a valuable way (e.g. primitivies, BigInt, ..). Keep tracking
bulk-like data (e.g. char[] or byte[]).
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
842f617bc1
Order sinks and sources first
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
be150f269b
Formatting
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
2654e27123
Exclude known internal APIs from being modeled
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
6b2460d4a1
Formatting
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
060862ab3b
Avoid certain test sources in models
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
e607953b9c
Simplify query
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
9a859334d4
Formatting
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
6c59333716
Remove workaround that accounted for missing flow
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
ca9d5439f0
Restrict source configuration to return nodes
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
7a7ec06819
Simplify sink configuration
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
1a4fd7bc7d
Allow camelcase names
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
2b2ac82fb7
Fix bug in sink detection
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
c616eb1473
Fix finding more sources
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
38579ef25b
Add proper metadata to queries
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
a80d50cbc0
Simplify field flow
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
a1d8dfb524
Initial support for source models
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
c844f5382f
Add script to generate flow models
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
f9fea15a52
Initial support for capturing sink models
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
364de55b8d
Support parameter->parameter flow
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
cd11ef3bf6
Support outgoing taint flow from fields
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
c3462be2c9
Capture argument->return value flows
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
ec772fb6b2
Add support for qualifier flow
2021-11-10 16:30:17 +01:00
Benjamin Muskalla
32ef40c77b
Add scaffolding for summary model generator
2021-11-10 16:30:17 +01:00
Anders Schack-Mulligen
fc69acee46
Java: Add test.
2021-10-07 13:28:02 +02:00
Tony Torralba
064aba810b
Remove hyphens from the flow testcase generator folder name
...
So that it can be imported from the autogenerated query `gen.ql`
2021-10-04 13:31:07 +02:00
Benjamin Muskalla
5f659f6e48
Merge branch 'main' into fixHiddenTypesTestGenerator
2021-09-28 17:42:39 +02:00
Benjamin Muskalla
70e1724463
Exclude methods with non-public parameter types
2021-09-24 12:41:12 +02:00
Benjamin Muskalla
38ca5aba98
Move test generator into subdirectory
2021-09-24 11:13:04 +02:00
Benjamin Muskalla
4e6a8d991e
Move stub generator into subdirectory
2021-09-24 11:12:41 +02:00
Joe Farebrother
e946f49b64
[Test gen] Gen methods for Set and Iterator
2021-09-17 11:22:50 +01:00
Joe Farebrother
54dbd7c0bd
[Test gen] Add more support method implementations
2021-09-16 15:23:03 +01:00
Joe Farebrother
ef5bf87672
[Test gen] Distinguish default support methods
2021-09-16 15:23:03 +01:00
Benjamin Muskalla
abd770a027
Avoid empty template in test generator
2021-09-14 15:32:12 +02:00
Benjamin Muskalla
f9918cc63c
Test generator uses InlineFlowTest
2021-09-14 11:58:56 +02:00
Chris Smowton
0dd463dd2b
Merge pull request #6520 from smowton/smowton/feature/allow-local-interfaces
...
Java: Allow local interfaces
2021-09-03 12:01:36 +01:00
Chris Smowton
c259d0204a
Move unreachable cases of IndirectType into getAContainedType
2021-09-02 17:53:52 +01:00
Chris Smowton
b9afccc015
Remove impossible lines from Stubs.qll
2021-09-02 17:14:38 +01:00
Chris Smowton
e048a729db
Add Interface.isLocal and use it where appropriate
...
Some EJB logic regrettably needs to be renamed out of the way. Hopefully the churn caused by this is less than would be caused if Interface's isLocal needed to be named differently from Class.isLocal.
2021-09-02 14:51:46 +01:00
Chris Smowton
b38a23daee
Fix test cases featuring primitive arrays
...
Previously we couldn't print the name of types like `byte[]` for example.
2021-08-31 15:12:47 +01:00
Chris Smowton
f94d8c341d
Abbreviate multi-column min
2021-08-31 11:57:49 +01:00
Chris Smowton
510f5abb9a
Add missing qldoc
2021-08-31 11:56:03 +01:00
Chris Smowton
5dddc48e60
autoformat
2021-08-31 11:53:13 +01:00
Sauyon Lee
adcb90aa8c
fixup generateflowtestcase chaneg
2021-08-27 11:25:03 -07:00
Sauyon Lee
23b9028d2c
Correctly determine which support method definitions are required
2021-08-27 11:25:03 -07:00
Sauyon Lee
04e04b3031
Use array allocation syntax
2021-08-27 11:25:03 -07:00
Sauyon Lee
97faeb026f
Fix side of stack that gen method types are used
2021-08-27 11:25:03 -07:00
