Benjamin Muskalla
0e9fcc6c39
Only generate models for local supertypes
...
Avoid generating models for classes
implementing external SPI (e.g. `FileFilter`).
Keep `toString` models intact as they're
commonly used as taint-propagation method
(e.g. see `Joiner`).
2021-11-10 16:30:23 +01:00
Benjamin Muskalla
157f56f48a
Capture model for defining interface
...
Instead of modeling individual implementations, take a more general
approach of reuse dataflows for interfaces defined by a library. This allows
tracking flows across all implementations and aligns better with how we
manually model frameworks. This may have some FPs given all possible flows
are modeled for a specific interface but also covers more scenarios where
we don't know which implementation of an interface is used.
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
f36bb8baaf
Exclude models for simpler types
...
Avoid generating models for types that can't really propagate taint
in a valuable way (e.g. primitivies, BigInt, ..). Keep tracking
bulk-like data (e.g. char[] or byte[]).
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
842f617bc1
Order sinks and sources first
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
be150f269b
Formatting
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
2654e27123
Exclude known internal APIs from being modeled
2021-11-10 16:30:22 +01:00
Benjamin Muskalla
6b2460d4a1
Formatting
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
060862ab3b
Avoid certain test sources in models
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
e607953b9c
Simplify query
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
9a859334d4
Formatting
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
6c59333716
Remove workaround that accounted for missing flow
2021-11-10 16:30:21 +01:00
Benjamin Muskalla
ca9d5439f0
Restrict source configuration to return nodes
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
7a7ec06819
Simplify sink configuration
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
1a4fd7bc7d
Allow camelcase names
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
2b2ac82fb7
Fix bug in sink detection
2021-11-10 16:30:20 +01:00
Benjamin Muskalla
c616eb1473
Fix finding more sources
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
38579ef25b
Add proper metadata to queries
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
a80d50cbc0
Simplify field flow
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
a1d8dfb524
Initial support for source models
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
c844f5382f
Add script to generate flow models
2021-11-10 16:30:19 +01:00
Benjamin Muskalla
f9fea15a52
Initial support for capturing sink models
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
364de55b8d
Support parameter->parameter flow
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
cd11ef3bf6
Support outgoing taint flow from fields
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
c3462be2c9
Capture argument->return value flows
2021-11-10 16:30:18 +01:00
Benjamin Muskalla
ec772fb6b2
Add support for qualifier flow
2021-11-10 16:30:17 +01:00
Benjamin Muskalla
32ef40c77b
Add scaffolding for summary model generator
2021-11-10 16:30:17 +01:00
Anders Schack-Mulligen
1e0eb2f6e4
Merge pull request #7072 from aschackmull/java/nomagic-synchsetunsynchget
...
Java: Fix bad magic in SynchSetUnsynchGet.
2021-11-08 13:48:22 +01:00
Anders Schack-Mulligen
92fb7f555c
Java: Fix bad magic in SynchSetUnsynchGet.
2021-11-08 11:42:20 +01:00
Anders Schack-Mulligen
85fdbda16f
Merge pull request #7002 from aschackmull/java/field-node
...
Java: Add FieldValueNode to break up cartesian step relation.
2021-11-08 09:31:42 +01:00
Tony Torralba
f4704f1325
Merge pull request #6397 from atorralba/atorralba/android-intent-redirect-query
...
Java: Create new Android Intent Redirection query
2021-11-04 10:42:59 +01:00
Tony Torralba
fd92c4e435
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-11-04 10:08:53 +01:00
Tony Torralba
6613a98e02
Fix references to logging library
2021-11-04 09:15:57 +01:00
Tony Torralba
474bf576a7
Minor corrections in QLDoc, qhelp and example code
2021-11-04 08:46:23 +01:00
Anders Schack-Mulligen
e6145f04d2
Merge pull request #6966 from atorralba/atorralba/android-explicit-intent-sanitizer
...
Android: Add ExplicitIntentSanitizer and allowIntentExtrasImplicitRead
2021-11-03 10:20:09 +01:00
CodeQL CI
5d62aa5b29
Merge pull request #6994 from erik-krogh/redundant-cast
...
Approved by RasmusWL, aschackmull, esbena, geoffw0, hvitved, nickrolfe
2021-11-02 03:45:48 -07:00
Tony Torralba
3ea1af3819
Refactor into separate libraries
2021-10-29 17:36:02 +02:00
Marcono1234
bfb9577d15
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
Erik Krogh Kristensen
d36c66cfca
remove redundant inline casts in arguments where the type is inferred by the call target
2021-10-29 14:37:56 +02:00
Anders Schack-Mulligen
35b6cbe549
Java: Fix compilation error.
2021-10-29 14:26:36 +02:00
Tony Torralba
7f15177498
Move from experimental
2021-10-29 10:19:05 +02:00
Erik Krogh Kristensen
15c90adec5
remove redundant cast where the type is enforced by an equality comparison
2021-10-28 18:08:20 +02:00
Erik Krogh Kristensen
e75448ebb0
remove redundant inline casts
2021-10-28 16:35:53 +02:00
Tony Torralba
6f7d0b62d7
Add ExplicitIntentSanitizer and allowIntentExtrasImplicitRead
2021-10-26 17:11:27 +02:00
Joe Farebrother
02b440b0ed
Merge pull request #6599 from joefarebrother/android-sensitive-communication
...
Java: Promote android sensitive broadcast query
2021-10-26 13:48:58 +01:00
Anders Schack-Mulligen
ba95d46ec3
Apply suggestions from code review
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2021-10-26 14:04:13 +02:00
Erik Krogh Kristensen
a3c55c2aec
use set literal instead of big disjunction of literals
2021-10-26 12:55:25 +02:00
Joe Farebrother
6dac86b9be
Fix unneeded import and spelling mistake
2021-10-25 14:11:00 +01:00
Joe Farebrother
0c1af2411b
Write intent in lowercase consistently
...
Co-authored-by: hubwriter <hubwriter@github.com >
2021-10-25 12:22:49 +01:00
Joe Farebrother
c89178c0e8
Apply suggestions from code review
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2021-10-22 10:54:57 +01:00
Joe Farebrother
a9dde419d2
Fix up test
2021-10-21 16:46:07 +01:00
