Stephan Brandauer
08f5774d13
Java: Automodel extraction fix for application mode
2023-07-25 17:11:07 +02:00
Stephan Brandauer
698b8d3c5c
Java: Automodel extraction fix; previously, we treated endpoints that were marked as sinks, as well as summary-neutrals as 'erroneous'
2023-07-25 16:52:27 +02:00
Tony Torralba
b8b38e4bbe
Java: Allow flow out of FieldValueNodes for non-static fields
2023-07-25 15:37:41 +02:00
Tony Torralba
c9fc5a54c7
Remove generated sinks and sources
2023-07-25 14:42:32 +02:00
Stephan Brandauer
2582b084f6
Merge pull request #13747 from github/tausbn/exclude-qualifier-argument-for-existing-models
...
Java: Exclude qualifier argument for existing models
2023-07-24 16:26:33 +02:00
Stephan Brandauer
13027a1094
Java: review suggestions from @atorralba
2023-07-24 14:09:10 +02:00
Stephan Brandauer
2f2f507a5d
Java: drive-by change: remove obsolete custom queries from application mode characteristics
2023-07-24 13:55:53 +02:00
Tony Torralba
6c0d47f122
Update java/ql/lib/semmle/code/java/frameworks/InputStream.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2023-07-24 08:49:37 +02:00
Tony Torralba
4e7438ac5c
Make sure that InputStreamWrapperCapturedLocalStep is indeed local
2023-07-24 08:49:37 +02:00
Tony Torralba
d3b3af8ae6
Re-adds jump step
...
Note that this causes FP flow in the call context test cases
2023-07-24 08:49:37 +02:00
Tony Torralba
36ff54b48b
Convert jump step into local step
...
Note that this has FNs in the test cases where the source is used locally in the nested classes' methods
2023-07-24 08:49:37 +02:00
Tony Torralba
cc5a404149
Add more test cases
2023-07-24 08:49:36 +02:00
Tony Torralba
226103b246
Add local class test
2023-07-24 08:49:36 +02:00
Tony Torralba
f054f73836
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2023-07-24 08:49:36 +02:00
Tony Torralba
1de68457ae
Move steps to InputStream.qll
2023-07-24 08:49:36 +02:00
Tony Torralba
0156fcc381
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2023-07-24 08:49:36 +02:00
Tony Torralba
3a6665b0ed
Add change note
2023-07-24 08:49:36 +02:00
Tony Torralba
5330ce12cc
Use new TypeInputStream
2023-07-24 08:49:34 +02:00
Tony Torralba
00e0e5a61a
Java: Add taint step for InputStream wrappers
2023-07-24 08:48:04 +02:00
github-actions[bot]
419bbbc9ac
Add changed framework coverage reports
2023-07-24 00:17:53 +00:00
github-actions[bot]
f91b7a9342
Post-release preparation for codeql-cli-2.14.1
2023-07-21 16:16:25 +00:00
Stephan Brandauer
79da723878
Java: only assume that _manual_ MaD sinks have been fully modeled
2023-07-21 10:43:07 +02:00
Tony Torralba
3d515b18df
Merge pull request #13769 from atorralba/atorralba/java/avoid-inputstream-low-confidence-dispatch
...
Java: Avoid low-confidence dispatch to InputStream methods
2023-07-21 10:42:34 +02:00
github-actions[bot]
c936a920b0
Release preparation for version 2.14.1
2023-07-20 16:32:27 +00:00
Geoffrey White
45a9d5bc7d
Java: QLDoc.
2023-07-20 11:53:52 +01:00
Geoffrey White
80cb386ffd
Java: Change note.
2023-07-20 11:52:04 +01:00
Geoffrey White
369f88beda
Java: Fix for multiple parse mode flags.
2023-07-20 11:49:54 +01:00
Geoffrey White
32c10885d4
Java: Add test case.
2023-07-20 11:43:11 +01:00
Tony Torralba
238cb26624
Add change note
2023-07-19 15:37:33 +02:00
Tony Torralba
29543f5726
Change InputStream.read from neutral to summary
2023-07-19 14:44:18 +02:00
Anders Schack-Mulligen
a9c76d4175
Merge pull request #13717 from aschackmull/dataflow/neverskipadditionalsteps
...
Dataflow: Add support for not skipping configuration-specific nodes in big-step
2023-07-19 14:06:54 +02:00
Stephan Brandauer
5575fc65aa
Merge pull request #13636 from github/tausbn/add-sink-alert-metrics-query
...
Java: Add metric queries for counting sinks coming from models
2023-07-19 13:12:32 +02:00
Anders Schack-Mulligen
e72a0b2f8c
Dataflow: Add change notes.
2023-07-19 11:41:15 +02:00
Anders Schack-Mulligen
ae24d68b5d
C/C++/C#/Java/Python/Ruby/Swift: Adjust expected output.
2023-07-19 11:41:15 +02:00
Anders Schack-Mulligen
95d17045c9
Dataflow: Sync.
2023-07-19 11:41:15 +02:00
Anders Schack-Mulligen
fd83b6afdb
Dataflow: Add support for not skipping configuration-specific nodes in big-step.
2023-07-19 11:41:15 +02:00
Tony Torralba
2dbbcc2413
Java: Avoid low-confidence dispatch to InputStream methods
...
Also adds a neutral model for `InputStream.read`, which offers a high-confidence alternative for this method.
2023-07-19 11:30:53 +02:00
Paul Hodgkinson
c7084b6d8e
Merge branch 'main' into java/experimental/command-injection
2023-07-18 11:38:44 +01:00
Anders Schack-Mulligen
e72366194b
Merge pull request #13754 from aschackmull/java/remotesource-inbarrier
...
Java: Exclude source-to-source flow in 5 queries.
2023-07-18 10:33:44 +02:00
Ian Lynagh
8a0286ec34
Java: Improve the diagnostics consistency query
...
Diagnostics can be easier to read if you see them in the order in which
they were generated. By selecting the compilation and indexes, they get
sorted by the testsuite driver.
d.getCompilationInfo(c, f, i) would be a bit more natural as
d = c.getDiagnostic(f, i), but currently we don't import Diagnostic into
the default ('import java') namespace, and I don't think it's worth
changing that for this.
2023-07-17 15:37:05 +01:00
Anders Schack-Mulligen
6770d2a49b
Java: Exclude source-to-source flow in 5 queries.
2023-07-17 09:06:49 +02:00
Taus
6b425f1395
Java: Revert definition of isNeutral
...
Reverts the change made in
daf2743143
2023-07-14 14:45:22 +02:00
Taus
6793bc6c6b
Java: Exclude qualifier argument for existing models
...
Excludes candadites for `Argument[this]` where we already have a model that covers a
different argument of the containing call.
2023-07-14 14:26:21 +02:00
Taus
895e829eb1
Java: Add QLDoc for query predicates
2023-07-14 14:22:10 +02:00
Taus
c4487673e8
Java: Swap input and ext
2023-07-14 14:21:59 +02:00
Taus
9193de6898
Merge pull request #13730 from github/tausbn/limit-number-of-candidates-in-application-mode
...
Java: Limit the number of samples extracted in application mode
2023-07-14 14:09:59 +02:00
Anders Schack-Mulligen
80a799df01
Merge pull request #13735 from aschackmull/dataflow/forcehighprecision-fix
...
Dataflow: Fix forceHighPrecision for length-2 prefixes.
2023-07-14 11:42:35 +02:00
github-actions[bot]
b675a1e2fe
Add changed framework coverage reports
2023-07-14 00:19:14 +00:00
Tony Torralba
cafc67e3be
Merge pull request #13714 from pwntester/java/langs3_improvements
...
[Java] Add missing commons lang3 model for ToStringBuilder.reflectionToString
2023-07-13 14:45:33 +02:00
Anders Schack-Mulligen
a0e96594d8
Merge pull request #13736 from aschackmull/dataflow/remove-superfluous-module-members
...
C#/Java/Ruby: Remove superfluous module members.
2023-07-13 13:59:31 +02:00
