Jeroen Ketema
9c774ac97f
Merge pull request #13426 from jketema/inline-3
...
Update inline flow tests to use parameterized module
2023-06-19 17:39:29 +02:00
Tony Torralba
c62689022e
Merge pull request #13256 from atorralba/atorralba/java/stapler-models
...
Java: Model the Stapler framework
2023-06-19 15:27:19 +02:00
Jeroen Ketema
bc42308bd3
Java: fix formatting
2023-06-19 10:31:49 +02:00
Jeroen Ketema
6a84e6cbfd
Add the merged PathGraph to all copies of the InlineFlowTest library
2023-06-19 10:28:10 +02:00
Ian Lynagh
a8acf16088
Kotlin: Remove diags.ql from classes test
...
The diags consistency test already handles this for us.
2023-06-16 12:57:19 +01:00
Jeroen Ketema
742eb8dd12
Java: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:10 +02:00
Tony Torralba
5e3d9d8136
Java: Model the Stapler framework
2023-06-14 12:34:52 +02:00
Tony Torralba
182513a981
Merge pull request #13235 from atorralba/atorralba/java/hudson-models
...
Java: Add Hudson models
2023-06-14 12:33:18 +02:00
Anders Schack-Mulligen
1a4fca334f
Merge pull request #13273 from aschackmull/dataflow/summarynode-refactor
...
Dataflow: Refactor FlowSummaryImpl to synthesize nodes independently from DataFlow::Node.
2023-06-14 09:38:36 +02:00
Jeroen Ketema
c3ba206b6a
Merge pull request #13346 from jketema/inline-2
...
Update inline expectation tests to use parameterized module
2023-06-13 10:10:55 +02:00
Tony Torralba
ffe67689ec
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-13 09:27:33 +02:00
Anders Schack-Mulligen
eec012d308
Java: Fix test
2023-06-12 13:18:13 +02:00
Jeroen Ketema
49993b023e
Java: Rewrite inline expectation tests to use parameterized module
2023-06-09 10:42:17 +02:00
Anders Schack-Mulligen
85d6b44d92
Java: Fix test output.
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
95afd551ff
Java: Fix qltest
2023-06-09 08:37:36 +02:00
Anders Schack-Mulligen
a0a9d30286
Java: Fix qltests.
2023-06-09 08:37:35 +02:00
Tony Torralba
4608481d7b
Java: Fix more problems in the Gson models
...
Found during type strengthening work by @aschackmull
2023-06-08 14:53:09 +02:00
Anders Schack-Mulligen
cc45db7c76
Merge pull request #13394 from atorralba/atorralba/java/fix-gson-jsonarray-models
...
Java: Fix Gson's JsonArray.add models
2023-06-08 11:05:40 +02:00
Tony Torralba
c0135673fa
Fix JsonArray.addAll model
...
Properly test JsonArray.add(String) and JsonArray.addAll(JsonArray) as well
2023-06-07 16:18:32 +02:00
Tony Torralba
6d7234f8ed
Merge pull request #13225 from atorralba/atorralba/java/path-injection-mad-sinks-2
...
Java: Migrate path injection sinks to models-as-data (simplified)
2023-06-07 14:27:36 +02:00
Tony Torralba
35b4c438ff
Fix Gson's JsonArray.add models
...
When the type of the argument isn't JsonElement, the summary must be taint flow instead of value flow
2023-06-07 14:12:20 +02:00
yoff
911835c30e
Merge pull request #13392 from yoff/java/test-type-tracking-through-flow-summaries
...
java: test type tracking through flow summaries
2023-06-07 14:10:23 +02:00
Tony Torralba
46b30453e3
Merge pull request #13386 from github/java/update-mad-decls-after-triage-2023-06-06T14-38-29
...
Java: Update MaD Declarations after Triage
2023-06-07 12:33:26 +02:00
Rasmus Lerchedahl Petersen
aec1e4a713
java: address ql alert
2023-06-07 11:40:50 +02:00
Rasmus Lerchedahl Petersen
76e1c6f76f
java: test type tracking through flow summaries
2023-06-07 11:18:53 +02:00
Tony Torralba
416d3d587d
Accept test changes
...
An uncovered test case is now correctly covered
2023-06-07 10:33:17 +02:00
Tony Torralba
72af634575
Kotlin: Add flow through use and with
2023-06-06 11:22:16 +02:00
Nick Rolfe
6c5c338e6b
Merge pull request #13348 from github/nickrolfe/java-location-tostring
...
Java: avoid call to `Location.toString()`
2023-06-06 09:55:42 +01:00
Jeroen Ketema
5f64354a70
Merge pull request #13353 from jketema/expecation
...
Fix typo in spelling of expectation
2023-06-02 12:29:49 +02:00
Tony Torralba
ad2f558002
Add Hudson models
...
Includes models-as-data rows, flow sources, and XSS sanitizers.
Tests for models-as-data rows not included.
2023-06-02 11:06:24 +02:00
Jeroen Ketema
7b17b92aca
Fix typo in spelling of expectation
2023-06-02 10:36:11 +02:00
Tony Torralba
527fe523a8
Add PathCreation.qll sinks to models-as-data
...
The old PathCreation sinks can't be removed because doing so would cause alert wobble in the path injection queries. See their getReportingNode predicates.
2023-06-02 09:14:35 +02:00
Tony Torralba
c3b1ef2cdf
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-02 08:57:24 +02:00
Jami
617107de35
Merge pull request #12916 from jcogs33/jcogs33/revamp-java-sink-kinds
...
Java: revamp MaD sink kinds
2023-06-01 12:48:30 -04:00
Nick Rolfe
7290e2bfd9
Java: avoid call to Location.toString()
2023-06-01 17:06:34 +01:00
Jami
10bab71c60
Merge pull request #12249 from jcogs33/jcogs33/add-heuristic-neutral-models
...
Java: add some neutral models discovered with heuristics
2023-06-01 07:51:55 -04:00
Jami Cogswell
82f208ca7a
Java: add isNeutralSink test case
2023-05-31 17:47:36 -04:00
Jami Cogswell
e28ce959a3
Java: update CaptureSinkModels test case
2023-05-31 15:51:07 -04:00
Jami Cogswell
5dbb698481
Java: update open/jdbc-url sink kinds to request-forgery
2023-05-31 15:50:31 -04:00
Tony Torralba
482bb94ad9
Merge pull request #13179 from pwntester/java_gson
...
[Java] Add basic support for Google's Gson library
2023-05-31 11:16:19 +02:00
Tony Torralba
6f302a43ea
Merge pull request #13297 from atorralba/atorralba/java/playmvc-models
...
Java: Add models for the Play Framework
2023-05-31 09:02:17 +02:00
Tony Torralba
d3d67f0fb0
Add tests & stubs
2023-05-30 17:52:00 +02:00
Andrew Eisenberg
2d81e30d81
Fix addsTo.pack references
...
This change is a prerequisite for a CLI change where there will be
strict testing of the `addsTo.pack` values. It must resolve to a pack
reference that is a transitive dependency of the current query's pack.
2023-05-29 13:45:41 -07:00
Jami Cogswell
24fc4ba2d4
Java: add tests
2023-05-26 18:55:13 -04:00
Tony Torralba
8e16a0d144
Add tests and stubs for the summaries
2023-05-26 12:43:58 +02:00
Tony Torralba
903fdb0cb8
Java: Add models for the Play Framework
2023-05-26 10:23:43 +02:00
Tony Torralba
a276cc3094
Convert all command injection sinks to MaD format
2023-05-25 11:41:32 +02:00
Tony Torralba
7d0b02e267
Merge pull request #13248 from atorralba/atorralba/java/nio-files-copy-models-fix
...
Java: Tweak java.nio.file.Files.copy models
2023-05-24 10:55:15 +02:00
Tony Torralba
654bb00946
Java: Tweak java.nio.files.Files.copy models
2023-05-23 10:27:19 +02:00
Ed Minnix
774baead60
Add test case based on missing result
2023-05-22 15:57:15 -04:00
