Tony Torralba
6b58d11eeb
Merge pull request #13900 from atorralba/atorralba/java/jaxws-getaremotemethod-improv
...
Java: Improve `JaxWsEndpoint::getARemoteMethod`
2023-08-24 13:37:15 +02:00
Tony Torralba
8c32919381
Merge pull request #13903 from atorralba/atorralba/jaxrs-mad-models
...
Java: New models for JAX-RS
2023-08-24 11:43:13 +02:00
Tony Torralba
3f9701cea7
Two fixes:
...
* Consider that the @WebService annotation (et al) can be in a supertype or interface
* getARemoteMethod should only return public methods, since protected, package-private, and private methods are not exposed
2023-08-24 11:35:52 +02:00
Anders Schack-Mulligen
ebe3f61ef6
Java: Fix models in qltest.
2023-08-24 09:44:43 +02:00
Asger F
ee1b3fd7e9
Java: update test after VariableCapture.qll change
2023-08-23 14:57:26 +02:00
Tony Torralba
0f3918af16
Merge pull request #13773 from atorralba/atorralba/java/mdht-xxe-sink
...
Java: Add XXE sinks for MDHT
2023-08-23 13:49:49 +02:00
Michael Nebel
699ed107f3
Java: Update SupportedExternalApis expected test output.
2023-08-21 09:59:00 +02:00
Michael Nebel
5623ccf4a0
Java: Re-factor NeutralCallable to include all neutrals and introduce NeutralSummaryCallable.
2023-08-21 09:59:00 +02:00
Michael Nebel
6deeb36a97
Java: Update the comments in SupportedExternalApis to include the neutral kind and add a sink neutral example.
2023-08-21 09:58:59 +02:00
Edward Minnix III
929090a847
Typos and style fixes
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2023-08-17 13:05:37 -04:00
Ed Minnix
55fae2daaa
Added ESAPI sanitizer
2023-08-17 13:05:37 -04:00
Ed Minnix
97d6e82869
Stubs for org.owasp.esapi
2023-08-17 13:05:37 -04:00
Ed Minnix
f58590c6a9
Trust Boundary Work
2023-08-17 13:05:37 -04:00
Ed Minnix
2aba425464
TrustBoundary test ql file
2023-08-17 13:05:36 -04:00
Anders Starcke Henriksen
56871c77f5
Merge branch 'main' into starcke/automodel-pack
2023-08-17 10:04:44 +02:00
Stephan Brandauer
44a9cf93e0
Merge branch 'main' into kaeluka/add-provenance-to-metadata
2023-08-16 09:31:03 +02:00
Stephan Brandauer
808dc3e8d3
Java: Automodel framework mode: track exact ai- provenance in alreadyAiModeled meta data property
2023-08-16 09:25:03 +02:00
Stephan Brandauer
20254c3d0a
Merge pull request #13886 from github/kaeluka/java-automodel-variadic-args
...
Java: automodel application mode: use endpoint class like in framework mode
2023-08-16 08:49:01 +02:00
Michael Nebel
a95aad51bd
Merge pull request #13546 from michaelnebel/java/withoutelement
...
Java: Support for With[out]Element for MaD.
2023-08-15 10:03:03 +02:00
Geoffrey White
657642a122
Java: Expose parts of the vquery message in the test.
2023-08-14 14:12:07 +01:00
Stephan Brandauer
551b34e3be
Java: Automodel application mode: include candidates that are useful for regression testing
2023-08-14 11:46:40 +02:00
Stephan Brandauer
1a95a34441
Java: automodel: use the call for call context, rather than the argument
2023-08-14 09:54:44 +02:00
Stephan Brandauer
4107758c8a
Java: automodel extraction: add strings to query selection
2023-08-14 09:49:50 +02:00
Stephan Brandauer
e927470961
Merge branch 'main' into kaeluka/java-automodel-variadic-args
2023-08-09 09:02:32 +02:00
Anders Schack-Mulligen
0ca3f3308b
Merge pull request #13478 from aschackmull/java/varcapture
...
Java: Add proper support for variable capture flow.
2023-08-08 16:22:56 +02:00
Anders Starcke Henriksen
8d34ab6d18
Merge branch 'main' into starcke/automodel-pack
2023-08-08 15:02:33 +02:00
Michael Nebel
0ed724eb13
Java: Make a flow summary for Set.clear using WithoutElement and introduce appropriate tests.
2023-08-08 11:10:08 +02:00
Anders Schack-Mulligen
cd22bb3505
Java: Add another test case.
2023-08-08 10:00:55 +02:00
Stephan Brandauer
3433437034
Java: automodel application mode: only extract the first argument corresponding to a varargs array
2023-08-07 14:15:17 +02:00
Michael Nebel
e62ec888c0
Merge pull request #13506 from michaelnebel/java/threatmodels
...
Java: Threat Models
2023-08-07 12:50:01 +02:00
Stephan Brandauer
e1a5eba61b
Java: automodel application mode: refactor varargs endpoint class to rely on normal argument node for nicer extracted examples
2023-08-07 12:18:52 +02:00
Stephan Brandauer
0781cb78e8
Java: automodel application mode: add isVarargsArray metadata value
2023-08-07 12:18:51 +02:00
Stephan Brandauer
5abf7769a7
Java: automodel application mode: use endpoint class like in framework mode
2023-08-07 12:18:51 +02:00
Tony Torralba
fb0102b763
Java: New models for JAX-RS
2023-08-07 11:52:23 +02:00
Tony Torralba
43b9199734
Java: Improved JaxWsEndpoint::getARemoteMethod
2023-08-07 10:21:58 +02:00
Michael Nebel
9c4d77a925
Java: Address review comments.
2023-08-04 13:47:30 +02:00
Paul Hodgkinson
fba37aa7c9
Merge branch 'main' into java/experimental/command-injection
2023-08-03 14:12:38 +01:00
aegilops
3658710578
Fixed formatting, committed expected test results
2023-08-03 13:50:40 +01:00
Anders Starcke Henriksen
e2abd3ff13
Create separate automodel pack.
2023-08-03 13:55:15 +02:00
Anders Schack-Mulligen
0ae81eace3
Java: update fixed test
2023-08-03 10:07:00 +02:00
Anders Schack-Mulligen
c5990311ca
Java: Redesign and reimplement variable capture flow.
2023-08-03 10:04:06 +02:00
Anders Schack-Mulligen
70bef64e2a
Java: Fix ratpack flow.
2023-08-03 10:04:05 +02:00
Anders Schack-Mulligen
9a4de208ef
Java: Fix qltests.
2023-08-03 10:04:05 +02:00
Anders Schack-Mulligen
d1a616a70a
Java: Add proper support for variable capture flow.
2023-08-03 10:04:02 +02:00
Michael Nebel
4568cccd71
Java: Add some unit tests for sourceModelKindConfig.
2023-08-01 12:56:13 +02:00
Michael Nebel
fc66b6ef9c
Java: Update test comments to reflect the MaD syntax.
2023-08-01 12:03:44 +02:00
Michael Nebel
e97a4a1aea
Java: Update telemetry test expected output.
2023-08-01 12:03:44 +02:00
Michael Nebel
0604a85bb1
Java: Add WithoutElement model for List.clear and add appropriate test.
2023-08-01 12:03:44 +02:00
Stephan Brandauer
bc3e78f034
Java: add automodel framework mode test case for newly supported interface-method parameter extraction
2023-08-01 09:18:58 +02:00
Stephan Brandauer
5ad984f22f
Java: update text expectations after merging #13823
2023-08-01 09:18:58 +02:00
