Jami Cogswell
e17486a9d8
Java: rename springframework stubs directory from 5.3.8 to 5.8.x
2025-03-11 15:20:58 -04:00
Michael Nebel
0a1d2d0bbb
Java: Update all test util paths to point to the new location.
2024-12-12 13:21:25 +01:00
Owen Mansel-Chan
066db766ef
Merge pull request #18153 from owen-mc/java/resttemplate-getforobject
...
Java: add SSRF sink model for the third parameter of `RestTemplate.getForObject`
2024-12-11 16:37:35 +00:00
Jeroen Ketema
89d20fd086
Java: Update expected test results
2024-12-03 19:18:59 +01:00
Owen Mansel-Chan
7648d397f8
Improve model to remove some false positives
2024-11-29 09:46:41 +00:00
Owen Mansel-Chan
b5fbf2e944
Add models for third arg of getForObject
...
No attempt to stop FPs.
2024-11-28 16:51:13 +00:00
Michael Nebel
cbd9cc6dae
Java: Update request forgery expected output.
2024-10-21 15:19:30 +02:00
Tony Torralba
2448bc8ce2
Java: Add new Apache CXF models
2023-08-25 11:17:51 +02:00
Tony Torralba
fb0102b763
Java: New models for JAX-RS
2023-08-07 11:52:23 +02:00
Jeroen Ketema
49993b023e
Java: Rewrite inline expectation tests to use parameterized module
2023-06-09 10:42:17 +02:00
Tony Torralba
903fdb0cb8
Java: Add models for the Play Framework
2023-05-26 10:23:43 +02:00
Ed Minnix
774baead60
Add test case based on missing result
2023-05-22 15:57:15 -04:00
Jami Cogswell
0e3d9e1fec
Java: update options file
2023-04-13 09:57:44 -04:00
Jami Cogswell
f27eff4f73
Java: add tests back
2023-04-13 09:15:03 -04:00
Jami Cogswell
6271b6f1c3
Java: temp removal of tests
2023-04-13 09:15:02 -04:00
Jami Cogswell
0445509080
Java: update test cases and add stubs
2023-04-13 09:15:02 -04:00
Jami Cogswell
540b8391dc
Java: add more tests
2023-04-13 09:12:55 -04:00
Jami Cogswell
cd7b79f62b
Java: add tests for org.apache.hc.client5.http.fluent
2023-04-13 09:12:54 -04:00
Jami Cogswell
1afa5af3dd
Java: move version 5 tests to new file and add tests for org.apache.hc.client5.http.classic.methods
2023-04-13 09:12:54 -04:00
Jami Cogswell
2a23f8766e
Java: add tests for org.apache.hc.client5.http.async.methods.model.yml; resolve conflicts
2023-04-13 09:12:54 -04:00
Anders Schack-Mulligen
ec34d44359
Java: Rename references.
2023-03-23 13:06:19 +01:00
Michael Nebel
e86f1e4961
Java: Replace Argument[-1] with Argument[this].
2023-03-20 10:14:20 +01:00
Tony Torralba
3b4980ba2f
org.kohsuke.stapler.model tests
2023-03-15 14:36:45 +01:00
Tony Torralba
db9e305a56
org.apache.commons.jelly tests
2023-03-14 17:04:14 +01:00
Tony Torralba
452b9d11db
java.net tests
2023-03-14 11:43:23 +01:00
Tony Torralba
705691b096
Merge pull request #12446 from github/java/update-mad-decls-after-triage-2023-03-08T14-51-59
...
Java: Update MaD Declarations after Triage
2023-03-13 14:07:59 +01:00
Tony Torralba
f07f0888aa
Fix tests
2023-03-10 12:35:13 +01:00
Tony Torralba
8065714ebe
Add tests
2023-03-10 12:35:13 +01:00
Anders Schack-Mulligen
e7f85673e9
Java: Fix tests and make modules private
2023-03-08 13:35:25 +01:00
p0wn4j
ee67d27b56
Java: Add JDBC connection SSRF sinks
2022-03-12 16:35:32 +04:00
Chris Smowton
e0a7f6e14f
Fix URLClassLoader test
2021-07-01 15:03:38 +01:00
p0wn4j
0db7496617
Add URLClassLoader and Spring WebClient SSRF sinks
2021-07-01 03:34:14 +04:00
Sauyon Lee
60db9e1851
Rename springframework-5.2.3 to 5.3.8
2021-06-28 08:26:39 -07:00
Chris Smowton
11b70326fd
Add Jakarta WS url-open sink
2021-06-17 11:58:41 +01:00
Chris Smowton
c531b81ebe
Rename RequestForgery.java -> SanitizationTests.java
2021-06-17 11:43:33 +01:00
Chris Smowton
cb99e17f4d
Split and rename JavaNetHttp and ApacheHttp tests for consistency
2021-06-17 11:43:32 +01:00
Chris Smowton
6c4a909b86
Remove dead code from test
2021-06-17 11:43:32 +01:00
Chris Smowton
08ab5f5546
Remove redundant test
2021-06-17 11:43:32 +01:00
Chris Smowton
74569ce316
Tidy Jax-RS test
2021-06-17 11:43:32 +01:00
Chris Smowton
57ca36baad
Tidy Spring test
2021-06-17 11:43:32 +01:00
Chris Smowton
8b080a94e7
Convert request forgery tests to inline expectations; add missing models revealed by this process.
2021-06-17 11:43:32 +01:00
Chris Smowton
b66dcbe5b6
Factor request-forgery config so it can be used in an inline-expectations test
2021-06-17 11:43:32 +01:00
Chris Smowton
ee872f1752
Add missing tests, add additional models revealed missing in the process, and add stubs to support them all.
2021-06-17 11:43:32 +01:00
Chris Smowton
49bbfc3f4b
Convert SSRF sinks into url-open CSV sinks
...
I also drop the previous approach of taint-tracking through various builder objects in favour of assuming that a URI set in a request-builder object is highly likely to end up requested in some way or another.
This will cause the `java/non-https-url` query to pick the new sinks up too, and fixes a Spring case that had never worked but went unnoticed until now.
2021-06-17 11:43:30 +01:00
Chris Smowton
55c72cebf2
Improve StringBuilder append chain tracking
...
Previously this didn't catch the case of constructors chaining directly into appends, like `StringBuilder sb = new StringBuilder("1").append("2")`
2021-06-17 11:41:06 +01:00
Chris Smowton
1549993565
Update test results to account for changed model structure
...
(Models now have internal nodes in order to allow field flow through them)
2021-06-17 11:41:05 +01:00
Chris Smowton
575198a0e4
Java SSRF query: Server Side -> Server-Side everywhere.
2021-06-17 11:41:04 +01:00
Chris Smowton
77904d9597
Remove failing test
...
The case where something might be exactly a constant is general across all queries, and not handled yet, particularly in the case where the result of `getParameter("uri")` might have changed between the check and the use.
2021-06-17 11:41:04 +01:00
Chris Smowton
6933d06a46
Add exactly the string '/' as a sanitizing prefix.
...
Usually this is ignored for suspicion that it could be taken for a protocol specifier, but on balance the context `(something) + "/" + tainted()` is more likely to be taken for a user-controlled location within a host the user does not control.
2021-06-17 11:41:03 +01:00
Chris Smowton
b5a450b881
SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.
2021-06-17 11:41:03 +01:00
