Jami Cogswell
7310c155e2
Java: rename SpringUrlForwardSink
2024-03-13 16:28:44 -04:00
Jami Cogswell
a8075969d8
Java: add QLDocs to UrlPathBarrier code
2024-03-13 16:28:44 -04:00
Jami Cogswell
042dcf9cd9
Java: some updates to UrlPathBarrier code
2024-03-13 16:28:44 -04:00
Jami Cogswell
052452b186
Java: create UrlDecodeMethod
2024-03-13 16:28:44 -04:00
Jami Cogswell
d220b3a298
Java: some updates to test cases
2024-03-13 16:28:43 -04:00
Jami Cogswell
43b49628fc
Java: use new 'SimpleTypeSanitizer', and update some non-extending subtype relationships
2024-03-13 16:28:43 -04:00
Jami Cogswell
2708e53c7f
Java: remove redundant imports
2024-03-13 16:28:43 -04:00
Jami Cogswell
f573032b2e
Java: remove todo comments from ext files
2024-03-13 16:28:43 -04:00
Jami Cogswell
911a61df22
Java: initial update of barrier and test cases to remove FN
2024-03-13 16:28:42 -04:00
Jami Cogswell
5fa63ab5c2
Java: update/add some TODO comments
2024-03-13 16:28:41 -04:00
Jami Cogswell
09bc21dbd3
Java: rename 'UnsafeUrlForward' to 'UrlForward'
2024-03-13 16:28:41 -04:00
Jami Cogswell
5a9d7552b3
Java: add some comments and minor code reorg
2024-03-13 16:28:41 -04:00
Jami Cogswell
1da1e896cb
Java: convert SpringModelAndViewSink to MaD
2024-03-13 16:28:41 -04:00
Jami Cogswell
8d66097483
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
2024-03-13 16:28:41 -04:00
Jami Cogswell
42e3825ea3
Java: convert RequestDispatcherSink to MaD
2024-03-13 16:28:40 -04:00
Jami Cogswell
4ff884e26c
Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)
2024-03-13 16:28:40 -04:00
Jami Cogswell
2a682995ae
Java: move MaD models to correct files, delete ones that already exist
2024-03-13 16:28:40 -04:00
Jami Cogswell
915e106ab3
Java: remove path-injection related models and tests for now
2024-03-13 16:28:40 -04:00
Jami Cogswell
2793f28428
Java: move config to Query.qll file
2024-03-13 16:28:40 -04:00
Jami Cogswell
0d38a9625e
Java: copy files from experimental
2024-03-13 16:28:39 -04:00
Tony Torralba
039bea1625
Java: Add more neutral JDK models
...
This is similar to https://github.com/github/codeql/pull/15766 , in the sense that it adds neutral models to prevent the model generator from generating summaries for them. These models were spotted while evaluating https://github.com/github/codeql/pull/14919 .
2024-03-13 16:59:38 +01:00
Tom Hvitved
02ae2d1520
Java: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Edward Minnix III
d54489931c
Merge pull request #15869 from egregius313/egregius313/java/fix/parcelfiledescriptor-open-sink
...
Java: Add path-injection sink for `ParcelFileDescriptor::open`
2024-03-12 16:39:20 -04:00
Erik Krogh Kristensen
863e3f79e5
Merge pull request #15731 from erik-krogh/java-url
...
Java: More sanitizers for request-forgery
2024-03-12 19:31:52 +01:00
erik-krogh
f613823047
add explicit QLDoc that any method named "contains" is matched
2024-03-12 15:25:27 +01:00
erik-krogh
35aae0a981
move changenote to src/
2024-03-12 15:22:57 +01:00
Erik Krogh Kristensen
b53ae77c56
expand change-note
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-03-12 15:22:17 +01:00
erik-krogh
74876ff49b
add change-note
2024-03-12 15:07:36 +01:00
erik-krogh
52f71e4553
small fixes based on review
2024-03-12 15:07:29 +01:00
Ed Minnix
76aeee2820
Change note
2024-03-11 10:34:15 -04:00
Ed Minnix
61dbe26858
Add sinks for android.os.ParcelFileDescriptor
2024-03-11 10:31:51 -04:00
Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
github-actions[bot]
dc9092c9ec
Post-release preparation for codeql-cli-2.16.4
2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d
Release preparation for version 2.16.4
2024-03-06 20:56:51 +00:00
Angela P Wen
ce31f8641a
Revert "Release preparation for version 2.16.4"
2024-03-06 12:07:33 -08:00
github-actions[bot]
661e68dab5
Release preparation for version 2.16.4
2024-03-05 18:13:58 +00:00
Angela P Wen
967963a653
Revert "Release preparation for version 2.16.4"
2024-03-05 08:53:33 -08:00
github-actions[bot]
a67218a027
Release preparation for version 2.16.4
2024-03-04 17:42:08 +00:00
Max Schaefer
1f3a3492ae
Merge pull request #15792 from github/max-schaefer-patch-1
...
Java: Fix sink type in hudson.model.yml
2024-03-04 13:08:47 +00:00
Owen Mansel-Chan
279605b486
Merge pull request #15786 from owen-mc/java/sensitive-logging-query-exclude-null-in-variable-name
...
Java: sensitive logging query exclude null in variable name
2024-03-04 12:14:42 +00:00
Max Schaefer
52a36ce41c
Java: Fix sink type in hudson.model.yml
2024-03-04 11:53:37 +00:00
Owen Mansel-Chan
038afc4008
Merge pull request #15772 from owen-mc/java/model-generator-exclude-tostring
...
Java: do not generate models for `toString` and lambda flow methods
2024-03-04 07:57:48 +00:00
Owen Mansel-Chan
c7efde3b7a
Remove variables with "null" in their name as sources
2024-03-03 20:55:04 +00:00
Owen Mansel-Chan
114c17ad57
Add more methods of java.util.Comparator
2024-03-02 20:55:30 +00:00
Owen Mansel-Chan
bf22c6dae0
Merge pull request #15766 from owen-mc/java/add-neutral-models
...
Java: add neutral models
2024-03-02 06:00:33 +00:00
Owen Mansel-Chan
0a8dfbafe4
Accept suggestion to put models under the right heading
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-03-01 16:05:28 +00:00
Owen Mansel-Chan
df64e0bc5f
Add neutral summary models for java.security.MessageDigest#digest
2024-03-01 14:08:31 +00:00
Owen Mansel-Chan
f89fedcbaf
Add some neutral models for java.util
2024-03-01 14:07:45 +00:00
Owen Mansel-Chan
10f6329b3e
Add manual neutral models for java.util.stream
...
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll
* Note: the following top JDK APIs are not modeled with MaD:
* `java.util.stream.Collectors#joining(CharSequence)`: cannot be modeled completely without a model for `java.util.stream.Stream#collect(Collector)` as well
* `java.util.stream.Collectors#toMap(Function,Function)`: specialized collectors flow
* `java.util.stream.Stream#collect(Collector)`: handled separately on a case-by-case basis as it is too complex for MaD
2024-03-01 12:32:04 +00:00
Owen Mansel-Chan
f907fd21ad
Add manual neutral models for java.text.Format and java.text.MessageFormat
...
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll
* Note: the following top JDK APIs are not modeled with MaD:
* `java.text.Format#format(Object)`: similar issue as `Object.toString`; depends on the object being passed as the argument
* `java.text.MessageFormat#format(String,Object[])`: similar issue as `Object.toString`; depends on the object being passed as the argument
2024-03-01 12:31:59 +00:00
