am0o0
7e5f2e2a48
experimentalSinkModel to sinkModel, remove one path injection sink that already exist before
2024-07-03 08:55:12 +02:00
Jami
901245ae3d
Merge branch 'main' into jcogs33/unsafe-url-forward-promotion-resource-and-file-methods
2024-06-26 21:57:07 -04:00
Mauro Baluda
29e3816412
Apply suggestions from code review
...
Address reviewiew comments
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-06-11 12:05:14 +02:00
Mauro Baluda
1d44f45be2
Update org.apache.commons.io.model.yml
2024-06-10 12:03:57 +02:00
Mauro Baluda
71505f4003
Added more org.apache.commons.io.FileUtils-related sinks to the path injection query.
2024-06-10 11:29:51 +02:00
am0o0
412472e9a4
add zip4j
2024-06-08 01:14:04 +02:00
am0o0
ceea475c45
add new s3 and spring IO path injection sinks
2024-06-08 01:04:20 +02:00
Tony Torralba
f16dd8c010
Apply code review suggestions.
2024-06-04 10:35:11 +02:00
Tony Torralba
f84c2a842d
Java: Add more File-related sinks for path-injection
2024-06-04 10:35:07 +02:00
Anders Schack-Mulligen
ba97c3623a
Java: Change most java.time.* df-generated taint models to neutrals.
2024-05-22 10:29:54 +02:00
Anders Schack-Mulligen
54f2316d00
Java: Add a neutral model.
2024-05-22 10:29:49 +02:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Owen Mansel-Chan
09e59ccf44
Name files with empty definitions of MaD extensible predicates to erowdmpty.model.yml
2024-05-01 21:39:38 +01:00
Owen Mansel-Chan
ae8240a695
Delete models for JDK internal packages
2024-04-09 13:23:03 +01:00
Jami
5792f7b770
Merge branch 'main' into jcogs33/unsafe-url-forward-promotion-resource-and-file-methods
2024-04-08 10:26:42 -04:00
Owen Mansel-Chan
e10333bf2b
Merge pull request #14919 from github/java/jdk-model-autogeneration
...
Java: add dataflow-generated models for JDK17
2024-04-04 21:12:55 +01:00
Owen Mansel-Chan
919436efbb
Remove df-gen models we have deliberately modeled
...
Manual models always take precedence over generated models, so there is
no point in keeping the generated models.
These manual models were deliberately written to take precedence over
the corresponding df-gen models.
2024-04-01 13:59:36 +01:00
Jami
d889e3cf98
Merge pull request #14854 from jcogs33/jcogs33/unsafe-url-forward-promotion
...
Java: Promote Unsafe URL Forward query from experimental
2024-03-29 16:34:06 -04:00
Jami Cogswell
b35f318910
Java: update models
2024-03-27 20:39:34 -04:00
Owen Mansel-Chan
311512c768
Remove df-gen models for incidentally modelled APIs
...
Manual models always take precedence over generated models, so there is
no point in keeping the generated models.
These APIs happened to have been modelled between model generation and
merging this PR.
2024-03-27 12:15:08 +00:00
Owen Mansel-Chan
f03a56f7e0
Run generation script
...
The command line was:
python3 /Users/owen-mc/workspace/codeql-home/codeql/java/ql/src/utils/modelgenerator/GenerateFlowModel.py /Users/owen-mc/db/java/openjdk17 --with-summaries --with-neutrals
2024-03-27 12:15:00 +00:00
Tony Torralba
7a0446740b
Update java/ql/lib/ext/java.net.model.yml
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2024-03-27 09:09:48 +01:00
Tony Torralba
d786ea90a4
Java: Add more neutrals
...
Adds more neutral models to help the model generator ignore certain callables.
Also improves the precision of certain URL models by using synthetic fields so that the parts of a URL are tainted separately.
2024-03-26 17:31:11 +01:00
Owen Mansel-Chan
b8608a1b1c
Merge pull request #15946 from owen-mc/java/more-manual-models
...
Java: more manual models
2024-03-19 15:00:27 +00:00
Owen Mansel-Chan
7371f5e508
Provenance should be "df-manual"
2024-03-19 13:33:49 +00:00
Owen Mansel-Chan
764e99bda7
Fix model for java.util.Scanner#findall(String)
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2024-03-18 16:56:20 +00:00
Owen Mansel-Chan
7fb05f4a76
Fix duplicate "df-" in "df-df-manual"
2024-03-18 11:17:55 +00:00
Jami Cogswell
658fffeac1
Java: remove experimental files
2024-03-17 22:03:59 -04:00
Owen Mansel-Chan
754d4cd959
Fix model provenance to df-manual
2024-03-17 14:36:47 +00:00
Owen Mansel-Chan
23a58a0835
Add df-manual models related to existing df-manual models
2024-03-17 14:21:05 +00:00
Owen Mansel-Chan
fc367042ef
Fix df-manual model with wrong parameter type
2024-03-17 14:21:01 +00:00
Owen Mansel-Chan
8e52483beb
Add df-manual models in manually modeled classes
2024-03-15 10:10:23 +00:00
Owen Mansel-Chan
2bd08838d4
Add manual neutral models for java.lang.ClassLoader
2024-03-14 11:40:06 +00:00
Owen Mansel-Chan
5b734c76b6
Add manual neutral models for java.util.Locale and its subclasses
2024-03-14 11:39:59 +00:00
Tony Torralba
eecab9122a
Recognize the model generator involvement in the models' provenances
2024-03-14 08:56:23 +01:00
Tony Torralba
5b88b8a3ed
A few more neutrals
2024-03-14 08:53:58 +01:00
Tony Torralba
36f6a6fb10
Model more EnumSet methods as neutrals
2024-03-14 08:46:43 +01:00
Jami Cogswell
e285cf232c
Java: add resource-related methods as path-injection sinks and as summaries
2024-03-13 22:48:57 -04:00
Jami Cogswell
f573032b2e
Java: remove todo comments from ext files
2024-03-13 16:28:43 -04:00
Jami Cogswell
1da1e896cb
Java: convert SpringModelAndViewSink to MaD
2024-03-13 16:28:41 -04:00
Jami Cogswell
8d66097483
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
2024-03-13 16:28:41 -04:00
Jami Cogswell
42e3825ea3
Java: convert RequestDispatcherSink to MaD
2024-03-13 16:28:40 -04:00
Jami Cogswell
2a682995ae
Java: move MaD models to correct files, delete ones that already exist
2024-03-13 16:28:40 -04:00
Jami Cogswell
915e106ab3
Java: remove path-injection related models and tests for now
2024-03-13 16:28:40 -04:00
Jami Cogswell
0d38a9625e
Java: copy files from experimental
2024-03-13 16:28:39 -04:00
Tony Torralba
039bea1625
Java: Add more neutral JDK models
...
This is similar to https://github.com/github/codeql/pull/15766 , in the sense that it adds neutral models to prevent the model generator from generating summaries for them. These models were spotted while evaluating https://github.com/github/codeql/pull/14919 .
2024-03-13 16:59:38 +01:00
Ed Minnix
61dbe26858
Add sinks for android.os.ParcelFileDescriptor
2024-03-11 10:31:51 -04:00
Max Schaefer
52a36ce41c
Java: Fix sink type in hudson.model.yml
2024-03-04 11:53:37 +00:00
Owen Mansel-Chan
bf22c6dae0
Merge pull request #15766 from owen-mc/java/add-neutral-models
...
Java: add neutral models
2024-03-02 06:00:33 +00:00
