5839 Commits

Author	SHA1	Message	Date
Erik Krogh Kristensen	6ff8d4de5c	add all remaining explicit this	2021-11-26 13:50:10 +01:00
Anders Schack-Mulligen	609d6011a2	Merge pull request #7229 from smowton/smowton/admin/document-xxe-sanitisation-policy ... Document XXE sanitisation policy	2021-11-25 10:55:25 +01:00
haby0	04a3f76a8b	Eliminate false positives of Mybatis Configuration Variable	2021-11-25 15:47:37 +08:00
haby0	d36a7ed10e	add test case	2021-11-25 15:47:32 +08:00
haby0	99c8b291b2	add sink	2021-11-25 15:47:32 +08:00
haby0	b8732859de	Add isSanitizerGuard, verify file path	2021-11-25 15:47:31 +08:00
haby0	31400df0d4	Modify sink and improve SQL injection detection	2021-11-25 15:47:30 +08:00
haby0	69690a2509	Modify sinks	2021-11-25 15:47:30 +08:00
haby0	4438f8c58c	Add MyBatis Mapper Sql Injection	2021-11-25 15:47:29 +08:00
Chris Smowton	3c8f6e3c07	Merge pull request #6717 from luchua-bc/java/thread-resource-abuse ... Java: CWE-400 - Query to detect uncontrolled thread resource consumption	2021-11-24 18:59:41 +00:00
Chris Smowton	c74eac4930	Remove needless casts	2021-11-24 12:18:05 +00:00
Chris Smowton	cec91c4831	Update ThreadResourceAbuse.qhelp	2021-11-24 12:15:48 +00:00
Chris Smowton	5101a8e9f3	Fix qhelp test	2021-11-24 12:12:56 +00:00
Chris Smowton	136ecaf49a	Abbreviate qhelp example	2021-11-24 12:12:22 +00:00
Chris Smowton	120f2045cd	Document XXE sanitisation policy	2021-11-24 12:03:28 +00:00
Anders Schack-Mulligen	a3b263ee6e	Merge pull request #7181 from bmuskalla/coverageAsDiagnostics ... Java: Add diagnostic query for framework coverage	2021-11-24 10:57:50 +01:00
luchua-bc	e56737e007	Use value step to optimize the taint step and add a test case for Apache file upload listener	2021-11-23 17:15:28 +00:00
Benjamin Muskalla	50518b5622	Fix sum of rows	2021-11-23 10:42:24 +01:00
luchua-bc	ed78d39d61	Move duplicate code to the shared library and update qldoc	2021-11-23 03:06:26 +00:00
Benjamin Muskalla	cd39d15b40	Simplify diagnostic query	2021-11-19 12:28:24 +01:00
Benjamin Muskalla	fb9b16325d	Add diagnostic query for framework coverage	2021-11-19 10:30:59 +01:00
luchua-bc	b6a6ed5ba3	Add a recommendation category query for local user input and check Apache file upload	2021-11-19 04:23:19 +00:00
Erik Krogh Kristensen	011fc20963	use matches instead of regexpMatch	2021-11-18 15:41:25 +01:00
Anders Schack-Mulligen	22ebe68b1b	Merge pull request #7132 from aschackmull/java/overrides ... Java: Fix overrides to not be transitive.	2021-11-17 15:38:11 +01:00
Benjamin Muskalla	0e6bb28016	Only consider store steps	2021-11-16 10:46:24 +01:00
Benjamin Muskalla	fd9199c0c0	Simplify handling of tainting fields	2021-11-15 16:40:09 +01:00
Benjamin Muskalla	d7ed325b3f	Refactor content flow into predicate	2021-11-15 16:30:55 +01:00
Benjamin Muskalla	f4310898b3	Capture sources flowing into parameters	2021-11-15 16:28:28 +01:00
Anders Schack-Mulligen	1cd42ea668	Java: Fix test and some references.	2021-11-15 16:03:04 +01:00
Benjamin Muskalla	8040d9cfcf	Only consider true return statements as sinks	2021-11-15 15:29:01 +01:00
Benjamin Muskalla	e6e52a3b32	190	2021-11-15 15:18:03 +01:00
Benjamin Muskalla	dc022430ee	Remove superflous instanceof	2021-11-15 13:07:02 +01:00
Benjamin Muskalla	412bd32f45	Move more predicates into configuration	2021-11-15 13:04:23 +01:00
Benjamin Muskalla	b84c03672d	Prefer types to TargetAPI	2021-11-15 12:43:46 +01:00
Benjamin Muskalla	bca6cecd1c	Remove basic support for lambda flow	2021-11-15 12:38:30 +01:00
Benjamin Muskalla	78e3906ea7	Exclude more JDK internals	2021-11-15 11:58:10 +01:00
Benjamin Muskalla	cce3780481	Restrict param2return value features	2021-11-15 09:57:23 +01:00
Benjamin Muskalla	a0b7f267ff	Only capture taint from own fields ... Also exclude `Charset` as relevant taint-carrying type. This is generally what we want to lets us avoid tracking arguments that lead to FP.	2021-11-12 10:15:15 +01:00
Benjamin Muskalla	0234e77d2f	Let sink node be pluggable in any call context	2021-11-12 09:43:05 +01:00
Benjamin Muskalla	b8809a20d8	Support propagating taint of inner object	2021-11-12 09:39:59 +01:00
Benjamin Muskalla	2d4176bec0	Ignore Number-derived types	2021-11-10 16:30:27 +01:00
Benjamin Muskalla	dbd393b77a	Support flow into field of referenced objects	2021-11-10 16:30:27 +01:00
Benjamin Muskalla	974c7b0898	Avoid cross-class flow for field writes	2021-11-10 16:30:26 +01:00
Benjamin Muskalla	74ac234f1c	Restrict field access to same type	2021-11-10 16:30:26 +01:00
Benjamin Muskalla	8740e879b4	Fix docs	2021-11-10 16:30:26 +01:00
Benjamin Muskalla	a546b38ee0	Restrict field access to corresponding type	2021-11-10 16:30:26 +01:00
Benjamin Muskalla	6960a7b97e	Remove extraneous last column	2021-11-10 16:30:25 +01:00
Benjamin Muskalla	ef972159a6	Fix bug when generating output in a subfolder	2021-11-10 16:30:25 +01:00
Benjamin Muskalla	4cfd978bfe	Support generating in respective folders	2021-11-10 16:30:25 +01:00
Benjamin Muskalla	b92758883b	Auto-format generated qll files	2021-11-10 16:30:25 +01:00