Jami Cogswell
042dcf9cd9
Java: some updates to UrlPathBarrier code
2024-03-13 16:28:44 -04:00
Jami Cogswell
052452b186
Java: create UrlDecodeMethod
2024-03-13 16:28:44 -04:00
Jami Cogswell
d220b3a298
Java: some updates to test cases
2024-03-13 16:28:43 -04:00
Jami Cogswell
43b49628fc
Java: use new 'SimpleTypeSanitizer', and update some non-extending subtype relationships
2024-03-13 16:28:43 -04:00
Jami Cogswell
2708e53c7f
Java: remove redundant imports
2024-03-13 16:28:43 -04:00
Jami Cogswell
911a61df22
Java: initial update of barrier and test cases to remove FN
2024-03-13 16:28:42 -04:00
Jami Cogswell
5fa63ab5c2
Java: update/add some TODO comments
2024-03-13 16:28:41 -04:00
Jami Cogswell
09bc21dbd3
Java: rename 'UnsafeUrlForward' to 'UrlForward'
2024-03-13 16:28:41 -04:00
Jami Cogswell
5a9d7552b3
Java: add some comments and minor code reorg
2024-03-13 16:28:41 -04:00
Jami Cogswell
1da1e896cb
Java: convert SpringModelAndViewSink to MaD
2024-03-13 16:28:41 -04:00
Jami Cogswell
8d66097483
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
2024-03-13 16:28:41 -04:00
Jami Cogswell
42e3825ea3
Java: convert RequestDispatcherSink to MaD
2024-03-13 16:28:40 -04:00
Jami Cogswell
4ff884e26c
Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)
2024-03-13 16:28:40 -04:00
Jami Cogswell
915e106ab3
Java: remove path-injection related models and tests for now
2024-03-13 16:28:40 -04:00
Jami Cogswell
2793f28428
Java: move config to Query.qll file
2024-03-13 16:28:40 -04:00
Tom Hvitved
02ae2d1520
Java: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Erik Krogh Kristensen
863e3f79e5
Merge pull request #15731 from erik-krogh/java-url
...
Java: More sanitizers for request-forgery
2024-03-12 19:31:52 +01:00
erik-krogh
f613823047
add explicit QLDoc that any method named "contains" is matched
2024-03-12 15:25:27 +01:00
erik-krogh
52f71e4553
small fixes based on review
2024-03-12 15:07:29 +01:00
Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
Owen Mansel-Chan
279605b486
Merge pull request #15786 from owen-mc/java/sensitive-logging-query-exclude-null-in-variable-name
...
Java: sensitive logging query exclude null in variable name
2024-03-04 12:14:42 +00:00
Owen Mansel-Chan
c7efde3b7a
Remove variables with "null" in their name as sources
2024-03-03 20:55:04 +00:00
Owen Mansel-Chan
114c17ad57
Add more methods of java.util.Comparator
2024-03-02 20:55:30 +00:00
Owen Mansel-Chan
bb97df1d71
do not generate models for lambda flow methods
2024-03-01 12:11:40 +00:00
Owen Mansel-Chan
bbf3fa7506
do not generate models for toString
2024-03-01 09:59:27 +00:00
Chris Smowton
051d63a5a9
Merge pull request #15740 from smowton/smowton/feature/call-and-type-telemetry
...
Java: add extraction quality telemetry; improve stringification of some erroneous expressions
2024-02-29 16:51:51 +00:00
Tony Torralba
47bf556223
Merge pull request #15709 from atorralba/atorralba/java/enable-widget-taint-steps
...
Java: Re-enable Widget.qll flow steps
2024-02-29 17:33:05 +01:00
Chris Smowton
551006c15e
Make predicate private
2024-02-29 14:59:46 +00:00
Chris Smowton
1fd459e8fc
Improve stringification of some erroneous expressions
2024-02-29 14:59:45 +00:00
Anders Schack-Mulligen
df5e753ee0
Merge pull request #15570 from aschackmull/java/cache-interpretelement
...
Java: Cache interpretElement.
2024-02-27 13:39:56 +01:00
erik-krogh
b4b5ae2a2c
add some request-forgery sanitizers, inspired from C#
2024-02-27 10:05:26 +01:00
Mathias Vorreiter Pedersen
1d4c889ab8
Java: Use the shared type-flow library.
2024-02-26 17:13:32 +00:00
Tony Torralba
759b74791c
Java: Re-enable Widget.qll flow steps
...
The library Widget.qll was accidentally removed from the global context when its sources were migrated to models-as-data in #13136 . This re-adds it so that its flow steps are enabled again.
2024-02-23 13:07:35 +01:00
Joe Farebrother
2ebb80b632
Merge pull request #15548 from joefarebrother/android-local-auth-keys
...
Java: Add query for insecurely generated keys for local authentication.
2024-02-22 14:04:17 +00:00
Anders Schack-Mulligen
71f8ccf45f
Merge pull request #15654 from aschackmull/java/static-init-vec-query-perf
...
Java: Switch helper flow from Global to SimpleGlobal in StaticInitializationVectorQuery.
2024-02-21 10:51:16 +01:00
Anders Schack-Mulligen
66010b5c96
Java: Switch helper flow from Global to SimpleGlobal in StaticInitializationVectorQuery.
2024-02-19 14:04:43 +01:00
Owen Mansel-Chan
22692b9d55
Simplify definition of source and improve QLDoc
...
This is also slightly faster to evaluate (217s instead of 228s on apache/geode on my machine).
2024-02-16 16:47:41 +00:00
Tony Torralba
90a9d82b9d
Java: Expand ExactPathSanitizer to work on the argument of 'equals' too
2024-02-15 10:00:24 +01:00
Anders Schack-Mulligen
fb2d36ddac
Merge pull request #15451 from Marcono1234/marcono1234/java-assignment-doc
...
Java: Document which assignment type is covered by which class
2024-02-14 08:59:50 +01:00
Joe Farebrother
2eb93b7a3b
Add unit tests
2024-02-12 13:49:45 +00:00
Joe Farebrother
d8985f9f5b
Move tests for local auth to a folder
2024-02-12 13:49:45 +00:00
Joe Farebrother
c79a3eb6ae
Add query for insecure key generation
2024-02-12 13:49:44 +00:00
Joe Farebrother
75a2b9415c
Merge pull request #15481 from joefarebrother/android-local-auth
...
Java: Add query for insecure local authentication
2024-02-12 13:48:53 +00:00
Tony Torralba
cf7091ae5f
Merge branch 'main' into atorralba/java/open-redirect-sanitizer
2024-02-12 10:31:52 +01:00
Joe Farebrother
16aed18821
Address reviews - Elaborate on docs and update severity
2024-02-09 13:53:36 +00:00
Tom Hvitved
1ea7717714
Capture flow: Take overwrites in nested scopes into account
2024-02-09 14:49:23 +01:00
Anders Schack-Mulligen
8fc4fae7d2
Java: Cache interpretElement.
2024-02-09 14:43:36 +01:00
Tony Torralba
4c0d535cc2
Merge pull request #12886 from atorralba/atorralba/java/path-injection-mad-sinks
...
Java: Refactor path injection sinks
2024-02-09 10:48:49 +01:00
Tony Torralba
34f74869c8
Java: Add extension point and default sanitizer to Open Redirect query
2024-02-09 09:11:07 +01:00
Joe Farebrother
71852868ac
Add case for androidx.biometric api
2024-02-02 17:19:20 +00:00
