yoff
830f02af1f
java: fixes from the CI bots
2025-10-09 09:37:31 +02:00
yoff
096d5f2a56
java: implement SCC contraction of the call graph
...
Our monitor analysis would be fooled by cycles in the call graph,
since it required all edges on a path to a conflicting access to be either
- targetting a method where the access is monitored (recursively) or
- monitored locally, that is the call is monitored in the calling method
For access to be monitored (first case) all outgoing edges (towards an access) need
to satisfy this property. For a loop, that is too strong, only edges out of the loop
actually need to be protected. This led to FPs.
2025-10-09 09:14:16 +02:00
yoff
5b30153113
java: add Escaping query (P1)
2025-10-09 09:14:16 +02:00
yoff
328b53576a
java: add SafePublication query (P2)
2025-10-09 09:14:16 +02:00
yoff
fe487e8bf0
java: add ThreadSafe query (P3)
...
Co-authored-by: Raúl Pardo <raul.pardo@protonmail.com >
Co-authored-by: SimonJorgensenMancofi <simon.jorgensen@mancofi.dk >
Co-authored-by: Bjørnar Haugstad Jåtten <bjornjaat@hotmail.com >
2025-10-09 09:14:16 +02:00
REDMOND\brodes
f524de4afc
Crypto: Updating insecure iv/nonce to consider if an operation is known for it, and if so do not alert on non-secure random if it is tied to decryption
2025-10-08 16:27:18 -04:00
REDMOND\brodes
7a57496c54
Crypto: Missing test update.
2025-10-08 14:16:47 -04:00
REDMOND\brodes
11e81395b5
Crypto: Updated default flows to use taint tracking (this is needed to fix false positives in the unknown IV/Nonce query). Add the unknown IV/Nonce query and associated test cases. Fix unknown IV/Nonce query to focus on cases where the oepration isn't known or the operation subtype is not encrypt or wrap.
2025-10-08 14:14:17 -04:00
REDMOND\brodes
75b5a9fda8
Crypto: Update general regression test results to account for removal of JCA random source.
2025-10-08 12:55:11 -04:00
REDMOND\brodes
83ff70bcd8
Crypto: Adding tests for insecure iv or nonce. Updating generic literal sources to include array literals.
2025-10-08 12:47:58 -04:00
Anders Schack-Mulligen
18e33b193e
Merge pull request #20589 from aschackmull/java/array-entrypoint-read-taint
...
Java: Allow taint-read-steps for array sources.
2025-10-07 15:04:03 +02:00
Anders Schack-Mulligen
f0bfd7053e
Java: Add test case.
2025-10-07 13:40:44 +02:00
Nicolas Will
e2a8d58e02
Merge pull request #20583 from bdrodes/jca_signature_extensions
...
Crypto: Add JCA signatures, RNG, and unit tests
2025-10-06 18:51:30 +02:00
REDMOND\brodes
cb812b47ed
Crypto: more non-ascii removal.
2025-10-06 11:53:39 -04:00
REDMOND\brodes
017a956d5e
Crypto: more non-ascii removal.
2025-10-06 11:34:45 -04:00
REDMOND\brodes
abeb3141b1
Crypto: Formatting test cases, more removal of non-ascii
2025-10-06 10:46:09 -04:00
Nicolas Will
15e9bb9cc1
Format Test and update .expected
2025-10-06 16:29:25 +02:00
REDMOND\brodes
96f6832a6f
Crypto: Updating expected files for unit tests.
2025-10-06 10:07:15 -04:00
REDMOND\brodes
606aef38cb
Crypto: Removing non-ascii characters from unit tests
2025-10-06 09:56:14 -04:00
REDMOND\brodes
9c5765a48c
Crypto: Add missing string constants for signature algorithms.
2025-10-03 17:17:07 -04:00
REDMOND\brodes
66e9d7671d
Crypto: Add jca unit tests.
2025-10-03 13:32:02 -04:00
Ben Rodes
e823d80f0c
Merge branch 'main' into java_nonce_reuse_tests
2025-10-02 13:31:40 -04:00
Chris Smowton
f88daff45f
Java: note that classes with entirely private constructors can't be subclassed
2025-09-30 13:57:44 +01:00
Anders Schack-Mulligen
e302616135
Java: Accept qltest change.
2025-09-12 15:41:18 +02:00
Anders Schack-Mulligen
e8f1ec68db
Java: Accept guards test results.
2025-09-12 15:41:17 +02:00
Anders Schack-Mulligen
03321ff910
Java: Replace nullness implementation.
2025-09-12 15:41:16 +02:00
Anders Schack-Mulligen
452bbf7289
Java: Add some more nullness tests.
2025-09-12 13:38:21 +02:00
Anders Schack-Mulligen
b5c7bc1b33
Java: Accept test output.
2025-09-10 15:42:18 +02:00
Idriss Riouak
b89b68dfdb
Merge pull request #20339 from github/idrissrio/scoped-values
...
Java: Add MaDs for `java.lang.ScopedValue`
2025-09-10 11:21:34 +02:00
idrissrio
728a4aff22
Java: Add model for thenExpand and accept new results
2025-09-08 13:17:53 +02:00
idrissrio
3aba4d3e1e
Java: Add test showing missing model for thenExpand
2025-09-08 13:17:52 +02:00
idrissrio
55ff71b760
Java: Address review comment. Fix dataflow model
2025-09-08 13:17:51 +02:00
idrissrio
311690cffe
Java: accept new test results
2025-09-08 13:17:49 +02:00
idrissrio
16fbe8d96f
Java: add dataflow test for newly added KDF API
2025-09-08 13:17:46 +02:00
idrissrio
666678a582
Java: Address review comment. Inline dataflow annotation
2025-09-08 12:55:20 +02:00
idrissrio
a8541b9f76
Java: accept new test results
2025-09-08 12:55:15 +02:00
idrissrio
0159f5b422
Java: Add failing test for Scoped Values
2025-09-08 12:55:13 +02:00
idrissrio
039b5af2e0
Java: Add module import declaration test
2025-09-06 12:38:40 +02:00
idrissrio
f1186432c1
Java: Accept new test result after extractor changes
2025-09-05 10:43:35 +02:00
idrissrio
b2ef60c165
Java: add tests for compact source files
2025-09-05 10:19:03 +02:00
idrissrio
9363bc318a
Java: Add compact source file tests
2025-09-05 10:18:58 +02:00
idrissrio
1605438333
Java: Accept new test result after extractor changes
2025-09-04 17:01:45 +02:00
idrissrio
6c773a7473
Java: Add test to verify that the AST does not capture instance initializers
2025-09-04 17:01:44 +02:00
idrissrio
fffb4c03b0
Java: add flexible constructor test including CFG predecessor query
2025-09-04 17:01:43 +02:00
idrissrio
6b022edf06
Java: Address review comment. Add prologue field initialization tests
2025-09-04 17:01:42 +02:00
idrissrio
de6d9f4d50
Java: Add test for flexible constructor support
2025-09-04 17:01:41 +02:00
Napalys Klicius
b4d6cb6e5f
Merge pull request #20178 from Napalys/java/visible-for-testing-abuse
...
Java: Added new query `java/visible-for-testing-abuse`
2025-08-29 08:38:04 +02:00
Napalys Klicius
1949d9f8f3
Merge branch 'main' into java/mocking-all-non-private-methods-means-unit-test-is-too-big
2025-08-28 14:22:06 +02:00
Napalys Klicius
970167bc62
Java: moved java/mocking-all-non-private-methods-means-unit-test-is-too-big to a more appropriate location, namely Violation of Best Practice/Testing
2025-08-28 14:20:19 +02:00
Napalys Klicius
a3aacfb688
Merge pull request #20190 from Napalys/java/jvm-exit-query-promotion
...
Java: Enhance `java/jvm-exit` query and add to quality
2025-08-27 13:23:02 +02:00
