Anders Schack-Mulligen
6081ba5902
Merge pull request #17604 from aschackmull/java/neutral-overrides
...
Java/C#: Add overrides to the interpretation of neutral MaD models.
2024-10-01 14:55:54 +02:00
Anders Schack-Mulligen
222ae6ad2d
Java: Add a neutral for Comparable.compareTo
2024-09-30 15:51:48 +02:00
Anders Schack-Mulligen
0459d136d3
Java: Remove neutral model for Object.toString.
2024-09-30 15:17:21 +02:00
Anders Schack-Mulligen
fb630d266e
Java: Add a couple of neutrals
2024-09-27 15:24:06 +02:00
Anders Schack-Mulligen
12d6875cc4
Java: Replace the MaD Object.clone() models with a non-aliasing value step.
2024-07-16 11:11:50 +02:00
Owen Mansel-Chan
b8608a1b1c
Merge pull request #15946 from owen-mc/java/more-manual-models
...
Java: more manual models
2024-03-19 15:00:27 +00:00
Owen Mansel-Chan
7371f5e508
Provenance should be "df-manual"
2024-03-19 13:33:49 +00:00
Owen Mansel-Chan
754d4cd959
Fix model provenance to df-manual
2024-03-17 14:36:47 +00:00
Owen Mansel-Chan
8e52483beb
Add df-manual models in manually modeled classes
2024-03-15 10:10:23 +00:00
Owen Mansel-Chan
2bd08838d4
Add manual neutral models for java.lang.ClassLoader
2024-03-14 11:40:06 +00:00
Owen Mansel-Chan
0e95f41900
Add manual neutral models for java.lang
...
See comment in java/ql/src/Metrics/Summaries/TopJdkApis.qll
* Note: the following top JDK APIs are not modeled with MaD:
* `java.lang.System#getProperty(String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
* `java.lang.System#setProperty(String,String)`: needs to be modeled by regular CodeQL matching the get and set keys to reduce FPs
2024-03-01 12:31:49 +00:00
Max Schaefer
93990ec9df
Merge pull request #15486 from github/java/update-mad-decls-after-triage-2024-01-31T11-16-45
...
Java: Update MaD Declarations after Triage
2024-02-09 11:18:17 +00:00
Anders Schack-Mulligen
49b00f3842
Java: Remove two redundant models implied by CharSequence models.
2024-02-02 13:17:26 +01:00
Max Schaefer
ad8038bade
Update MaD Declarations after Triage
2024-01-31 11:28:10 +00:00
Owen Mansel-Chan
2f01688319
Merge pull request #15280 from owen-mc/java/add-manual-models-for-df-generation
...
Java: improve models for some important JDK methods
2024-01-11 12:47:37 +00:00
Ed Minnix
ad32b81492
environment-injection sink
2024-01-08 09:38:41 -05:00
Owen Mansel-Chan
ce3097e9ce
Fix manual models for String.valueOf(Object)
...
Add a neutral model for it, but also a summary model for `String.valueOf(CharSequence)`
2024-01-04 11:31:20 +00:00
Owen Mansel-Chan
0076f06ce7
Improve manual models of java.lang.Exception
2024-01-04 11:31:18 +00:00
Owen Mansel-Chan
e415c54c5e
Reorder manual models of java.lang.Throwable
2024-01-04 11:31:16 +00:00
Owen Mansel-Chan
f52ea5c2fd
Improve manual models of java.lang.Throwable
2024-01-04 11:31:14 +00:00
Tony Torralba
107a05af71
Update MaD Declarations after Triage
2023-10-31 16:52:02 +01:00
Edward Minnix III
655470f3da
Refactor EnvInput to MaD
2023-10-03 22:28:47 -04:00
Anders Schack-Mulligen
5c40d553b4
Java: Switch XmlParsers lib to lightweight data flow.
2023-09-20 10:21:53 +02:00
Anders Schack-Mulligen
6c02e30f56
Java: Update models.
2023-08-23 13:24:55 +02:00
Anders Schack-Mulligen
d1a616a70a
Java: Add proper support for variable capture flow.
2023-08-03 10:04:02 +02:00
Stephan Brandauer
4391799b7e
Merge pull request #13403 from github/java/update-mad-decls-after-triage-2023-06-08T08-51-47
...
Java: Update MaD Declarations after Triage
2023-07-13 11:15:41 +02:00
Tony Torralba
ffe67689ec
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-13 09:27:33 +02:00
Tony Torralba
2fd2c434f2
Apply suggestions from code review
...
Co-authored-by: Jami <57204504+jcogs33@users.noreply.github.com >
2023-06-13 09:24:15 +02:00
Stephan Brandauer
8f697ac1ee
Java: fix broken MaD export format
2023-06-08 12:02:50 +02:00
Stephan Brandauer
c6f10519fa
Merge branch 'main' into java/update-mad-decls-after-triage-2023-06-08T08-51-47
2023-06-08 12:00:07 +02:00
Stephan Brandauer
bda938c544
Update MaD Declarations after Triage
2023-06-08 10:51:48 +02:00
Taus
f4fd908f7f
Java: Comment out sinks for which no query exists
2023-06-06 13:01:59 +02:00
Taus
7ad860fc98
Java: Update MaD declarations after triage
...
Co-authored-by: Stephan Brandauer <kaeluka@github.com >
2023-06-05 18:00:40 +02:00
Tony Torralba
c3b1ef2cdf
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-02 08:57:24 +02:00
Jami Cogswell
cb10f4976b
Java: update create/read-file sink kinds to path-injection
2023-05-31 15:49:07 -04:00
Jami Cogswell
430010daa3
Java: update logging sink kind to log-injection
2023-05-31 15:49:06 -04:00
Tony Torralba
a276cc3094
Convert all command injection sinks to MaD format
2023-05-25 11:41:32 +02:00
Michael Nebel
bd23814e7c
Java: Update existing neutrals to include kind information.
2023-05-08 16:18:59 +02:00
Michael Nebel
169d8d5cf9
Java: All ai-generated models have been manually verified.
2023-04-13 09:21:06 +02:00
Jami Cogswell
6b695434b7
Java: add yml model for UnsupportedOperationException; resolve conflict
2023-04-06 10:19:19 -04:00
Stephan Brandauer
f87618238f
Review suggestions
2023-04-05 15:15:03 +02:00
Stephan Brandauer
0a5d19fc71
Update MaD Declarations after Triage
2023-04-05 15:15:02 +02:00
Jami Cogswell
8046ec2f78
Java: update -1 to this
2023-03-23 18:01:28 -04:00
Jami Cogswell
29999d7bc8
Java: add WithoutElement comment
2023-03-23 18:00:21 -04:00
Jami Cogswell
62d64d5828
Java: add comments for reflection-related models
2023-03-23 18:00:21 -04:00
Jami Cogswell
db545e4981
Java: switch StringBuilder.delete to AbstractStringBuilder.delete
2023-03-23 18:00:20 -04:00
Jami Cogswell
56d14820e4
Java: change taint to value for Class.cast
2023-03-23 18:00:20 -04:00
Jami Cogswell
bdd7f18e35
Java: remove some comments
2023-03-23 18:00:20 -04:00
Jami Cogswell
17e0920325
Java: resolve more conflicts
2023-03-23 18:00:14 -04:00
Jami Cogswell
c213d56d2c
Java: resolve some more -1 to this conflicts
2023-03-23 17:56:46 -04:00
