Michael Nebel
|
8f734ad1b2
|
Java: Tighten the criteria for when we disregard generated models.
|
2024-08-27 14:48:11 +02:00 |
|
Michael Nebel
|
fe6693739a
|
Java: Make more finegrained dataflow dispatch viable callable heuristic.
|
2024-08-27 13:27:52 +02:00 |
|
Anders Schack-Mulligen
|
993bfee096
|
Merge pull request #17259 from aschackmull/dataflow/remove-srcsink-grouping
Dataflow: Remove src/sink grouping feature
|
2024-08-20 14:42:33 +02:00 |
|
Anders Schack-Mulligen
|
8470e91c16
|
Legacy Dataflow: Sync.
|
2024-08-20 10:07:57 +02:00 |
|
Rasmus Wriedt Larsen
|
1e12c11adc
|
Java: Model System.in as stdin threat-model
|
2024-08-15 15:37:35 +02:00 |
|
Michael Nebel
|
f0817dc07c
|
C#/Java: Use a parameterized module for making the source and sink callable classes.
|
2024-08-14 09:50:38 +02:00 |
|
Michael Nebel
|
4a5c9f0ec4
|
Merge pull request #17007 from michaelnebel/shared/neutralimplementation
C#/Java/Go: Neutrals are split into separate classes.
|
2024-08-12 13:58:12 +02:00 |
|
Tom Hvitved
|
a7410e4a16
|
Java: Fix bad join
Before
```
[2024-08-06 10:37:59] Evaluated non-recursive predicate BoundingChecks::arrayReference/1#754911ba@0628dahn in 20981ms (size: 2009682526).
Evaluated relational algebra for predicate BoundingChecks::arrayReference/1#754911ba@0628dahn with tuple counts:
94480 ~0% {2} r1 = SCAN `Expr::ArrayAccess.getArray/0#dispred#b90c658a` OUTPUT In.1, In.0
32 ~0% {2} r2 = JOIN r1 WITH `Expr::MethodCall.getMethod/0#dispred#41989dc9` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
1013 ~1% {2} | JOIN WITH `Expr::MethodCall.getMethod/0#dispred#41989dc9_10#join_rhs` ON FIRST 1 OUTPUT Lhs.1, Rhs.1
92091 ~4% {2} r3 = JOIN r1 WITH variableBinding ON FIRST 1 OUTPUT Rhs.1, Lhs.1
2009681513 ~0% {2} | JOIN WITH variableBinding_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Rhs.1
2009682526 ~0% {2} r4 = r2 UNION r3
return r4
[2024-08-06 10:38:02] Evaluated non-recursive predicate BoundingChecks::lessthanLength/1#48b5e1b7@2885308n in 0ms (size: 108).
Evaluated relational algebra for predicate BoundingChecks::lessthanLength/1#48b5e1b7@2885308n with tuple counts:
1518 ~0% {2} r1 = JOIN `Expr::ComparisonExpr.isStrict/0#dispred#fd8c6ddb` WITH `Expr::ComparisonExpr.getGreaterOperand/0#dispred#e8df4b14` ON FIRST 1 OUTPUT Rhs.1, Lhs.0
455 ~2% {2} | JOIN WITH Expr::FieldAccess#2b664c37 ON FIRST 1 OUTPUT Lhs.1, Lhs.0
455 ~1% {3} | JOIN WITH `Expr::ComparisonExpr.getLesserOperand/0#dispred#d7744bc2` ON FIRST 1 OUTPUT Lhs.1, Lhs.0, Rhs.1
455 ~0% {5} | JOIN WITH `Expr::FieldAccess.getField/0#dispred#29ef4aa0` ON FIRST 1 OUTPUT Rhs.1, _, Lhs.1, Lhs.0, Lhs.2
455 ~0% {5} | REWRITE WITH Out.1 := "length"
116 ~0% {3} | JOIN WITH `Element::Element.hasName/1#dispred#8acbbbde` ON FIRST 2 OUTPUT Lhs.4, Lhs.2, Lhs.3
93 ~0% {3} | JOIN WITH variableBinding ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
93 ~1% {3} | JOIN WITH `Expr::VarAccess.getQualifier/0#dispred#2b0f1cd1` ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Rhs.1
484 ~2% {3} | JOIN WITH variableBinding_10#join_rhs ON FIRST 1 OUTPUT Lhs.1, Rhs.1, Lhs.2
277 ~3% {2} | JOIN WITH `BoundingChecks::conditionHolds/2#fa0354b9#bb` ON FIRST 2 OUTPUT Lhs.1, Lhs.2
166 ~5% {2} | JOIN WITH `Expr::ArrayAccess.getIndexExpr/0#dispred#345f6cf4_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
110 ~0% {1} | JOIN WITH `BoundingChecks::arrayReference/1#754911ba` ON FIRST 2 OUTPUT Lhs.0
return r1
```
After
```
[2024-08-06 13:29:50] Evaluated non-recursive predicate BoundingChecks::lengthAccess/2#54b10eff@719e68tb in 0ms (size: 309).
Evaluated relational algebra for predicate BoundingChecks::lengthAccess/2#54b10eff@719e68tb with tuple counts:
6241 ~0% {2} r1 = JOIN `BoundingChecks::getAnAccess/1#152ad44e_10#join_rhs` WITH `Expr::VarAccess.getQualifier/0#dispred#2b0f1cd1_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1
6240 ~0% {4} | JOIN WITH `Expr::FieldAccess.getField/0#dispred#29ef4aa0` ON FIRST 1 OUTPUT Rhs.1, _, Lhs.1, Lhs.0
6240 ~0% {4} | REWRITE WITH Out.1 := "length"
309 ~2% {2} | JOIN WITH `Element::Element.hasName/1#dispred#8acbbbde` ON FIRST 2 OUTPUT Lhs.3, Lhs.2
return r1
[2024-08-06 13:29:50] Evaluated non-recursive predicate BoundingChecks::lessthanLength/1#48b5e1b7@0fcac509 in 1ms (size: 108).
Evaluated relational algebra for predicate BoundingChecks::lessthanLength/1#48b5e1b7@0fcac509 with tuple counts:
94480 ~0% {3} r1 = JOIN `Expr::ArrayAccess.getArray/0#dispred#b90c658a` WITH `Expr::ArrayAccess.getIndexExpr/0#dispred#345f6cf4` ON FIRST 1 OUTPUT Rhs.1, Lhs.0, Lhs.1
648 ~4% {4} | JOIN WITH variableBinding ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Lhs.0, Rhs.1
621 ~1% {4} | JOIN WITH `BoundingChecks::getAnAccess/1#152ad44e_10#join_rhs` ON FIRST 1 OUTPUT Lhs.2, Lhs.1, Lhs.3, Rhs.1
344 ~0% {4} | JOIN WITH `BoundingChecks::conditionHolds/2#fa0354b9#bb_10#join_rhs` ON FIRST 1 OUTPUT Rhs.1, Lhs.1, Lhs.2, Lhs.3
341 ~0% {4} | JOIN WITH `Expr::ComparisonExpr.isStrict/0#dispred#fd8c6ddb` ON FIRST 1 OUTPUT Lhs.0, Lhs.1, Lhs.2, Lhs.3
341 ~0% {5} | JOIN WITH `Expr::ComparisonExpr.getGreaterOperand/0#dispred#e8df4b14` ON FIRST 1 OUTPUT Rhs.1, Lhs.3, Lhs.1, Lhs.2, Lhs.0
110 ~2% {3} | JOIN WITH `BoundingChecks::lengthAccess/2#54b10eff` ON FIRST 2 OUTPUT Lhs.4, Lhs.2, Lhs.3
110 ~0% {3} | JOIN WITH `Expr::ComparisonExpr.getLesserOperand/0#dispred#d7744bc2` ON FIRST 1 OUTPUT Rhs.1, Lhs.2, Lhs.1
110 ~0% {1} | JOIN WITH variableBinding ON FIRST 2 OUTPUT Lhs.2
return r1
```
|
2024-08-06 13:30:19 +02:00 |
|
Anders Schack-Mulligen
|
4d023f14a6
|
Merge pull request #17075 from RobbingDaHood/17052-second-try-do-not-expose-error-message
Java: 17052 Second try: do not expose error message
|
2024-08-02 12:44:27 +02:00 |
|
Owen Mansel-Chan
|
e259b25428
|
Add "tokenizer" to sensitive variable name FPs
|
2024-07-30 15:38:32 +01:00 |
|
Owen Mansel-Chan
|
0704946324
|
Factor out matching sensitive variable name FPs
|
2024-07-30 15:37:54 +01:00 |
|
Anders Schack-Mulligen
|
5073f4f7dd
|
Merge pull request #17096 from aschackmull/java/pp-experimental-models
Java: Pretty-print experimental models for qltest.
|
2024-07-30 13:31:15 +02:00 |
|
Anders Schack-Mulligen
|
da5250d3a7
|
Java: Pretty-print experimental models for qltest.
|
2024-07-30 11:43:44 +02:00 |
|
Jami
|
0ba5a74f6a
|
Merge pull request #17074 from jcogs33/jcogs33/java/fix-regex-use-comments
Java: fix comments about use of sink kind `regex-use`
|
2024-07-26 08:57:39 -04:00 |
|
RobbingDaHood
|
feb31d2006
|
Merge branch 'main' into 17052-second-try-do-not-expose-error-message
|
2024-07-25 18:13:49 +02:00 |
|
Daniel Winther Petersen
|
1c1ba7734f
|
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
|
2024-07-25 18:12:45 +02:00 |
|
Jami
|
91f5f086fb
|
Merge pull request #17025 from jcogs33/jcogs33/java/adjust-url-syntheticfield
Java: add TaintInheritingContent for URL synthetic fields
|
2024-07-25 12:11:39 -04:00 |
|
Jami Cogswell
|
eea3e82cca
|
Java: fix 'regex-use' comments
|
2024-07-25 10:39:03 -04:00 |
|
Anders Schack-Mulligen
|
c693f03462
|
Merge pull request #17070 from aschackmull/dataflow/pptype-refactor
Dataflow: Replace `ppReprType` with `DataFlowType.toString`.
|
2024-07-25 14:30:08 +02:00 |
|
Anders Schack-Mulligen
|
7a48fe1102
|
Dataflow: Replace ppReprType with DataFlowType.toString.
|
2024-07-25 13:08:47 +02:00 |
|
Owen Mansel-Chan
|
5a39610ba7
|
Merge pull request #17053 from owen-mc/java/fix/regex-use-sink-kind
Java: Add comments about use of sink kind `regex-use`
|
2024-07-24 21:08:52 +01:00 |
|
Owen Mansel-Chan
|
89f958105a
|
Mention regex-use sink kind in QLDoc for regexSinkKindInfo
|
2024-07-23 21:38:30 +01:00 |
|
Salah Baddou
|
4f80ae2190
|
Merge branch 'main' into sbaddou/fix
|
2024-07-23 12:03:13 +01:00 |
|
Owen Mansel-Chan
|
ff8bb2b1f8
|
Merge pull request #16760 from owen-mc/java/reverse-dns-separate-threat-model-kind
Java: make a separate threat model kind for reverse DNS sources
|
2024-07-23 10:08:52 +01:00 |
|
Anders Schack-Mulligen
|
b5b9c4d931
|
Update java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
Java: Make class private
|
2024-07-23 10:07:51 +02:00 |
|
Anders Schack-Mulligen
|
bb86a07a93
|
Update java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
fix typo
|
2024-07-23 10:03:07 +02:00 |
|
Anders Schack-Mulligen
|
5912a17ab4
|
Update java/ql/lib/semmle/code/java/security/SensitiveLoggingQuery.qll
Autoformat
|
2024-07-23 10:01:49 +02:00 |
|
Salah Baddou
|
2ad70cbee2
|
Move SensitiveLoggerConfig source to extensible format
|
2024-07-22 17:34:00 +01:00 |
|
Jami Cogswell
|
4790656b79
|
Java: add TaintInheritingContent for URL synthetic fields
|
2024-07-20 23:03:32 -04:00 |
|
Michael Nebel
|
2796597d1a
|
Code quality improvements.
|
2024-07-19 09:36:17 +02:00 |
|
Michael Nebel
|
ca4bd0c606
|
C#/Java/Go: Neutrals are split into seperate classes.
|
2024-07-18 16:29:38 +02:00 |
|
Owen Mansel-Chan
|
e2356d9820
|
Merge pull request #16914 from owen-mc/java/android-app-detection
Java: Improve Android app detection
|
2024-07-16 21:52:43 +01:00 |
|
Owen Mansel-Chan
|
db6cd1877c
|
Accept suggested QLDoc fix
Co-authored-by: Chris Smowton <smowton@github.com>
|
2024-07-16 12:24:42 +01:00 |
|
Anders Schack-Mulligen
|
938f46b888
|
Java: Remove superfluous clone models.
|
2024-07-16 11:11:53 +02:00 |
|
Anders Schack-Mulligen
|
12d6875cc4
|
Java: Replace the MaD Object.clone() models with a non-aliasing value step.
|
2024-07-16 11:11:50 +02:00 |
|
Anders Schack-Mulligen
|
da5abc8321
|
Dataflow: Replace MakeSets with QlBuiltins::InternSets.
|
2024-07-15 13:35:57 +02:00 |
|
Owen Mansel-Chan
|
b7a5252cb0
|
Refactor inAndroidApplication
|
2024-07-13 07:35:02 +01:00 |
|
Owen Mansel-Chan
|
8241d0b7ef
|
Update QLDoc for ReverseDnsUserInput
|
2024-07-08 15:33:39 +01:00 |
|
Owen Mansel-Chan
|
5347770608
|
Update Android app detection
|
2024-07-07 00:24:25 +01:00 |
|
Owen Mansel-Chan
|
9c82966022
|
Move detection of Android app to one place
|
2024-07-05 23:47:56 +01:00 |
|
Tom Hvitved
|
4ae8720930
|
SSA: Add BasicBlock.{getNode/1,length/0} to the input signature
|
2024-07-03 11:32:35 +02:00 |
|
Owen Mansel-Chan
|
91db2b6c9c
|
Make new threat model kind "reverse-dns"
|
2024-06-24 21:23:46 +01:00 |
|
Anders Schack-Mulligen
|
8c23e21073
|
Dataflow: Cache compatibleTypes.
|
2024-06-24 13:35:48 +02:00 |
|
Michael Nebel
|
cd9d58fdc8
|
Merge pull request #16772 from michaelnebel/java/taintedpermissionthreatmodel
Java: Opt-in `java/tainted-permissions-check` to threat models.
|
2024-06-18 10:54:28 +02:00 |
|
Michael Nebel
|
197cdab43d
|
Merge pull request #16752 from michaelnebel/shared/sourcesinkcallables
C#/Java: Add some (shared) helper classes for Neutrals, Sources and Sink
|
2024-06-17 14:58:27 +02:00 |
|
Anders Schack-Mulligen
|
96b6ddefe0
|
Merge pull request #16751 from aschackmull/java/sndlevelscope-fix
Java: Calculate 2nd level scopes for implicit instance accesses.
|
2024-06-17 13:10:46 +02:00 |
|
Michael Nebel
|
833b4f90bf
|
Java: Make source and sink callable adapters.
|
2024-06-17 12:53:08 +02:00 |
|
Michael Nebel
|
327dab69d0
|
Java: Opt-in the tainted permissions check query to threat models.
|
2024-06-17 11:02:08 +02:00 |
|
Owen Mansel-Chan
|
7a13c31021
|
Exclude loopback address from reverse DNS source
|
2024-06-14 14:05:01 +01:00 |
|
Anders Schack-Mulligen
|
b47831af14
|
Java: Calculate 2nd level scopes for implicit instance accesses.
|
2024-06-13 13:57:18 +02:00 |
|