Chris Smowton
f1c3a11103
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
Chris Smowton
d83ed33252
Make supertype consideration consistent
2021-09-10 16:27:28 +01:00
Chris Smowton
9b488207eb
Add support for the Flexjson framework to the unsafe-deserialization query
2021-09-10 16:27:23 +01:00
Chris Smowton
655236c70d
Remove no-longer-needed generic specifiers
2021-09-10 16:10:55 +01:00
Chris Smowton
d940085384
Spring HTTP: inherit produced content-types from surrounding class
2021-09-10 16:10:52 +01:00
Chris Smowton
bdd135dbff
Spring HTTP: mark explicitly content-typed body calls as sinks
...
Previously only the return from the request-handler method constituted a sink, and was filtered by the Produces annotation if any, even though a BodyBuilder could explicitly override.
These sinks are also marked as out-barriers to avoid duplicate paths when the Produces annotation is in agreement.
2021-09-10 16:10:50 +01:00
Chris Smowton
701d0bcdca
Spring content types: recognise constant content-type strings
2021-09-10 16:10:48 +01:00
Chris Smowton
4397371a50
Spring constant media types: recognise constant string versions
...
Previously we only recognised the constant MediaTypes
2021-09-10 16:10:47 +01:00
Chris Smowton
b9b34eb0ee
Move Spring XSS sink definition into SpringHttp.qll
2021-09-10 16:10:45 +01:00
Chris Smowton
3b6cc97557
Sanitize Spring bodies directly associated with an XSS-safe Content-Type
2021-09-10 16:10:44 +01:00
Chris Smowton
2d03840fde
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
...
Originally authored by @haby0, squashed to clean up a tangled commit history.
2021-09-10 13:49:31 +01:00
Tom Hvitved
649c2ce188
Merge pull request #6586 from hvitved/dataflow/stage2-precise-call-ctx-take2
...
Data flow: Add precise call contexts to stage 2
2021-09-10 11:34:35 +02:00
Tom Hvitved
296d10fe2a
Data flow: Adjust callMayFlowThroughFwd pragmas
2021-09-10 09:21:24 +02:00
Anders Schack-Mulligen
3e17fdcaa3
Merge pull request #6407 from bmuskalla/charSeqSubSeq
...
Java: Track taint for CharSequence#subSequence
2021-09-10 09:01:29 +02:00
Anders Schack-Mulligen
13c4b93d3d
Merge pull request #6648 from aschackmull/java/func-interface
...
Java: Fix FunctionalInterface.
2021-09-09 16:14:14 +02:00
Benjamin Muskalla
9d5e48430e
Merge branch 'main' into charSeqSubSeq
2021-09-09 16:04:36 +02:00
Anders Schack-Mulligen
ec3990c619
Java: Fix FunctionalInterface.
2021-09-09 15:04:22 +02:00
Benjamin Muskalla
c0e65e71b4
Revert "Java: Fix external flow perofrmance with future optimiser."
...
This reverts commit be1d4c04f2
2021-09-09 13:06:23 +02:00
Benjamin Muskalla
a1b7437f8d
Merge branch 'main' into thirdpartyapitelemtry
2021-09-09 11:11:42 +02:00
Benjamin Muskalla
96a34b6165
Fix value flow for fluent api
2021-09-08 16:12:52 +02:00
Benjamin Muskalla
b47507293a
Minor fixes for fluent apis
2021-09-08 15:32:41 +02:00
Anders Schack-Mulligen
1af39f0776
Dataflow: Sync.
2021-09-08 13:02:07 +02:00
Anders Schack-Mulligen
2e9876f58f
Dataflow: Only calculate fastTC for the relevant part of edges.
2021-09-08 13:01:29 +02:00
Anders Schack-Mulligen
2b7882e6e5
Merge pull request #5032 from aschackmull/dataflow/subpaths
...
Dataflow: Add subpaths query predicate.
2021-09-08 11:52:41 +02:00
alexet
81f4822b8d
Java: Fix performance with future optimiser by caching a predicate
2021-09-07 16:38:40 +01:00
alexet
be1d4c04f2
Java: Fix external flow perofrmance with future optimiser.
2021-09-07 16:38:39 +01:00
alexet
726feb3f4d
Java: Fix magic in TC with future optimiser.
2021-09-07 16:38:39 +01:00
Anders Schack-Mulligen
7ec1fa2ebe
Dataflow: Sync.
2021-09-07 12:51:42 +02:00
Anders Schack-Mulligen
2d7d45a8ac
Dataflow: Account for hidden nodes.
2021-09-07 12:51:42 +02:00
Anders Schack-Mulligen
3c3d71d4a0
Dataflow: Sync
2021-09-07 12:51:42 +02:00
Anders Schack-Mulligen
81ed3e7176
Dataflow: Add subpaths query predicate.
2021-09-07 12:51:42 +02:00
Benjamin Muskalla
51475d2fb0
Merge branch 'main' into thirdpartyapitelemtry
2021-09-03 14:23:31 +02:00
Chris Smowton
29b9231f49
Rename db types relating to local classes
...
These now all refer to types or classes-or-interfaces.
2021-09-02 14:51:51 +01:00
Chris Smowton
e8bdc8ba17
Make Member.getEnclosingCallable compatible with local interfaces
2021-09-02 14:51:50 +01:00
Chris Smowton
608d24f75e
Rename QL elements that refer to local classes
2021-09-02 14:51:50 +01:00
Chris Smowton
0a5410c2d3
Remove unnecessary charpred
2021-09-02 14:51:49 +01:00
Chris Smowton
fca561351d
Fix typo
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-09-02 14:51:48 +01:00
Chris Smowton
e048a729db
Add Interface.isLocal and use it where appropriate
...
Some EJB logic regrettably needs to be renamed out of the way. Hopefully the churn caused by this is less than would be caused if Interface's isLocal needed to be named differently from Class.isLocal.
2021-09-02 14:51:46 +01:00
Tom Hvitved
c3ecae503b
Data flow: Sync files
2021-09-01 19:58:47 +02:00
Benjamin Muskalla
c1d34d7d6f
Move Strings to lib
2021-09-01 15:55:39 +02:00
Benjamin Muskalla
190bf90bc8
Replace stringbuilder step with model
2021-09-01 15:41:16 +02:00
Benjamin Muskalla
5df5805d36
Convert strings to summary model
2021-09-01 15:41:14 +02:00
Benjamin Muskalla
e0d978fd58
Migrate String constructor to model
2021-09-01 15:41:13 +02:00
Chris Smowton
7977d9c253
Fix minor mistakes in old Guava models
...
Also add tests for the affected functions
2021-08-31 15:26:09 +01:00
Benjamin Muskalla
9ca3b4661a
Fix return value for requireNonNullElse
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-08-26 14:03:55 +02:00
Benjamin Muskalla
8abb9fb045
Replace Objects model
2021-08-26 12:06:56 +02:00
Benjamin Muskalla
4e2c148e80
Model Objects API as CSV
2021-08-26 12:06:47 +02:00
Marcono1234
c8d98ae649
Java: Fix Field.getInitializer() matching non-initializer assignments
2021-08-24 14:04:44 +01:00
Ian Lynagh
a9db1c52e5
All languages: Add getPrimaryQlClasses()
...
This is a non-overridable predicate that concatenates all the
getAPrimaryQlClass() results into a comma-separated string.
2021-08-23 15:49:10 +01:00
Andrew Eisenberg
c9f1c98390
Packaging: C# refactoring
...
Split c# pack into `codeql/csharp-all` and `codeql/csharp-queries`.
2021-08-19 14:09:35 -07:00
