Chris Smowton
d940085384
Spring HTTP: inherit produced content-types from surrounding class
2021-09-10 16:10:52 +01:00
Chris Smowton
bdd135dbff
Spring HTTP: mark explicitly content-typed body calls as sinks
...
Previously only the return from the request-handler method constituted a sink, and was filtered by the Produces annotation if any, even though a BodyBuilder could explicitly override.
These sinks are also marked as out-barriers to avoid duplicate paths when the Produces annotation is in agreement.
2021-09-10 16:10:50 +01:00
Chris Smowton
701d0bcdca
Spring content types: recognise constant content-type strings
2021-09-10 16:10:48 +01:00
Chris Smowton
3b6cc97557
Sanitize Spring bodies directly associated with an XSS-safe Content-Type
2021-09-10 16:10:44 +01:00
Chris Smowton
29028c5d46
Update test expectations to account for dataflow subpaths changes
2021-09-10 13:53:41 +01:00
Chris Smowton
2d03840fde
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
...
Originally authored by @haby0, squashed to clean up a tangled commit history.
2021-09-10 13:49:31 +01:00
Anders Schack-Mulligen
3e17fdcaa3
Merge pull request #6407 from bmuskalla/charSeqSubSeq
...
Java: Track taint for CharSequence#subSequence
2021-09-10 09:01:29 +02:00
Chris Smowton
5b8b27a2aa
Merge pull request #6651 from smowton/smowton/admin/functional-interface-tests
...
Add tests for functional interfaces
2021-09-09 22:02:16 +01:00
Benjamin Muskalla
9d5e48430e
Merge branch 'main' into charSeqSubSeq
2021-09-09 16:04:36 +02:00
Chris Smowton
a0bf170d02
Add test for functional interfaces
2021-09-09 15:00:42 +01:00
Benjamin Muskalla
eef044f4d0
Add test to capture expected parameter format
2021-09-09 13:05:15 +02:00
Benjamin Muskalla
a1b7437f8d
Merge branch 'main' into thirdpartyapitelemtry
2021-09-09 11:11:42 +02:00
Marcono1234
a173d9593b
Java: Detect spurious param Javadoc tag of generic classes
2021-09-09 00:11:02 +02:00
Benjamin Muskalla
9e66ee1da0
Add example to inline flow test docs
2021-09-07 16:47:02 +02:00
Benjamin Muskalla
3641b28c3e
Convert javax-json to InlineFlowTest
2021-09-07 16:47:01 +02:00
Benjamin Muskalla
a6b47208e1
Convert optional to InlineFlowTest
2021-09-07 16:47:01 +02:00
Benjamin Muskalla
2d9b4b33d4
Convert spring to InlineFlowTest
2021-09-07 16:47:01 +02:00
Benjamin Muskalla
da3b7a2b69
Convert json-java to InlineFlowTest
2021-09-07 16:47:00 +02:00
Benjamin Muskalla
ff73e46c95
Convert jackson to InlineFlowTest
2021-09-07 16:47:00 +02:00
Benjamin Muskalla
1ead522705
Convert guava-cache to InlineFlowTest
2021-09-07 16:47:00 +02:00
Benjamin Muskalla
efd5dc94e6
Convert apache-commons-lang3 to InlineFlowTest
2021-09-07 16:47:00 +02:00
Benjamin Muskalla
eba414e31b
Convert apache-collections to InlineFlowTest
2021-09-07 16:46:59 +02:00
Benjamin Muskalla
3bc70f0ce6
Convert containerflow to inline flow test
2021-09-07 16:46:59 +02:00
Benjamin Muskalla
7a0fc6ae61
Migrate jaxson to inline test
2021-09-07 16:46:59 +02:00
Benjamin Muskalla
41891959a3
Fix apache test
2021-09-07 16:46:58 +02:00
Benjamin Muskalla
2d13906e0e
Simplify jaxrs setup
2021-09-07 16:46:58 +02:00
Benjamin Muskalla
24d43689b2
Simplify test setup
2021-09-07 16:46:58 +02:00
Benjamin Muskalla
8830f1531f
Convert some tests to use InlineFlowTest
2021-09-07 16:46:58 +02:00
Benjamin Muskalla
acb055400d
Extract inline flow test
2021-09-07 16:46:57 +02:00
Benjamin Muskalla
d1a1f57e77
Convert taint-format test into inline test
2021-09-07 16:46:56 +02:00
Anders Schack-Mulligen
f6541811d2
Dataflow: Update more tests.
2021-09-07 13:02:20 +02:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
Andrew Eisenberg
bb9911e06f
Merge pull request #6605 from aeisenberg/aeisenberg/pack/consistency
2021-09-06 04:40:58 -07:00
Andrew Eisenberg
6a47fcaf1f
Packaging: Normalize all qlpack.yml files for all languages
...
This commit ensures consistency among all of our qlpacks. Here are the
changes:
1. Ensure only modern references are used (codeql-{lang} is converted to
codeql/{lang}-all or codeql/{lang}-queries where appropriate).
2. Use consistent version numbers. All languages are at 0.0.2 except
javascript, which is 0.0.3.
3. Convert all `libraryPathDependencies` to `dependencies` with version
constraints
4. Dependencies from query packs to other packs are always `"*"` since
these dependencies are always from source and we should get the
latest.
5. Dependencies from codeql/{lang}-lib to codeql/{lang}-upgrades must
be strict since there is a tight connection between the libary
and its relevant upgrades.
2021-09-03 11:53:28 -07:00
Chris Smowton
23d7633cd5
Add tests for static and final modifiers relating to record classes
2021-09-03 18:20:16 +01:00
Benjamin Muskalla
51475d2fb0
Merge branch 'main' into thirdpartyapitelemtry
2021-09-03 14:23:31 +02:00
Benjamin Muskalla
ab5c1d6bdd
Rework filter to exclude simple constructors
2021-09-03 13:38:01 +02:00
Benjamin Muskalla
9ed14b438e
Use readble format for APIs
2021-09-03 11:53:18 +02:00
Benjamin Muskalla
4b02e266fd
Fix test as we support explicit collection types
2021-09-03 11:37:39 +02:00
Benjamin Muskalla
ee8958ba03
Fix nodes for local taint test
2021-09-01 15:55:59 +02:00
Benjamin Muskalla
190bf90bc8
Replace stringbuilder step with model
2021-09-01 15:41:16 +02:00
Benjamin Muskalla
7ddf7ff211
Track taint from concatenated string
2021-09-01 15:41:16 +02:00
Benjamin Muskalla
d178fe4e5d
Fix failing tests
2021-09-01 15:41:16 +02:00
Benjamin Muskalla
93bc8aa7b2
Fix tests to take trim into account
2021-09-01 15:41:15 +02:00
Benjamin Muskalla
3928ffd30d
Support CharSequence#subSequence
2021-09-01 15:41:15 +02:00
Benjamin Muskalla
b7e608abc9
Model string builder APIs
2021-09-01 15:41:14 +02:00
Chris Smowton
7977d9c253
Fix minor mistakes in old Guava models
...
Also add tests for the affected functions
2021-08-31 15:26:09 +01:00
Chris Smowton
7a0555ecb3
Merge pull request #6357 from artem-smotrakov/static-iv
...
Java: Static initialization vector
2021-08-26 13:45:43 +01:00
Fosstars
c80a1da483
Don't consider copyOf() and clone() in ArrayUpdate
2021-08-25 12:11:34 +02:00
Chris Smowton
5a2dfda09e
Add test for field initializers
2021-08-24 14:04:45 +01:00
