Max Schaefer
bcf4f4febd
Drop a conjunct which is now spurious.
2024-01-11 11:56:59 +00:00
Max Schaefer
03ca244df2
Associate endpoints with their potential endpoint types and check these when determining candidates.
...
This prevents us from associating a sink candidate with a source type and vice versa.
However, this does not fix the problem of negative characteristics for sink types excluding source candidates.
2024-01-11 11:44:14 +00:00
Max Schaefer
a6d996b478
Add an example of a missed source candidate.
...
`Files.list` has a taint step from its first argument to its result, so that first argument should not be considered a sink candidate (and it is not). However, due to a bug in `IsMaDTaintStepCharacteristic` it is also not considered a source candidate, which is wrong: as the example shows, if that argument is a call we do very much want to consider it as a source candidate.
2024-01-11 11:27:34 +00:00
Max Schaefer
8e429bd399
Rename isSinkCandidate (and a related predicate) to isCandidate.
...
This reflects the fact that these predicates also deal with source candidates.
2024-01-11 11:20:51 +00:00
Max Schaefer
dba2e06a1d
Merge pull request #15283 from github/max-schaefer/release-automodel-query-pack
...
Release automodel extraction queries v0.0.12.
2024-01-11 10:28:55 +00:00
Owen Mansel-Chan
3767348dec
Update test expectations
2024-01-10 22:25:08 +00:00
Owen Mansel-Chan
7824e60acd
Manual neutral summaries should block generated summaries
2024-01-10 22:25:06 +00:00
Owen Mansel-Chan
370a32da8b
Test summary models and neutral models, manual and generated
2024-01-10 22:25:02 +00:00
Owen Mansel-Chan
9e2e01ff89
Update Top JDK APIs test expectation
2024-01-10 17:07:33 +00:00
Ian Lynagh
80163c5aac
Kotlin 2: Just accept the remaining comment differences for now
2024-01-10 16:39:47 +00:00
Ian Lynagh
ce4253c17f
Kotlin 2: Remove an expected diagnostic match
...
It is only generated when using the PSI comment extractor.
2024-01-10 16:39:04 +00:00
Ian Lynagh
20254fd71e
Kotlin: Accept a location change
2024-01-10 16:39:04 +00:00
Owen Mansel-Chan
33030417b4
Add change note
2024-01-10 15:48:28 +00:00
Ian Wright
75545db97c
restore files, whether overriding or not
2024-01-10 11:40:31 +00:00
Max Schaefer
8d56ee4a56
Release automodel extraction queries v0.0.12.
2024-01-10 11:29:36 +00:00
Ian Wright
f793ce1e49
remove temp testing comments
2024-01-10 11:07:06 +00:00
Ian Wright
ed8422a2da
remove need for CODEQL_DIST path
2024-01-10 11:07:06 +00:00
Ian Wright
0d2ec2d632
install codeql extension
2024-01-10 11:07:06 +00:00
Ian Wright
62bdaf069b
use gh tool to access codeql
2024-01-10 11:07:05 +00:00
Ian Wright
30e5be68c9
temp comment for testing
2024-01-10 11:07:05 +00:00
Ian Wright
9895114e05
temp comment for testing
2024-01-10 11:07:05 +00:00
Ian Wright
0f76fbad36
better processing of args
2024-01-10 11:07:05 +00:00
Ian Wright
749f8b9807
fix help message
2024-01-10 11:07:05 +00:00
Ian Wright
00f4991648
support dry-run
...
fix
fix
temp
temp
better support for dry-run
fix
fix
fix
fix
reinstate exits
2024-01-10 11:07:05 +00:00
Tom Hvitved
c9cf2a899c
Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify
...
Data flow: Remove column from `mayBenefitFromCallContext`
2024-01-10 11:43:15 +01:00
Max Schaefer
ac8e92eec5
Merge pull request #15264 from github/max-schaefer/automodel-exclude-generated-calls
...
Automodel: Do not generate features for compiler-generated program elements.
2024-01-10 10:22:00 +00:00
Tony Torralba
d6082f8446
Merge pull request #14926 from ebickle/fix/update-gson-model
...
Java: Improve Gson parse, get, and stream models
2024-01-10 09:11:01 +01:00
Max Schaefer
9b7cfd88cd
Clarify relationship of isFromSource and Element::fromSource.
2024-01-09 16:21:36 +00:00
Max Schaefer
3e8775daaa
Automodel: Do not generate features for compiler-generated program elements.
...
These have dummy locations, which breaks certain invariants that break downstream processing.
2024-01-09 13:39:46 +00:00
Ian Lynagh
0bc1463ab0
Merge pull request #14941 from igfoo/igfoo/dff
...
Kotlin 2: Accept some location changes
2024-01-09 12:20:37 +00:00
Tom Hvitved
f90201eb56
Data flow: Remove column from mayBenefitFromCallContext
2024-01-09 11:34:43 +01:00
Eric Bickle
f6fa7120d9
Merge branch 'main' into fix/update-gson-model
2024-01-08 15:46:14 -08:00
Eric Bickle
929ce65af1
Remove zero width space characters.
2024-01-08 13:15:38 -08:00
Ed Minnix
55da62e9cf
Remove stray comma
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2024-01-08 11:09:11 -05:00
Ed Minnix
b8466b45be
Update change note date
2024-01-08 09:39:11 -05:00
Edward Minnix III
2440075402
Remove off-topic reference
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-08 09:39:10 -05:00
Edward Minnix III
3816271b3e
Remove redundant CWE link
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-08 09:39:10 -05:00
Ed Minnix
2eff6b351c
Add comment
2024-01-08 09:39:09 -05:00
Ed Minnix
16bb19e176
Add OWASP and CERT references
2024-01-08 09:39:08 -05:00
Ed Minnix
9f974415c0
Add references to CWE-454 (External Initialization of Trusted Variables)
2024-01-08 09:39:07 -05:00
Ed Minnix
97b29bb965
Add Java Tutorial reference
2024-01-08 09:39:06 -05:00
Edward Minnix III
938d52b86f
Docs review suggestions
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2024-01-08 09:39:05 -05:00
Ed Minnix
a528db8958
Use MapMutation instead of MethodCall
2024-01-08 09:39:05 -05:00
Ed Minnix
e14be0e971
Add BAD markers to samples
2024-01-08 09:39:04 -05:00
Ed Minnix
709649e9df
Model replace and putIfAbsent
2024-01-08 09:39:03 -05:00
Ed Minnix
1544330f3f
Minor fixes for code review
2024-01-08 09:38:53 -05:00
Ed Minnix
4b9b27c395
change note
2024-01-08 09:38:52 -05:00
Edward Minnix III
18e8a27fca
Reworded name and description
2024-01-08 09:38:51 -05:00
Edward Minnix III
1f37e70d83
Fix typos
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-08 09:38:51 -05:00
Ed Minnix
51006aa088
Formatting fix
2024-01-08 09:38:50 -05:00
