Tony Torralba
ccd465d669
Update java/ql/lib/semmle/code/java/security/PathSanitizer.qll
2022-12-07 10:38:33 +01:00
Tony Torralba
2f622ad72c
Refactor by introducing helper predicates
2022-12-07 10:31:54 +01:00
Tony Torralba
85b2642a5e
Extraction discrepancy fixed in kotlinc 1.7.21
2022-12-07 09:57:31 +01:00
Ed Minnix
b6a59f0885
Java: Add support and tests for implicitly exported activity aliases
2022-12-06 23:11:48 -05:00
Ed Minnix
1472335c2e
Abbreviated change note in changelog entry for activity-alias
2022-12-06 23:11:48 -05:00
Ed Minnix
2255b0d96a
Modify getAndroidComponentXmlElement to handle activity-alias
...
Since aliases have both the `name` and `targetActivity` attributes, we
should check all identifying attributes in order to add
`<activity-alias>` elements as dataflow sources.
2022-12-06 23:11:48 -05:00
Ed Minnix
4620db0fe9
Activity alias: formatting changes suggested by Actions
2022-12-06 23:11:48 -05:00
Ed Minnix
ec6c421f91
Added change notes for AndroidManifest.qll
2022-12-06 23:11:48 -05:00
Ed Minnix
f4dbd41036
Test files for Activity Alias
2022-12-06 23:11:48 -05:00
Ed Minnix
4df926e148
Add method for finding aliases to AndroidActivityXmlElement
2022-12-06 23:11:48 -05:00
Ed Minnix
b4f08f8b91
Add support for Android Manifest <activity-alias> element
2022-12-06 23:11:48 -05:00
Ed Minnix
4c270fca91
Add generalized identifier resolution for AndroidManifest
...
Since more than one attribute can hold an identifier, refactor
identifier resolution into a separate method.
2022-12-06 23:11:47 -05:00
Ed Minnix
cf3e5a0abe
Add class for XML Attributes meant to hold an identifier in AndroidManifest
...
Some Android component attributes hold an identifier (e.g.
`android:name` and `android:targetActivity` for `<activity-alias>`).
2022-12-06 23:11:47 -05:00
Jami Cogswell
b82f9b1911
Java: add draft of generated vs manual MaD metrics query
2022-12-06 22:15:19 -05:00
retanoj
8ee418405b
consider blankspace / comma /dot field
2022-12-07 10:06:39 +08:00
Ed Minnix
1c81f8d8d5
Apply suggestion from docs review
2022-12-06 15:32:54 -05:00
Chris Smowton
c68ac460c9
Accept test changes: again this is a raw class extracted just for its signature.
2022-12-06 18:38:33 +00:00
Chris Smowton
d37a10e4f1
Accept test changes: methods no longer appearing to be final
...
This is actually a bug, which we should follow up on subsequently.
2022-12-06 18:38:31 +00:00
Chris Smowton
59eb81b50a
Accept test changes: a raw class getting extracted solely for use in a signature
...
We could revert this by allowing useType to avoid triggering class-instance extraction when used just for its signature result
2022-12-06 18:35:04 +00:00
Chris Smowton
f5579d59f8
Accept test changes: classes no longer getting multiple locations
2022-12-06 18:35:04 +00:00
Chris Smowton
9f722a7e12
Disable java_and_kotlin inconsistency test; accept changes
...
This was testing that a signature inconsistency occurs, but this now manifests as a db inconsistency which can't be used as a test expectation because specific tuple numbers are liable to change with the environment.
2022-12-06 18:35:04 +00:00
Chris Smowton
f2fded6486
Accept jvmstatic-annotation changes
...
These occur because the Companion field is odd, being extracted from source but not having an associated FieldDeclaration, leading to PrintAst enumerating the node differently depending on whether it has a source-file location or not but in either case choosing not to show it.
2022-12-06 18:35:04 +00:00
Chris Smowton
5e023bf619
Remove no-longer-applicable diagnostic matches
...
These resulted from the Java compiler exploring NotNull and other Kotlin-emitted annotations, which it no longer does because it finds a .class trap file already present and truncates its class-graph walk
2022-12-06 18:35:04 +00:00
retanoj
b0c86d8e51
change string match to regex match
2022-12-06 21:50:09 +08:00
Michael Nebel
8e4190d84a
Merge pull request #11516 from michaelnebel/java/externalflowcleanup
...
Java: Cleanup imports of `ExternalFlow`
2022-12-06 14:26:39 +01:00
Anders Schack-Mulligen
b579e2e7ed
Merge pull request #11493 from aschackmull/java/scc-equivrel
...
Java: Replace ad-hoc SCC reduction with union-find.
2022-12-06 14:02:46 +01:00
retanoj
2bbd37f9ab
change code snippet to or condition
2022-12-06 19:27:29 +08:00
retanoj
de652e1e27
expected
2022-12-06 18:09:48 +08:00
Chris Smowton
3b5b121aeb
Merge pull request #11553 from smowton/smowton/fix/kotlin-synthetic-noarg-constructor
...
Kotlin: Extract a no-arg constuctor whenever a Kotlin class has default values for all parameters
2022-12-06 10:07:31 +00:00
retanoj
fb8559f03a
tiny fix function name
2022-12-06 18:03:00 +08:00
retanoj
82d0551215
Merge branch 'main' into MybatisSqli
2022-12-06 17:19:30 +08:00
retanoj
d2140eb4b1
MyBatisAnnotationSqlInjection no @Param case
2022-12-06 17:07:49 +08:00
Tom Hvitved
b5e2e1e469
Merge pull request #11564 from hvitved/dataflow/parameter-position-consistency-checks
...
Data flow: Add consistency checks for parameter positions
2022-12-06 09:33:36 +01:00
Michael Nebel
cd5c0bec33
Merge pull request #11527 from michaelnebel/java/regeneratemodels
...
Java/C#: Delete old model generator scripts and update Java model re-generator script.
2022-12-06 09:24:13 +01:00
Henry Mercer
2627632a41
Java: Fix duplicate IDs
2022-12-05 19:06:03 +00:00
Chris Smowton
407e4cdd07
Don't create a default constructor for annotations, or classes that explicitly declare a no-arg constructor.
2022-12-05 16:17:51 +00:00
Chris Smowton
8897f5bccc
Merge pull request #11552 from smowton/smowton/fix/kotlin-toplevel-internal-names
...
Kotlin: Don't add name mangling to top-level internal functions
2022-12-05 15:36:52 +00:00
Michael Nebel
fca249a62e
Java: Address review comments.
2022-12-05 14:44:52 +01:00
Tony Torralba
8422df1c43
Add change note
2022-12-05 13:35:54 +01:00
Tom Hvitved
52f3a48638
Data flow: Sync files
2022-12-05 12:57:27 +01:00
Mauro Baluda
7c4b76b08b
Update InsecureCookie.ql
2022-12-05 12:55:53 +01:00
Tom Hvitved
faca4b5b56
Merge pull request #11461 from hvitved/ruby/unique-hash-splat-param
...
Ruby: At most one hash-splat `ParameterNode` per callable
2022-12-05 11:53:28 +01:00
Tony Torralba
47d61e0b4d
Add test for File.startsWith
2022-12-05 11:52:50 +01:00
Tony Torralba
71a6b09bad
Minor syntax change in tests
2022-12-05 11:52:02 +01:00
Michael Nebel
a9ba964be4
Java: Update the Java model re-generate script.
2022-12-05 11:39:44 +01:00
Michael Nebel
243b94b54a
Java/C#: Delete old model generator scripts and rename the new ones.
2022-12-05 11:39:44 +01:00
Mauro Baluda
16d7dc0853
Restrict DF configuration
2022-12-05 11:02:19 +01:00
Tony Torralba
8fb5c37ba8
Add change note
2022-12-05 11:00:57 +01:00
Tony Torralba
995b7327fe
Add missing QLDoc
2022-12-05 11:00:57 +01:00
Tony Torralba
21b51b48eb
Adapt PathSanitizer to Kotlin
2022-12-05 11:00:57 +01:00
