Anders Schack-Mulligen
e73e312e10
Java: Add change note.
2023-08-01 09:28:56 +02:00
Stephan Brandauer
621c05dc4b
Java: format
2023-08-01 09:19:03 +02:00
Stephan Brandauer
058236877e
Java: Drive-by: fix oversight in #13823
...
In PR #13823 , we had rewritten the endpoints that are being considered for framework mode. We used to use `DataFlow::ParameterNode` as endpoints.
However, `ParameterNode`s do not exist for the implicit `this` parameter; they also do not exist for bodiless interface-methods.
In PR #13823 , we forgot to model that `this` only exists for non-static methods and to only consider parameters that we have source code for.
2023-08-01 09:18:58 +02:00
Stephan Brandauer
37b6b46dbf
Java: update extraction query tests after merging PR #13747
2023-08-01 09:18:57 +02:00
Paul Hodgkinson
3bc7cf6ac7
Merge branch 'main' into java/experimental/command-injection
2023-07-31 19:14:55 +01:00
Tony Torralba
2cbb7ed296
Java: Add XXE sinks for MDHT
2023-07-31 11:13:17 +02:00
Stephan Brandauer
8bf960bd44
Java: fix QL-for-QL alert
2023-07-28 14:28:47 +02:00
Stephan Brandauer
021eedfdf1
Java: format
2023-07-28 14:26:34 +02:00
Stephan Brandauer
82fd0e45aa
Java: support Argument[this] in NotAModelApiParameter
2023-07-28 14:04:53 +02:00
Stephan Brandauer
a9d2f43538
Java: use a newtype for framework mode candidates
2023-07-28 13:51:25 +02:00
Stephan Brandauer
8ed773b240
Java: Framework mode extraction now uses a custom class for endpoints, so we can support both Argument[this] and interface-method parameters
2023-07-28 12:56:39 +02:00
Stephan Brandauer
09c64e8fee
Java: Support Argument[this] in framework mode metadata extraction
2023-07-28 12:55:26 +02:00
Chris Smowton
c69a9ea032
Merge pull request #13793 from github/post-release-prep/codeql-cli-2.14.1
...
Post-release preparation for codeql-cli-2.14.1
2023-07-26 17:22:05 +01:00
Stephan Brandauer
08f5774d13
Java: Automodel extraction fix for application mode
2023-07-25 17:11:07 +02:00
Stephan Brandauer
698b8d3c5c
Java: Automodel extraction fix; previously, we treated endpoints that were marked as sinks, as well as summary-neutrals as 'erroneous'
2023-07-25 16:52:27 +02:00
Stephan Brandauer
2582b084f6
Merge pull request #13747 from github/tausbn/exclude-qualifier-argument-for-existing-models
...
Java: Exclude qualifier argument for existing models
2023-07-24 16:26:33 +02:00
Stephan Brandauer
13027a1094
Java: review suggestions from @atorralba
2023-07-24 14:09:10 +02:00
Stephan Brandauer
2f2f507a5d
Java: drive-by change: remove obsolete custom queries from application mode characteristics
2023-07-24 13:55:53 +02:00
github-actions[bot]
f91b7a9342
Post-release preparation for codeql-cli-2.14.1
2023-07-21 16:16:25 +00:00
Stephan Brandauer
79da723878
Java: only assume that _manual_ MaD sinks have been fully modeled
2023-07-21 10:43:07 +02:00
github-actions[bot]
c936a920b0
Release preparation for version 2.14.1
2023-07-20 16:32:27 +00:00
Stephan Brandauer
5575fc65aa
Merge pull request #13636 from github/tausbn/add-sink-alert-metrics-query
...
Java: Add metric queries for counting sinks coming from models
2023-07-19 13:12:32 +02:00
Paul Hodgkinson
c7084b6d8e
Merge branch 'main' into java/experimental/command-injection
2023-07-18 11:38:44 +01:00
Taus
6b425f1395
Java: Revert definition of isNeutral
...
Reverts the change made in
daf2743143
2023-07-14 14:45:22 +02:00
Taus
6793bc6c6b
Java: Exclude qualifier argument for existing models
...
Excludes candadites for `Argument[this]` where we already have a model that covers a
different argument of the containing call.
2023-07-14 14:26:21 +02:00
Taus
895e829eb1
Java: Add QLDoc for query predicates
2023-07-14 14:22:10 +02:00
Taus
c4487673e8
Java: Swap input and ext
2023-07-14 14:21:59 +02:00
Taus
9193de6898
Merge pull request #13730 from github/tausbn/limit-number-of-candidates-in-application-mode
...
Java: Limit the number of samples extracted in application mode
2023-07-14 14:09:59 +02:00
Anders Schack-Mulligen
91de43f918
C#/Java/Ruby: Remove superfluous module members.
2023-07-13 11:38:35 +02:00
Taus
49194a2af7
Java: Limit the number of samples extracted in application mode
...
Uses the same trick as for the negative examples, this time with a limit of 7
candidates for each endpoint signature.
As this duplicates some of the logic used in another query, it may be worthwhile
to consider extracting this into a shared parameterized module.
2023-07-12 15:13:10 +02:00
Tony Torralba
ce600367df
Java: Add support for Kotlin's apply to java/android/unsafe-android-webview-fetch
2023-07-10 17:40:16 +02:00
github-actions[bot]
13cf054a9d
Post-release preparation for codeql-cli-2.14.0
2023-07-07 14:55:41 +00:00
github-actions[bot]
6484ee106e
Release preparation for version 2.14.0
2023-07-07 08:22:14 +00:00
Taus
f666260cd8
Java: Add meta query for metrics gathering
...
Exposes the same information as the existing queries through two query
predicates instead. This makes the downstream data gathering a bit more
convenient to implement.
2023-07-06 16:59:15 +02:00
Taus
36c6c7235c
Java: Move instance counting logic into utility library
2023-07-06 16:59:15 +02:00
Dave Bartolomeo
9631e9f2f1
Bump minor version numbers post-GHES
2023-07-06 10:10:01 -04:00
Dave Bartolomeo
2bb9adfbf1
Merge remote-tracking branch 'origin/main' into dbartol/mergeback-3.10
2023-07-06 10:00:46 -04:00
Taus
97610d2cac
Java: Add query for counting sink model instances
...
Also adds a more sensible ordering to the existing queries.
2023-07-04 14:24:52 +02:00
Taus
b7e4bd290d
Java: Use an IPA type instead of a string
...
While the string representation is useful for quickly modifying queries, it's
a bit clunky when the data needs to be further parsed. Instead, the two queries
now select all of the columns of the sinkmodel separately (which makes it easy
to pull them out of the relevant output later on).
2023-07-03 23:17:55 +02:00
Michael Nebel
23a119b8c2
Java/C#: Reduce the amount of telemetry being produced.
2023-07-03 16:54:07 +02:00
Taus
6f24d939f6
Java: Also select query id
2023-07-01 15:04:06 +02:00
Taus
dca227389d
Java: Add metric queries for counting sinks coming from models
...
Adds two queries for gathering metrics on the number of alerts (for a selection of queries)
that arise from models with the `ai-generated` provenance.
2023-06-30 15:07:13 +02:00
github-actions[bot]
668aaa2dc8
Post-release preparation for codeql-cli-2.13.5
2023-06-30 08:51:48 +00:00
Koen Vlaswinkel
6806b8750d
Java: Use getSourceDeclaration to handle generic types
2023-06-29 11:49:16 +02:00
github-actions[bot]
9d7987f822
Release preparation for version 2.13.5
2023-06-29 09:26:18 +00:00
Paul Hodgkinson
bfbb77a796
Merge branch 'main' into java/experimental/command-injection
2023-06-29 09:51:14 +01:00
aegilops
01798f63f8
Switched to new dataflow and added a test (but it doesn't produce results yet)
2023-06-28 17:14:39 +01:00
Koen Vlaswinkel
fcb2f1082c
Java: Fix external API name for nested types
...
This fixes the name of reported external APIs for nested types.
The `toString()` method of `getSourceDeclaration()` would report the
name of a type, but not the name of the enclosing type. This results
in missing information in the `UnsupportedExternalAPIs.ql` query.
For example, previously it would report:
```
org.zapodot.junit.db.Builder#build()
```
However, the `Builder` class does not exist in the package and is only
a nested type within `EmbeddedDatabaseRule`. The correct name should be:
```
org.zapodot.junit.db.EmbeddedDatabaseRule$Builder#build()
```
This name also matches the format of MaD.
2023-06-27 15:23:55 +02:00
Tony Torralba
a7c2a25cac
Merge pull request #12879 from atorralba/atorralba/java/command-injection-mad-sinks
...
Java: Convert all command injection sinks to MaD format
2023-06-27 14:06:45 +02:00
Tony Torralba
3c3b53001f
Merge pull request #13550 from jorgectf/jorgectf/lang2-models
...
Java: Add models for `org.apache.commons.lang`
2023-06-27 11:20:59 +02:00
