Owen Mansel-Chan
f0fe3a3388
Merge pull request #17260 from owen-mc/go/mad/convert-sink-5
...
Go: Allow MaD models for XSS sinks using "html-injection" or "js-injection"
2024-08-20 22:40:44 +01:00
Owen Mansel-Chan
30f8d6e4ff
Allow MaD models for XSS sinks using "html-injection" or "js-injection"
2024-08-20 14:04:23 +01:00
Anders Schack-Mulligen
993bfee096
Merge pull request #17259 from aschackmull/dataflow/remove-srcsink-grouping
...
Dataflow: Remove src/sink grouping feature
2024-08-20 14:42:33 +02:00
Anders Schack-Mulligen
8470e91c16
Legacy Dataflow: Sync.
2024-08-20 10:07:57 +02:00
Owen Mansel-Chan
2d2afb17ad
Convert gocb nosql-injection sinks to MaD
2024-08-16 11:19:15 +01:00
Owen Mansel-Chan
ec9d88b364
Convert mongodb nosql-injection sinks to MaD
2024-08-16 11:19:13 +01:00
Owen Mansel-Chan
86e9f15929
Accept MaD sinks with kind nosql-injection
2024-08-16 11:19:12 +01:00
Owen Mansel-Chan
ced000ae46
Add Argument.getACorrespondingSyntacticArgument
2024-08-16 11:19:09 +01:00
Owen Mansel-Chan
652dd88c36
Convert database/sql/driver sql-injection sinks to MaD
2024-08-16 11:19:06 +01:00
Owen Mansel-Chan
501bb3eb56
Convert database/sql sql-injection sinks to MaD
2024-08-16 11:19:03 +01:00
Owen Mansel-Chan
ad213579a1
Convert Beego orm sql-injection sinks to MaD
2024-08-16 11:19:01 +01:00
Owen Mansel-Chan
3eb5b2669b
Convert Bun sql-injection sinks to MaD
2024-08-16 11:18:58 +01:00
Owen Mansel-Chan
3b2b7d7d1c
Convert Xorm sql-injection sinks to MaD
2024-08-16 11:18:57 +01:00
Owen Mansel-Chan
ba310417a8
Convert Gorm sql-injection sinks to MaD
2024-08-16 11:18:55 +01:00
Owen Mansel-Chan
7ad63fc3e6
Convert sqlx sql-injection sinks to MaD
2024-08-16 11:18:54 +01:00
Owen Mansel-Chan
db559f75b6
Convert gogf/gf sql-injection sinks to MaD
2024-08-16 11:18:52 +01:00
Owen Mansel-Chan
ce0cb12c29
Upgrade and convert gorqlite sql-injection sinks to MaD
2024-08-16 11:18:51 +01:00
Owen Mansel-Chan
06f86dd22f
Convert squirrel sql-injection sinks to MaD (non-existent methods removed)
...
Various non-existent methods were modeled, and I couldn't find any
evidence that they used to exist. They aren't in the stubs or tests. I
have removed them.
2024-08-16 11:18:49 +01:00
Owen Mansel-Chan
0dfdee775b
Merge pull request #17177 from owen-mc/go/mad/convert-sink-3
...
Go: convert regex-use, url-redirection sinks to use models-as-data
2024-08-12 16:21:48 +01:00
Michael Nebel
4a5c9f0ec4
Merge pull request #17007 from michaelnebel/shared/neutralimplementation
...
C#/Java/Go: Neutrals are split into separate classes.
2024-08-12 13:58:12 +02:00
Owen Mansel-Chan
1df81dbfb6
Use regex-use[receiver] instead of regex-use[-1]
2024-08-11 00:37:25 +01:00
Owen Mansel-Chan
49f3959405
Convert url-redirection sinks to MaD
2024-08-11 00:29:53 +01:00
Owen Mansel-Chan
3a285f500e
Convert regex-use sinks to use MaD
2024-08-11 00:21:31 +01:00
Owen Mansel-Chan
5ef37c4501
Converting command-injection sinks to use MaD
2024-08-08 17:03:57 +01:00
Owen Mansel-Chan
8536e7eb02
Convert path-injection sinks to use MaD
2024-08-08 17:03:53 +01:00
Owen Mansel-Chan
fa472f5e18
Convert logging sinks to use MaD
2024-08-08 17:01:49 +01:00
Owen Mansel-Chan
572c773345
Change provenance for MaD models that use package grouping
2024-08-06 13:13:39 +01:00
Owen Mansel-Chan
62adb31ca6
Add more import paths for xmlpath
2024-08-01 14:52:19 +01:00
Owen Mansel-Chan
e4cd29efc6
Fix missing go-jose package path
2024-07-31 11:09:53 +01:00
Owen Mansel-Chan
9cb01d4573
Merge branch 'main' into go/mad/convert-sinks
2024-07-30 08:03:18 +01:00
Owen Mansel-Chan
a6cb511ed7
Convert XPath injection sinks to MaD
2024-07-25 12:56:06 +01:00
Owen Mansel-Chan
78b66abad3
Convert existing credentials sinks to MaD
...
I checked that the tests failed when I removed the classes and passed
again when I add the MaD models.
2024-07-25 12:53:16 +01:00
Owen Mansel-Chan
93c9910e6f
Convert go/request-forgery sinks to MaD
2024-07-25 12:53:15 +01:00
Owen Mansel-Chan
f7d681516a
Allow MaD sinks for go/request-forgery
...
Request forgery sinks which have `getRequest` different from the sink
itself cannot be modeled using models-as-data.
2024-07-25 12:53:14 +01:00
Anders Schack-Mulligen
7a48fe1102
Dataflow: Replace ppReprType with DataFlowType.toString.
2024-07-25 13:08:47 +02:00
Michael Nebel
2796597d1a
Code quality improvements.
2024-07-19 09:36:17 +02:00
Michael Nebel
ca4bd0c606
C#/Java/Go: Neutrals are split into seperate classes.
2024-07-18 16:29:38 +02:00
Owen Mansel-Chan
fc17b905f0
Convert WebSocketReaderAsSource to MaD
2024-07-18 10:53:13 +01:00
Owen Mansel-Chan
cfdd48711b
Convert Fasthttp::RequestHeader::RemoteFlowSource to MaD
2024-07-17 12:11:59 +01:00
Owen Mansel-Chan
abeca3d9f9
Convert Fasthttp::RequestCtx::RemoteFlowSource to MaD
2024-07-17 12:11:58 +01:00
Owen Mansel-Chan
729069e3d9
Convert Fasthttp::Request::RemoteFlowSource to MaD
2024-07-17 12:11:57 +01:00
Owen Mansel-Chan
c3169d258f
Convert Fasthttp::Args::RemoteFlowSource to MaD
2024-07-17 12:11:57 +01:00
Owen Mansel-Chan
5a00b5ec96
Convert Fasthttp::URI::RemoteFlowSource to MaD
2024-07-17 12:11:56 +01:00
Owen Mansel-Chan
e6c7e1a0bc
Merge pull request #16990 from owen-mc/go/change-string-prefix-check
...
Go: Change string prefix check
2024-07-17 09:57:45 +01:00
Owen Mansel-Chan
535b4ea986
Convert net/http UserControlledRequestField sources to MaD
2024-07-16 16:53:02 +01:00
Owen Mansel-Chan
873fd6646b
Convert Revel::UserControlledRequestMethod sources to MaD
2024-07-16 16:53:01 +01:00
Owen Mansel-Chan
034f2d4221
Convert Revel field read sources to MaD
2024-07-16 16:53:01 +01:00
Owen Mansel-Chan
8647f69720
Change string prefix check
...
This avoids putting all the prefixes in the string pool.
2024-07-16 15:56:28 +01:00
Owen Mansel-Chan
124567caa4
Convert Mux::RequestVars to MaD
2024-07-16 11:18:19 +01:00
Owen Mansel-Chan
061c187a8e
Convert GithubComGinGonicGinContextBindSource to MaD
2024-07-16 11:18:18 +01:00
