Anders Schack-Mulligen
b192f6dfe0
Java: Remove some deprecated classes.
2020-11-24 14:04:01 +01:00
Anders Schack-Mulligen
3f04099c25
Update java/ql/src/experimental/CWE-918/RequestForgery.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2020-11-24 13:18:58 +01:00
Anders Schack-Mulligen
0450489022
Java: Review fixes.
2020-11-24 11:31:44 +01:00
Anders Schack-Mulligen
2cf10a7658
Merge pull request #4427 from aschackmull/java/fastjson
...
Java: Add support for FastJson in unsafe deserialization.
2020-11-23 14:40:14 +01:00
luchua-bc
a311462791
Move to query-test folder and update qldoc
2020-11-19 13:12:42 +00:00
Porcupiney Hairs
ebc6c49555
include suggestions from review.
2020-11-19 03:37:00 +05:30
luchua-bc
85434ca410
Format the source code and update qldoc
2020-11-17 21:20:53 +00:00
Aditya Sharad
b9b6a35564
Merge pull request #4629 from pwntester/improve_bean_validation_query
...
Java: add some improvements to the bean validation query
2020-11-17 08:35:49 -08:00
Anders Schack-Mulligen
f74fc0ff26
Dataflow: Fix bad join-orders.
2020-11-17 14:28:25 +01:00
luchua-bc
0bd6255c41
Query for cleartext storage using Android SharedPreferences
2020-11-16 17:23:01 +00:00
Anders Schack-Mulligen
4be731d2ab
Java: Adjust reference to static method and add test.
2020-11-16 11:47:58 +01:00
Anders Schack-Mulligen
80ee92ae97
Java: Add support for FastJson in unsafe deserialization.
2020-11-16 11:47:58 +01:00
Anders Schack-Mulligen
9e45f10c5d
Dataflow: Remove headUsesContent.
2020-11-13 15:12:39 +01:00
Anders Schack-Mulligen
e0a6a485df
Dataflow: Sync.
2020-11-13 15:12:16 +01:00
Anders Schack-Mulligen
d324cd1844
Dataflow: Some qldoc.
2020-11-13 15:09:30 +01:00
Anders Schack-Mulligen
293429f821
Dataflow: Make a bunch of the interface predicates private.
2020-11-13 15:09:30 +01:00
Anders Schack-Mulligen
d028e6b334
Dataflow: Change some headUsesContent to getHead.
2020-11-13 15:09:30 +01:00
Anders Schack-Mulligen
aa66b9bb48
Dataflow: Align more predicates.
2020-11-13 15:09:30 +01:00
Anders Schack-Mulligen
6e6e5d6414
Dataflow: Renamings.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
786edbf045
Dataflow: Align on parameterMayFlowThrough.
...
This actually provides a decent pruning improvement in stages 3 and 4.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
15bf1b1026
Dataflow: Rename some stage 1 predicates.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
af54afa24b
Dataflow: Add stage statistics.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
8b5e452728
Dataflow: Improve cons-cand relation.
...
Post-recursion we can filter the forward cons-candidates to only include
those that met a read step, and similarly restrict the reverse flow
cons-candidates to those that met a store step.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
e4fb41507b
Dataflow: Reshuffle some predicates.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
5a1c0e9ec4
Dataflow: Get rid of early filter.
...
This constructs a few more tuples in Stage3::fwdFlow0, which are then
filtered in Stage3::fwdFlow. This is cleaner and appears faster.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
3e18e02d2c
Dataflow: Refactor step predicate in fwdFlowRead.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
c5a2c261dc
Dataflow: Refactor forward store step relation.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
b6f1ab6429
Dataflow: Refactor step relation in revFlowStore.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
12fe38bcb6
Dataflow: Reorder, rename, and add columns to store-flow.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
aa28fdb83d
Dataflow: Align some qldoc.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
0a4c680e17
Dataflow: Align on localStep.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
4b5905c5e0
Dataflow: Risky! Remove fwdFlowLocalEntry.
...
This commit is a little bit risky, as it allows for some potentially bad
join-orders. The best order starts with the delta and proceeds with the
then functional `mid.getEnclosingCallable()` and `getLocalCallContext`.
In this order `localFlowEntry` becomes superfluous. The standard order
is however somewhat unwilling to choose this. If it picks
`getLocalCallContext` and `getEnclosingCallable` as the first join, the
result is really bad, but it appears that the existence of
`localFlowEntry` at least means that it'll do `localFlowEntry`,
`getEnclosingCallable`, `getLocalCallContext` in that order, which
appears to be acceptable, although it isn't optimal. Without the
`localFlowEntry` conjunct we end up with the worst case. We'll need to
watch this particular join-ordering until we get better join-ordering
directives.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
19a9285d00
Dataflow: Reshuffle a few conjuncts.
2020-11-13 15:09:29 +01:00
Anders Schack-Mulligen
7a95466241
Dataflow: Remove superfluous conjuncts.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
03ef9d00ec
Dataflow: Refactor call contexts.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
dc2b2cc13f
Dataflow: Some renamings.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
d037909c7b
Dataflow: Minor reorderings and renamings.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
00d726de3f
Dataflow: Refactor stage 4 read and stores.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
2afc572a34
Dataflow: Refactor stage 2 read and stores.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
b0e5925fea
Dataflow: Refactor stage 3 conscand predicates.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
261ef0fbff
Dataflow: Refactor forward stores and remove some useless conjuncts.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
628e0a795a
Dataflow: A few variable renamings.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
bfd8a3d104
Dataflow: Rename stage 2 cons-cand predicates.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
0a60a3abb3
Dataflow: Align on ApNil.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
60b51011b9
Dataflow: Minor refactor of Stage2::revFlow.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
c054295347
Dataflow: Rename option type branches.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
7eeae49e06
Dataflow: Remove AccessPathFront column.
...
This column is functionally determined from the access path, and was
merely included to help with some join-orders that no longer appear
problematic.
2020-11-13 15:09:28 +01:00
Anders Schack-Mulligen
1fe423550f
Dataflow: Stage comments and some formatting.
2020-11-13 15:09:27 +01:00
Anders Schack-Mulligen
586d52fac0
Dataflow: More renaming.
2020-11-13 15:09:27 +01:00
Anders Schack-Mulligen
3f25df902f
Dataflow: Rename some types and variables.
2020-11-13 15:09:27 +01:00
