Chris Smowton
2cc1f46871
Model constructors for (Imm|M)utable(Pair|Triple)
2021-06-17 12:34:40 +01:00
Chris Smowton
fbaa382158
Add tests for Pair.of and Triple.of
2021-06-17 12:34:40 +01:00
Chris Smowton
472a2a64dd
Add models for Apache Commons tuples
2021-06-17 12:25:21 +01:00
Chris Smowton
11b70326fd
Add Jakarta WS url-open sink
2021-06-17 11:58:41 +01:00
Chris Smowton
7509e36382
Remove no-longer-needed BasicRequestLine model from InsecureBasicAuth.ql; adjust test expectations accordingly
2021-06-17 11:43:33 +01:00
Chris Smowton
c531b81ebe
Rename RequestForgery.java -> SanitizationTests.java
2021-06-17 11:43:33 +01:00
Chris Smowton
cb99e17f4d
Split and rename JavaNetHttp and ApacheHttp tests for consistency
2021-06-17 11:43:32 +01:00
Chris Smowton
6c4a909b86
Remove dead code from test
2021-06-17 11:43:32 +01:00
Chris Smowton
08ab5f5546
Remove redundant test
2021-06-17 11:43:32 +01:00
Chris Smowton
74569ce316
Tidy Jax-RS test
2021-06-17 11:43:32 +01:00
Chris Smowton
57ca36baad
Tidy Spring test
2021-06-17 11:43:32 +01:00
Chris Smowton
8b080a94e7
Convert request forgery tests to inline expectations; add missing models revealed by this process.
2021-06-17 11:43:32 +01:00
Chris Smowton
b66dcbe5b6
Factor request-forgery config so it can be used in an inline-expectations test
2021-06-17 11:43:32 +01:00
Chris Smowton
ee872f1752
Add missing tests, add additional models revealed missing in the process, and add stubs to support them all.
2021-06-17 11:43:32 +01:00
Chris Smowton
49bbfc3f4b
Convert SSRF sinks into url-open CSV sinks
...
I also drop the previous approach of taint-tracking through various builder objects in favour of assuming that a URI set in a request-builder object is highly likely to end up requested in some way or another.
This will cause the `java/non-https-url` query to pick the new sinks up too, and fixes a Spring case that had never worked but went unnoticed until now.
2021-06-17 11:43:30 +01:00
Chris Smowton
55c72cebf2
Improve StringBuilder append chain tracking
...
Previously this didn't catch the case of constructors chaining directly into appends, like `StringBuilder sb = new StringBuilder("1").append("2")`
2021-06-17 11:41:06 +01:00
Chris Smowton
f388aae78e
Fix getAnArgUsageOffset and improve its space complexity
...
Also add tests checking the output of the new function
2021-06-17 11:41:05 +01:00
Chris Smowton
1549993565
Update test results to account for changed model structure
...
(Models now have internal nodes in order to allow field flow through them)
2021-06-17 11:41:05 +01:00
Chris Smowton
575198a0e4
Java SSRF query: Server Side -> Server-Side everywhere.
2021-06-17 11:41:04 +01:00
Chris Smowton
77904d9597
Remove failing test
...
The case where something might be exactly a constant is general across all queries, and not handled yet, particularly in the case where the result of `getParameter("uri")` might have changed between the check and the use.
2021-06-17 11:41:04 +01:00
Chris Smowton
6933d06a46
Add exactly the string '/' as a sanitizing prefix.
...
Usually this is ignored for suspicion that it could be taken for a protocol specifier, but on balance the context `(something) + "/" + tainted()` is more likely to be taken for a user-controlled location within a host the user does not control.
2021-06-17 11:41:03 +01:00
Chris Smowton
b5a450b881
SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.
2021-06-17 11:41:03 +01:00
Chris Smowton
487c1db6ed
Promote SSRF query to main query set
2021-06-17 11:41:01 +01:00
Anders Schack-Mulligen
6ca8d69b26
Merge pull request #5881 from haby0/java/UnsafeDeserialization
...
Java: CWE-502 Add UnsafeDeserialization sinks
2021-06-17 12:36:34 +02:00
Anders Schack-Mulligen
8fe2f4a554
Merge pull request #6034 from owen-mc/java/jax-rs
...
Improve JAX-WS and JAX-RS models
2021-06-17 12:35:34 +02:00
haby0
363ad5b470
Fix error
2021-06-17 17:36:35 +08:00
Owen Mansel-Chan
b9bc1f978c
Update style of inline expectation comments
2021-06-17 10:04:15 +01:00
Chris Smowton
558813acf7
Inline expectation tests: accept // $MISSING: and // $SPURIOUS:
...
Previously there had to be a space after the $ token, unlike ordinary expectations (i.e., // $xss was already accepted)
2021-06-17 09:44:39 +01:00
Owen Mansel-Chan
0987425f94
Reinstate failing tests with MISSING: prefix
2021-06-17 09:36:51 +01:00
haby0
3dd851fffb
expected
2021-06-17 15:20:03 +08:00
Owen Mansel-Chan
5f82993b0b
Put parameters with inline expectation comments on their own lines
2021-06-17 06:41:01 +01:00
Tony Torralba
47fffb04a6
Merge branch 'main' into atorralba/promote-ognl-injection
2021-06-16 15:46:33 +02:00
Tony Torralba
91ba30a781
Merge branch 'main' into atorralba/promote-missing-jwt-signature-check
2021-06-16 15:46:14 +02:00
Tony Torralba
dab33b21fb
Merge branch 'main' into atorralba/promote-mvel-injection
2021-06-16 15:44:43 +02:00
Tony Torralba
bf2be6ec7c
Merge branch 'main' into atorralba/promote-jndi-injection
2021-06-16 15:34:37 +02:00
Tony Torralba
66a8f57784
Fix HttpsUrls tests affected by the new URL summary
2021-06-16 13:04:00 +02:00
Tony Torralba
66d49aa4e8
Fix InsecureBasicAuth tests affected by the new URL summary
2021-06-16 13:01:40 +02:00
Tony Torralba
af6bd0b963
Consider subtypes of ReaderSource
2021-06-16 13:01:40 +02:00
Tony Torralba
87dfc92aba
Add tests for CompilationUnit's subtypes
2021-06-16 13:01:40 +02:00
Tony Torralba
e324e4e8d1
Remove non-ascii characters added by accident
2021-06-16 13:01:40 +02:00
Tony Torralba
357b0e1a90
Fix SSRF tests affected by the new URL summary
2021-06-16 13:01:40 +02:00
Tony Torralba
f3ef93fa8a
Make sinks more specific, improve tests
2021-06-16 13:01:39 +02:00
Tony Torralba
7ff4d368be
Fix tests
2021-06-16 13:01:39 +02:00
Tony Torralba
5d56eb6ea1
Add stubs
2021-06-16 13:01:39 +02:00
Tony Torralba
7883549c25
Use InlineExpectationsTest
2021-06-16 13:01:39 +02:00
Tony Torralba
356601ce15
Moved from experimental
2021-06-16 13:01:38 +02:00
haby0
c1ada6d85b
Merge branch 'main' into java/UnsafeDeserialization
2021-06-16 16:37:03 +08:00
Tony Torralba
e2918d55b5
Move tests back from internal repo
2021-06-16 10:09:44 +02:00
Anders Schack-Mulligen
19305a217a
Merge pull request #5374 from joefarebrother/guava-base
...
Java: Model additional flow steps for the package `com.google.common.base` of the Guava framwork.
2021-06-15 10:58:48 +02:00
Joe Farebrother
36cb207600
Increase precision of tests to test value flow
2021-06-14 11:20:07 +01:00
