Anders Schack-Mulligen
12d6875cc4
Java: Replace the MaD Object.clone() models with a non-aliasing value step.
2024-07-16 11:11:50 +02:00
Jami
b70a4c839c
Merge branch 'main' into jcogs33/add-toByteArray-summaries
2024-07-15 12:35:05 -04:00
Jami Cogswell
cd82ada239
Java: add manual models for all overloads of IOUtils.toByteArray
2024-07-15 12:12:31 -04:00
am0o0
1d1c476674
update tests and use TaintFlowTestArgString
...
add stubs
add missed sink models
2024-07-13 16:58:51 +02:00
Jami Cogswell
77a8ba934c
Java: add path-injection sink for hudson.FilePath.exists()
2024-07-11 15:03:40 -04:00
Jami Cogswell
4a1497f367
Java: add IOUtils.toByteArray(InputStream) summary
2024-07-11 13:33:08 -04:00
am0o0
7e5f2e2a48
experimentalSinkModel to sinkModel, remove one path injection sink that already exist before
2024-07-03 08:55:12 +02:00
Jami
901245ae3d
Merge branch 'main' into jcogs33/unsafe-url-forward-promotion-resource-and-file-methods
2024-06-26 21:57:07 -04:00
Mauro Baluda
29e3816412
Apply suggestions from code review
...
Address reviewiew comments
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-06-11 12:05:14 +02:00
Mauro Baluda
1d44f45be2
Update org.apache.commons.io.model.yml
2024-06-10 12:03:57 +02:00
Mauro Baluda
71505f4003
Added more org.apache.commons.io.FileUtils-related sinks to the path injection query.
2024-06-10 11:29:51 +02:00
am0o0
412472e9a4
add zip4j
2024-06-08 01:14:04 +02:00
am0o0
ceea475c45
add new s3 and spring IO path injection sinks
2024-06-08 01:04:20 +02:00
Tony Torralba
f16dd8c010
Apply code review suggestions.
2024-06-04 10:35:11 +02:00
Tony Torralba
f84c2a842d
Java: Add more File-related sinks for path-injection
2024-06-04 10:35:07 +02:00
Anders Schack-Mulligen
ba97c3623a
Java: Change most java.time.* df-generated taint models to neutrals.
2024-05-22 10:29:54 +02:00
Anders Schack-Mulligen
54f2316d00
Java: Add a neutral model.
2024-05-22 10:29:49 +02:00
Owen Mansel-Chan
83249cd9c2
Fix grammar in comment
2024-05-02 09:59:48 +01:00
Owen Mansel-Chan
16dcc0969b
Standardise comment explaining why extensible predicates must be defined
2024-05-01 22:00:01 +01:00
Owen Mansel-Chan
09e59ccf44
Name files with empty definitions of MaD extensible predicates to erowdmpty.model.yml
2024-05-01 21:39:38 +01:00
Owen Mansel-Chan
ae8240a695
Delete models for JDK internal packages
2024-04-09 13:23:03 +01:00
Jami
5792f7b770
Merge branch 'main' into jcogs33/unsafe-url-forward-promotion-resource-and-file-methods
2024-04-08 10:26:42 -04:00
Owen Mansel-Chan
e10333bf2b
Merge pull request #14919 from github/java/jdk-model-autogeneration
...
Java: add dataflow-generated models for JDK17
2024-04-04 21:12:55 +01:00
Owen Mansel-Chan
919436efbb
Remove df-gen models we have deliberately modeled
...
Manual models always take precedence over generated models, so there is
no point in keeping the generated models.
These manual models were deliberately written to take precedence over
the corresponding df-gen models.
2024-04-01 13:59:36 +01:00
Jami
d889e3cf98
Merge pull request #14854 from jcogs33/jcogs33/unsafe-url-forward-promotion
...
Java: Promote Unsafe URL Forward query from experimental
2024-03-29 16:34:06 -04:00
Jami Cogswell
b35f318910
Java: update models
2024-03-27 20:39:34 -04:00
Owen Mansel-Chan
311512c768
Remove df-gen models for incidentally modelled APIs
...
Manual models always take precedence over generated models, so there is
no point in keeping the generated models.
These APIs happened to have been modelled between model generation and
merging this PR.
2024-03-27 12:15:08 +00:00
Owen Mansel-Chan
f03a56f7e0
Run generation script
...
The command line was:
python3 /Users/owen-mc/workspace/codeql-home/codeql/java/ql/src/utils/modelgenerator/GenerateFlowModel.py /Users/owen-mc/db/java/openjdk17 --with-summaries --with-neutrals
2024-03-27 12:15:00 +00:00
Tony Torralba
7a0446740b
Update java/ql/lib/ext/java.net.model.yml
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2024-03-27 09:09:48 +01:00
Tony Torralba
d786ea90a4
Java: Add more neutrals
...
Adds more neutral models to help the model generator ignore certain callables.
Also improves the precision of certain URL models by using synthetic fields so that the parts of a URL are tainted separately.
2024-03-26 17:31:11 +01:00
Owen Mansel-Chan
b8608a1b1c
Merge pull request #15946 from owen-mc/java/more-manual-models
...
Java: more manual models
2024-03-19 15:00:27 +00:00
Owen Mansel-Chan
7371f5e508
Provenance should be "df-manual"
2024-03-19 13:33:49 +00:00
Owen Mansel-Chan
764e99bda7
Fix model for java.util.Scanner#findall(String)
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2024-03-18 16:56:20 +00:00
Owen Mansel-Chan
7fb05f4a76
Fix duplicate "df-" in "df-df-manual"
2024-03-18 11:17:55 +00:00
Jami Cogswell
658fffeac1
Java: remove experimental files
2024-03-17 22:03:59 -04:00
Owen Mansel-Chan
754d4cd959
Fix model provenance to df-manual
2024-03-17 14:36:47 +00:00
Owen Mansel-Chan
23a58a0835
Add df-manual models related to existing df-manual models
2024-03-17 14:21:05 +00:00
Owen Mansel-Chan
fc367042ef
Fix df-manual model with wrong parameter type
2024-03-17 14:21:01 +00:00
Owen Mansel-Chan
8e52483beb
Add df-manual models in manually modeled classes
2024-03-15 10:10:23 +00:00
Owen Mansel-Chan
2bd08838d4
Add manual neutral models for java.lang.ClassLoader
2024-03-14 11:40:06 +00:00
Owen Mansel-Chan
5b734c76b6
Add manual neutral models for java.util.Locale and its subclasses
2024-03-14 11:39:59 +00:00
Tony Torralba
eecab9122a
Recognize the model generator involvement in the models' provenances
2024-03-14 08:56:23 +01:00
Tony Torralba
5b88b8a3ed
A few more neutrals
2024-03-14 08:53:58 +01:00
Tony Torralba
36f6a6fb10
Model more EnumSet methods as neutrals
2024-03-14 08:46:43 +01:00
Jami Cogswell
e285cf232c
Java: add resource-related methods as path-injection sinks and as summaries
2024-03-13 22:48:57 -04:00
Jami Cogswell
f573032b2e
Java: remove todo comments from ext files
2024-03-13 16:28:43 -04:00
Jami Cogswell
1da1e896cb
Java: convert SpringModelAndViewSink to MaD
2024-03-13 16:28:41 -04:00
Jami Cogswell
8d66097483
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
2024-03-13 16:28:41 -04:00
Jami Cogswell
42e3825ea3
Java: convert RequestDispatcherSink to MaD
2024-03-13 16:28:40 -04:00
Jami Cogswell
2a682995ae
Java: move MaD models to correct files, delete ones that already exist
2024-03-13 16:28:40 -04:00
