Tony Torralba
6fcaae20e7
Add tests and fix bugs highlighted by them
2022-10-04 12:27:01 +02:00
Tony Torralba
f19eb783be
Generalize file/path taint steps
...
This is needed by PathSanitizer but also helps simplify ZipSlip.ql
2022-10-04 12:27:01 +02:00
Tony Torralba
4e29c39c78
Merge ZipSlip sanitization logic into PathSanitizer.qll
...
Apply code review suggestions regarding weak sanitizers
2022-10-04 12:27:01 +02:00
Tony Torralba
5706e8b377
Improve PathSanitizer
...
Rename PathTraversalSanitizer to PathInjectionSanitizer
2022-10-04 12:26:17 +02:00
Tony Torralba
50ad234694
Move PathSanitizer to the main library
2022-10-04 12:26:17 +02:00
Tony Torralba
d5478a01ab
Merge pull request #10671 from github/revert-10640-atorralba/fix-cartesian-product
...
Java: Revert #10489 and #10640
2022-10-04 12:25:46 +02:00
Tony Torralba
281e49daf7
Revert "Java: Add CompilationUnit.getATypeAvailableBySimpleName()"
...
This reverts commit 431aa2cb79
2022-10-04 10:59:45 +02:00
Tony Torralba
01b950f68b
Revert "Java: Rename predicate to getATypeInScope"
...
This reverts commit fd99ae78b3
2022-10-04 10:59:43 +02:00
Edward Minnix III
cfc0bb595f
Documentation fix for hasIncompletePermissions
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-10-03 11:20:15 -04:00
Chris Smowton
5e2c607650
PrintAst: reliably sort function overloads
2022-10-03 15:28:55 +01:00
Chris Smowton
d3d3ce843a
Kotlin: Implement JvmOverloads annotation
...
This generates functions that omit parameters with default values, rightmost first, such that Java can achieve a similar experience to Kotlin (which represents calls internally as if the default was supplied explicitly, and/or uses a $default method that supplies the needed arguments).
A complication: combining JvmOverloads with JvmStatic means that both the companion object and the surrounding class get overloads.
2022-10-03 15:28:55 +01:00
Ed Minnix
e72963986f
Moved Android manifest incomplete permission logic into library
2022-09-29 14:06:18 -04:00
Anders Schack-Mulligen
b48b5d45ef
Merge pull request #10498 from Marcono1234/marcono1234/compilation-unit-simple-name-type
...
Java: Add `CompilationUnit.getATypeInScope()`
2022-09-28 13:18:29 +02:00
Joe Farebrother
6cb26d5129
Merge pull request #10241 from joefarebrother/android-webview-dubugging
...
Java: Add query for WebView debugging enabled
2022-09-28 10:50:51 +01:00
Tom Hvitved
df2b586e7c
Merge pull request #10577 from hvitved/dataflow/get-a-read-content-fan-in
...
Data flow: Fix bad join-order when getAReadContent has large fan-in
2022-09-27 20:04:58 +02:00
Jami
56e3334c6d
Merge pull request #10479 from jcogs33/android-service-sources
...
Java: add Android service sources
2022-09-27 12:40:18 -04:00
Jami Cogswell
7e0c61de2c
switch to hasName
2022-09-27 10:45:52 -04:00
Tom Hvitved
335e1a8233
Address review comments
2022-09-27 13:36:52 +02:00
erik-krogh
7675571daa
fix RegExpEscape::getValue having multiple results for some escapes
2022-09-27 13:25:23 +02:00
Tom Hvitved
45fc62f16b
Data flow: Sync files
2022-09-26 20:39:48 +02:00
Anders Schack-Mulligen
1687d08587
Dataflow: Sync.
2022-09-26 16:10:03 +02:00
Anders Schack-Mulligen
17dba00264
Dataflow: Minor visibility cleanup.
2022-09-26 16:09:42 +02:00
Marcono1234
fd99ae78b3
Java: Rename predicate to getATypeInScope
2022-09-25 14:44:16 +02:00
Jami Cogswell
65f3ae9829
clean up files
2022-09-23 18:59:27 -04:00
Jami Cogswell
7e13610d24
minor qldoc update
2022-09-23 18:59:27 -04:00
Jami Cogswell
24b34cd32f
add a few more tests, and some clean-up
2022-09-23 18:59:27 -04:00
Jami Cogswell
decba39c09
add service flow sources
2022-09-23 18:59:27 -04:00
Anders Schack-Mulligen
dcc3f9e0a2
Java: Improve performance of StaticInitializationVector.
2022-09-23 14:39:32 +02:00
Tom Hvitved
8b424d181a
Merge pull request #10505 from hvitved/dataflow/viable-impl-in-ctx-consistency
...
Data flow: Guard against `viableImplInCallContext` not being a subset of `viableCallable`
2022-09-23 10:38:48 +02:00
Tom Hvitved
ad6b870f94
Data flow: Sync files
2022-09-22 15:01:33 +02:00
Erik Krogh Kristensen
6e6880bbe4
Merge pull request #10486 from erik-krogh/java-unqueryable
...
Java: Delete some unused code
2022-09-22 14:21:39 +02:00
erik-krogh
a8929b6400
deprecate RegExpFlags::getFlags instead of deleting it
2022-09-22 13:43:42 +02:00
erik-krogh
b61bd56d70
un-deprecate guardControls_v2
2022-09-22 13:42:50 +02:00
Tom Hvitved
f0f4fe7286
Merge pull request #10444 from hvitved/ruby/stmt-sequence-post-update
...
Ruby: Add post-update nodes for compound arguments
2022-09-22 13:18:51 +02:00
Joe Farebrother
eb3655da1c
Remove type check from the barrier predicate
2022-09-21 13:57:32 +01:00
Joe Farebrother
a6a500ade2
Apply suggestions from code review - doc improvements, simplification
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-21 13:57:31 +01:00
Joe Farebrother
eed2df0fb3
Fix qhelp & ql-for-ql errors
2022-09-21 13:57:30 +01:00
Joe Farebrother
f934554143
Add docs + add an additional case
2022-09-21 13:57:29 +01:00
Joe Farebrother
20b2956322
Add webview debugging query
2022-09-21 13:57:28 +01:00
Tamás Vajk
82c3e53694
Merge pull request #10473 from tamasvajk/kotlin-suspend
...
Kotlin: Extract `suspend` functions
2022-09-21 14:22:44 +02:00
Tom Hvitved
db8b6ac69a
Data flow: Sync files
2022-09-21 11:02:24 +02:00
Marcono1234
431aa2cb79
Java: Add CompilationUnit.getATypeAvailableBySimpleName()
...
This predicate is mainly helpful for Javadoc queries and for queries which
check whether the name of an element shadows another type.
2022-09-20 23:15:50 +02:00
Tony Torralba
cbb64cc8c1
Merge pull request #10352 from atorralba/atorralba/promote-template-injection
...
Java: Promote Server-side template injection from experimental
2022-09-20 16:11:58 +02:00
Chris Smowton
f826342112
Merge pull request #6246 from Marcono1234/marcono1234/annotation-improvements
...
Java: Improve and add predicates and classes for annotations
2022-09-20 11:48:29 +01:00
erik-krogh
8eefa4c1b0
deprecate internal predicate that was never used
2022-09-20 12:39:41 +02:00
erik-krogh
bec381a1dc
remove unused predicate from NfaUtilsSpecific.qll
2022-09-20 12:38:34 +02:00
Tamas Vajk
a6e44ed1cf
Kotlin: extract suspend modifier and handle suspend SAM conversions
2022-09-19 13:36:28 +02:00
Chris Smowton
3fa1f17b83
Java: really return a unique location for non-source entities
...
This was always supposed to pick one of several candidate non-source locations (usually for a generic type instantiation), but since `getFile().toString()` just produces the basename of the class file actually the results would almost always tie and all of the candidate locations would be returned. Use the full class file path as a tiebreaker instead.
2022-09-16 18:23:31 +01:00
Anders Schack-Mulligen
1945f185ed
Apply suggestions from code review
...
Autoformat
2022-09-16 15:49:16 +01:00
Marcono1234
c8b922937b
Java: Extend AnnotationType.isATargetType documentation
2022-09-16 15:49:16 +01:00
