7 Commits

Author	SHA1	Message	Date
MarkLee131	b49c6dcbd4	Add @Pattern annotation test case and javax-validation-constraints stub ... Adds a dedicated test verifying that fields annotated with @javax.validation.constraints.Pattern are recognized as sanitized by RegexpCheckBarrier, in addition to the existing String.matches() guard test.	2026-04-04 22:04:05 +08:00
Kaixuan Li	258a53e146	Update java/ql/test/query-tests/security/CWE-501/TrustBoundaryViolations.java ... Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>	2026-04-04 22:02:00 +08:00
MarkLee131	345b842edc	Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers ... The trust-boundary-violation query only recognized OWASP ESAPI validators as sanitizers. ESAPI is rarely used in modern Java projects, while regex validation via String.matches() and @javax.validation.constraints.Pattern is the standard approach in Spring/Jakarta applications. RegexpCheckBarrier already exists in Sanitizers.qll and is used by other queries (e.g., RequestForgery). This wires it into TrustBoundaryConfig, so patterns like input.matches("[a-zA-Z0-9]+") and @Pattern annotations are recognized as sanitizers, consistent with the existing ESAPI treatment.	2026-04-04 21:36:37 +08:00
Nora Dimitrijević	94386f0550	[TEST] Java: TrustBoundaryViolations: convert test to qlref	2025-07-17 18:58:59 +02:00
Edward Minnix III	929090a847	Typos and style fixes ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-08-17 13:05:37 -04:00
Ed Minnix	55fae2daaa	Added ESAPI sanitizer	2023-08-17 13:05:37 -04:00
Ed Minnix	f58590c6a9	Trust Boundary Work	2023-08-17 13:05:37 -04:00