1587 Commits

Author	SHA1	Message	Date
Anders Schack-Mulligen	bd9e3d0fa9	Merge pull request #5751 from aschackmull/java/collection-flow ... Java: Convert all collection and array steps from taint flow to value flow.	2021-06-03 15:29:14 +02:00
Tom Hvitved	d0b6808299	Java: Move common CSV logic for sources and sinks into shared library	2021-06-03 13:54:51 +02:00
Tony Torralba	56a429a5f9	Merge branch 'main' into promote-jexl-injection	2021-06-03 11:10:56 +02:00
Tony Torralba	607dcd4a27	Don't use CSV models for private flow configs	2021-06-03 11:05:13 +02:00
Tony Torralba	00836c4bac	Fix QLDocs	2021-06-03 10:52:52 +02:00
Tony Torralba	2833f8daa4	Change predicate isUnsafeEngine -> isSafeEngine to improve performance	2021-06-03 10:42:41 +02:00
Tony Torralba	9cb0e3371c	Bidirectional import in ExternalFlow.qll	2021-06-03 10:22:42 +02:00
Tony Torralba	56d6fc951c	Fixed some QLDoc	2021-06-03 10:22:15 +02:00
Tom Hvitved	daf2cc3d53	Java: Improve performance of isUnreachableInCall()	2021-06-02 20:39:05 +02:00
Anders Schack-Mulligen	8a20395857	Merge pull request #5940 from pwntester/main ... Remove XSS sink for Java	2021-06-02 12:30:20 +02:00
Anders Schack-Mulligen	c0e562de21	Merge pull request #5979 from hvitved/java/shared-external-summaries ... Java: Move some CSV flow summary code into shared library	2021-06-02 12:28:45 +02:00
Tony Torralba	b30c92e69e	Refactored into MvelInjection.qll using CSV models	2021-06-02 11:33:01 +02:00
Alvaro Muñoz	9aba92397d	lift XssSink check to InformationLeakSink	2021-06-01 17:16:41 +02:00
Anders Schack-Mulligen	650c4f19d2	Java: More qldoc.	2021-06-01 16:09:17 +02:00
Tom Hvitved	14f9a5c280	Java: Move some CSV flow summary code into shared library	2021-06-01 13:22:14 +02:00
Anders Schack-Mulligen	fc913e744e	Java: Minor model fix.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	a40880af70	Java: Add read-as-taint and config-dependent store-as-taint.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	2f087e17cb	Java: Allow <> in types for now.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	3f538e7fac	Java: Update some models.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	9e313d0cf6	Java: Remove container taint steps.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	3b6cef4f74	Java: Add container flow models.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	ffd52bb673	Java: Fix bug in matching generic signatures.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	1001dd84e6	Java: Switch array steps and one containerstep.	2021-06-01 11:47:52 +02:00
Anders Schack-Mulligen	ce509eb7e1	Merge pull request #5927 from aschackmull/dataflow/flowthrough-dispatch-perf ... Dataflow: Improve performance in flow-through pruning	2021-06-01 11:46:22 +02:00
Anders Schack-Mulligen	5d21c64247	Dataflow: qldoc fix.	2021-06-01 10:49:47 +02:00
Anders Schack-Mulligen	4f9a6c151b	Dataflow: Code review fixes.	2021-06-01 10:29:17 +02:00
Anders Schack-Mulligen	683f853fa5	Dataflow: Fix another bad join order.	2021-05-31 15:14:13 +02:00
Alvaro Muñoz	41d034d5a0	Attempt to use information-leak sink category	2021-05-30 00:22:40 +02:00
Alvaro Muñoz	706874491b	Remove XSS sink for Java	2021-05-28 15:13:18 +02:00
Erik Krogh Kristensen	79989cc3f4	CPP/Java: Fix getAPrimaryQlClass implementations	2021-05-27 21:36:27 +02:00
Anders Schack-Mulligen	d05f524759	Merge pull request #5941 from aschackmull/java/virt-disp-perf ... Java: Improve performance of virtual dispatch calculation.	2021-05-25 14:44:51 +02:00
Anders Schack-Mulligen	4884da363f	Java: Bugfix.	2021-05-25 11:48:35 +02:00
Anders Schack-Mulligen	017bf68906	Dataflow: Fix bad join order.	2021-05-25 11:40:53 +02:00
Tony Torralba	7dbdba28cc	Consider search methods with unsafe SearchControls	2021-05-21 15:21:04 +02:00
Anders Schack-Mulligen	d00618f4f4	Java: Improve performance of virtual dispatch calculation.	2021-05-21 15:04:08 +02:00
Sebastian Bauersfeld	28f597440f	Add method invocations of Spring's SavedRequest as a remote sources.	2021-05-20 20:00:14 +07:00
Tony Torralba	0589dd7e54	Move Jndi.qll from experimental	2021-05-20 12:30:28 +02:00
Tony Torralba	3f0b803796	Refactored to use CSV sink models	2021-05-20 12:00:05 +02:00
Anders Schack-Mulligen	4406b8e339	Dataflow: Sync.	2021-05-19 19:22:36 +02:00
Anders Schack-Mulligen	bb258813a1	Dataflow: Improve performance for dispatch-join in flow-through.	2021-05-19 19:20:57 +02:00
Tony Torralba	1351516e9a	Moved JNDI injection related files from experimental to standard	2021-05-19 11:32:51 +02:00
Tony Torralba	43d4575359	Add createParser as taint preserving callable	2021-05-19 11:20:54 +02:00
Tony Torralba	e58746508d	Merge branch 'main' into atorralba/promote-ognl-injection	2021-05-19 10:41:08 +02:00
Anders Schack-Mulligen	9b0e3b1950	Merge pull request #5814 from JLLeitschuh/feat/JLL/jackson_as_taint_step ... [Java] Add taint tracking through Jackson deserialization	2021-05-18 09:31:16 +02:00
Tony Torralba	1815656a02	Use set literals for OGNL packages	2021-05-17 16:56:37 +02:00
Tony Torralba	8d682000b4	Fix QLDocs	2021-05-17 16:53:30 +02:00
Tony Torralba	cfb38c43b3	QLDocs	2021-05-17 15:04:50 +02:00
Tony Torralba	897cd5384f	Created JWT.qll and refactored to use CSV models	2021-05-17 14:44:33 +02:00
haby0	689c28a178	modified JsonIoSafeOptionalArgs	2021-05-17 19:00:59 +08:00
Anders Schack-Mulligen	77c93dcf26	Make private	2021-05-17 10:35:04 +02:00