Joe Farebrother
036e83a247
Fix error with implementing interfaces
2021-07-15 10:49:13 +01:00
Joe Farebrother
06d6ddc1b9
Fix issue with reporting javac output
2021-07-15 10:49:13 +01:00
Joe Farebrother
8f40a6e21e
Use shlex for printing commands
2021-07-15 10:49:13 +01:00
Joe Farebrother
c850c7d079
Fix typo in comment
2021-07-15 10:49:13 +01:00
Joe Farebrother
b562bdd14f
Simplify the python script
2021-07-15 10:49:12 +01:00
Joe Farebrother
f35320e85b
Add explanatory comments + minor fixes
2021-07-15 10:49:12 +01:00
Joe Farebrother
cce6217e17
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-07-15 10:49:12 +01:00
Joe Farebrother
471c140d2c
Fix incorrect comment
2021-07-15 10:49:12 +01:00
Joe Farebrother
cffaa8d9a0
Improve the stubbing query to handle more language constructs correctly
2021-07-15 10:49:12 +01:00
Joe Farebrother
40bb19e4f1
Add Java stubbing script
2021-07-15 10:49:12 +01:00
Anders Schack-Mulligen
d34e748c83
Merge pull request #6290 from aschackmull/java/query-metadata3
...
Java: Add metadata.
2021-07-15 09:59:45 +02:00
Anders Schack-Mulligen
60b3dbd217
Java: Add metadata.
2021-07-15 09:16:56 +02:00
Chris Smowton
0b2750828e
Add models for org.springframework.jdbc.object
...
Also add tests for the existing Spring JDBC SQL injection sinks in the process
2021-07-14 17:25:00 +01:00
Anders Schack-Mulligen
a0481bda91
Merge pull request #6282 from aschackmull/java/query-metadata2
...
Java: Add missing metadata.
2021-07-14 15:17:27 +02:00
Anders Schack-Mulligen
11fc23ba09
Merge pull request #6030 from smowton/smowton/admin/test-generator
...
Add test-generator script + add generated models for Spring summary steps
2021-07-14 14:44:07 +02:00
Anders Schack-Mulligen
9034b03c7b
Java: Add missing metadata.
2021-07-14 14:40:50 +02:00
Sauyon Lee
d7bfc2eebf
Remove redundant model lines
2021-07-14 05:05:17 -07:00
Sauyon Lee
fc7e062deb
Java: Add models for the Spring cache package
2021-07-14 04:57:56 -07:00
Sauyon Lee
d9fb09d132
Java: Add models for the Spring ui package.
2021-07-14 04:57:56 -07:00
Anders Schack-Mulligen
04244b3c45
Merge pull request #5974 from github/sauyon/java/spring-webmultipart
...
Model Spring `web.multipart`
2021-07-14 13:57:24 +02:00
Anders Schack-Mulligen
3c4cd15738
Merge pull request #5505 from joefarebrother/android-sql-convert
...
Java: Convert Android SQL-related flow steps to CSV format
2021-07-14 13:56:55 +02:00
Chris Smowton
e9390cb3eb
Remove superfluous conjunct
2021-07-14 12:42:28 +01:00
Chris Smowton
3ae99b93ca
Merge pull request #6215 from aschackmull/java/fix-csv-subtype-interpretation
...
Java: Fix CSV subtype interpretation
2021-07-14 09:57:21 +01:00
Sauyon Lee
b807757863
Model Spring web.multipart
2021-07-13 10:29:01 -07:00
Chris Smowton
1044049e72
Simplify getInput
2021-07-13 16:36:26 +01:00
Chris Smowton
98b85a481c
Improve inline-expectation style
2021-07-13 16:36:08 +01:00
Chris Smowton
a11021991a
Improve method documentation
2021-07-13 16:35:44 +01:00
Chris Smowton
b5492056d8
Remove superfluous parens
2021-07-13 16:35:22 +01:00
Chris Smowton
97694bc9a1
Report error even if interpretElement resolves to a non-Callable Element
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-07-13 16:16:01 +01:00
Tom Hvitved
7e9d87055d
Data flow: Sync
2021-07-13 16:15:00 +02:00
Anders Schack-Mulligen
0f6f020766
Java: Fix models.
2021-07-13 15:23:19 +02:00
Tom Hvitved
47d126e681
Data flow: Sync
2021-07-12 12:09:51 +02:00
Joe Farebrother
4d459f24d9
Fix up tests and update models
2021-07-02 14:46:33 +01:00
Joe Farebrother
fc017b7934
Use ArrayElement of in flow step specifications
2021-07-02 14:46:31 +01:00
Joe Farebrother
15415931ce
Use Argument ranges in CSV rows
2021-07-02 14:46:03 +01:00
Joe Farebrother
5325622813
Convert sql-related flow steps to CSV
2021-07-02 14:46:03 +01:00
Anders Schack-Mulligen
3c6604daa7
Java: Fix subtypes interpretation.
2021-07-02 14:43:56 +02:00
Anders Schack-Mulligen
55ebbc3e01
Java: Add signature to Map.put.
2021-07-02 14:41:32 +02:00
Chris Smowton
a51154a8ef
Deduplicate Jexl configuration
2021-07-02 10:02:28 +01:00
Chris Smowton
bbd3ecb768
Add docs to RandomQuery.qll
2021-07-02 10:02:28 +01:00
Chris Smowton
e661fc08d3
Split Android XSS sink defintions out of XSS.qll
...
This removes one of the routes by which XSS.qll is always in scope, and so its dataflow configuration is too -- however it is still always in scope because JaxWS.qll imports it.
2021-07-02 10:02:25 +01:00
Chris Smowton
747a8e4157
Split up JexlInjection.qll
...
This avoids a DataFlow2::Configuration being in scope for all queries via the import from ExternalFlow.qll
2021-07-02 10:01:51 +01:00
Chris Smowton
643f7dfb87
Split up Random.qll
...
This prevents bringing a dataflow config into scope from utility libraries.
2021-07-02 10:00:49 +01:00
Anders Schack-Mulligen
80124df78e
Merge pull request #5487 from joefarebrother/sql-sinks
...
Java: Convert SQL sinks to CSV format
2021-07-02 10:51:09 +02:00
Anders Schack-Mulligen
4e1155cfd2
Merge pull request #6202 from smowton/smowton/admin/cleanup-duplicated-experimental-query
...
Deduplicate shared body of regular and experimental versions of `java/command-line-injection` query.
2021-07-02 09:23:50 +02:00
Anders Schack-Mulligen
f9da044e54
Merge pull request #6185 from aschackmull/java/perf-fix-request-forgery
...
Java: Fix bad magic.
2021-07-02 09:07:07 +02:00
Chris Smowton
8b7db8a8cc
Merge pull request #5408 from p0wn4j/urlclassloader-webclient-ssrf-sinks
...
Java: Add URLClassLoader, WebClient SSRF sinks
2021-07-01 16:14:22 +01:00
Chris Smowton
d5a9f3d87b
Deduplicate shared body of regular and experimental versions of java/command-line-injection query.
2021-07-01 14:53:56 +01:00
Joe Farebrother
160f3b4312
Remove ArrayElement from sink specifications
2021-07-01 14:41:39 +01:00
Joe Farebrother
1a06c132be
Use ArrayElement of to handle arargs case in SpringJdbc.qll
2021-07-01 14:38:20 +01:00
