Chris Smowton
f9f143d62c
Merge pull request #5347 from Marcono1234/marcono1234/simplify-tests
...
Java: Simplify tests using InlineExpectationsTest
2021-03-08 14:47:28 +00:00
Anders Schack-Mulligen
e63f81171c
Merge pull request #5349 from p0wn4j/fix-nashorn-engine-1
...
Java: Fix NashornScriptEngine detection in ScriptEngine query
2021-03-08 13:23:36 +01:00
Chris Smowton
6cf15f49bb
Replace hasTaintFlow=y with hasTaintFlow everywhere
2021-03-08 11:57:35 +00:00
Marcono1234
b7353f0bb0
Java: Simplify tests using InlineExpectationsTest
2021-03-08 11:49:52 +00:00
Rasmus Lerchedahl Petersen
cc9a938054
InlineExpectationTest: clarify the nedd for an
...
empty `.expected` file
2021-03-08 09:18:47 +01:00
p0wn4j
6841f5f7c4
Java: Add NashornScriptEngine detection in ScriptEngine query
...
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
2021-03-06 16:19:07 +04:00
Anders Schack-Mulligen
cf4f55d9ab
Merge pull request #5223 from smowton/smowton/feature/backward-dataflow-for-modelled-fluent-methods
...
Java: Add backward dataflow edges through modelled function invocations
2021-03-05 15:11:43 +01:00
Chris Smowton
012058a866
Apply review suggestions: use ArgumentNode.argumentOf, and change more uses of ValuePreservingCallable -> ValuePreservingMethod
2021-03-05 13:34:13 +00:00
Chris Smowton
990bdc20b0
Move value-preserving callable class into FlowSteps
2021-03-05 11:55:53 +00:00
Anders Schack-Mulligen
0d7f6ced8f
Merge pull request #5334 from Marcono1234/marcono1234/improve-constant-loop-condition
...
Java: Improve constant-loop-condition
2021-03-05 11:36:25 +01:00
Anders Schack-Mulligen
00983c8967
Merge pull request #4965 from artem-smotrakov/jexl-injection
...
Java: Query for detecting JEXL injections
2021-03-05 10:52:36 +01:00
Anders Schack-Mulligen
20ccb52912
Merge pull request #4299 from torque59/play-framework
...
Initial support for Java - Play Framework > 2.6.x
2021-03-05 10:51:53 +01:00
Anders Schack-Mulligen
3565ba51b3
Merge pull request #5209 from smowton/smowton/feature/commons-misc-text
...
Java: add models for miscellaneous text-processing utilities from Commons Lang
2021-03-05 10:21:58 +01:00
Francis Alexander
a35f6d030c
Test fixes and change notes
2021-03-05 06:50:57 +05:30
Marcono1234
e9e9634306
Java: Improve constant-loop-condition
2021-03-04 23:33:29 +01:00
Artem Smotrakov
0695b2a1fb
Removed TaintedSpringRequestBody
2021-03-04 20:27:39 +01:00
CodeQL CI
ad4b9372bd
Merge pull request #5302 from RasmusWL/expectation-tests-allow-str-prefix
...
Approved by MathiasVP, tausbn
2021-03-04 06:48:57 -08:00
Chris Smowton
40b0f68d2a
Add backward dataflow edges through modelled function invocations.
...
Also add convenience abstract classes for easily modelling new functions as fluent or value-preserving.
2021-03-04 11:45:19 +00:00
Chris Smowton
b0ba0585a7
Add models for Apache Commons Lang and Text's Str[ing]Substitutor
2021-03-04 11:11:55 +00:00
Chris Smowton
f749c31136
Add models for commons lang/text's Str[ing]Lookup class
2021-03-04 11:11:55 +00:00
Chris Smowton
1580d23b2b
Add models for WordUtils and StrTokenizer
...
Both of these have commons-text and commons-lang variants.
2021-03-04 11:11:55 +00:00
Anders Schack-Mulligen
fe07630e40
Merge pull request #5219 from smowton/smowton/feature/backward-dataflow-for-fluent-methods
...
Java: Add backward dataflow edges through fluent function invocations.
2021-03-04 11:13:32 +01:00
Anders Schack-Mulligen
3400c121d6
Merge pull request #5202 from joefarebrother/apache-http
...
Java: Add modelling for Apache HTTP Components
2021-03-03 13:41:41 +01:00
Joe Farebrother
81ff76814f
Remove incorrect expectaton
2021-03-02 16:35:34 +00:00
Francis Alexander
173c4b7f2f
More Play stubs improvements
2021-03-02 20:39:25 +05:30
Francis Alexander
4384f78595
Play stubs improvements, cleanup and return values
2021-03-02 16:50:16 +05:30
Rasmus Wriedt Larsen
0874712c97
C++/Java/Python: Allow Python string prefix in InlineExpectationsTest
...
I've been writing tests for crypto libraries in Python, and have wanted to write
code along the lines of
```py
md5.hash(b"some message") # $ HashInput=b"some message"
```
which didn't work before this commit, forcing me to store my text in a variable
like below. This turned out to be really annoying when dealing with more complex
examples, so therefore I'm adding this new functionality to allow this behavior.
```py
msg = b"some message"
md5.hash(msg) # $ HashInput=msg
```
2021-03-01 13:44:28 +01:00
Chris Smowton
aab9deceef
Remove package from test Java file
2021-03-01 10:32:44 +00:00
Chris Smowton
54caf501e7
Switch fluent-methods test to use a plain DataFlow::Configuration
...
No taint edges are involved, so TaintTracking was unnecessary.
2021-03-01 10:16:02 +00:00
Chris Smowton
fadbb32bd6
Add backward dataflow edges through fluent function invocations.
...
This means that much as obj.getA().setB(...) already has a side-effect on `obj`, all three setters in obj.setA(...).setB(...).setC(...) will have a side-effect on `obj`.
2021-03-01 10:11:28 +00:00
Tamás Vajk
505d04b13e
Merge pull request #5102 from luchua-bc/java/main-method-in-servlet
...
Java: CWE-489 Query to detect main() method in servlets
2021-02-25 16:05:06 +01:00
Anders Schack-Mulligen
f0d3841369
Merge pull request #5105 from JLLeitschuh/feat/JLL/depricated_bintray_usage
...
CWE-1104: Maven POM dependence upon Bintray/JCenter
2021-02-25 09:08:31 +01:00
Artem Smotrakov
34b6ed0a05
Removed commented code from JexlUberspect
2021-02-24 22:31:03 +01:00
Anders Schack-Mulligen
add960bc4d
Merge pull request #4880 from luchua-bc/java/sensitive-query-with-get
...
Java: Sensitive GET Query
2021-02-24 11:08:47 +01:00
yo-h
1d654febfd
Merge pull request #5195 from aschackmull/java/cwe-548-test
...
Java: Add empty file to test.
2021-02-23 21:12:40 -05:00
Joe Farebrother
e13c779f0f
Add additional unit tests
2021-02-23 16:17:13 +00:00
Joe Farebrother
a3b8d4ab2d
Switch to inline test expectations; fix failing test outputs
2021-02-23 14:26:12 +00:00
Joe Farebrother
7b5961769a
Add unit tests for version 5.x
2021-02-23 14:26:12 +00:00
Joe Farebrother
cf58a90d74
Add unit tests for utility methods
2021-02-23 14:26:12 +00:00
Joe Farebrother
5bba7f6df7
Add unit tests
2021-02-23 14:26:11 +00:00
Anders Schack-Mulligen
b1bed2731d
Merge pull request #5172 from smowton/smowton/feature/commons-strbuilder
...
Java: Add support for commons-lang's StrBuilder class
2021-02-23 14:39:11 +01:00
yo-h
6213c20bc3
Merge pull request #5136 from aschackmull/java/csv-models
...
Java: Add support for framework modelling through csv data.
2021-02-22 19:00:41 -05:00
Jonathan Leitschuh
ad99aa2d76
Fix typo in test output
2021-02-22 13:26:51 -05:00
luchua-bc
40df01d2cd
Update qldoc and method name
2021-02-22 14:15:41 +00:00
Artem Smotrakov
43a07bb13a
Better sink in SandboxedJexlFlowConfig
2021-02-20 11:17:51 +01:00
luchua-bc
3d9ac0d094
Add query for enterprise beans
2021-02-20 02:00:42 +00:00
Chris Smowton
321df82851
Apply review feedback: comment style, bracketing, and use proper MISSING test annotations
2021-02-18 14:56:52 +00:00
Anders Schack-Mulligen
954e0b9496
Java: Add empty file to test.
2021-02-18 13:10:29 +01:00
Anders Schack-Mulligen
6f583baa90
Java: More documentation and support for field writes.
2021-02-18 11:18:31 +01:00
Anders Schack-Mulligen
862c41632e
Java: Add empty file to test.
2021-02-17 13:23:18 +01:00
