10083 Commits

Author	SHA1	Message	Date
Tony Torralba	2dff0ce5b4	Merge pull request #13712 from pwntester/java/new_struts2_models ... [Java] New models for Struts2 framework	2023-07-28 14:31:25 +02:00
Ian Lynagh	499bd970d3	Merge pull request #13412 from igfoo/igfoo/json_escape ... Kotlin: Tweak our JSON escaping	2023-07-28 11:13:51 +01:00
Tony Torralba	9d6bc76dc0	Merge pull request #13817 from atorralba/atorralba/java/non-static-fieldvaluenode-step ... Java: Allow flow out of FieldValueNodes for non-static fields	2023-07-27 09:14:04 +02:00
Chris Smowton	c69a9ea032	Merge pull request #13793 from github/post-release-prep/codeql-cli-2.14.1 ... Post-release preparation for codeql-cli-2.14.1	2023-07-26 17:22:05 +01:00
Tony Torralba	8685242c16	Add tests	2023-07-26 14:13:43 +02:00
Stephan Brandauer	24cdc962c2	Merge pull request #13818 from github/kaeluka/fix-erroneous-endpoints-that-are-sinks-and-summary-neutrals ... Java: Automodel Fix, Prevent Some Erroneous Endpoints	2023-07-26 12:45:29 +02:00
Tony Torralba	602eb43109	Update partial flow test expectations	2023-07-26 09:32:13 +02:00
Ian Lynagh	532552a7ac	Merge pull request #13751 from igfoo/igfoo/getCompilationInfo ... Java: Improve the diagnostics consistency query	2023-07-25 16:54:17 +01:00
Stephan Brandauer	08f5774d13	Java: Automodel extraction fix for application mode	2023-07-25 17:11:07 +02:00
Stephan Brandauer	698b8d3c5c	Java: Automodel extraction fix; previously, we treated endpoints that were marked as sinks, as well as summary-neutrals as 'erroneous'	2023-07-25 16:52:27 +02:00
Tony Torralba	b8b38e4bbe	Java: Allow flow out of FieldValueNodes for non-static fields	2023-07-25 15:37:41 +02:00
Tony Torralba	c9fc5a54c7	Remove generated sinks and sources	2023-07-25 14:42:32 +02:00
Stephan Brandauer	2582b084f6	Merge pull request #13747 from github/tausbn/exclude-qualifier-argument-for-existing-models ... Java: Exclude qualifier argument for existing models	2023-07-24 16:26:33 +02:00
Stephan Brandauer	13027a1094	Java: review suggestions from @atorralba	2023-07-24 14:09:10 +02:00
Stephan Brandauer	2f2f507a5d	Java: drive-by change: remove obsolete custom queries from application mode characteristics	2023-07-24 13:55:53 +02:00
github-actions[bot]	419bbbc9ac	Add changed framework coverage reports	2023-07-24 00:17:53 +00:00
github-actions[bot]	f91b7a9342	Post-release preparation for codeql-cli-2.14.1	2023-07-21 16:16:25 +00:00
Stephan Brandauer	79da723878	Java: only assume that _manual_ MaD sinks have been fully modeled	2023-07-21 10:43:07 +02:00
Tony Torralba	3d515b18df	Merge pull request #13769 from atorralba/atorralba/java/avoid-inputstream-low-confidence-dispatch ... Java: Avoid low-confidence dispatch to InputStream methods	2023-07-21 10:42:34 +02:00
github-actions[bot]	c936a920b0	Release preparation for version 2.14.1	2023-07-20 16:32:27 +00:00
Tony Torralba	238cb26624	Add change note	2023-07-19 15:37:33 +02:00
Tony Torralba	29543f5726	Change InputStream.read from neutral to summary	2023-07-19 14:44:18 +02:00
Anders Schack-Mulligen	a9c76d4175	Merge pull request #13717 from aschackmull/dataflow/neverskipadditionalsteps ... Dataflow: Add support for not skipping configuration-specific nodes in big-step	2023-07-19 14:06:54 +02:00
Stephan Brandauer	5575fc65aa	Merge pull request #13636 from github/tausbn/add-sink-alert-metrics-query ... Java: Add metric queries for counting sinks coming from models	2023-07-19 13:12:32 +02:00
Anders Schack-Mulligen	e72a0b2f8c	Dataflow: Add change notes.	2023-07-19 11:41:15 +02:00
Anders Schack-Mulligen	ae24d68b5d	C/C++/C#/Java/Python/Ruby/Swift: Adjust expected output.	2023-07-19 11:41:15 +02:00
Anders Schack-Mulligen	95d17045c9	Dataflow: Sync.	2023-07-19 11:41:15 +02:00
Anders Schack-Mulligen	fd83b6afdb	Dataflow: Add support for not skipping configuration-specific nodes in big-step.	2023-07-19 11:41:15 +02:00
Tony Torralba	2dbbcc2413	Java: Avoid low-confidence dispatch to InputStream methods ... Also adds a neutral model for `InputStream.read`, which offers a high-confidence alternative for this method.	2023-07-19 11:30:53 +02:00
Anders Schack-Mulligen	e72366194b	Merge pull request #13754 from aschackmull/java/remotesource-inbarrier ... Java: Exclude source-to-source flow in 5 queries.	2023-07-18 10:33:44 +02:00
Ian Lynagh	8a0286ec34	Java: Improve the diagnostics consistency query ... Diagnostics can be easier to read if you see them in the order in which they were generated. By selecting the compilation and indexes, they get sorted by the testsuite driver. d.getCompilationInfo(c, f, i) would be a bit more natural as d = c.getDiagnostic(f, i), but currently we don't import Diagnostic into the default ('import java') namespace, and I don't think it's worth changing that for this.	2023-07-17 15:37:05 +01:00
Anders Schack-Mulligen	6770d2a49b	Java: Exclude source-to-source flow in 5 queries.	2023-07-17 09:06:49 +02:00
Taus	6b425f1395	Java: Revert definition of isNeutral ... Reverts the change made in daf2743143 With the change in the aforementioned commit, we were extracting candidates for endpoints that had a neutral _summary_ model. These are bad candidates, as they have already been triaged.	2023-07-14 14:45:22 +02:00
Taus	6793bc6c6b	Java: Exclude qualifier argument for existing models ... Excludes candadites for `Argument[this]` where we already have a model that covers a different argument of the containing call.	2023-07-14 14:26:21 +02:00
Taus	895e829eb1	Java: Add QLDoc for query predicates	2023-07-14 14:22:10 +02:00
Taus	c4487673e8	Java: Swap input and ext	2023-07-14 14:21:59 +02:00
Taus	9193de6898	Merge pull request #13730 from github/tausbn/limit-number-of-candidates-in-application-mode ... Java: Limit the number of samples extracted in application mode	2023-07-14 14:09:59 +02:00
Anders Schack-Mulligen	80a799df01	Merge pull request #13735 from aschackmull/dataflow/forcehighprecision-fix ... Dataflow: Fix forceHighPrecision for length-2 prefixes.	2023-07-14 11:42:35 +02:00
github-actions[bot]	b675a1e2fe	Add changed framework coverage reports	2023-07-14 00:19:14 +00:00
Tony Torralba	cafc67e3be	Merge pull request #13714 from pwntester/java/langs3_improvements ... [Java] Add missing commons lang3 model for ToStringBuilder.reflectionToString	2023-07-13 14:45:33 +02:00
Anders Schack-Mulligen	a0e96594d8	Merge pull request #13736 from aschackmull/dataflow/remove-superfluous-module-members ... C#/Java/Ruby: Remove superfluous module members.	2023-07-13 13:59:31 +02:00
Anders Schack-Mulligen	91de43f918	C#/Java/Ruby: Remove superfluous module members.	2023-07-13 11:38:35 +02:00
Stephan Brandauer	4391799b7e	Merge pull request #13403 from github/java/update-mad-decls-after-triage-2023-06-08T08-51-47 ... Java: Update MaD Declarations after Triage	2023-07-13 11:15:41 +02:00
Anders Schack-Mulligen	58cd16565f	Dataflow: Fix forceHighPrecision for length-2 prefixes.	2023-07-13 10:55:39 +02:00
Anders Schack-Mulligen	d46b2a32ae	Dataflow: Improve debug printing.	2023-07-13 10:55:39 +02:00
Tony Torralba	7204c30025	Update 2023-07-12-apache-commons-lang3-tostringbuilder.md	2023-07-13 09:38:33 +02:00
Ed Minnix	63299688d5	Add change notes for default implementations of isBarrier and isAdditionalFlowStep	2023-07-12 15:21:16 -04:00
Ed Minnix	1cd8922ab5	Java: Add default implementation of StateConfigSig::isAdditionalFlowStep/4	2023-07-12 15:06:24 -04:00
Ed Minnix	1835b40f7b	Java: Add default impl to StateConfigSig::isBarrier/2	2023-07-12 15:06:24 -04:00
Ian Lynagh	fe24cc1900	Merge pull request #13718 from igfoo/igfoo/file_classes ... Kotlin: Improve file class support	2023-07-12 15:42:16 +01:00