intrigus
36575bb26f
Move back to experimental.........
2021-06-25 16:47:25 +02:00
intrigus
fe923facc8
Java: Move comments to separate lines.
...
Move comments to separate lines to improve
the rendering in the finished query help.
2021-06-25 16:47:25 +02:00
intrigus-lgtm
f527df73d5
Apply suggestions from code review.
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-06-25 16:47:25 +02:00
intrigus
6bfdf8d148
Java: Fix qhelp errors.
2021-06-25 16:47:24 +02:00
intrigus
dc0b06a735
Java: Factor out SecurityFlag library.
2021-06-25 16:47:24 +02:00
intrigus-lgtm
51fdcf86c8
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-06-25 16:47:24 +02:00
intrigus
6f217d37da
Java: Apply suggestions from review.
2021-06-25 16:47:24 +02:00
intrigus
4a00670b68
Java: Reduce long comment.
2021-06-25 16:47:24 +02:00
intrigus
45cec3df1c
Java: Use this consistently in QL classes.
2021-06-25 16:47:24 +02:00
intrigus
0c1ce74135
Java: Switch from tabs to spaces.
2021-06-25 16:47:24 +02:00
intrigus
281e0859d1
Java: Accept test changes.
2021-06-25 16:47:23 +02:00
intrigus
6413af4fbe
Java: Expand tests.
2021-06-25 16:47:23 +02:00
intrigus
484533c659
Java: Flag "intentionally" unsafe methods in tests.
...
Previously intentionally unsafe methods such as `disableCertificate`
would be ignored by this query. But now they will also be flagged
as it is hard to guess intentions...
Adjust the tests to account for this change.
2021-06-25 16:47:23 +02:00
intrigus
7023793af4
Java: Fix compilation errors in test.
2021-06-25 16:47:23 +02:00
intrigus
6d09db6fd6
Java: Explicitly list custom flow steps.
2021-06-25 16:47:23 +02:00
intrigus
e4775e0fae
Java: Remove "intention-guessing" sanitizer & simplify.
...
This removes the sanitizer part that classified some results as FP
if the results were in methods with certain names, like
`disableVerification()`. I now think that it's a bad idea to filter
based on the method name.
The custom flow steps in `flagFlowStep` are now listed explicitly.
Simplified check whether a method throws an exception.
2021-06-25 16:47:23 +02:00
intrigus
8a7f6b72e9
Java: Apply suggestions for QHelp
2021-06-25 16:47:23 +02:00
intrigus
d37d922e8f
Java: Fix Typos
2021-06-25 16:47:22 +02:00
intrigus-lgtm
030c286902
Java: Use machine-in-the-middle consistently
2021-06-25 16:47:22 +02:00
intrigus-lgtm
f52e438f3e
Java: Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-06-25 16:47:22 +02:00
intrigus
592fd1e8ca
Java: Accept test changes
2021-06-25 16:47:22 +02:00
intrigus
1b96d0ac54
Java: Remove overlapping code
2021-06-25 16:47:22 +02:00
intrigus
87554a78d4
Java: Add insecure trust manager query.
2021-06-25 16:47:22 +02:00
Anders Schack-Mulligen
2d24387e9e
Merge pull request #6149 from edoardopirovano/fix-java-regression
...
Performance: Fix bad join order in Java dataflow library
2021-06-25 10:42:05 +02:00
Chris Smowton
2acb4de2cb
Merge pull request #5955 from haby0/java/JShellCodeInjection
...
Java: JShell Injection
2021-06-24 17:03:30 +01:00
Anders Schack-Mulligen
95ad8b55fe
Merge pull request #6107 from aschackmull/dataflow/implicit-reads
...
Dataflow: Add support for implicit reads
2021-06-24 15:38:35 +02:00
Anders Schack-Mulligen
cd0efbe7ce
Dataflow: Sync.
2021-06-24 14:19:17 +02:00
Anders Schack-Mulligen
1c1d11a4a4
DataFlow: Address review comments.
2021-06-24 14:18:45 +02:00
haby0
3cf71c50b8
Mobile stubs
2021-06-24 19:24:38 +08:00
Anders Schack-Mulligen
1e511c0a9e
Merge pull request #6137 from smowton/smowton/feature/java-util-optional
...
Java: Model java.util.Optional
2021-06-24 13:21:36 +02:00
Edoardo Pirovano
0909c9ff22
Performance: Fix bad join order in dataflow library
2021-06-24 08:24:17 +01:00
yo-h
ffdc752720
Merge pull request #6059 from smowton/smowton/fix/qualified-name-generic-types
...
Adapt to static methods and nested types returning unbound declaring types
2021-06-23 14:45:51 -04:00
Chris Smowton
74feaf2893
Adapt to static methods and nested types returning unbound declaring types
...
Previously these returned raw declaring types instead
2021-06-23 16:03:18 +01:00
Chris Smowton
b34448af87
{Generic,Parameterized,Raw}Type: implement getAPrimaryQlClass
...
An aid to debugging
2021-06-23 15:58:31 +01:00
Anders Schack-Mulligen
6374914053
Java: Fix bad magic.
2021-06-23 14:39:18 +02:00
Artem Smotrakov
0dfb869c5b
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-06-23 13:23:54 +02:00
Artem Smotrakov
14e724bce6
Added sinks for RmiBasedExporter and HessianExporter
2021-06-23 09:53:47 +02:00
Chris Smowton
9fd1606238
Model java.util.Optional
2021-06-22 21:17:22 +01:00
Anders Schack-Mulligen
206a37cf08
Merge pull request #6130 from aschackmull/java/collection-test
...
Java: Improve test and fix a few missing cases.
2021-06-22 11:56:44 +02:00
Anders Schack-Mulligen
38fc8a750c
Java: Improve test and fix a few missing cases.
2021-06-22 11:16:02 +02:00
Anders Schack-Mulligen
c06e152e90
Java: Remove outdated test.
2021-06-21 16:08:59 +02:00
Anders Schack-Mulligen
27c973e157
Java: Fix some qltests.
2021-06-21 16:08:52 +02:00
Anders Schack-Mulligen
d383c0f69b
Java: Remove temporary store-as-taint.
2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
65ac8be5ac
Java: Add defaultImplicitTaintRead and sync.
2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
aa82d0b815
Java: Make Content public as DataFlow::Content.
2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
80880320d5
Dataflow: Sync.
2021-06-21 14:42:47 +02:00
Anders Schack-Mulligen
b7ac329ba1
DataFlow: Add support for configuration-specific implicit reads.
2021-06-21 14:41:19 +02:00
Chris Smowton
e2aaae8181
Increase test fieldFlowBranchLimit to 1000
...
Might as well head off future failures in this test
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-06-21 12:51:37 +01:00
Chris Smowton
c5eef7be8c
Increase field flow branch limit in Jax-RS tests
...
This fixes apparently-missing results by allowing the dataflow library to persist even when there are many Map implementations possibly available.
2021-06-21 12:46:13 +01:00
Anders Schack-Mulligen
9110dfaeb3
Merge pull request #6095 from hvitved/dataflow/local-cc-join
...
Data flow: Fix `getLocalCallContext` join-order
2021-06-21 12:53:38 +02:00
