Shyam Mehta
50b4df52f0
Fixed precision labels
2022-08-08 17:36:04 -04:00
Shyam Mehta
9d3e8ec475
Update PartialPathTraversalFromRemote.qhelp
2022-08-08 17:35:36 -04:00
smehta23
4f1bc3022c
Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalFromRemote.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-08-08 17:09:43 -04:00
Shyam Mehta
76cecc170e
Fix documentation
2022-08-03 14:30:17 -04:00
Shyam Mehta
09ec37943c
Partial Path Traversal split into 2 queries
2022-07-20 17:53:26 -04:00
smehta23
b7e522749f
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2022-07-20 15:32:59 -04:00
Chris Smowton
a6970638cb
Improve description
2022-07-13 20:27:10 +01:00
Chris Smowton
01cec0490b
Abbreviate qhelp
2022-07-13 20:24:44 +01:00
Shyam Mehta
65b9947428
Incorporate jksco's feedback
2022-07-12 02:02:31 -04:00
smehta23
781a2a73d3
Merge branch 'main' into feat/SM/java_partial_path_traversal_vulnerability
2022-07-12 01:48:12 -04:00
Shyam Mehta
39f885413f
Change log
2022-07-01 11:34:56 -04:00
smehta23
391dd5b38d
Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java
...
Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com >
2022-07-01 10:55:58 -04:00
smehta23
ebe48ec30a
Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp
...
Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com >
2022-07-01 10:53:43 -04:00
smehta23
48e16e52b5
Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversal.qhelp
...
Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com >
2022-07-01 10:52:41 -04:00
Shyam Mehta
1a41d4c379
Add CVE number
2022-07-01 10:51:33 -04:00
Chris Smowton
b499ba5aa8
Kotlin: don't extract private setters of external classes
...
Previously these would get extracted unlike other private methods even if the class was a standard library or other external class. This could cause inconsistencies because if we also compiled the class from source we could end up deciding different names for the property's setter: setXyz$private when seen from source, and setXyz without a
suffix when seen as an external .class file. Avoiding extracting these functions from the external perspective both restores consistency with other kinds of method and avoids these consistency problems.
2022-07-01 15:44:17 +01:00
Shyam Mehta
300a14c35c
Add ESAPI reference
2022-07-01 10:43:59 -04:00
smehta23
209a21655a
Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalGood.java
...
Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com >
2022-07-01 10:40:38 -04:00
smehta23
c6f2f61bfb
Update java/ql/src/Security/CWE/CWE-023/PartialPathTraversalBad.java
...
Co-authored-by: Jonathan Leitschuh <jonathan.leitschuh@gmail.com >
2022-07-01 10:39:46 -04:00
Chris Smowton
4c6a9772af
Merge pull request #9768 from smowton/smowton/fix/internal-method-name-mangling
...
Kotlin: Mangle names of internal functions to match JVM symbols
2022-07-01 14:33:32 +01:00
Chris Smowton
14aef792e0
Accept test changes
2022-07-01 10:35:17 +01:00
Chris Smowton
df78b7e54b
Merge pull request #9755 from smowton/smowton/feature/implement-jvmstatic-annotation
...
Kotlin: support JvmStatic annotation
2022-07-01 10:14:08 +01:00
Chris Smowton
b9eec13466
Accept integration test changes
2022-06-30 22:21:04 +01:00
Chris Smowton
dd93062101
Kotlin: Mangle names of internal functions to match JVM symbols
2022-06-30 21:56:25 +01:00
Ian Lynagh
144c0d63b1
Merge pull request #9766 from igfoo/igfoo/extension
...
Kotlin: Fix a label
2022-06-30 21:16:26 +01:00
Ian Lynagh
b373af47d1
Kotlin: Fix a label
...
We want the .javaResult.id of a TypeResults.
2022-06-30 16:59:18 +01:00
Chris Smowton
570e418b22
Fix ordering PrintAst nodes
2022-06-30 16:07:32 +01:00
Chris Smowton
ec95cbace4
PrintAst: Tie-break multiple class members created at the same source location
...
Otherwise Kotlin introducing a getter, setter and field declaration based on the same property tied in the sort order, and so could be output in different orders on different machines.
2022-06-30 15:29:56 +01:00
Chris Smowton
0d0d240fd4
Accept test changes re: new compiler-generated nodes
2022-06-30 15:29:20 +01:00
Ian Lynagh
83fd9c3b3e
Merge pull request #9763 from igfoo/igfoo/foreach
...
Kotlin: Replace a map call with forEach
2022-06-30 15:02:57 +01:00
Ian Lynagh
0e56e50d18
Kotlin: Replace a map call with forEach
2022-06-30 13:50:22 +01:00
Chris Smowton
8214c3b78e
Add AST dump for JvmStatic annotation test
2022-06-30 13:11:43 +01:00
Chris Smowton
98761041f1
Prevent labelling proxies of default getters and setters as themselves default getters and setters
2022-06-30 13:11:00 +01:00
Chris Smowton
bf581b971c
Rename willExtract properties to shouldExtract
2022-06-30 12:51:09 +01:00
Chris Smowton
5a47e1dd95
Annotate generated static proxy methods as compiler-generated
2022-06-30 12:48:11 +01:00
Chris Smowton
466cf7573b
Autoformat
2022-06-30 12:42:39 +01:00
Chris Smowton
b4124ac553
Add test
2022-06-30 12:42:39 +01:00
Chris Smowton
bfdb21d551
Kotlin: support JvmStatic annotation
...
This makes non-companion object methods into static methods, and for companion objects introduces static proxy methods that call the companion instance method.
Note this doesn't quite implement what kotlinc does, since it will also eliminate getters and setters by promoting an object field into a static field, but our translation is simpler and only differs in private members' details.
2022-06-30 12:42:38 +01:00
Chris Smowton
ab52a020fa
Add test
2022-06-30 10:22:56 +01:00
Chris Smowton
8e5bbea9f9
Use map...firstOrNull not firstNotNullOfOrNull
...
The latter was introduced in Kotlin 1.5, so we can't use it in all supported versions.
2022-06-30 10:15:44 +01:00
Chris Smowton
2d98eb591e
Kotlin: note that raw inner classes nest within a raw outer.
...
Previously the Java extractor did this but the Kotlin extractor nested them within an unbound outer type.
2022-06-30 10:15:44 +01:00
github-actions[bot]
e9d3f658a3
Add changed framework coverage reports
2022-06-30 00:18:31 +00:00
Shyam Mehta
16814071df
Fix typo in .qhelp
2022-06-29 18:03:57 -04:00
Shyam Mehta
7ab8f0262c
Fix duplicate class header and better fix using toPath()
2022-06-29 18:01:12 -04:00
Shyam Mehta
955e614563
Add documentation of the Partial Path Traversal vuln
2022-06-29 17:31:04 -04:00
Andrew Eisenberg
fbeecd6c08
Merge pull request #9744 from github/aeisenberg/move-contextual-queries
2022-06-29 11:44:33 -07:00
Andrew Eisenberg
ddf06f8617
Add change notes and qldoc for moved files
2022-06-29 10:03:12 -07:00
Andrew Eisenberg
a3f4d1bf66
Move contextual queries from src to lib
...
With this change, users are now able to run View AST command in
vscode within vscode workspaces that do not include the core libraries.
The relevant core library only needs to be installed in the package
cache.
2022-06-29 07:51:26 -07:00
Ian Lynagh
d285e19e77
Merge pull request #9731 from igfoo/igfoo/private
...
Kotlin: Make more methods private
2022-06-29 11:24:33 +01:00
Jeroen Ketema
55e052af26
Merge pull request #9686 from aschackmull/dataflow/no-node-scan
...
Dataflow performance: Avoid node scans
2022-06-29 10:38:56 +02:00
