Tom Hvitved
6874b8d4b3
Data flow: Prevent bad join-order in pathStep
2021-04-09 14:24:47 +02:00
Anders Schack-Mulligen
6109ef5e88
Merge pull request #5475 from Marcono1234/marcono1234/minus-literal
...
Java: Improve documentation regarding minus in front of numeric literals
2021-04-08 16:11:14 +02:00
Anders Schack-Mulligen
d42a01cb3a
qldoc fixup
2021-04-08 15:45:21 +02:00
Chris Smowton
eaa2d4d831
Stop using wildcard Argument
...
All instances are replaced with a specific Argument or range.
2021-03-25 15:42:35 +00:00
Chris Smowton
2f34588770
Constructor models: use Argument[-1] for the result, not ReturnValue
2021-03-25 15:23:08 +00:00
Chris Smowton
a5220bf616
Convert StrBuilder models to CSV
2021-03-25 15:11:52 +00:00
Chris Smowton
25a0e09130
Convert StringUtils models to CSV
2021-03-25 15:11:52 +00:00
Chris Smowton
1beac06236
Translate ArrayUtils models to CSV
2021-03-25 15:11:51 +00:00
Chris Smowton
7fb5bd0cab
Add tests for and slightly expand models of Commons Lang's ArrayUtils class
2021-03-25 15:11:51 +00:00
yo-h
72ae902e0d
Merge pull request #5371 from aschackmull/java/framework-coverage
...
Java: Add query for CSV framework coverage.
2021-03-24 17:36:13 -04:00
Anders Schack-Mulligen
4955f95f64
Apply suggestions from code review
...
Clarify documentation.
Co-authored-by: Chris Smowton <smowton@github.com >
2021-03-24 14:32:18 +01:00
Anders Schack-Mulligen
41168e2b36
Java: Support argument and parameter ranges.
2021-03-24 13:32:30 +01:00
Anders Schack-Mulligen
234f62fd05
Java: Merge packages that likely belong to the same framework.
2021-03-24 13:17:04 +01:00
Chris Smowton
fa90655dd0
Partial revert: only introduce inferred taint edges from callsite-crossing value edges if an original taint edge targets the *start* of the value edge.
...
Previously we would also take a taint edge targeting a result and a value-preserving edge propagating another argument to the result to imply a taint edge targeting that argument.
2021-03-23 14:35:03 +00:00
yo-h
b495e1efab
Merge pull request #5411 from aschackmull/java/dataflow-lambda-dispatch
...
Java: Bugfix dispatch to lambda in call context.
2021-03-22 08:25:21 -04:00
Anders Schack-Mulligen
f681d584bd
Merge pull request #5474 from Marcono1234/marcono1234/string-building-type
...
Java: Add StringBuildingType
2021-03-22 13:16:54 +01:00
Marcono1234
1534b387bb
Java: Improve documentation regarding minus in front of numeric literals
2021-03-22 00:54:14 +01:00
Marcono1234
cd059eb965
Java: Add StringBuildingType
2021-03-22 00:19:23 +01:00
Marcono1234
fa98443bb7
Java: Add value predicates for float and double literals; improve tests
2021-03-21 18:07:55 +01:00
Tom Hvitved
09a49e4580
Merge pull request #5311 from hvitved/dataflow/lambda
...
Data flow: Move C# lambda flow logic into shared library
2021-03-19 11:44:15 +01:00
Joe Farebrother
f5e4b87d1e
Remove redundant rows and add note on collection flow
2021-03-16 14:28:24 +00:00
Joe Farebrother
980b2c1f4c
Convert existing Guava models to CSV system
2021-03-16 14:24:49 +00:00
Anders Schack-Mulligen
aa360c0378
Merge pull request #5413 from smowton/smowton/feature/infer-fluent-method-taint-flow
...
Add taint-preserving edges where a call also has a value-preserving edge
2021-03-16 14:10:11 +01:00
Anders Schack-Mulligen
53c360479a
Merge pull request #5329 from tamasvajk/feature/csv-taint-step
...
Java: migrate taint steps to CSV
2021-03-16 14:09:21 +01:00
Anders Schack-Mulligen
46bae88181
Merge pull request #5375 from aschackmull/dataflow/unbind
...
Dataflow: Switch from unbind to pragma[only_bind_into].
2021-03-16 14:03:54 +01:00
Tom Hvitved
b11e15154f
Data flow: Sync files and add stubs
2021-03-16 13:49:32 +01:00
Tamas Vajk
d02fba8c37
Java: adjust wrapped constructor calls
2021-03-16 12:42:41 +01:00
Tamas Vajk
e3534d1635
Java: cover wrapped constructor taint flow
2021-03-16 12:10:28 +01:00
Tamas Vajk
af0dff8c6f
Java: migrate constructor flow taint steps to CSV
2021-03-16 12:10:28 +01:00
Tamas Vajk
f9a207dd9f
Java: migrate 'arg to arg' taint steps to CSV
2021-03-16 12:10:28 +01:00
Tamas Vajk
7e1534a6cd
Java: migrate 'arg to return' taint steps to CSV
2021-03-16 12:10:28 +01:00
Tamas Vajk
5cdbde2686
Java: migrate 'qualifier to return' taint steps to CSV
2021-03-16 12:10:28 +01:00
Tamas Vajk
40126563ef
Java: migrate 'qualifier to arg' taint steps to CSV
2021-03-16 12:10:28 +01:00
Anders Schack-Mulligen
2d8d967060
Dataflow: Address review comment.
2021-03-16 11:07:33 +01:00
Chris Smowton
6d108c0fa7
Improve docstring for composedValueAndTaintModelStep
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-16 09:00:35 +00:00
Chris Smowton
915a19fb9d
Improve naming; eliminate some harmless extra results
...
Adding `src != valueSource` should have no effect as the introduced edge would already exist, but could reduce workload downstream.
2021-03-16 08:57:14 +00:00
Chris Smowton
516122aa74
Add taint-preserving edges where a call also has a value-preserving edge
...
For example, for a fluent method that returns `this`, we take a tainting edge from argX to either `this` or the return value to also taint the other.
2021-03-16 08:45:24 +00:00
Anders Schack-Mulligen
45c9428668
Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources
...
Java: Add support for Commons-Lang's RandomUtils
2021-03-15 16:21:01 +01:00
Anders Schack-Mulligen
662e17ff85
Java: Bugfix dispatch to lambda in call context.
2021-03-15 15:09:03 +01:00
Anders Schack-Mulligen
5aa9c2bd19
Dataflow: One more pragma.
2021-03-12 15:59:19 +01:00
Chris Smowton
92d61354d4
Remove abstract class RandomNumberGenerator
2021-03-12 13:04:31 +00:00
Anders Schack-Mulligen
a8b84e430f
Merge pull request #5390 from Marcono1234/patch-2
...
Java: Fix documentation mistake in Modules.qll
2021-03-12 12:51:24 +01:00
Anders Schack-Mulligen
c9786df760
Merge pull request #5344 from smowton/smowton/feature/commons-object-utils
...
Java: Add models for flow- and taint-preserving functions in Commons ObjectUtils
2021-03-12 12:46:31 +01:00
Anders Schack-Mulligen
1d3ad0cb52
Java: Remove value steps from taint steps.
2021-03-12 11:09:53 +01:00
Marcono1234
edeb08480e
Java: Fix documentation mistake in Modules.qll
2021-03-11 23:45:59 +01:00
Chris Smowton
b5268def16
Add models for CONST_BYTE and CONST_SHORT
2021-03-11 16:22:56 +00:00
Chris Smowton
1c1ca70027
Add models for flow- and taint-preserving functions in Commons ObjectUtils.
...
These should all be value-preserving, but we don't support value-preserving varargs methods yet.
2021-03-11 16:22:54 +00:00
Anders Schack-Mulligen
87e4dec86a
Merge pull request #5300 from tamasvajk/feature/external-remote-flow-sources
...
Java: Convert remote flow sources to use new CSV format
2021-03-11 10:44:17 +01:00
Anders Schack-Mulligen
674886a17d
Dataflow: Sync.
2021-03-10 16:53:51 +01:00
Anders Schack-Mulligen
667dab28d4
Dataflow: Switch from unbind to pragma[only_bind_into].
2021-03-10 16:52:45 +01:00
