Chris Smowton
6d108c0fa7
Improve docstring for composedValueAndTaintModelStep
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-16 09:00:35 +00:00
Chris Smowton
915a19fb9d
Improve naming; eliminate some harmless extra results
...
Adding `src != valueSource` should have no effect as the introduced edge would already exist, but could reduce workload downstream.
2021-03-16 08:57:14 +00:00
Chris Smowton
516122aa74
Add taint-preserving edges where a call also has a value-preserving edge
...
For example, for a fluent method that returns `this`, we take a tainting edge from argX to either `this` or the return value to also taint the other.
2021-03-16 08:45:24 +00:00
Anders Schack-Mulligen
45c9428668
Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources
...
Java: Add support for Commons-Lang's RandomUtils
2021-03-15 16:21:01 +01:00
Chris Smowton
92d61354d4
Remove abstract class RandomNumberGenerator
2021-03-12 13:04:31 +00:00
Anders Schack-Mulligen
a8b84e430f
Merge pull request #5390 from Marcono1234/patch-2
...
Java: Fix documentation mistake in Modules.qll
2021-03-12 12:51:24 +01:00
Anders Schack-Mulligen
c9786df760
Merge pull request #5344 from smowton/smowton/feature/commons-object-utils
...
Java: Add models for flow- and taint-preserving functions in Commons ObjectUtils
2021-03-12 12:46:31 +01:00
Anders Schack-Mulligen
1d3ad0cb52
Java: Remove value steps from taint steps.
2021-03-12 11:09:53 +01:00
Marcono1234
edeb08480e
Java: Fix documentation mistake in Modules.qll
2021-03-11 23:45:59 +01:00
Chris Smowton
b5268def16
Add models for CONST_BYTE and CONST_SHORT
2021-03-11 16:22:56 +00:00
Chris Smowton
1c1ca70027
Add models for flow- and taint-preserving functions in Commons ObjectUtils.
...
These should all be value-preserving, but we don't support value-preserving varargs methods yet.
2021-03-11 16:22:54 +00:00
Anders Schack-Mulligen
87e4dec86a
Merge pull request #5300 from tamasvajk/feature/external-remote-flow-sources
...
Java: Convert remote flow sources to use new CSV format
2021-03-11 10:44:17 +01:00
Tom Hvitved
fc5158c41c
Merge pull request #5338 from hvitved/dataflow/performance-tweaks
...
Data flow: Performance tweaks
2021-03-10 13:56:57 +01:00
Chris Smowton
410f21cd55
Fix comment describing two-arg nextInt/nextLong
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-03-10 08:43:37 +00:00
Chris Smowton
fa51af5be1
NBSP -> original-flavour space
2021-03-09 15:40:45 +00:00
Chris Smowton
9163893879
Add models for Commons-Lang's RegExUtils class
2021-03-09 15:11:13 +00:00
Tom Hvitved
fe6efde449
Address review comments
2021-03-09 14:30:12 +01:00
Tamas Vajk
5480a31b68
Java: Remove MultipartFile.getSize/isEmpty from remote flow sources
2021-03-09 12:23:47 +01:00
Tamas Vajk
0d405c293a
Java: Convert PlayRequestGetMethod to CSV based flow source
2021-03-09 12:20:35 +01:00
Joe Farebrother
7a4ce83169
Merge pull request #5310 from joefarebrother/guava-io
...
Java: Add modelling for Guava IO utilities
2021-03-09 11:19:44 +00:00
Joe Farebrother
bd4a414abd
Remove CSV data from query
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-09 10:50:15 +00:00
Tamas Vajk
e0b1a86038
Java: Convert WebSocketMessageParameterSource to CSV based flow source
2021-03-09 11:49:59 +01:00
Tamas Vajk
193458eb3d
Java: Convert SpringRestTemplateResponseEntityMethod to CSV based flow source
2021-03-09 11:49:59 +01:00
Tamas Vajk
e0c51b510f
Java: Convert WebViewGetUrlMethod to CSV based flow source
2021-03-09 11:42:40 +01:00
Tamas Vajk
8ba820cae1
Java: Convert android XML get* methods to CSV based flow source
2021-03-09 11:42:13 +01:00
Tamas Vajk
09b0d824b4
Java: Convert org.apache.http.Http*.get* methods to CSV based flow source
2021-03-09 11:41:33 +01:00
Tamas Vajk
3c8ac5c789
Java: Convert Cookie.get* methods to CSV based flow source
2021-03-09 11:41:33 +01:00
Tamas Vajk
86cf143029
Java: Convert ServletRequestGetBodyMethod to CSV based flow source
2021-03-09 11:41:32 +01:00
Tamas Vajk
b05a9043b5
Java: Convert SpringWebRequestGetMethod to CSV based flow source
2021-03-09 11:41:32 +01:00
Tamas Vajk
09bcf878f7
Java: Convert HttpServletRequest.get* methods to CSV based flow source
2021-03-09 11:40:59 +01:00
Tamas Vajk
f2448cc921
Java: Convert SpringMultipartFileSource to CSV based flow source
2021-03-09 11:40:18 +01:00
Tamas Vajk
80b4d63d4b
Java: Convert SpringMultipartRequestSource to CSV based flow source
2021-03-09 11:39:47 +01:00
Tamas Vajk
06fdd64dab
Java: Remove already modelled BeanValidationSource
2021-03-09 11:35:42 +01:00
Tamas Vajk
3dfc236bbe
Java: Remove already modelled RemoteTaintedMethods
2021-03-09 11:35:42 +01:00
Joe Farebrother
ed228cbcef
Add sinks for URL Open Stream query
2021-03-08 14:07:53 +00:00
Chris Smowton
790fb7829a
Improve comment and change-note accuracy
2021-03-08 11:00:05 +00:00
Chris Smowton
4a4f4b01a1
Add support for java.util.concurrent.ThreadLocalRandom
2021-03-08 10:59:53 +00:00
p0wn4j
6841f5f7c4
Java: Add NashornScriptEngine detection in ScriptEngine query
...
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
2021-03-06 16:19:07 +04:00
Anders Schack-Mulligen
cf4f55d9ab
Merge pull request #5223 from smowton/smowton/feature/backward-dataflow-for-modelled-fluent-methods
...
Java: Add backward dataflow edges through modelled function invocations
2021-03-05 15:11:43 +01:00
Tom Hvitved
6e5af1a9f8
Data flow: Sync files
2021-03-05 14:56:40 +01:00
Chris Smowton
012058a866
Apply review suggestions: use ArgumentNode.argumentOf, and change more uses of ValuePreservingCallable -> ValuePreservingMethod
2021-03-05 13:34:13 +00:00
Chris Smowton
eed357dc93
ValuePreservingCallable -> ValuePreservingMethod
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 13:28:35 +00:00
Chris Smowton
a37b98ca27
Value-preserving methods: handle generics in DataFlowUtil.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 13:15:06 +00:00
Chris Smowton
ca86925a45
Update java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 13:02:19 +00:00
Chris Smowton
45f3365d06
Apply suggestions from code review
...
Note value-preserving functions can't be constructors
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 12:52:38 +00:00
Chris Smowton
e3cf5c235e
Add support for Commons-Lang's RandomUtils
...
This is realised by somewhat generalising our interfaces for modelling RNGs. We also add tests for randomness-related queries that didn't have any, and addtest cases checking the Apache random-number generators are interchangeable with the stdlib ones.
2021-03-05 12:09:33 +00:00
Chris Smowton
990bdc20b0
Move value-preserving callable class into FlowSteps
2021-03-05 11:55:53 +00:00
Joe Farebrother
3f3640fcbd
Model ByteArrayDataOutput
2021-03-05 11:19:55 +00:00
Joe Farebrother
470a2ca336
Add CopyTo
2021-03-05 11:19:55 +00:00
Joe Farebrother
61dcf3a275
Apply suggestions from code review
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-03-05 11:19:55 +00:00
