Anders Schack-Mulligen
5b67ba2939
Merge pull request #10177 from atorralba/atorralba/path-sanitizer
...
Java: Promote `PathSanitizer.qll` from experimental
2022-10-06 10:29:33 +02:00
Anders Schack-Mulligen
cbeff4efc8
Merge pull request #10693 from atorralba/atorralba/fix-guard-bad-magic
...
Java: Fixes bad magic in `Guard::guardControls_v3`
2022-10-06 10:14:48 +02:00
Tom Hvitved
0beea9fd1a
Fix typos
2022-10-05 15:54:52 +02:00
Tom Hvitved
6f518c1996
Data flow: Sync files
2022-10-05 12:58:29 +02:00
Tony Torralba
527425b397
Fixes bad magic in Guard::guardControls_v3
2022-10-05 12:35:33 +02:00
Anders Schack-Mulligen
6db0db431f
Java: Add pruning for local taint flow.
2022-10-05 12:02:05 +02:00
Tamás Vajk
d0ea7ea2e3
Merge pull request #10677 from tamasvajk/kotlin-param-modifiers
...
Kotlin: Extract parameter modifiers (`noinline`, `crossinline`)
2022-10-04 21:53:48 +02:00
Tamas Vajk
81fffce79b
Kotlin: Extract parameter modifiers (noinline, crossinline)
2022-10-04 14:02:06 +02:00
Tony Torralba
9db65eae7f
Address review comments
2022-10-04 12:27:01 +02:00
Tony Torralba
264d6db9d7
Rename AllowListGuard to AllowedPrefixGuard
2022-10-04 12:27:01 +02:00
Tony Torralba
90020b6aab
Make block lists work with substring matching too
...
A block list approach doesn't need to restrict itself to prefix matching
2022-10-04 12:27:01 +02:00
Tony Torralba
69d1895175
Update java/ql/lib/semmle/code/java/security/PathSanitizer.qll
2022-10-04 12:27:01 +02:00
Tony Torralba
6fcaae20e7
Add tests and fix bugs highlighted by them
2022-10-04 12:27:01 +02:00
Tony Torralba
f19eb783be
Generalize file/path taint steps
...
This is needed by PathSanitizer but also helps simplify ZipSlip.ql
2022-10-04 12:27:01 +02:00
Tony Torralba
4e29c39c78
Merge ZipSlip sanitization logic into PathSanitizer.qll
...
Apply code review suggestions regarding weak sanitizers
2022-10-04 12:27:01 +02:00
Tony Torralba
5706e8b377
Improve PathSanitizer
...
Rename PathTraversalSanitizer to PathInjectionSanitizer
2022-10-04 12:26:17 +02:00
Tony Torralba
50ad234694
Move PathSanitizer to the main library
2022-10-04 12:26:17 +02:00
Tony Torralba
d5478a01ab
Merge pull request #10671 from github/revert-10640-atorralba/fix-cartesian-product
...
Java: Revert #10489 and #10640
2022-10-04 12:25:46 +02:00
Tony Torralba
281e49daf7
Revert "Java: Add CompilationUnit.getATypeAvailableBySimpleName()"
...
This reverts commit 431aa2cb79
2022-10-04 10:59:45 +02:00
Tony Torralba
01b950f68b
Revert "Java: Rename predicate to getATypeInScope"
...
This reverts commit fd99ae78b3
2022-10-04 10:59:43 +02:00
Chris Smowton
5e2c607650
PrintAst: reliably sort function overloads
2022-10-03 15:28:55 +01:00
Chris Smowton
d3d3ce843a
Kotlin: Implement JvmOverloads annotation
...
This generates functions that omit parameters with default values, rightmost first, such that Java can achieve a similar experience to Kotlin (which represents calls internally as if the default was supplied explicitly, and/or uses a $default method that supplies the needed arguments).
A complication: combining JvmOverloads with JvmStatic means that both the companion object and the surrounding class get overloads.
2022-10-03 15:28:55 +01:00
Anders Schack-Mulligen
b48b5d45ef
Merge pull request #10498 from Marcono1234/marcono1234/compilation-unit-simple-name-type
...
Java: Add `CompilationUnit.getATypeInScope()`
2022-09-28 13:18:29 +02:00
Joe Farebrother
6cb26d5129
Merge pull request #10241 from joefarebrother/android-webview-dubugging
...
Java: Add query for WebView debugging enabled
2022-09-28 10:50:51 +01:00
Tom Hvitved
df2b586e7c
Merge pull request #10577 from hvitved/dataflow/get-a-read-content-fan-in
...
Data flow: Fix bad join-order when getAReadContent has large fan-in
2022-09-27 20:04:58 +02:00
Jami
56e3334c6d
Merge pull request #10479 from jcogs33/android-service-sources
...
Java: add Android service sources
2022-09-27 12:40:18 -04:00
Jami Cogswell
7e0c61de2c
switch to hasName
2022-09-27 10:45:52 -04:00
Tom Hvitved
335e1a8233
Address review comments
2022-09-27 13:36:52 +02:00
erik-krogh
7675571daa
fix RegExpEscape::getValue having multiple results for some escapes
2022-09-27 13:25:23 +02:00
Tom Hvitved
45fc62f16b
Data flow: Sync files
2022-09-26 20:39:48 +02:00
Anders Schack-Mulligen
1687d08587
Dataflow: Sync.
2022-09-26 16:10:03 +02:00
Anders Schack-Mulligen
17dba00264
Dataflow: Minor visibility cleanup.
2022-09-26 16:09:42 +02:00
Marcono1234
fd99ae78b3
Java: Rename predicate to getATypeInScope
2022-09-25 14:44:16 +02:00
Jami Cogswell
65f3ae9829
clean up files
2022-09-23 18:59:27 -04:00
Jami Cogswell
7e13610d24
minor qldoc update
2022-09-23 18:59:27 -04:00
Jami Cogswell
24b34cd32f
add a few more tests, and some clean-up
2022-09-23 18:59:27 -04:00
Jami Cogswell
decba39c09
add service flow sources
2022-09-23 18:59:27 -04:00
Anders Schack-Mulligen
dcc3f9e0a2
Java: Improve performance of StaticInitializationVector.
2022-09-23 14:39:32 +02:00
Tom Hvitved
8b424d181a
Merge pull request #10505 from hvitved/dataflow/viable-impl-in-ctx-consistency
...
Data flow: Guard against `viableImplInCallContext` not being a subset of `viableCallable`
2022-09-23 10:38:48 +02:00
Tom Hvitved
ad6b870f94
Data flow: Sync files
2022-09-22 15:01:33 +02:00
Erik Krogh Kristensen
6e6880bbe4
Merge pull request #10486 from erik-krogh/java-unqueryable
...
Java: Delete some unused code
2022-09-22 14:21:39 +02:00
erik-krogh
a8929b6400
deprecate RegExpFlags::getFlags instead of deleting it
2022-09-22 13:43:42 +02:00
erik-krogh
b61bd56d70
un-deprecate guardControls_v2
2022-09-22 13:42:50 +02:00
Tom Hvitved
f0f4fe7286
Merge pull request #10444 from hvitved/ruby/stmt-sequence-post-update
...
Ruby: Add post-update nodes for compound arguments
2022-09-22 13:18:51 +02:00
Joe Farebrother
eb3655da1c
Remove type check from the barrier predicate
2022-09-21 13:57:32 +01:00
Joe Farebrother
a6a500ade2
Apply suggestions from code review - doc improvements, simplification
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-21 13:57:31 +01:00
Joe Farebrother
eed2df0fb3
Fix qhelp & ql-for-ql errors
2022-09-21 13:57:30 +01:00
Joe Farebrother
f934554143
Add docs + add an additional case
2022-09-21 13:57:29 +01:00
Joe Farebrother
20b2956322
Add webview debugging query
2022-09-21 13:57:28 +01:00
Tamás Vajk
82c3e53694
Merge pull request #10473 from tamasvajk/kotlin-suspend
...
Kotlin: Extract `suspend` functions
2022-09-21 14:22:44 +02:00
