6 Commits

Author	SHA1	Message	Date
Chris Smowton	8b080a94e7	Convert request forgery tests to inline expectations; add missing models revealed by this process.	2021-06-17 11:43:32 +01:00
Chris Smowton	55c72cebf2	Improve StringBuilder append chain tracking ... Previously this didn't catch the case of constructors chaining directly into appends, like `StringBuilder sb = new StringBuilder("1").append("2")`	2021-06-17 11:41:06 +01:00
Chris Smowton	77904d9597	Remove failing test ... The case where something might be exactly a constant is general across all queries, and not handled yet, particularly in the case where the result of `getParameter("uri")` might have changed between the check and the use.	2021-06-17 11:41:04 +01:00
Chris Smowton	6933d06a46	Add exactly the string '/' as a sanitizing prefix. ... Usually this is ignored for suspicion that it could be taken for a protocol specifier, but on balance the context `(something) + "/" + tainted()` is more likely to be taken for a user-controlled location within a host the user does not control.	2021-06-17 11:41:03 +01:00
Chris Smowton	b5a450b881	SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.	2021-06-17 11:41:03 +01:00
Chris Smowton	487c1db6ed	Promote SSRF query to main query set	2021-06-17 11:41:01 +01:00