Joe Farebrother
7a4ce83169
Merge pull request #5310 from joefarebrother/guava-io
...
Java: Add modelling for Guava IO utilities
2021-03-09 11:19:44 +00:00
Joe Farebrother
ed228cbcef
Add sinks for URL Open Stream query
2021-03-08 14:07:53 +00:00
Anders Schack-Mulligen
cf4f55d9ab
Merge pull request #5223 from smowton/smowton/feature/backward-dataflow-for-modelled-fluent-methods
...
Java: Add backward dataflow edges through modelled function invocations
2021-03-05 15:11:43 +01:00
Chris Smowton
012058a866
Apply review suggestions: use ArgumentNode.argumentOf, and change more uses of ValuePreservingCallable -> ValuePreservingMethod
2021-03-05 13:34:13 +00:00
Chris Smowton
eed357dc93
ValuePreservingCallable -> ValuePreservingMethod
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 13:28:35 +00:00
Chris Smowton
a37b98ca27
Value-preserving methods: handle generics in DataFlowUtil.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 13:15:06 +00:00
Chris Smowton
ca86925a45
Update java/ql/src/semmle/code/java/dataflow/FlowSteps.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 13:02:19 +00:00
Chris Smowton
45f3365d06
Apply suggestions from code review
...
Note value-preserving functions can't be constructors
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-03-05 12:52:38 +00:00
Chris Smowton
990bdc20b0
Move value-preserving callable class into FlowSteps
2021-03-05 11:55:53 +00:00
Joe Farebrother
3f3640fcbd
Model ByteArrayDataOutput
2021-03-05 11:19:55 +00:00
Joe Farebrother
470a2ca336
Add CopyTo
2021-03-05 11:19:55 +00:00
Joe Farebrother
61dcf3a275
Apply suggestions from code review
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-03-05 11:19:55 +00:00
Joe Farebrother
f5564b1c3b
Remove unnecassary import
2021-03-05 11:19:54 +00:00
Joe Farebrother
d30d1a2ab2
Add unit tests and fix issues
2021-03-05 11:19:52 +00:00
Joe Farebrother
d67de88d34
Model Guava IO package
2021-03-05 11:19:25 +00:00
Anders Schack-Mulligen
20ccb52912
Merge pull request #4299 from torque59/play-framework
...
Initial support for Java - Play Framework > 2.6.x
2021-03-05 10:51:53 +01:00
Anders Schack-Mulligen
3565ba51b3
Merge pull request #5209 from smowton/smowton/feature/commons-misc-text
...
Java: add models for miscellaneous text-processing utilities from Commons Lang
2021-03-05 10:21:58 +01:00
Owen Mansel-Chan
96eaf2119f
Correct signature and package in comment
...
cf https://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletResponse.html#addCookie(javax.servlet.http.Cookie)
2021-03-04 15:10:02 +00:00
Chris Smowton
da0a7f343a
Move existing value-preserving methods to use ValuePreservingCallable
2021-03-04 11:45:45 +00:00
Chris Smowton
40b0f68d2a
Add backward dataflow edges through modelled function invocations.
...
Also add convenience abstract classes for easily modelling new functions as fluent or value-preserving.
2021-03-04 11:45:19 +00:00
Chris Smowton
71cd329ded
Directly import Lang from ExternalFlow's Frameworks module
2021-03-04 11:12:21 +00:00
Chris Smowton
563404120f
Move calls to getSourceDeclaration
2021-03-04 11:11:56 +00:00
Chris Smowton
43b9436bb8
Convert Apache misc text models to CSV taint-flow specifications
2021-03-04 11:11:56 +00:00
Chris Smowton
0029d3b743
Java CSV flow summaries: allow specifying an unqualified typename to imply either the type itself or any generic specialisation.
...
It is still possible to specify a precise generic signature if need be.
2021-03-04 11:11:56 +00:00
Chris Smowton
b0ba0585a7
Add models for Apache Commons Lang and Text's Str[ing]Substitutor
2021-03-04 11:11:55 +00:00
Chris Smowton
f749c31136
Add models for commons lang/text's Str[ing]Lookup class
2021-03-04 11:11:55 +00:00
Chris Smowton
1580d23b2b
Add models for WordUtils and StrTokenizer
...
Both of these have commons-text and commons-lang variants.
2021-03-04 11:11:55 +00:00
Anders Schack-Mulligen
fe07630e40
Merge pull request #5219 from smowton/smowton/feature/backward-dataflow-for-fluent-methods
...
Java: Add backward dataflow edges through fluent function invocations.
2021-03-04 11:13:32 +01:00
Anders Schack-Mulligen
f91c71c8f7
Merge pull request #5270 from Marcono1234/marcono1234/class-isPackageProtected
...
Java: Add Class and Interface.isPackageProtected()
2021-03-03 16:33:57 +01:00
Anders Schack-Mulligen
7ca57fd7a5
Merge pull request #5294 from Marcono1234/patch-1
...
Java: Fix wrong algorithm name matching
2021-03-03 16:33:13 +01:00
Marcono1234
d5d0439471
Java: Fix wrong algorithm name matching
...
The regex character class `[5|7]` matches `5`, `7` and `|`.
2021-03-03 15:44:23 +01:00
Anders Schack-Mulligen
3400c121d6
Merge pull request #5202 from joefarebrother/apache-http
...
Java: Add modelling for Apache HTTP Components
2021-03-03 13:41:41 +01:00
Anders Schack-Mulligen
394c82d564
Apply suggestions from code review
...
Adjust qldoc.
2021-03-02 10:17:07 +01:00
Chris Smowton
cdccc1a064
Remove needless typecasts
2021-03-01 16:47:34 +00:00
Porcuiney Hairs
14ec148272
refactor to meet experimental guidelines.
2021-03-01 18:46:33 +05:30
Chris Smowton
c32514bf66
Sync dataflow library files
2021-03-01 10:27:28 +00:00
Chris Smowton
e6b1fe9b5f
Fluent interface dataflow: support argument-output flow directly declared by the simpleLocalFlowStep relation
...
This means we will treat fluent interfaces that are modelled the same as those where we determine an argument flows to an output by inspection of the function body.
2021-03-01 10:23:38 +00:00
Chris Smowton
fadbb32bd6
Add backward dataflow edges through fluent function invocations.
...
This means that much as obj.getA().setB(...) already has a side-effect on `obj`, all three setters in obj.setA(...).setB(...).setC(...) will have a side-effect on `obj`.
2021-03-01 10:11:28 +00:00
Porcupiney Hairs
602f63ad45
[Java] Add QL for detecting Spring View Manipulation Vulnerabilities.
2021-02-26 16:29:18 +05:30
Marcono1234
fa189ded9d
Java: Add Class and Interface.isPackageProtected()
2021-02-25 18:21:18 +01:00
Joe Farebrother
41b7db144d
Allow for array types in model signatures
2021-02-25 11:40:48 +00:00
Anders Schack-Mulligen
f0d3841369
Merge pull request #5105 from JLLeitschuh/feat/JLL/depricated_bintray_usage
...
CWE-1104: Maven POM dependence upon Bintray/JCenter
2021-02-25 09:08:31 +01:00
Joe Farebrother
caa6f00292
Switch to CSV based modelling
2021-02-24 16:59:49 +00:00
Anders Schack-Mulligen
add960bc4d
Merge pull request #4880 from luchua-bc/java/sensitive-query-with-get
...
Java: Sensitive GET Query
2021-02-24 11:08:47 +01:00
luchua-bc
56e3b301e9
Resolve ambiguous method access
2021-02-23 15:18:07 +00:00
Joe Farebrother
ee651da23f
Remove TODO comment
2021-02-23 14:27:11 +00:00
Joe Farebrother
a3b8d4ab2d
Switch to inline test expectations; fix failing test outputs
2021-02-23 14:26:12 +00:00
Joe Farebrother
7b5961769a
Add unit tests for version 5.x
2021-02-23 14:26:12 +00:00
Joe Farebrother
cf58a90d74
Add unit tests for utility methods
2021-02-23 14:26:12 +00:00
Joe Farebrother
e5d624d1e8
Add open redirect sinks
2021-02-23 14:26:12 +00:00
