Tony Torralba
7b34b10cee
Decouple from #10177
2022-10-06 16:28:17 +02:00
Tony Torralba
1bf1349167
Test all sinks
2022-10-06 16:28:17 +02:00
Tony Torralba
39b5ebfd7b
Fix qhelp
2022-10-06 16:28:17 +02:00
Tony Torralba
76ea255277
Add security-severity
2022-10-06 16:28:17 +02:00
Tony Torralba
4a18892da9
Second query version
...
Remove sinks flowing to write operations requirement
2022-10-06 16:28:17 +02:00
Tony Torralba
153ec5368e
First query version requiring sinks to flow to write operations
2022-10-06 16:28:17 +02:00
Henry Mercer
7a7d164b07
Merge pull request #10698 from github/henrymercer/successfully-extracted-files-tag
...
Tag successfully extracted files queries
2022-10-06 13:21:52 +01:00
Anders Schack-Mulligen
5b67ba2939
Merge pull request #10177 from atorralba/atorralba/path-sanitizer
...
Java: Promote `PathSanitizer.qll` from experimental
2022-10-06 10:29:33 +02:00
Anders Schack-Mulligen
cbeff4efc8
Merge pull request #10693 from atorralba/atorralba/fix-guard-bad-magic
...
Java: Fixes bad magic in `Guard::guardControls_v3`
2022-10-06 10:14:48 +02:00
Tom Hvitved
0e6735b804
Merge pull request #10691 from hvitved/dataflow/conjunctive-clears
...
Data flow: Take conjunctive `With(out)Contents` into account in `prohibitsUseUseFlow`
2022-10-06 09:03:30 +02:00
Henry Mercer
d80d39504f
Tag successfully extracted files queries
...
Tag the successfully extracted files queries with
`successfully-extracted-files` to make them easier to identify
programmatically in a language-independent way.
This follows the prior art for lines of code queries, which are tagged
`lines-of-code`.
2022-10-05 19:19:43 +01:00
Chris Smowton
7f8bcf76bf
Merge pull request #10665 from dilanbhalla/dilan-java/guidance-exectainted
...
Java Guidance: ExecTainted.ql (experimental version)
2022-10-05 15:05:10 +01:00
Tom Hvitved
0beea9fd1a
Fix typos
2022-10-05 15:54:52 +02:00
Tamás Vajk
d0d8ef1236
Merge pull request #10672 from tamasvajk/kotlin-unary-op
...
Kotlin: extract unary plus and minus operators
2022-10-05 13:30:21 +02:00
Tom Hvitved
6f518c1996
Data flow: Sync files
2022-10-05 12:58:29 +02:00
Tony Torralba
527425b397
Fixes bad magic in Guard::guardControls_v3
2022-10-05 12:35:33 +02:00
Anders Schack-Mulligen
6db0db431f
Java: Add pruning for local taint flow.
2022-10-05 12:02:05 +02:00
Tamás Vajk
ecfbd5edfe
Merge pull request #10674 from tamasvajk/kotlin-implements
...
Kotlin: extract `implInterface`
2022-10-05 09:11:41 +02:00
Tamás Vajk
d0ea7ea2e3
Merge pull request #10677 from tamasvajk/kotlin-param-modifiers
...
Kotlin: Extract parameter modifiers (`noinline`, `crossinline`)
2022-10-04 21:53:48 +02:00
Tamás Vajk
c45a04a2c8
Merge pull request #10675 from tamasvajk/kotlin-enum-constants
...
Kotlin: extract `isEnumConstant` relation
2022-10-04 21:53:22 +02:00
Tamas Vajk
ea0a04a74f
Kotlin: extract unary plus and minus operators
2022-10-04 15:18:35 +02:00
Tamas Vajk
2e72ec748f
Kotlin: add numeric unary operator test cases
2022-10-04 15:18:35 +02:00
Ian Lynagh
db673c0355
Merge pull request #10646 from tamasvajk/kotlin-java-kotlin-function-mapping
...
Kotlin: Simplify `kotlinFunctionToJavaEquivalent`
2022-10-04 13:46:22 +01:00
Tamas Vajk
81fffce79b
Kotlin: Extract parameter modifiers (noinline, crossinline)
2022-10-04 14:02:06 +02:00
Tamas Vajk
09051e76cf
Kotlin: extract isEnumConstant relation
2022-10-04 13:30:02 +02:00
Tamas Vajk
876bea653d
Kotlin: Add test case for missing enum constants
2022-10-04 13:29:15 +02:00
Tamas Vajk
d2861361d9
Kotlin: extract implInterface
2022-10-04 13:12:01 +02:00
Tamas Vajk
d50be83f57
Kotlin: add test to distinguish implements vs extends
2022-10-04 13:10:19 +02:00
Tony Torralba
9db65eae7f
Address review comments
2022-10-04 12:27:01 +02:00
Tony Torralba
b8fa9433be
Fix duplicated test
2022-10-04 12:27:01 +02:00
Tony Torralba
264d6db9d7
Rename AllowListGuard to AllowedPrefixGuard
2022-10-04 12:27:01 +02:00
Tony Torralba
90020b6aab
Make block lists work with substring matching too
...
A block list approach doesn't need to restrict itself to prefix matching
2022-10-04 12:27:01 +02:00
Tony Torralba
69d1895175
Update java/ql/lib/semmle/code/java/security/PathSanitizer.qll
2022-10-04 12:27:01 +02:00
Tony Torralba
6fcaae20e7
Add tests and fix bugs highlighted by them
2022-10-04 12:27:01 +02:00
Tony Torralba
f19eb783be
Generalize file/path taint steps
...
This is needed by PathSanitizer but also helps simplify ZipSlip.ql
2022-10-04 12:27:01 +02:00
Tony Torralba
4e29c39c78
Merge ZipSlip sanitization logic into PathSanitizer.qll
...
Apply code review suggestions regarding weak sanitizers
2022-10-04 12:27:01 +02:00
Tony Torralba
89d905cc03
Add change note
2022-10-04 12:27:01 +02:00
Tony Torralba
08c67fb174
Use PathInjectionSanitizer in relevant queries
2022-10-04 12:27:01 +02:00
Tony Torralba
dff878e531
Apply TaintedPath recent changes to TaintedPathLocal
2022-10-04 12:26:59 +02:00
Tony Torralba
5706e8b377
Improve PathSanitizer
...
Rename PathTraversalSanitizer to PathInjectionSanitizer
2022-10-04 12:26:17 +02:00
Tony Torralba
50ad234694
Move PathSanitizer to the main library
2022-10-04 12:26:17 +02:00
Tony Torralba
d5478a01ab
Merge pull request #10671 from github/revert-10640-atorralba/fix-cartesian-product
...
Java: Revert #10489 and #10640
2022-10-04 12:25:46 +02:00
Chris Smowton
e29be411ef
Merge pull request #9811 from smowton/smowton/feature/kotlin-jvmoverloads-annotation
...
Kotlin: Implement JvmOverloads annotation
2022-10-04 11:21:44 +01:00
Tony Torralba
2deb3e5625
Reapply "Java: Fix cartesian product"
...
This reverts commit c1654ce7cc
2022-10-04 11:11:44 +02:00
Chris Smowton
58cb5446c3
Add cross-check to getValueParameterLabel
2022-10-04 10:04:18 +01:00
Tony Torralba
281e49daf7
Revert "Java: Add CompilationUnit.getATypeAvailableBySimpleName()"
...
This reverts commit 431aa2cb79
2022-10-04 10:59:45 +02:00
Tony Torralba
01b950f68b
Revert "Java: Rename predicate to getATypeInScope"
...
This reverts commit fd99ae78b3
2022-10-04 10:59:43 +02:00
Tony Torralba
df29e05b9f
Revert "Java: Adjust ImpossibleJavadocThrows.ql"
...
This reverts commit c40b6285a2
2022-10-04 10:59:39 +02:00
Tony Torralba
c1654ce7cc
Revert "Java: Fix cartesian product"
2022-10-04 10:56:32 +02:00
Tamas Vajk
2c467376ea
Revert "Only log once the missing java-kotlin method mapping warnings"
...
This reverts commit 7524f3372d
2022-10-04 08:54:07 +02:00
