Chris Smowton
0b2750828e
Add models for org.springframework.jdbc.object
...
Also add tests for the existing Spring JDBC SQL injection sinks in the process
2021-07-14 17:25:00 +01:00
Sauyon Lee
1f97ac88c8
Fix tests
2021-07-14 05:05:17 -07:00
Sauyon Lee
eaef1c146c
Add generated tests
2021-07-14 05:05:16 -07:00
Sauyon Lee
16931e5de8
Add necessary stubs for Spring
...
Co-Authored-By: smowton <smowton@github.com >
2021-07-14 04:57:56 -07:00
Anders Schack-Mulligen
04244b3c45
Merge pull request #5974 from github/sauyon/java/spring-webmultipart
...
Model Spring `web.multipart`
2021-07-14 13:57:24 +02:00
Anders Schack-Mulligen
3c4cd15738
Merge pull request #5505 from joefarebrother/android-sql-convert
...
Java: Convert Android SQL-related flow steps to CSV format
2021-07-14 13:56:55 +02:00
Chris Smowton
3ae99b93ca
Merge pull request #6215 from aschackmull/java/fix-csv-subtype-interpretation
...
Java: Fix CSV subtype interpretation
2021-07-14 09:57:21 +01:00
Sauyon Lee
51211c0394
Add stubs
2021-07-13 10:29:02 -07:00
Sauyon Lee
c2c7fee8df
Fix tests
2021-07-13 10:29:02 -07:00
Sauyon Lee
b01e6d49fb
Add generated tests
2021-07-13 10:29:01 -07:00
Anders Schack-Mulligen
9388983e41
Java: Add missing stub.
2021-07-13 15:26:37 +02:00
Joe Farebrother
fc017b7934
Use ArrayElement of in flow step specifications
2021-07-02 14:46:31 +01:00
Anders Schack-Mulligen
3c6604daa7
Java: Fix subtypes interpretation.
2021-07-02 14:43:56 +02:00
Anders Schack-Mulligen
6813a79423
Java: Add test for override of Map.put highlighting problem.
2021-07-02 14:41:59 +02:00
Chris Smowton
a51154a8ef
Deduplicate Jexl configuration
2021-07-02 10:02:28 +01:00
Chris Smowton
747a8e4157
Split up JexlInjection.qll
...
This avoids a DataFlow2::Configuration being in scope for all queries via the import from ExternalFlow.qll
2021-07-02 10:01:51 +01:00
Anders Schack-Mulligen
80124df78e
Merge pull request #5487 from joefarebrother/sql-sinks
...
Java: Convert SQL sinks to CSV format
2021-07-02 10:51:09 +02:00
Chris Smowton
8b7db8a8cc
Merge pull request #5408 from p0wn4j/urlclassloader-webclient-ssrf-sinks
...
Java: Add URLClassLoader, WebClient SSRF sinks
2021-07-01 16:14:22 +01:00
Joe Farebrother
1e82c607ef
Mark failing tests as missing
2021-07-01 15:29:47 +01:00
Chris Smowton
e0a7f6e14f
Fix URLClassLoader test
2021-07-01 15:03:38 +01:00
Joe Farebrother
160f3b4312
Remove ArrayElement from sink specifications
2021-07-01 14:41:39 +01:00
Joe Farebrother
4bea33402c
Rename test labels for more clarity
2021-07-01 14:38:20 +01:00
Joe Farebrother
29f82fc81f
Use ArrayElementOf in Android sinks
2021-07-01 14:38:19 +01:00
Joe Farebrother
f4a59cc2e3
Convert tainted arrays to arrays of tainted elements in tests
2021-07-01 14:38:19 +01:00
Joe Farebrother
865477d020
Convert android tests to inline expectations
2021-07-01 14:38:19 +01:00
Joe Farebrother
7926d16844
Convert SQL sinks to CSV format
2021-07-01 14:38:19 +01:00
Anders Schack-Mulligen
cda5c22f6e
Merge pull request #5590 from github/sauyon/java-spring-errors
...
Add models for Spring validation.Errors
2021-07-01 14:29:49 +02:00
p0wn4j
0db7496617
Add URLClassLoader and Spring WebClient SSRF sinks
2021-07-01 03:34:14 +04:00
Tony Torralba
a3e1b139c3
Fix spring stubs location
2021-06-30 12:56:45 +02:00
Tony Torralba
0bb9e464b2
Merge branch 'main' into atorralba/spring-beans
2021-06-30 12:55:10 +02:00
Tony Torralba
9d64cadb50
Adapt tests after applying changes from code review
2021-06-30 10:02:03 +02:00
Anders Schack-Mulligen
374859efb4
Merge pull request #6156 from smowton/smowton/feature/jax-rs-content-type-sensitivity
...
Jax RS XSS Tests
2021-06-30 09:52:07 +02:00
Sauyon Lee
52b24118b3
Add tests for Spring validation.Errors
2021-06-29 12:01:23 -07:00
Sauyon Lee
aa0fbce28e
Remove unnecessary code from stubs
2021-06-29 05:51:38 -07:00
Sauyon Lee
534ab86900
Add models for Spring validation.Errors
2021-06-29 05:51:21 -07:00
Sauyon Lee
fe2b73ed72
Stub more of Spring
2021-06-29 05:51:19 -07:00
Chris Smowton
48d4493146
Fix test indentation
2021-06-29 12:42:20 +01:00
Chris Smowton
9551321592
Fix LinkedMultiValueMap models and make tests more realistic
2021-06-29 12:40:57 +01:00
Chris Smowton
60179ce8f0
Genericise MultiValueMaps; remove non-longer-needed casts
2021-06-29 12:32:22 +01:00
Chris Smowton
916c7c576d
Remove superfluous (Object) casts
2021-06-29 12:28:42 +01:00
Chris Smowton
71f6d59646
Genericise test util functions
2021-06-29 12:27:03 +01:00
Chris Smowton
60126b406f
Clean up test
...
Remove unused import; drop unused util methods and needless casts.
2021-06-29 12:20:47 +01:00
Anders Schack-Mulligen
1bd01a5eee
Update java/ql/test/library-tests/frameworks/spring/util/test.ql
2021-06-29 13:13:09 +02:00
Chris Smowton
3d270bbc50
Drop models for stringifying functions
...
Per default stringification isn't taint-propagating in Java
2021-06-29 12:01:08 +01:00
Chris Smowton
0441098b18
Amend models of MultiValueMap.addAll overloads
2021-06-29 11:58:46 +01:00
Chris Smowton
5769f4718f
Add missing CollectionUtils model
2021-06-29 11:44:29 +01:00
Chris Smowton
f7a4614f56
Add missing tests for AntPathMatcher's protected methods; fix models accordingly
2021-06-29 11:35:25 +01:00
Chris Smowton
dd70f2c87e
Add spurious results now found in JaxXSS.java
2021-06-28 19:24:19 +01:00
Chris Smowton
768a8e78dd
Fixup JaxRs.ql to cope with stubbed MediaType file
...
In a real-world situation this type would be defined in an imported jar, but since here it is defined in a stub the getADeclaredContentType routine can see it is defined as an empty string in the stubbed implementation. Filter these out so the test more closely resembles the real situation.
2021-06-28 19:24:19 +01:00
Chris Smowton
8eaffaff35
Fix test mistakes
2021-06-28 19:24:19 +01:00
