Anders Schack-Mulligen
b556590ef8
Merge pull request #17663 from aschackmull/dataflow/speculative-flow
...
Dataflow: Add support for speculative taint flow.
2024-10-31 08:12:43 +01:00
Michael Nebel
786d04e939
Java: Add the clone method to the model generation exclusions.
2024-10-21 15:19:43 +02:00
Anders Schack-Mulligen
c20f12fa6c
Add qldoc.
2024-10-16 14:35:23 +02:00
Anders Schack-Mulligen
8b99154a00
Java: Add support for speculative taint flow.
2024-10-16 14:35:19 +02:00
Anders Schack-Mulligen
c80627a3d3
Dataflow: add plumbing for adding provenance to state-steps.
2024-10-16 14:35:18 +02:00
Anders Schack-Mulligen
6081ba5902
Merge pull request #17604 from aschackmull/java/neutral-overrides
...
Java/C#: Add overrides to the interpretation of neutral MaD models.
2024-10-01 14:55:54 +02:00
Anders Schack-Mulligen
ec0bd4494c
Java: Add overrides to the interpretation of neutral MaD models.
2024-09-30 13:11:49 +02:00
Rasmus Wriedt Larsen
381ea93ec3
Merge pull request #17424 from RasmusWL/active-threat-model-source
...
Go/Java/C#: Rename `ThreatModelFlowSource` to `ActiveThreatModelSource`
2024-09-26 13:08:17 +02:00
Michael Nebel
dd993c3900
Merge pull request #17509 from michaelnebel/modelgen/parammodule
...
C#/Java: Re-factor the model generator to be a parameterized module.
2024-09-26 10:57:16 +02:00
Chuan-kai Lin
1cd8af54f2
Merge pull request #17190 from github/cklin/diff-informed-java-queries
...
Java: add support for alert location restrictions
2024-09-23 08:39:24 -07:00
Rasmus Wriedt Larsen
63c3a71d95
Merge branch 'main' into active-threat-model-source
2024-09-23 11:18:14 +02:00
Anders Schack-Mulligen
3a1e50dcf9
Dataflow: Simplify diff-informed implementation and tweak flag name.
2024-09-20 07:07:10 -07:00
Michael Nebel
2033818e39
Java: Use the shared model generator implementation.
2024-09-19 12:20:51 +02:00
Anders Schack-Mulligen
2837d2551a
Merge pull request #17490 from aschackmull/java/capture-in-obinit
...
Java: Fix support for variable capture inside object initializers.
2024-09-18 09:29:01 +02:00
Anders Schack-Mulligen
20661a3c56
Java: Fix support for variable capture inside object initializers.
2024-09-17 10:42:21 +02:00
Ian Lynagh
41ed6e6695
Java: Deprecate RefType.nestedName(), and add RefType.getNestedName()
2024-09-16 17:16:25 +01:00
Rasmus Wriedt Larsen
8c10155eb7
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
Chuan-kai Lin
ff78bebf19
Shared support for alert filtering
2024-09-11 13:18:26 -07:00
Rasmus Wriedt Larsen
038bc832a7
Go/Java/C#: Rename to ActiveThreatModelSource
...
As part of adding support for threat-models to Python/JS (see
https://github.com/github/codeql/pull/17203 ), we ran into some trouble
with name clashes.
Naming in existing languages supporting threat-models:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)
However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and we had to come up with new names.
Initially I used `ThreatModelSource` for the "QL only modeling", but
that meant that we needed a new name to represent the active sources
coming from either QL or data-extensions... for this I came up with
`ActiveThreatModelSource`, and I really liked it. To me, it's much
clearer that this class only contains the currently active threat
model sources.
So to align languages, I got approval from @michaelnebel to rename the
existing classes.
2024-09-10 14:46:15 +02:00
Michael Nebel
a5b462292f
Merge pull request #17330 from michaelnebel/java/modelgenfieldbased
...
Java/C#: Field based model generator (Experimental).
2024-09-06 11:11:46 +02:00
erik-krogh
0fdd06fff5
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
Michael Nebel
4bdf21b022
Java: Add Content Flow module.
2024-09-03 09:45:07 +02:00
Michael Nebel
e8595e28e9
Update java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2024-08-28 15:04:38 +02:00
Michael Nebel
8f734ad1b2
Java: Tighten the criteria for when we disregard generated models.
2024-08-27 14:48:11 +02:00
Michael Nebel
fe6693739a
Java: Make more finegrained dataflow dispatch viable callable heuristic.
2024-08-27 13:27:52 +02:00
Anders Schack-Mulligen
993bfee096
Merge pull request #17259 from aschackmull/dataflow/remove-srcsink-grouping
...
Dataflow: Remove src/sink grouping feature
2024-08-20 14:42:33 +02:00
Anders Schack-Mulligen
8470e91c16
Legacy Dataflow: Sync.
2024-08-20 10:07:57 +02:00
Rasmus Wriedt Larsen
1e12c11adc
Java: Model System.in as stdin threat-model
2024-08-15 15:37:35 +02:00
Michael Nebel
f0817dc07c
C#/Java: Use a parameterized module for making the source and sink callable classes.
2024-08-14 09:50:38 +02:00
Michael Nebel
4a5c9f0ec4
Merge pull request #17007 from michaelnebel/shared/neutralimplementation
...
C#/Java/Go: Neutrals are split into separate classes.
2024-08-12 13:58:12 +02:00
Anders Schack-Mulligen
4d023f14a6
Merge pull request #17075 from RobbingDaHood/17052-second-try-do-not-expose-error-message
...
Java: 17052 Second try: do not expose error message
2024-08-02 12:44:27 +02:00
Anders Schack-Mulligen
da5250d3a7
Java: Pretty-print experimental models for qltest.
2024-07-30 11:43:44 +02:00
RobbingDaHood
feb31d2006
Merge branch 'main' into 17052-second-try-do-not-expose-error-message
2024-07-25 18:13:49 +02:00
Daniel Winther Petersen
1c1ba7734f
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
2024-07-25 18:12:45 +02:00
Jami
91f5f086fb
Merge pull request #17025 from jcogs33/jcogs33/java/adjust-url-syntheticfield
...
Java: add TaintInheritingContent for URL synthetic fields
2024-07-25 12:11:39 -04:00
Anders Schack-Mulligen
7a48fe1102
Dataflow: Replace ppReprType with DataFlowType.toString.
2024-07-25 13:08:47 +02:00
Owen Mansel-Chan
ff8bb2b1f8
Merge pull request #16760 from owen-mc/java/reverse-dns-separate-threat-model-kind
...
Java: make a separate threat model kind for reverse DNS sources
2024-07-23 10:08:52 +01:00
Jami Cogswell
4790656b79
Java: add TaintInheritingContent for URL synthetic fields
2024-07-20 23:03:32 -04:00
Michael Nebel
2796597d1a
Code quality improvements.
2024-07-19 09:36:17 +02:00
Michael Nebel
ca4bd0c606
C#/Java/Go: Neutrals are split into seperate classes.
2024-07-18 16:29:38 +02:00
Anders Schack-Mulligen
938f46b888
Java: Remove superfluous clone models.
2024-07-16 11:11:53 +02:00
Anders Schack-Mulligen
12d6875cc4
Java: Replace the MaD Object.clone() models with a non-aliasing value step.
2024-07-16 11:11:50 +02:00
Anders Schack-Mulligen
da5abc8321
Dataflow: Replace MakeSets with QlBuiltins::InternSets.
2024-07-15 13:35:57 +02:00
Owen Mansel-Chan
8241d0b7ef
Update QLDoc for ReverseDnsUserInput
2024-07-08 15:33:39 +01:00
Tom Hvitved
4ae8720930
SSA: Add BasicBlock.{getNode/1,length/0} to the input signature
2024-07-03 11:32:35 +02:00
Owen Mansel-Chan
91db2b6c9c
Make new threat model kind "reverse-dns"
2024-06-24 21:23:46 +01:00
Anders Schack-Mulligen
8c23e21073
Dataflow: Cache compatibleTypes.
2024-06-24 13:35:48 +02:00
Michael Nebel
197cdab43d
Merge pull request #16752 from michaelnebel/shared/sourcesinkcallables
...
C#/Java: Add some (shared) helper classes for Neutrals, Sources and Sink
2024-06-17 14:58:27 +02:00
Anders Schack-Mulligen
96b6ddefe0
Merge pull request #16751 from aschackmull/java/sndlevelscope-fix
...
Java: Calculate 2nd level scopes for implicit instance accesses.
2024-06-17 13:10:46 +02:00
Michael Nebel
833b4f90bf
Java: Make source and sink callable adapters.
2024-06-17 12:53:08 +02:00
