Commit Graph

12634 Commits

Author SHA1 Message Date
Chris Smowton
8f345f9618 Copyedit Java change note 2024-09-16 12:22:20 +01:00
github-actions[bot]
acdafd9646 Release preparation for version 2.19.0 2024-09-16 10:56:10 +00:00
Dave Bartolomeo
485fc04029 Initial merge from main 2024-09-15 08:55:31 -04:00
Rasmus Wriedt Larsen
66b61ee25a Go/Java/C#: Add change-note 2024-09-12 10:16:55 +02:00
Rasmus Wriedt Larsen
8c10155eb7 mass rename to ActiveThreatModelSource 2024-09-12 10:16:55 +02:00
Chuan-kai Lin
ff78bebf19 Shared support for alert filtering 2024-09-11 13:18:26 -07:00
Michael Nebel
0fbeca14ad Java: Add content based example with multiple paths. 2024-09-10 15:23:44 +02:00
Michael Nebel
9149a17d79 Java: Only keep the best generated model in terms of taint/value. 2024-09-10 15:23:38 +02:00
Michael Nebel
d7e61d07d1 Java: Update some model generator test cases. 2024-09-10 15:23:34 +02:00
Michael Nebel
d2c98c86dc Java: Improve content based model generation. 2024-09-10 15:23:20 +02:00
Rasmus Wriedt Larsen
038bc832a7 Go/Java/C#: Rename to ActiveThreatModelSource
As part of adding support for threat-models to Python/JS (see
https://github.com/github/codeql/pull/17203), we ran into some trouble
with name clashes.

Naming in existing languages supporting threat-models:
- `SourceNode` (for QL only modeling)
- `ThreatModelFlowSource` (for active sources from QL or data-extensions)

However, since we use `LocalSourceNode` in Python, and `SourceNode` in
JS (for local source nodes), it seems a bit confusing to follow the same
naming convention as other languages, and we had to come up with new names.

Initially I used `ThreatModelSource` for the "QL only modeling", but
that meant that we needed a new name to represent the active sources
coming from either QL or data-extensions... for this I came up with
`ActiveThreatModelSource`, and I really liked it. To me, it's much
clearer that this class only contains the currently active threat
model sources.

So to align languages, I got approval from @michaelnebel to rename the
existing classes.
2024-09-10 14:46:15 +02:00
github-actions[bot]
97edff3f70 Post-release preparation for codeql-cli-2.18.4 2024-09-09 18:45:46 +00:00
github-actions[bot]
91537cdf9a Release preparation for version 2.18.4 2024-09-09 16:08:48 +00:00
Michael Nebel
a5b462292f Merge pull request #17330 from michaelnebel/java/modelgenfieldbased
Java/C#: Field based model generator (Experimental).
2024-09-06 11:11:46 +02:00
Michael Nebel
e1048cf8ea Java/C#: Address review comments. 2024-09-05 19:23:05 +02:00
Erik Krogh Kristensen
8508056e72 Merge pull request #17349 from erik-krogh/del-deps-sep-2024
All: delete outdated deprecations
2024-09-04 14:18:31 +02:00
Cornelius Riemenschneider
05ffb47711 Merge pull request #17334 from github/criemen/rename-java
Java: Rename integration test directories.
2024-09-04 12:51:51 +02:00
Erik Krogh Kristensen
4258119ba3 Merge branch 'main' into del-deps-sep-2024 2024-09-04 12:43:41 +02:00
github-actions[bot]
3eeb79c599 Add changed framework coverage reports 2024-09-04 00:19:10 +00:00
erik-krogh
e2b16bd8f9 add some change-notes 2024-09-03 22:06:07 +02:00
erik-krogh
e76dcf9df9 delete a test for a deleted file 2024-09-03 20:31:01 +02:00
erik-krogh
846882d22c delete imports to a deleted file 2024-09-03 20:31:00 +02:00
erik-krogh
20dfdc9661 delete some deprecated files 2024-09-03 20:30:59 +02:00
erik-krogh
0fdd06fff5 use my script to delete outdated deprecations 2024-09-03 20:30:58 +02:00
Michael Nebel
5ddcb16cd6 Java: Add content based model generation test. 2024-09-03 12:58:01 +02:00
Cornelius Riemenschneider
2dfca8ab20 Merge branch 'main' into criemen/rename-java 2024-09-03 11:04:29 +02:00
Michael Nebel
6365e5edff Java: Initial implementation of content based model generation. 2024-09-03 09:45:11 +02:00
Michael Nebel
4bdf21b022 Java: Add Content Flow module. 2024-09-03 09:45:07 +02:00
Cornelius Riemenschneider
321820e758 Java: Rename integration test directories.
We are no longer bound to the platform-specific directories, so simplify the test organization.
If you don't want this change, just skip merging this PR. It's purely optional.

I kept the platform-specific directories around under `kotlin`,
but you could also easily merge all these together if you find them unhelpful.
I'll leave that change to you.
2024-08-30 10:28:25 +02:00
Henry Mercer
3490067316 Merge branch 'main' into henrymercer/rc-3.15-mergeback 2024-08-29 19:48:01 +01:00
Cornelius Riemenschneider
5ecc6f9dc8 Merge remote-tracking branch 'origin/main' into criemen/pytest-java 2024-08-29 16:43:46 +02:00
Cornelius Riemenschneider
dd7f757281 Address review. 2024-08-29 16:43:27 +02:00
Michael Nebel
53b2471c9d Java: Update expected test output. 2024-08-29 09:03:46 +02:00
Michael Nebel
fa5d6f12be Java: Update logging test expected output. 2024-08-28 16:16:16 +02:00
Michael Nebel
bd5529cefa Java: Update the Byte- and CharBuffer models and add models for set- and getParameters on LogRecord. 2024-08-28 16:15:09 +02:00
Michael Nebel
395656a1cf Java: Extend the logging test with a test case for parameters. 2024-08-28 16:13:32 +02:00
Michael Nebel
e8595e28e9 Update java/ql/lib/semmle/code/java/dataflow/internal/DataFlowDispatch.qll
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
2024-08-28 15:04:38 +02:00
Michael Nebel
15b06907dd Java: Updated expected test output. 2024-08-27 14:48:14 +02:00
Michael Nebel
8f734ad1b2 Java: Tighten the criteria for when we disregard generated models. 2024-08-27 14:48:11 +02:00
Michael Nebel
021fd1450e Java: Add some dispatch examples to the external flow step test. 2024-08-27 14:48:03 +02:00
Michael Nebel
43b52a0921 Java: Add change note. 2024-08-27 13:28:18 +02:00
Michael Nebel
7488cc0811 Java: Updated expected test output. 2024-08-27 13:28:13 +02:00
Michael Nebel
d79aa294ec Java: Move some neutrals into the model.yml file (they have previosly been ignored due to wrong file extension). 2024-08-27 13:28:09 +02:00
Michael Nebel
db51604f46 Java: Promote some generated models and add some manual neutrals. 2024-08-27 13:28:05 +02:00
Michael Nebel
6cb5e13a23 Java: Re-factor tests and update expected test output. 2024-08-27 13:28:00 +02:00
Michael Nebel
68880b2056 Java: Update expected test output. Generated models are no longer applied as there exist a source implementation. 2024-08-27 13:27:55 +02:00
Michael Nebel
fe6693739a Java: Make more finegrained dataflow dispatch viable callable heuristic. 2024-08-27 13:27:52 +02:00
Cornelius Riemenschneider
1c3b9f7031 Delete legacy test utils. 2024-08-27 13:14:24 +02:00
Cornelius Riemenschneider
c69df1a6e3 Port java integration tests to pytest.
Some notes:
* These tests rely on a variety of fixtures
* The previous maven-wrapper checks were checking for the version of maven installed by looking at the checked-in wrapper script. I dropped this behavior.
* I replaced a lot of test queries that queried for a (subset of) source archive files with the source_archive fixture. In particular, tests that excluded properties files from being listed in the expected output now include them.
   It's much faster to generate this list via the fixture instead of using CodeQL for it.
2024-08-27 13:14:23 +02:00
Cornelius Riemenschneider
5fa30c33b8 Remove legacy java files. 2024-08-27 13:14:21 +02:00