10119 Commits

Author	SHA1	Message	Date
Michael Nebel	a8ccc8d980	Java: Update MaD internal documentation.	2023-08-01 12:03:44 +02:00
Michael Nebel	fc66b6ef9c	Java: Update test comments to reflect the MaD syntax.	2023-08-01 12:03:44 +02:00
Michael Nebel	99ac98bffc	Java: Re-factor a model to use WithElement (this model is already tested in collections/B.java).	2023-08-01 12:03:44 +02:00
Michael Nebel	e97a4a1aea	Java: Update telemetry test expected output.	2023-08-01 12:03:44 +02:00
Michael Nebel	0604a85bb1	Java: Add WithoutElement model for List.clear and add appropriate test.	2023-08-01 12:03:44 +02:00
Michael Nebel	21ec83a197	Java: Add MaD support for With[out]Element.	2023-08-01 12:03:44 +02:00
github-actions[bot]	b547ae7c2f	Add changed framework coverage reports	2023-08-01 00:18:36 +00:00
Tony Torralba	5488abc512	Merge pull request #13850 from atorralba/atorralba/java/unimportant-generated-models ... Java: Remove superfluous generated models	2023-07-31 11:25:03 +02:00
Tony Torralba	41f1315da9	Merge pull request #13772 from atorralba/atorralba/java/inputstream-wrapper-read-step ... Java: Add taint steps for InputStream wrappers	2023-07-31 11:12:43 +02:00
Tony Torralba	3bd4d34a47	Java: Remove superfluous generated models	2023-07-31 09:48:03 +02:00
Stephan Brandauer	40eab180cc	Merge pull request #13823 from github/kaeluka/support-argument-this-in-frameworkmode-metadata-extraction ... Java: Support Argument[this] and parameters of bodiless interface methods in framework mode metadata extraction	2023-07-28 17:38:39 +02:00
Tony Torralba	08cba7dc5f	Merge pull request #13713 from pwntester/java/struts2_source_taint_inheriting ... [Java] Implement field taint inheritance for Struts2 unmarshalled objects	2023-07-28 16:46:27 +02:00
Owen Mansel-Chan	a020189895	Merge pull request #13822 from owen-mc/dataflow/mergepathgraph3-signature-fix ... Dataflow: MergePathGraph3 signature fix	2023-07-28 15:15:43 +01:00
Tony Torralba	2dff0ce5b4	Merge pull request #13712 from pwntester/java/new_struts2_models ... [Java] New models for Struts2 framework	2023-07-28 14:31:25 +02:00
Stephan Brandauer	8bf960bd44	Java: fix QL-for-QL alert	2023-07-28 14:28:47 +02:00
Stephan Brandauer	021eedfdf1	Java: format	2023-07-28 14:26:34 +02:00
Stephan Brandauer	82fd0e45aa	Java: support Argument[this] in NotAModelApiParameter	2023-07-28 14:04:53 +02:00
Stephan Brandauer	a9d2f43538	Java: use a newtype for framework mode candidates	2023-07-28 13:51:25 +02:00
Stephan Brandauer	8ed773b240	Java: Framework mode extraction now uses a custom class for endpoints, so we can support both Argument[this] and interface-method parameters	2023-07-28 12:56:39 +02:00
Stephan Brandauer	09c64e8fee	Java: Support Argument[this] in framework mode metadata extraction	2023-07-28 12:55:26 +02:00
Ian Lynagh	499bd970d3	Merge pull request #13412 from igfoo/igfoo/json_escape ... Kotlin: Tweak our JSON escaping	2023-07-28 11:13:51 +01:00
Alvaro Muñoz	c3a2ae2943	Account for public fields/setters	2023-07-28 12:12:07 +02:00
Tony Torralba	c239a4399c	Changed Struts2ActionSupportClassFieldReadSource to be a FieldValueNode instead of a field read	2023-07-27 10:39:06 +02:00
Alvaro Muñoz	97a4230d5d	add change note	2023-07-27 10:39:06 +02:00
Alvaro Muñoz	f3fc56294e	implement field taint inheritance for Struts2 unmarshalled objects	2023-07-27 10:39:06 +02:00
Tony Torralba	9d6bc76dc0	Merge pull request #13817 from atorralba/atorralba/java/non-static-fieldvaluenode-step ... Java: Allow flow out of FieldValueNodes for non-static fields	2023-07-27 09:14:04 +02:00
Owen Mansel-Chan	9b2b58a823	Sync files	2023-07-26 21:48:10 +01:00
Chris Smowton	c69a9ea032	Merge pull request #13793 from github/post-release-prep/codeql-cli-2.14.1 ... Post-release preparation for codeql-cli-2.14.1	2023-07-26 17:22:05 +01:00
Tony Torralba	8685242c16	Add tests	2023-07-26 14:13:43 +02:00
Stephan Brandauer	24cdc962c2	Merge pull request #13818 from github/kaeluka/fix-erroneous-endpoints-that-are-sinks-and-summary-neutrals ... Java: Automodel Fix, Prevent Some Erroneous Endpoints	2023-07-26 12:45:29 +02:00
Tony Torralba	602eb43109	Update partial flow test expectations	2023-07-26 09:32:13 +02:00
Ian Lynagh	532552a7ac	Merge pull request #13751 from igfoo/igfoo/getCompilationInfo ... Java: Improve the diagnostics consistency query	2023-07-25 16:54:17 +01:00
Stephan Brandauer	08f5774d13	Java: Automodel extraction fix for application mode	2023-07-25 17:11:07 +02:00
Stephan Brandauer	698b8d3c5c	Java: Automodel extraction fix; previously, we treated endpoints that were marked as sinks, as well as summary-neutrals as 'erroneous'	2023-07-25 16:52:27 +02:00
Tony Torralba	b8b38e4bbe	Java: Allow flow out of FieldValueNodes for non-static fields	2023-07-25 15:37:41 +02:00
Tony Torralba	c9fc5a54c7	Remove generated sinks and sources	2023-07-25 14:42:32 +02:00
Stephan Brandauer	2582b084f6	Merge pull request #13747 from github/tausbn/exclude-qualifier-argument-for-existing-models ... Java: Exclude qualifier argument for existing models	2023-07-24 16:26:33 +02:00
Stephan Brandauer	13027a1094	Java: review suggestions from @atorralba	2023-07-24 14:09:10 +02:00
Stephan Brandauer	2f2f507a5d	Java: drive-by change: remove obsolete custom queries from application mode characteristics	2023-07-24 13:55:53 +02:00
Tony Torralba	6c0d47f122	Update java/ql/lib/semmle/code/java/frameworks/InputStream.qll ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2023-07-24 08:49:37 +02:00
Tony Torralba	4e7438ac5c	Make sure that InputStreamWrapperCapturedLocalStep is indeed local	2023-07-24 08:49:37 +02:00
Tony Torralba	d3b3af8ae6	Re-adds jump step ... Note that this causes FP flow in the call context test cases	2023-07-24 08:49:37 +02:00
Tony Torralba	36ff54b48b	Convert jump step into local step ... Note that this has FNs in the test cases where the source is used locally in the nested classes' methods	2023-07-24 08:49:37 +02:00
Tony Torralba	cc5a404149	Add more test cases	2023-07-24 08:49:36 +02:00
Tony Torralba	226103b246	Add local class test	2023-07-24 08:49:36 +02:00
Tony Torralba	f054f73836	Apply suggestions from code review ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2023-07-24 08:49:36 +02:00
Tony Torralba	1de68457ae	Move steps to InputStream.qll	2023-07-24 08:49:36 +02:00
Tony Torralba	0156fcc381	Apply suggestions from code review ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2023-07-24 08:49:36 +02:00
Tony Torralba	3a6665b0ed	Add change note	2023-07-24 08:49:36 +02:00
Tony Torralba	5330ce12cc	Use new TypeInputStream	2023-07-24 08:49:34 +02:00