Tony Torralba
b20d53cfd4
Update java/ql/src/semmle/code/java/security/OgnlInjection.qll
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-07-29 15:08:27 +02:00
Tony Torralba
3259ead946
Decouple OgnlInjection.qll to reuse the taint tracking configuration
2021-07-20 17:21:10 +02:00
Tony Torralba
b6904a7992
Merge branch 'main' into atorralba/promote-ognl-injection
2021-07-20 17:17:17 +02:00
Anders Schack-Mulligen
db76b12f3f
Merge pull request #6313 from aschackmull/java/fix-csv-dispatch
...
Java: Fix a bug in call-context-sensitve dispatch to SummarizedCallable.
2021-07-19 12:49:31 +02:00
Anders Schack-Mulligen
0b89f96055
Merge pull request #6318 from Marcono1234/patch-1
...
Java: Fix documentation mistake for `ProtoPom`
2021-07-19 11:25:06 +02:00
Anders Schack-Mulligen
d1f21a854a
Merge pull request #6042 from joefarebrother/spring-http
...
[Java] Model spring `http` package
2021-07-19 11:24:41 +02:00
Anders Schack-Mulligen
c32a75a1b3
Merge pull request #6183 from smowton/smowton/feature/javax-json-models
...
Add models of the jakarta/javax.json package
2021-07-19 11:19:21 +02:00
Marcono1234
87d6b9ca5a
Java: Fix documentation mistake for ProtoPom
2021-07-18 02:49:43 +02:00
Anders Schack-Mulligen
effca4495f
Java: Fix a bug in call-context-sensitve dispatch to SummarizedCallable.
2021-07-16 14:31:29 +02:00
Chris Smowton
7b984cc2b0
Add models for Apache Commons Lang's Mutable container
2021-07-15 14:58:25 +01:00
Anders Schack-Mulligen
5b7c2d133f
Merge pull request #6291 from aschackmull/java/csv-synthfield
...
Java: Add support for synthetic fields in csv rows.
2021-07-15 13:43:56 +02:00
Anders Schack-Mulligen
8ccdd4fb9f
Merge pull request #6211 from aschackmull/dataflow/refactor-call-context-check
...
Dataflow: Refactor call context check
2021-07-15 12:27:23 +02:00
Anders Schack-Mulligen
7339bd89ba
Java: Add support for synthetic fields in csv rows.
2021-07-15 12:19:34 +02:00
Joe Farebrother
e7e432d7fd
Fix incorrect row
2021-07-15 10:39:05 +01:00
Joe Farebrother
f3ab295f0f
Fix up tests
2021-07-15 10:34:21 +01:00
Joe Farebrother
df74a142dd
Update for collection flow and add more tests
2021-07-15 10:33:33 +01:00
Joe Farebrother
8f89d748fe
Add spring tests
2021-07-15 10:33:33 +01:00
Joe Farebrother
c1555b36a1
Add additional HTTP flow steps
2021-07-15 10:32:13 +01:00
Joe Farebrother
9b6213dbf0
Convert existing spring http steps to csv
2021-07-15 10:32:10 +01:00
Chris Smowton
0b2750828e
Add models for org.springframework.jdbc.object
...
Also add tests for the existing Spring JDBC SQL injection sinks in the process
2021-07-14 17:25:00 +01:00
Anders Schack-Mulligen
11fc23ba09
Merge pull request #6030 from smowton/smowton/admin/test-generator
...
Add test-generator script + add generated models for Spring summary steps
2021-07-14 14:44:07 +02:00
Sauyon Lee
d7bfc2eebf
Remove redundant model lines
2021-07-14 05:05:17 -07:00
Sauyon Lee
fc7e062deb
Java: Add models for the Spring cache package
2021-07-14 04:57:56 -07:00
Sauyon Lee
d9fb09d132
Java: Add models for the Spring ui package.
2021-07-14 04:57:56 -07:00
Anders Schack-Mulligen
04244b3c45
Merge pull request #5974 from github/sauyon/java/spring-webmultipart
...
Model Spring `web.multipart`
2021-07-14 13:57:24 +02:00
Anders Schack-Mulligen
3c4cd15738
Merge pull request #5505 from joefarebrother/android-sql-convert
...
Java: Convert Android SQL-related flow steps to CSV format
2021-07-14 13:56:55 +02:00
Chris Smowton
3ae99b93ca
Merge pull request #6215 from aschackmull/java/fix-csv-subtype-interpretation
...
Java: Fix CSV subtype interpretation
2021-07-14 09:57:21 +01:00
Anders Schack-Mulligen
0ccb213ec5
Dataflow: Sync.
2021-07-14 10:36:09 +02:00
Anders Schack-Mulligen
dbe1ca928b
Dataflow: Simplify call context checks.
2021-07-14 10:36:09 +02:00
Anders Schack-Mulligen
c95e78546c
Dataflow: Refactor
2021-07-14 10:36:09 +02:00
Sauyon Lee
b807757863
Model Spring web.multipart
2021-07-13 10:29:01 -07:00
Tom Hvitved
7e9d87055d
Data flow: Sync
2021-07-13 16:15:00 +02:00
Anders Schack-Mulligen
0f6f020766
Java: Fix models.
2021-07-13 15:23:19 +02:00
Chris Smowton
78fe0f810a
Add models for decode/encodePointer methods
2021-07-13 11:10:46 +01:00
Chris Smowton
2bd58d6ba7
Improve header comment
2021-07-12 18:09:23 +01:00
Chris Smowton
cc4401b453
Add models of JsonPointer, JsonMergeDiff and JsonPatchBuilder
2021-07-12 18:08:45 +01:00
Chris Smowton
539859497b
Add models of JsonMergePatch, JsonPatchBuilder and JsonPointer
2021-07-12 17:39:51 +01:00
Chris Smowton
6bf931392b
Add missing model of JsonObjectBuilder.remove
2021-07-12 17:13:39 +01:00
Tom Hvitved
47d126e681
Data flow: Sync
2021-07-12 12:09:51 +02:00
Joe Farebrother
4d459f24d9
Fix up tests and update models
2021-07-02 14:46:33 +01:00
Joe Farebrother
fc017b7934
Use ArrayElement of in flow step specifications
2021-07-02 14:46:31 +01:00
Joe Farebrother
15415931ce
Use Argument ranges in CSV rows
2021-07-02 14:46:03 +01:00
Joe Farebrother
5325622813
Convert sql-related flow steps to CSV
2021-07-02 14:46:03 +01:00
Anders Schack-Mulligen
3c6604daa7
Java: Fix subtypes interpretation.
2021-07-02 14:43:56 +02:00
Anders Schack-Mulligen
55ebbc3e01
Java: Add signature to Map.put.
2021-07-02 14:41:32 +02:00
Chris Smowton
a51154a8ef
Deduplicate Jexl configuration
2021-07-02 10:02:28 +01:00
Chris Smowton
bbd3ecb768
Add docs to RandomQuery.qll
2021-07-02 10:02:28 +01:00
Chris Smowton
e661fc08d3
Split Android XSS sink defintions out of XSS.qll
...
This removes one of the routes by which XSS.qll is always in scope, and so its dataflow configuration is too -- however it is still always in scope because JaxWS.qll imports it.
2021-07-02 10:02:25 +01:00
Chris Smowton
747a8e4157
Split up JexlInjection.qll
...
This avoids a DataFlow2::Configuration being in scope for all queries via the import from ExternalFlow.qll
2021-07-02 10:01:51 +01:00
Chris Smowton
643f7dfb87
Split up Random.qll
...
This prevents bringing a dataflow config into scope from utility libraries.
2021-07-02 10:00:49 +01:00
