Owen Mansel-Chan
a5d9cb179a
Merge pull request #20930 from owen-mc/java/spring-rest-template-request-forgery-sinks
...
Java: add more Spring RestTemplate request forgery sinks
2026-01-15 14:23:15 +00:00
Owen Mansel-Chan
a85d0ea8a3
Make tests pass
2025-12-02 17:08:16 +00:00
Owen Mansel-Chan
8fd8fc07b7
Add failing tests for more regex match methods
2025-12-02 17:06:34 +00:00
Owen Mansel-Chan
969b0cf439
Add SSRF sinks for uriVariables arguments of more methods on Spring RestTemplate
2025-11-27 23:44:35 +00:00
Nora Dimitrijević
aac4f63e9a
Java: convert RequestForgery test to .qlref
2025-06-24 16:42:32 +02:00
Jeroen Ketema
89d20fd086
Java: Update expected test results
2024-12-03 19:18:59 +01:00
Jeroen Ketema
49993b023e
Java: Rewrite inline expectation tests to use parameterized module
2023-06-09 10:42:17 +02:00
Chris Smowton
8b080a94e7
Convert request forgery tests to inline expectations; add missing models revealed by this process.
2021-06-17 11:43:32 +01:00
Chris Smowton
49bbfc3f4b
Convert SSRF sinks into url-open CSV sinks
...
I also drop the previous approach of taint-tracking through various builder objects in favour of assuming that a URI set in a request-builder object is highly likely to end up requested in some way or another.
This will cause the `java/non-https-url` query to pick the new sinks up too, and fixes a Spring case that had never worked but went unnoticed until now.
2021-06-17 11:43:30 +01:00
Chris Smowton
55c72cebf2
Improve StringBuilder append chain tracking
...
Previously this didn't catch the case of constructors chaining directly into appends, like `StringBuilder sb = new StringBuilder("1").append("2")`
2021-06-17 11:41:06 +01:00
Chris Smowton
1549993565
Update test results to account for changed model structure
...
(Models now have internal nodes in order to allow field flow through them)
2021-06-17 11:41:05 +01:00
Chris Smowton
575198a0e4
Java SSRF query: Server Side -> Server-Side everywhere.
2021-06-17 11:41:04 +01:00
Chris Smowton
77904d9597
Remove failing test
...
The case where something might be exactly a constant is general across all queries, and not handled yet, particularly in the case where the result of `getParameter("uri")` might have changed between the check and the use.
2021-06-17 11:41:04 +01:00
Chris Smowton
b5a450b881
SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.
2021-06-17 11:41:03 +01:00
Chris Smowton
487c1db6ed
Promote SSRF query to main query set
2021-06-17 11:41:01 +01:00
