Tony Torralba
eecab9122a
Recognize the model generator involvement in the models' provenances
2024-03-14 08:56:23 +01:00
Tony Torralba
5b88b8a3ed
A few more neutrals
2024-03-14 08:53:58 +01:00
Tony Torralba
36f6a6fb10
Model more EnumSet methods as neutrals
2024-03-14 08:46:43 +01:00
Tamas Vajk
b5f349bd2c
C#: Handle namespace resolution error more gracefully
2024-03-14 08:37:22 +01:00
Jeroen Ketema
b2e0485c94
Merge pull request #15908 from jketema/destructors12
...
C++: suppress destructors with reuse expressions until proper support is added
2024-03-14 07:41:59 +01:00
Jami Cogswell
e285cf232c
Java: add resource-related methods as path-injection sinks and as summaries
2024-03-13 22:48:57 -04:00
Mathias Vorreiter Pedersen
a839c92979
C++: Fix mapping issue between dataflow nodes and expressions when the expression is a prvalue.
2024-03-13 22:59:09 +00:00
Mathias Vorreiter Pedersen
2fc0922b29
Merge branch 'main' into bring-back-type-barriers-in-non-constant-format
2024-03-13 22:46:35 +00:00
Mathias Vorreiter Pedersen
d1c253b519
C++: Accept test changes.
2024-03-13 22:41:32 +00:00
Mathias Vorreiter Pedersen
61597f5ac7
C++: This commit does two things:
...
1. It fixes a logic error in the cannotContainString predicate.
2. It reverts the changes to the `isSource` predicate that required the external
function to be within the source root.
The change to `isSource` was meant to fix the a performance problem that occurred
because of the logic error in the cannotContainString predicate. However, now that
the logic error is fixed this is no longer necessary 🎉
2024-03-13 22:40:06 +00:00
jorgectf
446a2dc267
Add security sinks
2024-03-13 23:22:13 +01:00
Alvaro Muñoz
872b1f88f0
More regexp improvements
2024-03-13 22:47:19 +01:00
erik-krogh
ef8368cfc4
fix typo
2024-03-13 22:37:13 +01:00
Alvaro Muñoz
0e50204672
More regexp improvements
2024-03-13 22:19:55 +01:00
Jami Cogswell
1b01f26d09
Java: adjust BarrierPrefix to handle prepended chars
2024-03-13 16:28:45 -04:00
Jami Cogswell
5ac453eb38
Java: add spurious test case for StringBuilder.append
2024-03-13 16:28:45 -04:00
Jami Cogswell
04d27f2d65
Java: adjust prefix barriers
2024-03-13 16:28:44 -04:00
Jami Cogswell
e99cea340b
Java: update UrlPathBarrier to include FollowsBarrierPrefix
2024-03-13 16:28:44 -04:00
Jami Cogswell
c5a59d6c51
Java: add QLDoc
2024-03-13 16:28:44 -04:00
Jami Cogswell
7310c155e2
Java: rename SpringUrlForwardSink
2024-03-13 16:28:44 -04:00
Jami Cogswell
a002674587
Java: clean up comments on test cases
2024-03-13 16:28:44 -04:00
Jami Cogswell
a8075969d8
Java: add QLDocs to UrlPathBarrier code
2024-03-13 16:28:44 -04:00
Jami Cogswell
042dcf9cd9
Java: some updates to UrlPathBarrier code
2024-03-13 16:28:44 -04:00
Jami Cogswell
052452b186
Java: create UrlDecodeMethod
2024-03-13 16:28:44 -04:00
Jami Cogswell
d220b3a298
Java: some updates to test cases
2024-03-13 16:28:43 -04:00
Jami Cogswell
d9772c1880
Java: update change note
2024-03-13 16:28:43 -04:00
Jami Cogswell
43b49628fc
Java: use new 'SimpleTypeSanitizer', and update some non-extending subtype relationships
2024-03-13 16:28:43 -04:00
Jami Cogswell
2708e53c7f
Java: remove redundant imports
2024-03-13 16:28:43 -04:00
Jami Cogswell
f573032b2e
Java: remove todo comments from ext files
2024-03-13 16:28:43 -04:00
Jami Cogswell
911a61df22
Java: initial update of barrier and test cases to remove FN
2024-03-13 16:28:42 -04:00
Jami Cogswell
c8ec301793
Java: add change note
2024-03-13 16:28:42 -04:00
Jami Cogswell
e75c96c0f9
Java: combine test cases; add test for StaplerResponse.forward
2024-03-13 16:28:41 -04:00
Jami Cogswell
5fa63ab5c2
Java: update/add some TODO comments
2024-03-13 16:28:41 -04:00
Jami Cogswell
c331393cfd
Java: update qhelp
2024-03-13 16:28:41 -04:00
Jami Cogswell
09bc21dbd3
Java: rename 'UnsafeUrlForward' to 'UrlForward'
2024-03-13 16:28:41 -04:00
Jami Cogswell
6e7c05467b
Java: update query metadata and alert message
2024-03-13 16:28:41 -04:00
Jami Cogswell
5a9d7552b3
Java: add some comments and minor code reorg
2024-03-13 16:28:41 -04:00
Jami Cogswell
1da1e896cb
Java: convert SpringModelAndViewSink to MaD
2024-03-13 16:28:41 -04:00
Jami Cogswell
8d66097483
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
2024-03-13 16:28:41 -04:00
Jami Cogswell
42e3825ea3
Java: convert RequestDispatcherSink to MaD
2024-03-13 16:28:40 -04:00
Jami Cogswell
4ff884e26c
Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)
2024-03-13 16:28:40 -04:00
Jami Cogswell
2a682995ae
Java: move MaD models to correct files, delete ones that already exist
2024-03-13 16:28:40 -04:00
Jami Cogswell
915e106ab3
Java: remove path-injection related models and tests for now
2024-03-13 16:28:40 -04:00
Jami Cogswell
35a083ae9e
Java: update test cases to use inline expectations
2024-03-13 16:28:40 -04:00
Jami Cogswell
2793f28428
Java: move config to Query.qll file
2024-03-13 16:28:40 -04:00
Jami Cogswell
0d38a9625e
Java: copy files from experimental
2024-03-13 16:28:39 -04:00
Asger F
eff5f3b7d6
JS: Remove duplicate dependency from qlpack.yml
2024-03-13 20:43:44 +01:00
Jeroen Ketema
866a3934d4
C++: suppress destructors with reuse expressions until proper support is added
2024-03-13 20:17:00 +01:00
Tom Hvitved
54fa8181da
Address review comment
2024-03-13 20:03:01 +01:00
Alvaro Muñoz
87b284e5e6
update
2024-03-13 19:14:57 +01:00
