Java: Promote Unsafe URL Forward query from experimental#14854

Merged

jcogs33 merged 40 commits into

github:mainfrom

jcogs33:jcogs33/unsafe-url-forward-promotion

Mar 29, 2024

Commits on Mar 13, 2024

Java: copy files from experimental

Jami Cogswell
authored and
Jami Cogswell
committed
Java: move config to Query.qll file

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update test cases to use inline expectations

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove path-injection related models and tests for now

Jami Cogswell
authored and
Jami Cogswell
committed
Java: move MaD models to correct files, delete ones that already exist

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)

Jami Cogswell
authored and
Jami Cogswell
committed
Java: convert RequestDispatcherSink to MaD

Jami Cogswell
authored and
Jami Cogswell
committed
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink

Jami Cogswell
authored and
Jami Cogswell
committed
Java: convert SpringModelAndViewSink to MaD

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add some comments and minor code reorg

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update query metadata and alert message

Jami Cogswell
authored and
Jami Cogswell
committed
Java: rename 'UnsafeUrlForward' to 'UrlForward'

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update qhelp

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update/add some TODO comments

Jami Cogswell
authored and
Jami Cogswell
committed
Java: combine test cases; add test for StaplerResponse.forward

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add change note

Jami Cogswell
authored and
Jami Cogswell
committed
Java: initial update of barrier and test cases to remove FN

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove todo comments from ext files

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove redundant imports

Jami Cogswell
authored and
Jami Cogswell
committed
Java: use new 'SimpleTypeSanitizer', and update some non-extending subtype relationships

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update change note

Jami Cogswell
authored and
Jami Cogswell
committed
Java: some updates to test cases

Jami Cogswell
authored and
Jami Cogswell
committed
Java: create UrlDecodeMethod

Jami Cogswell
authored and
Jami Cogswell
committed
Java: some updates to UrlPathBarrier code

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add QLDocs to UrlPathBarrier code

Jami Cogswell
authored and
Jami Cogswell
committed
Java: clean up comments on test cases

Jami Cogswell
authored and
Jami Cogswell
committed
Java: rename SpringUrlForwardSink

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add QLDoc

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update UrlPathBarrier to include FollowsBarrierPrefix

Jami Cogswell
authored and
Jami Cogswell
committed
Java: adjust prefix barriers

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add spurious test case for StringBuilder.append

Jami Cogswell
authored and
Jami Cogswell
committed
Java: adjust BarrierPrefix to handle prepended chars

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Mar 15, 2024

Java: performance fix

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Mar 18, 2024

Java: remove experimental files

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove experimental tests

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Mar 27, 2024

Java: remove redundant line

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove parentheses

Jami Cogswell
authored and
Jami Cogswell
committed
Java: use InlineFlowTest instead of InlineExpectationsTest

Jami Cogswell
authored and
Jami Cogswell
committed
Java: move UrlForward.qll code to UrlForwardQuery.qll

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Mar 28, 2024

docs wording updates

jcogs33
and
subatoi
authored