149 Commits (431a9beaf0868f253b813730539e387d33b6eac9)

Author SHA1 Message Date
Josh Berdine cfc1c8be36 [copyright] Remove years
6 years ago
Mehdi Bouaziz 5d1a213f52 [Hil] Fix failure in exception node
6 years ago
Mehdi Bouaziz f6c2bd3f61 [quandary] Insecure Intent Handling
6 years ago
Mehdi Bouaziz dfd725d46c [quandary] Also use summary for direct sources
6 years ago
Nikos Gorogiannis 8d855bdcdb [access paths] do not print class name of Java fields
6 years ago
Mehdi Bouaziz af6e4ff9d1 Fix quandary tests output
6 years ago
Mehdi Bouaziz 87b3907628 [quandary] Allow several kinds for external sources/sinks
6 years ago
Mehdi Bouaziz 9a4416f7d4 [quandary] String concatenation sanitizes class loading
6 years ago
Mehdi Bouaziz 174bdcd22b [quandary] Add class-loading sinks
6 years ago
Jeremy Dubreil 56709b4ccb [infer] the bug hash should also consider the anonymous classes in the qualifier
6 years ago
Mehdi Bouaziz 7c89d92851 [RFC] Format all java files
6 years ago
Jules Villard a29e769b61 [kill -a][1/4] stop using `-a foo` in the infer repo
6 years ago
Julian Sutherland dd4ee55d5a fixed error in java expected test results
6 years ago
Julian Sutherland b7c90c3fe0 Fixed incorrect reporting of tainted index in function call by quandary
6 years ago
Jeremy Dubreil d000a27bd4 [infer] use a fully qualified name for the procedure field in the final report
6 years ago
Martino Luca cccef6261d Revert "[Perf] Add cost information to the hashing function"
6 years ago
Martino Luca ac64be761f [Perf] Add cost information to the hashing function
6 years ago
Jules Villard 30c470eb48 [tests] record error bucket in expected output
7 years ago
Jules Villard 8b882ac1df Change license to MIT
7 years ago
Sam Blackshear 370f5c80e6 [quandary] only treat overrides of service methods as endpoints
7 years ago
Sam Blackshear bb2ff197b3 [absint] fix handling of exceptions
7 years ago
Sam Blackshear 30d7239aff [quandary] SQL sinks for java
7 years ago
Sam Blackshear 670ae4a673 [quandary] `WebResourceRequest.getUrl` as source
7 years ago
Sam Blackshear aabf8aec55 [quandary] use `_risk` warning types for endpoint sources in Java
7 years ago
Sam Blackshear 6d46b0c7be [cleanup] stop printing `&`'s on `Var.t`'s
7 years ago
Sam Blackshear b57aa90d7d [quandary] don't crash if JSON source/sink is invalid procedure name
7 years ago
Sam Blackshear 4952f1ea3b [quandary] tests documenting limitations of sanitizers
7 years ago
Sam Blackshear d720eb52ba [quandary] check for subclassing in externally specified sources/sinks
7 years ago
Jeremy Dubreil d74f189dfe [infer] add the report kind to the list of expected output
7 years ago
Sam Blackshear 66d03869ab [quandary] don't treat private Java methods as endpoints
7 years ago
Sam Blackshear 71a3843746 Revert occurence counting change
7 years ago
Sam Blackshear 37ab9ec391 [quandary] ProcessBuilder as sink
7 years ago
Sam Blackshear ab77cfe803 [quandary] thrift services as sources in Java
7 years ago
Sam Blackshear 27172f7f8a [quandary] java shell exec as sink
7 years ago
Jeremy Dubreil 96ca6b6f02 [infer][bug hash] take the number of occurences of a report into account
7 years ago
Radu Grigore eb91d59e40 [infer][PR] Fixed namespace for Java globals.
7 years ago
Sam Blackshear f5e7a6e6d7 [quandary] print index(es) of tainted parameters at each call
7 years ago
Sam Blackshear 41129087e4 [quandary] only Intents created from Uris should be sources
7 years ago
Sam Blackshear 7e8739de0a [quandary] more fine-grained issue types for Java
7 years ago
Sam Blackshear 432fa4913c [quandary] report all Intents constructed from URIs
7 years ago
Sam Blackshear 735b0b2ef7 [quandary] include source/sink caller in error message
7 years ago
Jeremy Dubreil 3e94c868f4 [infer] use the classname without the package name to compute the bug hash
7 years ago
Jeremy Dubreil ea29749671 [infer] simpler bug hash
7 years ago
Sam Blackshear 7428f36fbd [quandary] turn off dynamic dispatch handling in Java
7 years ago
Sam Blackshear 5e910929be [quandary] handle taint propagation in copying of structs/via derefs of pointers to structs
7 years ago
Sam Blackshear 67c45bed78 [quandary] fix invariant 1: "sink(s) with only non-footprint source" violations
7 years ago
Jules Villard b95f29c8d1 various minor improvements
7 years ago
Jules Villard d2b4f3c8da [config] add option to force deletion of results dir
7 years ago
Sam Blackshear d08bebe563 [reporting] don't report duplicate warnings on different instantiations of the same template
7 years ago
Sam Blackshear 6533aa65c6 [quandary] deserialization as sink
7 years ago