293 Commits (5fe28785bc3157f356e70c8f5d5642dae0c09008)

Author SHA1 Message Date
Jules Villard 902de9d6e3 [sil] make return value and type mandatory
7 years ago
Sam Blackshear 6b8900746b [quandary] only treat overrides of service methods as endpoints
7 years ago
Jules Villard ce0ffaf877 [ocaml] detect and kill dead modules
7 years ago
Sam Blackshear 30d7239aff [quandary] SQL sinks for java
7 years ago
Sam Blackshear ffba5de70c [quandary] distinguish between SQL reads and writes
7 years ago
Sam Blackshear cbc793be16 [quandary] simplify source/sink matching
7 years ago
Sam Blackshear 1d792f0b48 [quandary] fix formatting of endpoint traces, again
7 years ago
Josh Berdine 16988b0a7a [ocamlformat] Upgrade to ocamlformat 0.5
7 years ago
Sam Blackshear 670ae4a673 [quandary] `WebResourceRequest.getUrl` as source
7 years ago
Sam Blackshear cfa2dd5f83 [quandary] pass call flags to sink creation
7 years ago
Mehdi Bouaziz 4aefa6f76b Debug: session name
7 years ago
Sam Blackshear 767606b98e [quandary] fix unintended markdown formatting in error messages
7 years ago
Sam Blackshear 33fe8879a5 [quandary] report flows originating from `UserControlledEndpoint` as `_RISK`
7 years ago
Sam Blackshear aabf8aec55 [quandary] use `_risk` warning types for endpoint sources in Java
7 years ago
Sam Blackshear 57a8c2f594 [quandary] don't taint dummy Thrift `_return` formals
7 years ago
Mehdi Bouaziz 2916c97e0a [easy] Java nits
7 years ago
Sam Blackshear b57aa90d7d [quandary] don't crash if JSON source/sink is invalid procedure name
7 years ago
Sam Blackshear d720eb52ba [quandary] check for subclassing in externally specified sources/sinks
7 years ago
Daiva Naudziuniene 4157ba820a [HIL] Implicit dereference in access expression
7 years ago
Josh Berdine 3534838b73 [ocamlformat] Upgrade to ocamlformat 0.4
7 years ago
Sam Blackshear 66d03869ab [quandary] don't treat private Java methods as endpoints
7 years ago
Daiva Naudziuniene 5ebc6562ee [HIL] AccessExpression on the left hand side of assignment
7 years ago
Daiva Naudziuniene 896e849bfc [HIL] Access expression
7 years ago
Sam Blackshear 1a75ec9cf8 [cleanup] Move ObjC/C++-specific Procname functions to dedicated module
7 years ago
Sam Blackshear 37ab9ec391 [quandary] ProcessBuilder as sink
7 years ago
Sam Blackshear ab77cfe803 [quandary] thrift services as sources in Java
7 years ago
Sam Blackshear 27172f7f8a [quandary] java shell exec as sink
7 years ago
Sam Blackshear f7c415f7ae [cleanup] restrict Java-specific utility functions to Typ.Procname.Java.t's
7 years ago
Sam Blackshear 04d2882a6b [cleanup] organize Java-specific functions on types
7 years ago
Sam Blackshear fb7556816f [quandary] report gflags to shell exec, but not file or url creation
7 years ago
Sam Blackshear f5e7a6e6d7 [quandary] print index(es) of tainted parameters at each call
7 years ago
Sam Blackshear 7f62154318 [quandary] separate sanitizers for different kinds of escaping
7 years ago
Sam Blackshear b06676f309 [quandary] only use gflag sources in developer mode
7 years ago
Josh Berdine 63439ecc02 [ocamlformat] Upgrade base and ocamlformat
7 years ago
Sam Blackshear 8732c7d7a1 [quandary] add curl_easy_setop with CURLOPT_POSTFIELDS as sink
7 years ago
Sam Blackshear 82a3b2649e [quandary] only warn on shell/sql injection from stringy gflag sources
7 years ago
Jeremy Dubreil 1f6d73269e [infer] simplify the API to report errors
7 years ago
Sam Blackshear 41129087e4 [quandary] only Intents created from Uris should be sources
7 years ago
Sam Blackshear 32675a7b02 [quandary] improve curl_easy_setopt sink
7 years ago
Sam Blackshear d3f4043bc0 [quandary] curl function for setting URL as sink
7 years ago
Sam Blackshear 7e8739de0a [quandary] more fine-grained issue types for Java
7 years ago
Sam Blackshear 432fa4913c [quandary] report all Intents constructed from URIs
7 years ago
Sam Blackshear 6abbe66ee6 [quandary] file creation as sink
7 years ago
Sam Blackshear 19824aa27b [quandary] don't taint this var of endpoints
7 years ago
Sam Blackshear 735b0b2ef7 [quandary] include source/sink caller in error message
7 years ago
Sam Blackshear 3c28e0308a [quandary] clean up source type in report
7 years ago
Sam Blackshear 087ff08b82 [quandary] eliminate spammy soft error for bad return summary
7 years ago
Sam Blackshear 164fa457e9 [quandary] treat any non-primitive endpoint formal as a source
7 years ago
Sam Blackshear 8665386b8a [quandary] report USER_CONTROLLED_SQL_RISK on flows from endpoint -> SQL
7 years ago
Sam Blackshear 97f3af15f3 [quandary] support multiple sanitizer kinds in C++
7 years ago