334 Commits (c2c876d435988b6e7aae8fa363ff47173e14415c)

Author SHA1 Message Date
Nikos Gorogiannis 764e9ee1be [AI] empty is not (necessarily) bottom
6 years ago
Mehdi Bouaziz a130556869 [quandary] Separate insecure intent handling issue type when call is in an exposed class
6 years ago
Mehdi Bouaziz 9f333bb433 [quandary] Different source kinds for endpoints
6 years ago
Mehdi Bouaziz f6c2bd3f61 [quandary] Insecure Intent Handling
6 years ago
Mehdi Bouaziz dfd725d46c [quandary] Also use summary for direct sources
6 years ago
Mehdi Bouaziz a6d78db9b5 [quandary] Simplify endpoints config
6 years ago
Mehdi Bouaziz 930dd2eb03 [quandary] Inline internal analyze_call
6 years ago
Mehdi Bouaziz 3ad33c979e [quandary] Split exec_instr
6 years ago
Mehdi Bouaziz 87b3907628 [quandary] Allow several kinds for external sources/sinks
6 years ago
Jules Villard 26d4a2d14f [HIL] simplify some functors around TransferFunctions
6 years ago
Jules Villard 92c06e4f1f [HIL][4/4] array offsets are now HilExp.t
6 years ago
Jules Villard 1ee5877aa2 [HIL][3/4] remove compatibility AccessExpression.ml
6 years ago
Ted Reed 28b346a903 quandary: Detect flows to EnvironmentChange that includes putenv only
6 years ago
Ted Reed 22bebd2cee quandary: Break out deserialization from endpoints into a _risk category
6 years ago
Nikos Gorogiannis 6aba4b7ca2 [AI] kill astate type
6 years ago
Mehdi Bouaziz 8443cd73f6 [quandary] Allow sinks to have multiple taints
6 years ago
Mehdi Bouaziz 5b3bca5562 [quandary] Allow sources to have multiple taints
6 years ago
Sungkeun Cho 1486a5f105 [infer] Translate casting expressions of integer pointers
6 years ago
Jules Villard 6f9028a77f [pulse] use WTO scheduler
6 years ago
Mehdi Bouaziz 9a4416f7d4 [quandary] String concatenation sanitizes class loading
6 years ago
Mehdi Bouaziz 174bdcd22b [quandary] Add class-loading sinks
6 years ago
Jules Villard 52bcce29b5 [access expressions] force clients to normalize when introducing `Dereference` and `AddressOf`
6 years ago
Mehdi Bouaziz 2d4e58f57f Mangled.this/is_this
6 years ago
Julian Sutherland 93690dfa0e Check that the end the traces of inferBO and quandary issues match before matching them to form an quandaryBO issue
6 years ago
Julian Sutherland 0e9d8380c2 filter issues correctly
6 years ago
Julian Sutherland 60784ad045 Updated QuandaryBO issue matching.
6 years ago
Julian Sutherland f6afe3a092 quandaryBO now filters out quandary and inferBO errors if they are not enabled.
6 years ago
Mehdi Bouaziz ddbb7e05d3 Reporting cleanup 22: log_error/warning -> use IssueType rather than exception
6 years ago
Julian Sutherland e715d48c12 QuandaryBO
6 years ago
Julian Sutherland 34b0a6165c Added new issues to differentiate tainted buffer accesses and heap allocations
6 years ago
Josh Berdine 40ab73037e [ocamlformat] upgrade to ocamlformat 0.7
6 years ago
Nikos Gorogiannis c2416defed Fix IntLit.to_int interface and uses.
6 years ago
Mehdi Bouaziz fc5c093d1e ProcCfg: do not include module Node
7 years ago
Jules Villard 8b882ac1df Change license to MIT
7 years ago
Sam Blackshear 370f5c80e6 [quandary] only treat overrides of service methods as endpoints
7 years ago
Mehdi Bouaziz 1898ef3a7a [Summary] Move payloads to a separate module
7 years ago
Sam Blackshear 85b8087f66 [quandary] de-prioritize command line flag sources
7 years ago
Sam Blackshear d70d23c5f3 [quandary] treat Fragments like other Context types
7 years ago
Jules Villard 3aa6fdf1ce [rename] specs -> summary, Summary -> SummaryPayload
7 years ago
Jules Villard dfe2ad5229 [camel] call `Format.pp_print_*` directly where appropriate
7 years ago
Sam Blackshear c99b634655 [quandary] print caller of unexpected operator= expression
7 years ago
Jules Villard 902de9d6e3 [sil] make return value and type mandatory
7 years ago
Sam Blackshear 6b8900746b [quandary] only treat overrides of service methods as endpoints
7 years ago
Jules Villard ce0ffaf877 [ocaml] detect and kill dead modules
7 years ago
Sam Blackshear 30d7239aff [quandary] SQL sinks for java
7 years ago
Sam Blackshear ffba5de70c [quandary] distinguish between SQL reads and writes
7 years ago
Sam Blackshear cbc793be16 [quandary] simplify source/sink matching
7 years ago
Sam Blackshear 1d792f0b48 [quandary] fix formatting of endpoint traces, again
7 years ago
Josh Berdine 16988b0a7a [ocamlformat] Upgrade to ocamlformat 0.5
7 years ago
Sam Blackshear 670ae4a673 [quandary] `WebResourceRequest.getUrl` as source
7 years ago