312 Commits (cb4bf4443f0c0d3065090a64f67a69e8fa677df1)

Author SHA1 Message Date
Mehdi Bouaziz 2d4e58f57f Mangled.this/is_this
7 years ago
Julian Sutherland 93690dfa0e Check that the end the traces of inferBO and quandary issues match before matching them to form an quandaryBO issue
7 years ago
Julian Sutherland 0e9d8380c2 filter issues correctly
7 years ago
Julian Sutherland 60784ad045 Updated QuandaryBO issue matching.
7 years ago
Julian Sutherland f6afe3a092 quandaryBO now filters out quandary and inferBO errors if they are not enabled.
7 years ago
Mehdi Bouaziz ddbb7e05d3 Reporting cleanup 22: log_error/warning -> use IssueType rather than exception
7 years ago
Julian Sutherland e715d48c12 QuandaryBO
7 years ago
Julian Sutherland 34b0a6165c Added new issues to differentiate tainted buffer accesses and heap allocations
7 years ago
Josh Berdine 40ab73037e [ocamlformat] upgrade to ocamlformat 0.7
7 years ago
Nikos Gorogiannis c2416defed Fix IntLit.to_int interface and uses.
7 years ago
Mehdi Bouaziz fc5c093d1e ProcCfg: do not include module Node
7 years ago
Jules Villard 8b882ac1df Change license to MIT
7 years ago
Sam Blackshear 370f5c80e6 [quandary] only treat overrides of service methods as endpoints
7 years ago
Mehdi Bouaziz 1898ef3a7a [Summary] Move payloads to a separate module
7 years ago
Sam Blackshear 85b8087f66 [quandary] de-prioritize command line flag sources
7 years ago
Sam Blackshear d70d23c5f3 [quandary] treat Fragments like other Context types
7 years ago
Jules Villard 3aa6fdf1ce [rename] specs -> summary, Summary -> SummaryPayload
7 years ago
Jules Villard dfe2ad5229 [camel] call `Format.pp_print_*` directly where appropriate
7 years ago
Sam Blackshear c99b634655 [quandary] print caller of unexpected operator= expression
7 years ago
Jules Villard 902de9d6e3 [sil] make return value and type mandatory
7 years ago
Sam Blackshear 6b8900746b [quandary] only treat overrides of service methods as endpoints
7 years ago
Jules Villard ce0ffaf877 [ocaml] detect and kill dead modules
7 years ago
Sam Blackshear 30d7239aff [quandary] SQL sinks for java
7 years ago
Sam Blackshear ffba5de70c [quandary] distinguish between SQL reads and writes
7 years ago
Sam Blackshear cbc793be16 [quandary] simplify source/sink matching
7 years ago
Sam Blackshear 1d792f0b48 [quandary] fix formatting of endpoint traces, again
7 years ago
Josh Berdine 16988b0a7a [ocamlformat] Upgrade to ocamlformat 0.5
7 years ago
Sam Blackshear 670ae4a673 [quandary] `WebResourceRequest.getUrl` as source
7 years ago
Sam Blackshear cfa2dd5f83 [quandary] pass call flags to sink creation
7 years ago
Mehdi Bouaziz 4aefa6f76b Debug: session name
7 years ago
Sam Blackshear 767606b98e [quandary] fix unintended markdown formatting in error messages
7 years ago
Sam Blackshear 33fe8879a5 [quandary] report flows originating from `UserControlledEndpoint` as `_RISK`
7 years ago
Sam Blackshear aabf8aec55 [quandary] use `_risk` warning types for endpoint sources in Java
7 years ago
Sam Blackshear 57a8c2f594 [quandary] don't taint dummy Thrift `_return` formals
7 years ago
Mehdi Bouaziz 2916c97e0a [easy] Java nits
7 years ago
Sam Blackshear b57aa90d7d [quandary] don't crash if JSON source/sink is invalid procedure name
7 years ago
Sam Blackshear d720eb52ba [quandary] check for subclassing in externally specified sources/sinks
7 years ago
Daiva Naudziuniene 4157ba820a [HIL] Implicit dereference in access expression
7 years ago
Josh Berdine 3534838b73 [ocamlformat] Upgrade to ocamlformat 0.4
7 years ago
Sam Blackshear 66d03869ab [quandary] don't treat private Java methods as endpoints
7 years ago
Daiva Naudziuniene 5ebc6562ee [HIL] AccessExpression on the left hand side of assignment
8 years ago
Daiva Naudziuniene 896e849bfc [HIL] Access expression
8 years ago
Sam Blackshear 1a75ec9cf8 [cleanup] Move ObjC/C++-specific Procname functions to dedicated module
8 years ago
Sam Blackshear 37ab9ec391 [quandary] ProcessBuilder as sink
8 years ago
Sam Blackshear ab77cfe803 [quandary] thrift services as sources in Java
8 years ago
Sam Blackshear 27172f7f8a [quandary] java shell exec as sink
8 years ago
Sam Blackshear f7c415f7ae [cleanup] restrict Java-specific utility functions to Typ.Procname.Java.t's
8 years ago
Sam Blackshear 04d2882a6b [cleanup] organize Java-specific functions on types
8 years ago
Sam Blackshear fb7556816f [quandary] report gflags to shell exec, but not file or url creation
8 years ago
Sam Blackshear f5e7a6e6d7 [quandary] print index(es) of tainted parameters at each call
8 years ago