Java: add CSRF query#18288

Merged

jcogs33 merged 38 commits intogithub:mainfrom

jcogs33:jcogs33/csrf-unprotected-request-type

Feb 11, 2025

Commits on Jan 30, 2025

Java: add qhelp

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add class for Spring request mapping methods that are not default-protected from CSRF

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add a class for MyBatis Mapper methods that update a database

Jami Cogswell
authored and
Jami Cogswell
committed
Java: move contents of MyBatisMapperXML.qll in src to MyBatis.qll in lib so importable, and fix experimental files broken by the move

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add a class for PreparedStatement methods that update a database

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add a class for methods that update a sql database (found using sql-injection nodes)

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add CallGraph module for displaying call graph paths

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add query

Jami Cogswell
authored and
Jami Cogswell
committed
Java: initial tests

Jami Cogswell
authored and
Jami Cogswell
committed
Java: handle MyBatis annotations for insert/update/delete

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add taint-tracking config for execute to exclude FPs from non-update queries like select

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add class for Stapler web methods that are not default-protected from CSRF

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add name-based heuristic

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update .expected file contents

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove exists variable

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove exists variable in test

Jami Cogswell
authored and
Jami Cogswell
committed
Java: performance fix

Jami Cogswell
authored and
Jami Cogswell
committed
Java: update InlineExpectationsTest import for new location

Jami Cogswell
authored and
Jami Cogswell
committed
Java: add change note

Jami Cogswell
authored and
Jami Cogswell
committed
Java: qldocs for CallGraph module

Jami Cogswell
authored and
Jami Cogswell
committed
Java: Stapler tests and stubs

Jami Cogswell
authored and
Jami Cogswell
committed
Java: more database update tests and stubs

Jami Cogswell
authored and
Jami Cogswell
committed
Java: more name-based heuristic tests to test regex

Jami Cogswell
authored and
Jami Cogswell
committed
Java: some clean-up and refactoring

Jami Cogswell
authored and
Jami Cogswell
committed
Java: rename getMethod to getMethodValue

Jami Cogswell
authored and
Jami Cogswell
committed
Java: use two negations

Jami Cogswell
authored and
Jami Cogswell
committed
Java: refactor into canTargetDatabaseUpdateMethod

Jami Cogswell
authored and
Jami Cogswell
committed
Java: refactor unprotectedDatabaseUpdate

Jami Cogswell
authored and
Jami Cogswell
committed
Java: precision to medium

Jami Cogswell
authored and
Jami Cogswell
committed
Java: expand qhelp, include Stapler examples

Jami Cogswell
authored and
Jami Cogswell
committed
Java: narrow query

Jami Cogswell
authored and
Jami Cogswell
committed
Java: minor qhelp update

Jami Cogswell
authored and
Jami Cogswell
committed
Java: resolve merge conflict

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Feb 3, 2025

Java: qhelp wording updates

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Feb 4, 2025

Java: minor qhelp updates

Jami Cogswell
authored and
Jami Cogswell
committed
Java: rewrite qhelp overview section; aligns with overview section used by Python and Ruby

Jami Cogswell
authored and
Jami Cogswell
committed
Java: remove token section from qhelp overview

Jami Cogswell
authored and
Jami Cogswell
committed

Commits on Feb 5, 2025

Java: minor qhelp updates

Jami Cogswell
authored and
Jami Cogswell
committed