Matt Brown
10ccbdd8be
Add tainting for array keys
...
Fixes #5470
2021-03-24 15:32:56 -04:00
Matt Brown
937e68cc75
Change taint path names to prepare for allowing array key tainting
2021-03-24 15:23:56 -04:00
Samuel Mortenson
e07337650b
Make taint source keys unique to the added taints. ( #5444 )
2021-03-20 15:42:24 -04:00
Matt Brown
15e87b13b8
Prevent infinite loop while scanning in some situations
2021-01-26 15:51:15 -05:00
Matt Brown
3f155792a7
Allow nested specialisation
2020-12-04 15:44:29 -05:00
Matt Brown
fd67d41120
Fix #4769 – don’t use unique ids for new generated nodes
2020-12-04 15:44:29 -05:00
Matt Brown
9a03a9a5d0
Move param taint sink addition after arguuments have been analysed
2020-11-22 19:39:40 -05:00
Matt Brown
853432a6aa
Fix tests
2020-11-22 16:24:33 -05:00
Matt Brown
6399707dd6
Prevent flows through TaintedInput-suppressed files
2020-11-22 16:04:57 -05:00
Matt Brown
78d644d1a1
Change TaintedText to TaintedCallable
2020-11-19 19:01:19 -05:00
Lukas Reschke
78f4a0691c
Add dedicated types for 'file', 'header' and 'cookie' ( #4630 )
...
* [WIP] Add dedicated sinks for 'file', 'header' and 'cookie'
* Add documentation
* Add mapping for taint flows
* Add tests
* Fix test
2020-11-19 17:47:29 -05:00
Matt Brown
95de6cf177
Allow immutable classes to be specialised through calls
2020-11-19 01:38:20 -05:00
Lukas Reschke
ddbfbb28e6
Split LDAP into custom category ( #4604 )
...
- Adds ldap_escape as sanitizer
- Defines the right parameters to ldap_search as sink
- Wrote documentation
- Added tests
2020-11-18 11:39:36 -05:00
Matt Brown
3f7f959726
Fix #4599 - propagate taints to parent callers where necessary
2020-11-18 09:59:54 -05:00
Lukas Reschke
5ba4681c17
Add SSRF sinks ( #4592 )
2020-11-18 00:52:48 -05:00
Matt Brown
f6591e6d0f
Use resolution that works in multithreaded mode
2020-11-17 17:24:46 -05:00
Matt Brown
2aa98bc5d0
Simplify tainted output a bit, removing duplicate paths
2020-11-17 17:17:18 -05:00
Matt Brown
43af3b1a57
Break out TaintedInput issues into a lot of separate ones
2020-11-17 12:44:31 -05:00
orklah
ceaaa39ec3
improve phpdoc ( #4352 )
2020-10-17 12:36:44 -04:00
orklah
ffe7874906
Misc improvements ( #4314 )
...
* extract the operation out of the loop when possible
* remove unnecessary interfaces when already inherited in parent
* simplify expressions
* avoid using alias functions
* redundant phpdoc
* unused imports
2020-10-15 13:23:35 -04:00
Matt Brown
516141a380
Rename ControlFlowGraph to more appropriate DataFlowGraph
2020-10-13 16:49:03 -04:00
Brown
da65a4327f
Move taint graph functionality into its own object
2020-09-25 00:37:40 -04:00
