testable-eu / sast-testability-patterns

Testability Pattern Catalogs for SAST
https://owasp.org/www-project-testability-patterns-for-web-applications/
Apache License 2.0
28 stars 2 forks source link

[Ongoing Effort] Deduplication of Pattern Classes in JAVA #25

Open pr0me opened 1 year ago

pr0me commented 1 year ago

This issue shall act as a dynamically updated list of patterns which currently are implemented in across different directories but only differ in syntax, e.g., the discovery rules are largely identical and only differ in the object's name we are grepping for.

In the long run, the goal is to merge such categories and reflect different manifestations through instances.

  1. Instantiation of a complex class by passing dynamic/user data to the constructor Query: cpg.call.where(_.methodFullName(".*[OBJECT_NAME].<init>.*")).whereNot(_.argument(1).isLiteral).location.toJson Candidates for merging:
    • 1_throwable
    • 11_bytearrayinputstream
    • 12_chararrayreader
    • 14_new_character [May need discussion. One instance differs.]