docs: Correct code block formatting in README - #5
Merged
Conversation
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
added a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
* fix unknown object super class * Fix cfg build performance
misonijnik
added a commit
that referenced
this pull request
Mar 19, 2026
Saloed
pushed a commit
that referenced
this pull request
Mar 20, 2026
Saloed
pushed a commit
that referenced
this pull request
Mar 20, 2026
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
New sample packages under samples-go/ wired into GoSampleBasedTest, each isolating a limitation found while improving the Go ruleset (see issues.md): - TypedFieldReadSource (#1): typed receiver on a field-read source crashes analysis (IllegalStateException "Unsupported field-source position: This"). - InterfaceImplSink (#2): a typed receiver matches only the exact static type, not a concrete implementor of the interface. - TypedArgSink (#3): a type ascription in argument position is ignored. - FieldReadSink (#4): a field-read sink never fires in taint mode. - MapValueToReceiver (#5): confirms the core DOES propagate a map value into a receiver-position sink, so the full-scan ServeJSON false-negative is an unroll-strategy/config issue, not a core bug. #1-#4 are @disabled with a todo referencing the issue; removing @disabled reproduces the bug now and the test should pass once it is fixed. #5 is enabled and passing. Full GoSampleBasedTest: 89 tests, 0 failures, 5 skipped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
misonijnik
added a commit
that referenced
this pull request
Jul 3, 2026
…equester.connect Add a multi-statement ssrf sink pattern that follows a HttpHost constructed from untrusted data into connect: $HOST = new org.apache.hc.core5.http.HttpHost($UNTRUSTED); ...; connect($HOST, ...) This pairs with the field-sensitive HttpHost#<init> passThrough (hostName vfield) on the model branch. The #5 sample uses the intermediate-variable form so the pattern binds $HOST across the construction and the connect call. Suite: OK 979.
misonijnik
added a commit
that referenced
this pull request
Jul 4, 2026
…equester.connect Add a multi-statement ssrf sink pattern that follows a HttpHost constructed from untrusted data into connect: $HOST = new org.apache.hc.core5.http.HttpHost($UNTRUSTED); ...; connect($HOST, ...) This pairs with the field-sensitive HttpHost#<init> passThrough (hostName vfield) on the model branch. The #5 sample uses the intermediate-variable form so the pattern binds $HOST across the construction and the connect call. Suite: OK 979.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.