yo-h
87cd72496c
Java: add extractor diagnostic queries
2021-04-19 15:34:16 -04:00
Anders Schack-Mulligen
80eb0a2df6
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-19 15:45:58 +02:00
haby0
8296abcea8
Fix Modify the ql query (the qhelp part is not modified).
2021-04-19 20:59:47 +08:00
Anders Schack-Mulligen
7d84cfacef
Java: Add MapKeyContent and MapValueContent.
2021-04-19 14:06:27 +02:00
Anders Schack-Mulligen
39862740e0
Java: Convert support for fluent interfaces.
2021-04-19 14:06:27 +02:00
haby0
23b508c5e7
Merge remote-tracking branch 'upstream/main' into UseOfLessTrustedSource
2021-04-19 20:05:49 +08:00
Anders Schack-Mulligen
60965b0d8c
Java: Adjust some csv models.
2021-04-19 14:02:19 +02:00
Anders Schack-Mulligen
a27dac029f
Java: Use shared flow summary library for csv models.
2021-04-19 14:02:19 +02:00
Mathias Vorreiter Pedersen
e36b42a03f
Java: Fix invalid id in experimental query
...
The invalid id broke CI here: https://github.com/github/codeql/pull/5703 (see https://github.slack.com/archives/CPSEA0G22/p1618602834224600 )
2021-04-17 09:47:15 +02:00
edvraa
29e320627f
Regex injection
2021-04-16 23:29:08 +03:00
Anders Schack-Mulligen
605f28f741
Merge pull request #5686 from smowton/haby0/JsonHijacking
...
Java: JSONP Injection w/cleanups
2021-04-16 11:09:17 +02:00
Chris Smowton
c37994089c
Revert changes to unrelated query
2021-04-15 16:24:29 +01:00
haby0
dedf765542
Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-15 22:59:22 +08:00
haby0
0e183ab4a4
Finish comment
2021-04-15 19:49:06 +08:00
Chris Smowton
fa36ba901a
Merge pull request #5471 from artem-smotrakov/el-injection
...
Java: Query for detecting Jakarta Expression Language injections
2021-04-15 12:39:34 +01:00
haby0
d269a7e717
CWE-598 reduction
2021-04-15 19:33:15 +08:00
haby0
216f204438
delete FilterClass
2021-04-15 19:28:25 +08:00
haby0
583d0889e2
delete tomcat-embed-core stub, update the ServletGetMethod class
2021-04-15 17:40:51 +08:00
haby0
5d05e4d224
Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjectionLib.qll
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-15 17:28:53 +08:00
Chris Smowton
bd3b3178ba
Fix documentation of Modifier.qll
2021-04-15 09:16:51 +01:00
haby0
b3bdf89fc2
rm VerificationMethodFlowConfig, use springframework-5.2.3 stub
2021-04-15 10:25:40 +08:00
Anders Schack-Mulligen
f43d427875
Merge pull request #5645 from Marcono1234/marcono1234/primary-ql-class
...
Java: Override getAPrimaryQlClass() for more classes
2021-04-14 14:51:29 +02:00
Chris Smowton
591ac38c31
Merge pull request #5591 from Marcono1234/marcono1234/member-nested-type
...
Java: Add MemberType
2021-04-14 12:29:54 +01:00
Anders Schack-Mulligen
3b6cd0f681
Merge pull request #5661 from smowton/smowton/cleanup/call-is-exprparent
...
Make Call a subclass of ExprParent.
2021-04-14 10:49:33 +02:00
Chris Smowton
2965a1f204
Use Thread$State as an inner-class example
...
Map<>$Entry currently has odd generic notation that may be about to change.
2021-04-14 08:43:05 +01:00
haby0
77208bcc91
Fix the error that there is no VerificationMethodToIfFlowConfig
2021-04-14 13:14:43 +08:00
haby0
e2ed0d02b0
Delete existsFilterVerificationMethod and existsServletVerificationMethod, add from get handler to filter
2021-04-14 12:34:52 +08:00
haby0
37dae67a0d
Fix RequestResponseFlowConfig.isSink error
2021-04-14 09:55:24 +08:00
Marcono1234
d853f0c400
Java: Add MemberType
2021-04-13 18:55:20 +02:00
haby0
00235ed3b3
Update java/ql/src/semmle/code/java/frameworks/Servlets.qll
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-13 23:58:52 +08:00
haby0
25b012db48
Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-13 23:58:28 +08:00
haby0
7be45e7c5e
Update java/ql/src/experimental/Security/CWE/CWE-352/JsonpInjection.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-13 23:56:17 +08:00
haby0
6e73d13670
Update java/ql/src/semmle/code/java/frameworks/Servlets.qll
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-04-13 23:48:45 +08:00
Marcono1234
89a5acf6e8
Java: Revert overriding XMLFile.getAPrimaryQlClass()
...
Library file has to be kept in sync with the other languages, however except
cpp none of them have the getAPrimaryQlClass() predicate declared in a
superclass. Therefore for simplicity revert the change for Java.
2021-04-13 17:09:15 +02:00
Chris Smowton
58d198261e
Merge pull request #5663 from smowton/luchua/java/sensitive-cookie-not-httponly
...
Java: CWE-1004 Query to check sensitive cookies without the HttpOnly flag set w/minor corrections
2021-04-13 12:08:53 +01:00
Chris Smowton
dee974ff2d
Make Call a subclass of ExprParent. All of its subclasses are in any case (via Expr or Stmt)
2021-04-13 09:13:47 +01:00
Marcono1234
c37dbb2e68
Java: Override getAPrimaryQlClass() for more classes
2021-04-13 08:46:01 +01:00
haby0
be39883166
Change the class name and comment,Use .(CompileTimeConstantExpr).getStringValue()
2021-04-13 14:10:10 +08:00
Artem Smotrakov
b96b665262
Renaming in java/ql/src/experimental/Security/CWE/CWE-094
2021-04-12 21:40:49 +03:00
luchua-bc
d7f26dfc18
Update stub classes and qldoc
2021-04-12 16:19:23 +00:00
Chris Smowton
423ff32d04
Merge pull request #5384 from luchua-bc/java/insecure-spring-actuator-config
...
Java: CWE-016 Query to detect insecure configuration of Spring Boot Actuator
2021-04-12 17:04:47 +01:00
Chris Smowton
bb23866cec
Add missing doc comments
2021-04-12 16:33:01 +01:00
Chris Smowton
2656a52880
Merge pull request #5538 from luchua-bc/java/credentials-in-properties
...
Java: CWE-555 Query to detect plaintext credentials in Java properties files
2021-04-12 15:22:21 +01:00
Chris Smowton
abeefcaced
Merge pull request #4947 from porcupineyhairs/DexLoading
...
Java : add query to detect insecure loading of Dex File
2021-04-12 15:22:12 +01:00
Chris Smowton
11bf982728
Remove superfluous linebreaks in qhelp file
2021-04-12 14:36:42 +01:00
Tom Hvitved
7d2a60e910
Merge pull request #5640 from hvitved/dataflow/path-step-perf
...
Data flow: Prevent bad join-order in `pathStep`
2021-04-12 14:40:46 +02:00
Anders Schack-Mulligen
acd4cf2878
Merge pull request #5636 from aschackmull/java/shared-flow-summaries
...
Java: Adopt shared flow summaries
2021-04-12 13:35:31 +02:00
Anders Schack-Mulligen
e003b04061
Merge pull request #5637 from Marcono1234/marcono1234/toString-method
...
Java: Add ToStringMethod
2021-04-12 11:43:55 +02:00
haby0
1b948ac2e2
Combine two Configurations into one
2021-04-12 15:44:39 +08:00
intrigus
8d11bc97ca
[Java] Add "missing jwt signature check" qhelp.
2021-04-10 13:36:22 +02:00
