Jami Cogswell
5fa63ab5c2
Java: update/add some TODO comments
2024-03-13 16:28:41 -04:00
Jami Cogswell
c331393cfd
Java: update qhelp
2024-03-13 16:28:41 -04:00
Jami Cogswell
09bc21dbd3
Java: rename 'UnsafeUrlForward' to 'UrlForward'
2024-03-13 16:28:41 -04:00
Jami Cogswell
6e7c05467b
Java: update query metadata and alert message
2024-03-13 16:28:41 -04:00
Jami Cogswell
5a9d7552b3
Java: add some comments and minor code reorg
2024-03-13 16:28:41 -04:00
Jami Cogswell
1da1e896cb
Java: convert SpringModelAndViewSink to MaD
2024-03-13 16:28:41 -04:00
Jami Cogswell
8d66097483
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
2024-03-13 16:28:41 -04:00
Jami Cogswell
42e3825ea3
Java: convert RequestDispatcherSink to MaD
2024-03-13 16:28:40 -04:00
Jami Cogswell
4ff884e26c
Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)
2024-03-13 16:28:40 -04:00
Jami Cogswell
2a682995ae
Java: move MaD models to correct files, delete ones that already exist
2024-03-13 16:28:40 -04:00
Jami Cogswell
915e106ab3
Java: remove path-injection related models and tests for now
2024-03-13 16:28:40 -04:00
Jami Cogswell
35a083ae9e
Java: update test cases to use inline expectations
2024-03-13 16:28:40 -04:00
Jami Cogswell
2793f28428
Java: move config to Query.qll file
2024-03-13 16:28:40 -04:00
Jami Cogswell
0d38a9625e
Java: copy files from experimental
2024-03-13 16:28:39 -04:00
Tony Torralba
039bea1625
Java: Add more neutral JDK models
...
This is similar to https://github.com/github/codeql/pull/15766 , in the sense that it adds neutral models to prevent the model generator from generating summaries for them. These models were spotted while evaluating https://github.com/github/codeql/pull/14919 .
2024-03-13 16:59:38 +01:00
Tom Hvitved
02ae2d1520
Java: Implement new data flow interface
2024-03-13 14:41:57 +01:00
Ian Lynagh
adefdfd59f
Merge pull request #15889 from igfoo/igfoo/k2exprs
...
Kotlin 2: Accept more changes in the exprs test
2024-03-13 11:34:10 +00:00
erik-krogh
013ed7adb3
Java: update the url-redirection in the same style as the C# qhelp
2024-03-13 11:58:16 +01:00
github-actions[bot]
cff2cdb9e4
Add changed framework coverage reports
2024-03-13 00:15:53 +00:00
Edward Minnix III
d54489931c
Merge pull request #15869 from egregius313/egregius313/java/fix/parcelfiledescriptor-open-sink
...
Java: Add path-injection sink for `ParcelFileDescriptor::open`
2024-03-12 16:39:20 -04:00
Erik Krogh Kristensen
863e3f79e5
Merge pull request #15731 from erik-krogh/java-url
...
Java: More sanitizers for request-forgery
2024-03-12 19:31:52 +01:00
Ian Lynagh
0e94aa0eb5
Kotlin 2: Accept more changes in the exprs test
2024-03-12 16:42:37 +00:00
erik-krogh
f613823047
add explicit QLDoc that any method named "contains" is matched
2024-03-12 15:25:27 +01:00
erik-krogh
35aae0a981
move changenote to src/
2024-03-12 15:22:57 +01:00
Erik Krogh Kristensen
b53ae77c56
expand change-note
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-03-12 15:22:17 +01:00
erik-krogh
74876ff49b
add change-note
2024-03-12 15:07:36 +01:00
erik-krogh
52f71e4553
small fixes based on review
2024-03-12 15:07:29 +01:00
Ian Lynagh
c2aa334465
Java: Accept test changes
2024-03-12 14:03:02 +00:00
Henry Mercer
c325ff8a23
Mark lines of code queries as telemetry queries
...
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.
The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
2024-03-11 16:40:31 +00:00
Ed Minnix
76aeee2820
Change note
2024-03-11 10:34:15 -04:00
Ed Minnix
61dbe26858
Add sinks for android.os.ParcelFileDescriptor
2024-03-11 10:31:51 -04:00
Tom Hvitved
da66281fef
Sync files
2024-03-11 13:02:04 +01:00
Tom Hvitved
7a39f077d9
Data flow: Add ConfigSig::accessPathLimit
2024-03-11 13:01:58 +01:00
Ian Lynagh
a9bab18804
Merge pull request #15848 from igfoo/igfoo/deleg2
...
Kotlin 2: Accept some more loc changes in exprs test
2024-03-08 11:49:11 +00:00
Chris Smowton
2321eecb9e
Add tests for multi-release jars under Java 11 and 17
2024-03-07 21:07:49 +00:00
Ian Lynagh
e74606eba3
Kotlin 2: Accept some more loc changes
2024-03-07 18:40:59 +00:00
Ian Lynagh
79c5ad93b0
Kotlin 2: Accept a loc change
...
This is a bit of an odd location for the IrVariableImpl as it includes a
comment, but the comment is already included in the corrresponding
IrLocalDelegatedPropertyImpl so it's not clearly wrong:
Element: 16 59 (2:4 - 2:47) class org.jetbrains.kotlin.ir.declarations.impl.IrLocalDelegatedPropertyImpl
-Element: 29 42 (2:17 - 2:30) class org.jetbrains.kotlin.ir.declarations.impl.IrVariableImpl
+Element: 16 59 (2:4 - 2:47) class org.jetbrains.kotlin.ir.declarations.impl.IrVariableImpl
So just accept the change.
2024-03-07 18:37:00 +00:00
Chris Smowton
c9474050c8
Merge pull request #15839 from smowton/smowton/admin/jdk22-extractor-upgrade-test-changes
...
Java: Explicitly import Lock class
2024-03-07 15:05:50 +00:00
Chris Smowton
dae20ca50c
Explicitly import Lock
2024-03-07 09:54:17 +00:00
github-actions[bot]
dc9092c9ec
Post-release preparation for codeql-cli-2.16.4
2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d
Release preparation for version 2.16.4
2024-03-06 20:56:51 +00:00
Angela P Wen
ce31f8641a
Revert "Release preparation for version 2.16.4"
2024-03-06 12:07:33 -08:00
Ian Lynagh
e58b6e86b2
Kotlin 2: Accept more loc changes in exprs test
2024-03-06 17:57:44 +00:00
github-actions[bot]
661e68dab5
Release preparation for version 2.16.4
2024-03-05 18:13:58 +00:00
Angela P Wen
967963a653
Revert "Release preparation for version 2.16.4"
2024-03-05 08:53:33 -08:00
Ian Lynagh
edd383afc1
Merge pull request #15803 from igfoo/igfoo/del1
...
Kotlin 2: Accept more location changes
2024-03-05 14:41:05 +00:00
github-actions[bot]
84f3771cdd
Add changed framework coverage reports
2024-03-05 00:15:54 +00:00
Ian Lynagh
6e09dcc16a
Kotlin 2: Accept more loc changes in exprs
2024-03-04 19:06:32 +00:00
Ian Lynagh
22e6c676c3
Kotlin 2: Accept loc change for a string literal in expr test
2024-03-04 19:02:40 +00:00
Ian Lynagh
b7d2e54bbd
Kotlin 2: exprs test: Accept loc change for ClassWithDelegate
2024-03-04 19:00:40 +00:00
