12771 Commits

Author	SHA1	Message	Date
Anders Schack-Mulligen	7623432c76	Java: Remove/deprecate FlowStateString-based extension points.	2023-12-14 15:15:58 +01:00
Anders Schack-Mulligen	a1068ce2f9	Dataflow: deprecate references	2023-12-14 15:05:33 +01:00
Tom Hvitved	c8b4a215bc	Merge pull request #14573 from hvitved/flow-summary-impl-param ... Move `FlowSummaryImpl.qll` to `dataflow` pack	2023-12-14 12:24:15 +01:00
Tom Hvitved	098afb935b	Address more review comments	2023-12-14 09:48:45 +01:00
Ed Minnix	717e69ac0e	Add properties file references	2023-12-13 16:54:55 -05:00
Jeroen Ketema	99e65df6ce	Merge remote-tracking branch 'upstream/rc/3.12' into mb12	2023-12-13 15:43:39 +01:00
Tony Torralba	66b54f03b7	Rename test	2023-12-13 11:15:27 +01:00
Tony Torralba	d955dce72a	Improve source of randomness detection ... Also sanitize flow out of sinks to avoid overlapping paths	2023-12-13 11:15:27 +01:00
Tony Torralba	fc45621ab1	Add pac4j JWT cryptographic key sinks	2023-12-13 11:15:27 +01:00
Tony Torralba	7bc907840c	Fix tests	2023-12-13 11:15:27 +01:00
Tony Torralba	3a5d711711	Add cookie sinks	2023-12-13 11:15:27 +01:00
Tony Torralba	435d1f97a3	Add sink for OpenSAML's RequestType.setID	2023-12-13 11:15:27 +01:00
masterofnow	e1b8fabf7f	Use global instead of local taint tracking.	2023-12-13 13:50:34 +08:00
masterofnow	8538c12267	Merge branch 'github:main' into LoadClassNoSignatureCheck	2023-12-13 13:47:40 +08:00
github-actions[bot]	9b20665d75	Add changed framework coverage reports	2023-12-13 00:16:25 +00:00
Tony Torralba	bd8f35bef7	Java: Fix FPs in Missing certificate pinning ... Local URIs should never require pinning	2023-12-12 18:02:12 +01:00
Tony Torralba	27be5ba14b	Merge pull request #15073 from atorralba/atorralba/java/remove-invalid-ognl-sinks ... Java: Remove invalid OGNL sinks	2023-12-12 16:52:31 +01:00
Tony Torralba	fad53a25c0	Update java/ql/lib/ext/struts2.model.yml ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2023-12-12 14:58:47 +01:00
Tony Torralba	103110f9c2	Java: Remove invalid OGNL sinks ... Fixes #15053	2023-12-12 13:39:51 +01:00
Edward Minnix III	06eef93f89	Docs review suggestions	2023-12-11 11:18:40 -05:00
Edward Minnix III	ce20c4ae03	Docs review suggestions ... Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com>	2023-12-11 11:18:40 -05:00
Ed Minnix	7362158229	Fix test case	2023-12-11 11:18:40 -05:00
Ed Minnix	1271cd3348	Remove unnecessary crypto sinks	2023-12-11 11:18:40 -05:00
Ed Minnix	3ca039bc8f	Rename to InsecureRandomness	2023-12-11 11:18:40 -05:00
Ed Minnix	6e70e6c85a	Use pre-exisiting type for SecureRandom	2023-12-11 11:18:39 -05:00
Edward Minnix III	4678302edb	Update query metadata ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-12-11 11:18:39 -05:00
Ed Minnix	bbf99375c7	Alter cookie sinks to instead focus on creation of a cookie	2023-12-11 11:18:39 -05:00
Ed Minnix	4bdf2b5e18	Bump change note date	2023-12-11 11:18:39 -05:00
Ed Minnix	b9d2a26e6e	Move ESAPI models into the Weak Randomness query ... These models don't need to apply to all queries. So instead they are better suited to be within the weak randomness query itself.	2023-12-11 11:18:39 -05:00
Ed Minnix	7f3995f524	Remove extra encryption-iv models	2023-12-11 11:18:39 -05:00
Ed Minnix	7241e0920c	Replace convertBytesToString with models	2023-12-11 11:18:39 -05:00
Ed Minnix	e9ca4a25d4	Update to new MethodCall name	2023-12-11 11:18:39 -05:00
Ed Minnix	a1e9564cc5	Add more sources	2023-12-11 11:18:39 -05:00
Ed Minnix	b8b2de2f3c	Remove use of crypto-parameter sink kind	2023-12-11 11:18:39 -05:00
Ed Minnix	646254c9b2	Add credentials sinks from SensitiveApi	2023-12-11 11:18:39 -05:00
Ed Minnix	057a74d914	Remove unnused class	2023-12-11 11:18:39 -05:00
Ed Minnix	fb875f5095	More variety of test cases	2023-12-11 11:18:39 -05:00
Ed Minnix	ba3c38c226	Restrict addCookie to specific interface	2023-12-11 11:18:38 -05:00
Ed Minnix	dc3e4cd928	Refactored method accesses to the RandomDataSource library	2023-12-11 11:18:38 -05:00
Ed Minnix	ce7690b53f	Make imports private	2023-12-11 11:18:38 -05:00
Edward Minnix III	bc0655573f	Simplifications ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-12-11 11:18:38 -05:00
Ed Minnix	14fdfa4428	Add new sink kind and change note	2023-12-11 11:18:38 -05:00
Ed Minnix	0313f39229	Cryptographic sinks	2023-12-11 11:18:38 -05:00
Ed Minnix	b713efb711	Add ThreadLocalRandom.current as another source	2023-12-11 11:18:38 -05:00
Ed Minnix	bf0123d6ae	Add org.apache.commons.lang.RandomStringUtils as a source	2023-12-11 11:18:38 -05:00
Ed Minnix	1daa83bf46	Add test cases	2023-12-11 11:18:38 -05:00
Ed Minnix	e69ff7b601	Move to library and add docs	2023-12-11 11:18:38 -05:00
Ed Minnix	9f986ca527	Add Weak Randomness Query	2023-12-11 11:18:38 -05:00
Tom Hvitved	f9dbf676a6	Java: Use FlowSummaryImpl from dataflow pack	2023-12-10 11:25:45 +01:00
Ed Minnix	1526da5929	Deprecation change note	2023-12-08 10:50:04 -05:00