Joe Farebrother
f9bb004618
Add sink models to notification builder setters
2024-01-23 09:51:38 +00:00
Joe Farebrother
143ce0b94a
Add sensitive notification query
2024-01-23 09:51:37 +00:00
Ed Minnix
fb80c5ea84
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
Ed Minnix
696788e5b2
Rename semmle.code.java.security.dataflow.CommonSanitizers to semmle.code.java.security.Sanitizers
2024-01-22 23:52:19 -05:00
Ed Minnix
bb44277090
Make import of dataflow private
2024-01-22 23:40:24 -05:00
Ed Minnix
67dfca2e58
Convert libraries to use instanceof SimpleScalarSanitizer
2024-01-22 23:38:26 -05:00
Ed Minnix
7f7c49d6ce
Add the SimpleScalarSanitizer class
...
The `SimpleScalarSanitizer` class represents common scalar types which
cannot realistically carry taint (e.g. primitives/numbers, and
eventually UUIDs and Dates)
2024-01-22 23:38:24 -05:00
erik-krogh
8be7eadace
delete outdated deprecations
2024-01-22 09:11:35 +01:00
Tony Torralba
2246c969a3
Merge pull request #15244 from Marcono1234/marcono1234/regex-flags
...
Java: Improve Regex flag parsing
2024-01-16 08:25:49 +01:00
Owen Mansel-Chan
6945289afc
Merge pull request #15246 from owen-mc/java/manual-neutral-overrides-generated
...
C#/Java: Manual neutral summaries should block generated summaries
2024-01-12 10:05:18 +00:00
Owen Mansel-Chan
7824e60acd
Manual neutral summaries should block generated summaries
2024-01-10 22:25:06 +00:00
Tom Hvitved
c9cf2a899c
Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify
...
Data flow: Remove column from `mayBenefitFromCallContext`
2024-01-10 11:43:15 +01:00
Tom Hvitved
f90201eb56
Data flow: Remove column from mayBenefitFromCallContext
2024-01-09 11:34:43 +01:00
Ed Minnix
a528db8958
Use MapMutation instead of MethodCall
2024-01-08 09:39:05 -05:00
Ed Minnix
709649e9df
Model replace and putIfAbsent
2024-01-08 09:39:03 -05:00
Ed Minnix
1544330f3f
Minor fixes for code review
2024-01-08 09:38:53 -05:00
Edward Minnix III
1f37e70d83
Fix typos
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-08 09:38:51 -05:00
Ed Minnix
6eff72f99a
Include other map mutations
2024-01-08 09:38:49 -05:00
Ed Minnix
f1f0f50c92
TaintedEnvironmentVariableQuery docs
2024-01-08 09:38:47 -05:00
Ed Minnix
d4e2b84348
Cleanup helper dataflow configuration
2024-01-08 09:38:45 -05:00
Ed Minnix
8ed3f3c865
Move to library
2024-01-08 09:38:44 -05:00
Tony Torralba
7e6f2d1fc5
Merge pull request #14681 from atorralba/atorralba/java/weak-randomness-cve-coverage
...
Java: Add more sinks to the Insecure Randomness query
2024-01-08 15:33:03 +01:00
Marcono1234
3edfdc5ceb
Java: Improve Regex flag parsing
...
Fixes:
- Flag `d` not being recognized
- Syntax for disabling flags (`-`) not being recognized
- Non-capturing group with flags erroneously containing `:` as literal
2024-01-06 04:15:09 +01:00
Tony Torralba
8ad787f3b8
Java: Generelize MaybeBrokenCryptoAlgorithmQuery.qll
2023-12-22 10:15:40 +01:00
Ed Minnix
7f9dff2dc7
Fix minor error in Weak Hashing
2023-12-21 22:48:07 -05:00
Ed Minnix
ce130c6ed5
Add replace to MapMutator
2023-12-19 10:23:06 -05:00
Edward Minnix III
56921a6e21
Merge pull request #14040 from egregius313/egregius313/weak-hashing-properties
...
Java: Add support for algorithm names specified in `.properties` files to `java/potentially-weak-cryptographic-algorithm`
2023-12-18 09:38:58 -05:00
Tony Torralba
9446249e94
Merge pull request #15012 from atorralba/atorralba/java/fix-missing-pinning-fp
...
Java: Fix FPs in Missing certificate pinning
2023-12-18 09:37:18 +01:00
Ed Minnix
09a0730491
QLdoc fix
2023-12-15 11:13:09 -05:00
Ed Minnix
02581a3850
Move class for getProperty method call to Properties.qll
2023-12-15 11:09:08 -05:00
Ed Minnix
1c3993e632
QLDocs
2023-12-15 11:09:07 -05:00
Ed Minnix
83c6ece405
Move weak hashing into MaybeBrokenCryptoAlgorithm
2023-12-15 11:09:07 -05:00
Ed Minnix
fbc2a33597
Replace MethodAccess with MethodCall
2023-12-15 11:09:07 -05:00
Ed Minnix
25fa8d5ae7
Move some logic to class
2023-12-15 11:09:07 -05:00
Ed Minnix
93cf5b8eb9
Weak Hashing Property initial query
2023-12-15 11:09:07 -05:00
Anders Schack-Mulligen
337e5e458c
Update java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2023-12-15 08:48:50 +01:00
Anders Schack-Mulligen
7623432c76
Java: Remove/deprecate FlowStateString-based extension points.
2023-12-14 15:15:58 +01:00
Anders Schack-Mulligen
a1068ce2f9
Dataflow: deprecate references
2023-12-14 15:05:33 +01:00
Tom Hvitved
c8b4a215bc
Merge pull request #14573 from hvitved/flow-summary-impl-param
...
Move `FlowSummaryImpl.qll` to `dataflow` pack
2023-12-14 12:24:15 +01:00
Tom Hvitved
098afb935b
Address more review comments
2023-12-14 09:48:45 +01:00
Tony Torralba
d955dce72a
Improve source of randomness detection
...
Also sanitize flow out of sinks to avoid overlapping paths
2023-12-13 11:15:27 +01:00
Tony Torralba
3a5d711711
Add cookie sinks
2023-12-13 11:15:27 +01:00
Tony Torralba
435d1f97a3
Add sink for OpenSAML's RequestType.setID
2023-12-13 11:15:27 +01:00
Tony Torralba
bd8f35bef7
Java: Fix FPs in Missing certificate pinning
...
Local URIs should never require pinning
2023-12-12 18:02:12 +01:00
Ed Minnix
3ca039bc8f
Rename to InsecureRandomness
2023-12-11 11:18:40 -05:00
Ed Minnix
6e70e6c85a
Use pre-exisiting type for SecureRandom
2023-12-11 11:18:39 -05:00
Ed Minnix
bbf99375c7
Alter cookie sinks to instead focus on creation of a cookie
2023-12-11 11:18:39 -05:00
Ed Minnix
b9d2a26e6e
Move ESAPI models into the Weak Randomness query
...
These models don't need to apply to all queries. So instead they are
better suited to be within the weak randomness query itself.
2023-12-11 11:18:39 -05:00
Ed Minnix
7241e0920c
Replace convertBytesToString with models
2023-12-11 11:18:39 -05:00
Ed Minnix
e9ca4a25d4
Update to new MethodCall name
2023-12-11 11:18:39 -05:00
