Max Schaefer
a46a7fadb2
Java: Improve QHelp for java/path-injection to mention less disruptive fixes.
2023-11-15 11:25:13 +00:00
masterofnow
532f6a5b0c
Removed @kind path-problem in comment. Added text message in select.
2023-11-13 08:27:07 +08:00
masterofnow
20592352d0
Updated text in LoadClassNoSignatureCheck.qhelp
2023-11-12 20:48:49 +08:00
masterofnow
fd66f47d82
Added LoadClassNoSignatureCheck.ql
2023-11-12 20:27:49 +08:00
Tony Torralba
5442cdb49c
Merge pull request #14610 from atorralba/atorralba/java/jms-deserialization
...
Java: Add JMS sink to java/unsafe-deserialization
2023-11-08 09:10:20 +01:00
Geoffrey White
e8a466a02c
Update dead link.
2023-11-07 09:26:07 +00:00
github-actions[bot]
2b939fdf08
Post-release preparation for codeql-cli-2.15.2
2023-10-30 16:06:51 +00:00
github-actions[bot]
4641990021
Release preparation for version 2.15.2
2023-10-30 11:05:53 +00:00
Tony Torralba
7af3d239ab
Java: Add JMS sink to java/unsafe-deserialization
2023-10-26 16:46:19 +02:00
Chris Smowton
06238dd5f6
Improve reflective class names
2023-10-24 13:29:32 +01:00
Chris Smowton
e8c9708282
Autoformat
2023-10-24 11:06:19 +01:00
Chris Smowton
ac38d4c9c6
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
Chris Smowton
59a49eef0b
Add aliases for public, importable renamed classes and predicates.
...
Also rename and aliases a couple of uses of Access noted along the way.
2023-10-24 10:54:35 +01:00
Chris Smowton
f552a15aae
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
Ian Lynagh
b89088737a
Merge pull request #14551 from igfoo/igfoo/loc
...
Java/Kotlin: Reshuffle our LoC queries
2023-10-23 11:50:03 +01:00
Ian Lynagh
26634a3266
Java/Kotlin: Add a changenote for the lines-of-code changes
2023-10-20 13:04:39 +01:00
Ian Lynagh
d816035da6
Java/Kotlin: Tweak LoC message
2023-10-20 13:02:11 +01:00
Ian Lynagh
13a9e83e6a
Java/Kotlin: Reshuffle our LoC queries
...
There's now a single lines-of-code query that gives the total number of
lines of code over both languages.
Per-language LoC queries are now just summaries.
2023-10-20 12:43:41 +01:00
Dave Bartolomeo
712f7758cf
Merge branch 'main' into post-release-prep/codeql-cli-2.15.1
2023-10-19 12:14:07 -04:00
Tony Torralba
da44b13fd4
Merge pull request #14515 from atorralba/atorralba/java/spring-csrf-improv
...
Java: Improve java/spring-disabled-csrf-protection
2023-10-18 17:49:10 +02:00
github-actions[bot]
8dcd8b9e5b
Post-release preparation for codeql-cli-2.15.1
2023-10-17 20:24:00 +00:00
github-actions[bot]
3b3c036626
Release preparation for version 2.15.1
2023-10-16 17:49:39 +00:00
Tony Torralba
d08ee76b16
Java: Improve java/spring-disabled-csrf-protection
2023-10-16 16:01:14 +02:00
Tony Torralba
ae8e237f2c
Merge pull request #14494 from atorralba/atorralba/remove-library
...
Java/C/C#: Remove library annotations
2023-10-16 09:01:40 +02:00
Owen Mansel-Chan
53561008a1
Merge pull request #14445 from owen-mc/go/automated-mad-coverage-report
...
Go: automated mad coverage report
2023-10-15 21:49:47 +01:00
amammad
7fcf39277d
modularize
2023-10-14 12:04:25 +02:00
Tony Torralba
0cea3f8531
Remove library annotations
2023-10-13 12:46:56 +02:00
Owen Mansel-Chan
286271340e
Merge branch 'main' into go/automated-mad-coverage-report
2023-10-11 21:31:25 +01:00
Owen Mansel-Chan
dfcdb4ace8
Update CSV to MaD in description for java and C#
2023-10-11 21:09:59 +01:00
Eric Bickle
ee2d8f84de
Merge branch 'main' into fix/thread-resource-arithmetic
2023-10-11 13:09:57 -07:00
Eric Bickle
f018d83951
Merge branch 'fix/thread-resource-arithmetic' of https://github.com/ebickle/codeql into fix/thread-resource-arithmetic
2023-10-11 13:09:39 -07:00
Eric Bickle
4cb78ab3c7
Remove change notes
2023-10-11 13:08:56 -07:00
Henry Mercer
1a370bfbbe
Merge pull request #14443 from github/post-release-prep/codeql-cli-2.15.0
...
Post-release preparation for codeql-cli-2.15.0
2023-10-11 17:39:04 +01:00
github-actions[bot]
ae6af17c74
Post-release preparation for codeql-cli-2.15.0
2023-10-11 14:19:20 +00:00
Eric Bickle
7a4382fb69
Merge branch 'main' into fix/thread-resource-arithmetic
2023-10-10 09:38:16 -07:00
Eric Bickle
80c8259e34
Remove unnecessary AdditionalValueStep check
2023-10-10 09:35:45 -07:00
Michael Nebel
5c44f8bbad
Merge pull request #14370 from michaelnebel/java/enablethreatmodels
...
Java: Enable threat models for most Java queries.
2023-10-10 09:25:47 +02:00
Michael Nebel
cf3a62d201
Java: Address review comments.
2023-10-09 13:06:59 +02:00
erik-krogh
e3e8f3d7c4
Java: delete various outdated deprecations
2023-10-09 09:14:54 +02:00
Eric Bickle
4dca396106
Add change notes for ThreadResourceAbuse ArithExpr fix
2023-10-06 14:31:37 -07:00
Eric Bickle
000c1f7ec8
Java: Flow taint through ArithExpr for ThreadResourceAbuse
...
Ensure that tainted values flow through arithmetic operations when
checking for ThreadResourceAbuse vulnerabilities.
For example, multiplying 'number of seconds' by 1000 as an input
to Thread.Sleep, which accepts milliseconds, is a common scenario.
2023-10-06 14:24:37 -07:00
Michael Nebel
dca39348ab
Java: Add change note.
2023-10-06 15:09:16 +02:00
github-actions[bot]
9fe993bec3
Release preparation for version 2.15.0
2023-10-04 14:15:27 +00:00
Michael Nebel
40e63a63e2
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
Henry Mercer
da92da2204
Bump minor versions of packs we regularly release
2023-10-03 16:31:23 +01:00
Henry Mercer
f3847b3f51
Merge branch 'main' into henrymercer/rc-3.11-mergeback
2023-10-03 16:30:23 +01:00
amammad
863fa364e2
remove CLI sources Library file & unused file system sinks
2023-09-30 20:11:14 +10:00
amammad
bb8063c0f4
remove CLI sources & unused imports
2023-09-30 06:07:44 +10:00
amammad
2ab10262fc
V3: better sinks, replace sinks arguments to sinks method accesses
2023-09-30 06:06:34 +10:00
amammad
83cffea1a1
v3
2023-09-30 05:56:39 +10:00
