Michael Nebel
2d57b7d56a
Java: Sync files.
2022-09-14 11:06:23 +02:00
Michael Nebel
13a802e260
Java: Sync files and make adjusting changes.
2022-09-14 11:06:23 +02:00
Tony Torralba
ac46a38b9d
Update java/ql/src/Security/CWE/CWE-079/XSS.java
2022-09-13 16:49:20 +02:00
Tony Torralba
2b027709e4
Update XSS qhelp
2022-09-13 16:39:48 +02:00
gx1
1c4488e7c8
Updated vulnerable XSS.java version
2022-09-13 15:58:25 +02:00
Anders Schack-Mulligen
c8b93e0910
Java: Replace uses of deprecated variableTrack.
2022-09-13 13:30:40 +02:00
Sebastian Bauersfeld
f95663cdfb
Java: Added change note.
2022-09-13 11:38:15 +07:00
Edward Minnix III
eadb8a3988
Merge pull request #10106 from egregius313/egregius313/android-backup-allowed
...
Java: Query to detect Android backup allowed
2022-09-12 11:14:03 -04:00
Tony Torralba
dd6257c757
Add security-severity
2022-09-12 11:59:01 +02:00
Edward Minnix III
08a17b355e
allowBackup documentation updates
...
Make error messages and descriptions clearer about application backups not being disabled, rather than focusing on `android:allowBackup` specifically.
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-09 09:30:49 -04:00
Edward Minnix III
83c8e22225
Apply suggestions from documentation review
...
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com >
2022-09-08 15:55:00 -04:00
Tony Torralba
6413de6c20
Add change note
2022-09-08 17:38:26 +02:00
Tony Torralba
fb13e7f307
Docs changes
2022-09-08 17:38:25 +02:00
Tony Torralba
b68e6669b8
Refactor TemplateInjection libraries
2022-09-08 17:38:25 +02:00
github-actions[bot]
a9d80a5a48
Release preparation for version 2.10.5
2022-09-08 11:35:54 +00:00
Ed Minnix
c69a2be976
Moved allowBackup query logic to allowsBackup pred
2022-09-07 12:08:25 -04:00
Edward Minnix III
f6c8144eed
Update java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-07 09:46:36 -04:00
Edward Minnix III
9ddfcf935b
Update java/ql/src/change-notes/2022-08-18-android-allowbackup-query.md
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-07 09:46:16 -04:00
Tony Torralba
cd61bd0606
Move files from experimental
2022-09-07 13:13:40 +02:00
Ed Minnix
dca4cd221a
Documentation cleanup for allowBackup query
2022-09-06 14:35:11 -04:00
Tony Torralba
c0dd9dd5d5
Merge pull request #10249 from atorralba/atorralba/regex-dot-bypass-docs
...
Java: Documentation fixes in the "Permissive dot regex" experimental query
2022-09-06 16:18:35 +02:00
Anders Schack-Mulligen
6ffaa6918a
Apply suggestions from code review
2022-09-06 14:11:48 +02:00
Tony Torralba
b94e0d3e69
Merge pull request #10251 from atorralba/atorralba/implicit-pendingintent-sinks
...
Java: Add new AlarmManager sinks to Use of implicit PendingIntents
2022-09-06 11:31:27 +02:00
Erik Krogh Kristensen
6cee635cb5
Merge pull request #10180 from erik-krogh/fixTags
...
Add missing security tags
2022-09-02 08:04:57 +02:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
Tony Torralba
04c230b128
Docs fixes
2022-09-01 09:57:32 +02:00
Tony Torralba
5d9f366ac5
Add change note
2022-09-01 09:53:46 +02:00
Michael Nebel
1cb6d78d35
Merge pull request #10170 from michaelnebel/java/models-io
...
Java: Update models for commons-io and add negative models.
2022-08-31 11:05:09 +02:00
Tony Torralba
2ec53bf78c
Merge pull request #9873 from luchua-bc/java/permissive-dot-regex
...
Java: CWE-625 Query to detect regex dot bypass
2022-08-31 10:24:18 +02:00
luchua-bc
e2e87980cc
Move pattern check to MatchRegexConfiguration::isSink
2022-08-30 22:48:12 +00:00
Ed Minnix
500a6f3b86
Add check for files which provide the app launcher
...
Adds support for filtering which applications include the
`android.intent.action.MAIN` intent.
2022-08-30 12:54:26 -04:00
Michael Nebel
e020ae77e0
Merge pull request #10158 from michaelnebel/csharp/narrowcollectiontypes
...
C#: Narrow collection like types in model generation.
2022-08-30 14:20:57 +02:00
Tony Torralba
1f83c5833b
Merge pull request #10092 from zbazztian/zbazztian/string.replace-taint
...
Java: Add additional taint steps for java.lang.String methods
2022-08-30 12:24:37 +02:00
Michael Nebel
2b1423dd74
Java: Exclude static initializers from model generation.
2022-08-29 14:29:32 +02:00
Michael Nebel
290c35e7c6
Java: Use negative summary models in unsupported external api telemetry query.
2022-08-29 14:28:55 +02:00
erik-krogh
b1e53280a6
fix that the wrong line got deleted
2022-08-29 13:26:02 +02:00
Erik Krogh Kristensen
bd5fd7d963
fix typo in change-note
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-08-29 13:25:54 +02:00
erik-krogh
f09fc7b0fc
Java: add java change-note
2022-08-29 13:10:21 +02:00
erik-krogh
8b37168223
Java: remove security tag from queries not in the security folder and with missing security-severity tags
2022-08-29 13:08:56 +02:00
github-actions[bot]
3b4ad3c4f1
Post-release preparation for codeql-cli-2.10.4
2022-08-26 09:32:11 +00:00
Michael Nebel
be4c2231d1
C#: Avoid generating new source models on 'file' kind sources.
2022-08-26 09:30:07 +02:00
erik-krogh
cc7a9ef97a
rename more acronyms
2022-08-25 20:52:27 +02:00
Erik Krogh Kristensen
06afe9c0f4
Merge pull request #9816 from erik-krogh/msgConsis
...
Make alert messages consistent across languages
2022-08-25 15:20:01 +02:00
github-actions[bot]
0f63bc077f
Release preparation for version 2.10.4
2022-08-25 12:52:26 +00:00
erik-krogh
c7aa58252a
change "does not seem to check" to "does not check" in unchecked-cast-in-equals queries
2022-08-25 12:31:58 +02:00
Edward Minnix III
e6a1b1fab9
Rename allowBackup query id
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-08-24 15:54:13 -04:00
Ed Minnix
a036639ecd
Added change notes
2022-08-24 15:54:13 -04:00
Ed Minnix
dad4a403db
Add support for android:allowBackup default value
...
The default value of `android:allowBackup` is `true`. Added support for
detecting if the default value is used.
2022-08-24 15:54:13 -04:00
Ed Minnix
6509426fb3
android:allowBackup query documentation
2022-08-24 15:54:13 -04:00
Ed Minnix
44b0a2b8af
Android allowBackup query
2022-08-24 15:54:13 -04:00
