Tony Torralba
|
36f6a6fb10
|
Model more EnumSet methods as neutrals
|
2024-03-14 08:46:43 +01:00 |
|
Jami Cogswell
|
e285cf232c
|
Java: add resource-related methods as path-injection sinks and as summaries
|
2024-03-13 22:48:57 -04:00 |
|
Jami Cogswell
|
1b01f26d09
|
Java: adjust BarrierPrefix to handle prepended chars
|
2024-03-13 16:28:45 -04:00 |
|
Jami Cogswell
|
04d27f2d65
|
Java: adjust prefix barriers
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
e99cea340b
|
Java: update UrlPathBarrier to include FollowsBarrierPrefix
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
c5a59d6c51
|
Java: add QLDoc
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
7310c155e2
|
Java: rename SpringUrlForwardSink
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
a8075969d8
|
Java: add QLDocs to UrlPathBarrier code
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
042dcf9cd9
|
Java: some updates to UrlPathBarrier code
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
052452b186
|
Java: create UrlDecodeMethod
|
2024-03-13 16:28:44 -04:00 |
|
Jami Cogswell
|
d220b3a298
|
Java: some updates to test cases
|
2024-03-13 16:28:43 -04:00 |
|
Jami Cogswell
|
43b49628fc
|
Java: use new 'SimpleTypeSanitizer', and update some non-extending subtype relationships
|
2024-03-13 16:28:43 -04:00 |
|
Jami Cogswell
|
2708e53c7f
|
Java: remove redundant imports
|
2024-03-13 16:28:43 -04:00 |
|
Jami Cogswell
|
f573032b2e
|
Java: remove todo comments from ext files
|
2024-03-13 16:28:43 -04:00 |
|
Jami Cogswell
|
911a61df22
|
Java: initial update of barrier and test cases to remove FN
|
2024-03-13 16:28:42 -04:00 |
|
Jami Cogswell
|
5fa63ab5c2
|
Java: update/add some TODO comments
|
2024-03-13 16:28:41 -04:00 |
|
Jami Cogswell
|
09bc21dbd3
|
Java: rename 'UnsafeUrlForward' to 'UrlForward'
|
2024-03-13 16:28:41 -04:00 |
|
Jami Cogswell
|
5a9d7552b3
|
Java: add some comments and minor code reorg
|
2024-03-13 16:28:41 -04:00 |
|
Jami Cogswell
|
1da1e896cb
|
Java: convert SpringModelAndViewSink to MaD
|
2024-03-13 16:28:41 -04:00 |
|
Jami Cogswell
|
8d66097483
|
Java: switch StaplerResponse.forward from request-forgery sink to url-forward sink
|
2024-03-13 16:28:41 -04:00 |
|
Jami Cogswell
|
42e3825ea3
|
Java: convert RequestDispatcherSink to MaD
|
2024-03-13 16:28:40 -04:00 |
|
Jami Cogswell
|
4ff884e26c
|
Java: remove more path-injection related classes (will maybe add some of these back in a separate PR)
|
2024-03-13 16:28:40 -04:00 |
|
Jami Cogswell
|
2a682995ae
|
Java: move MaD models to correct files, delete ones that already exist
|
2024-03-13 16:28:40 -04:00 |
|
Jami Cogswell
|
915e106ab3
|
Java: remove path-injection related models and tests for now
|
2024-03-13 16:28:40 -04:00 |
|
Jami Cogswell
|
2793f28428
|
Java: move config to Query.qll file
|
2024-03-13 16:28:40 -04:00 |
|
Jami Cogswell
|
0d38a9625e
|
Java: copy files from experimental
|
2024-03-13 16:28:39 -04:00 |
|
Tony Torralba
|
039bea1625
|
Java: Add more neutral JDK models
This is similar to https://github.com/github/codeql/pull/15766, in the sense that it adds neutral models to prevent the model generator from generating summaries for them. These models were spotted while evaluating https://github.com/github/codeql/pull/14919.
|
2024-03-13 16:59:38 +01:00 |
|
Tom Hvitved
|
02ae2d1520
|
Java: Implement new data flow interface
|
2024-03-13 14:41:57 +01:00 |
|
Edward Minnix III
|
d54489931c
|
Merge pull request #15869 from egregius313/egregius313/java/fix/parcelfiledescriptor-open-sink
Java: Add path-injection sink for `ParcelFileDescriptor::open`
|
2024-03-12 16:39:20 -04:00 |
|
Erik Krogh Kristensen
|
863e3f79e5
|
Merge pull request #15731 from erik-krogh/java-url
Java: More sanitizers for request-forgery
|
2024-03-12 19:31:52 +01:00 |
|
erik-krogh
|
f613823047
|
add explicit QLDoc that any method named "contains" is matched
|
2024-03-12 15:25:27 +01:00 |
|
erik-krogh
|
35aae0a981
|
move changenote to src/
|
2024-03-12 15:22:57 +01:00 |
|
Erik Krogh Kristensen
|
b53ae77c56
|
expand change-note
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
|
2024-03-12 15:22:17 +01:00 |
|
erik-krogh
|
74876ff49b
|
add change-note
|
2024-03-12 15:07:36 +01:00 |
|
erik-krogh
|
52f71e4553
|
small fixes based on review
|
2024-03-12 15:07:29 +01:00 |
|
Ed Minnix
|
76aeee2820
|
Change note
|
2024-03-11 10:34:15 -04:00 |
|
Ed Minnix
|
61dbe26858
|
Add sinks for android.os.ParcelFileDescriptor
|
2024-03-11 10:31:51 -04:00 |
|
Tom Hvitved
|
da66281fef
|
Sync files
|
2024-03-11 13:02:04 +01:00 |
|
github-actions[bot]
|
dc9092c9ec
|
Post-release preparation for codeql-cli-2.16.4
|
2024-03-06 22:19:33 +00:00 |
|
github-actions[bot]
|
2f058ffb4d
|
Release preparation for version 2.16.4
|
2024-03-06 20:56:51 +00:00 |
|
Angela P Wen
|
ce31f8641a
|
Revert "Release preparation for version 2.16.4"
|
2024-03-06 12:07:33 -08:00 |
|
github-actions[bot]
|
661e68dab5
|
Release preparation for version 2.16.4
|
2024-03-05 18:13:58 +00:00 |
|
Angela P Wen
|
967963a653
|
Revert "Release preparation for version 2.16.4"
|
2024-03-05 08:53:33 -08:00 |
|
github-actions[bot]
|
a67218a027
|
Release preparation for version 2.16.4
|
2024-03-04 17:42:08 +00:00 |
|
Max Schaefer
|
1f3a3492ae
|
Merge pull request #15792 from github/max-schaefer-patch-1
Java: Fix sink type in hudson.model.yml
|
2024-03-04 13:08:47 +00:00 |
|
Owen Mansel-Chan
|
279605b486
|
Merge pull request #15786 from owen-mc/java/sensitive-logging-query-exclude-null-in-variable-name
Java: sensitive logging query exclude null in variable name
|
2024-03-04 12:14:42 +00:00 |
|
Max Schaefer
|
52a36ce41c
|
Java: Fix sink type in hudson.model.yml
|
2024-03-04 11:53:37 +00:00 |
|
Owen Mansel-Chan
|
038afc4008
|
Merge pull request #15772 from owen-mc/java/model-generator-exclude-tostring
Java: do not generate models for `toString` and lambda flow methods
|
2024-03-04 07:57:48 +00:00 |
|
Owen Mansel-Chan
|
c7efde3b7a
|
Remove variables with "null" in their name as sources
|
2024-03-03 20:55:04 +00:00 |
|
Owen Mansel-Chan
|
114c17ad57
|
Add more methods of java.util.Comparator
|
2024-03-02 20:55:30 +00:00 |
|