hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 02:13:17 +01:00
Code Issues Packages Projects Releases Wiki Activity
77,734 Commits 1,671 Branches 157 Tags
codeql-cli-2.21.0
Commit Graph

4237 Commits

Author SHA1 Message Date
Joe Farebrother
71852868ac Add case for androidx.biometric api 2024-02-02 17:19:20 +00:00
Anders Schack-Mulligen
49b00f3842 Java: Remove two redundant models implied by CharSequence models. 2024-02-02 13:17:26 +01:00
Max Schaefer
ab6cea14c8 Fix missing quotes. 2024-01-31 11:49:25 +00:00
Joe Farebrother
9130603334 Address reviews - use SimpleTypeSanitizer and alter qldoc style 2024-01-31 11:31:25 +00:00
Max Schaefer
6c6f402fa5 Merge branch 'main' into java/update-mad-decls-after-triage-2024-01-31T11-16-45 2024-01-31 11:29:33 +00:00
Max Schaefer
ad8038bade Update MaD Declarations after Triage 2024-01-31 11:28:10 +00:00
Joe Farebrother
8bd79908a6 Implement local auth query 2024-01-30 16:49:55 +00:00
Tony Torralba
e2bf9ea2eb Consider File.exists() et al a path-injection sink 2024-01-30 14:51:36 +01:00
Joe Farebrother
94075ef148 Fix FPs - consider flow through fields when determining whether a view is masked, and find more instances of findViewById. 2024-01-29 16:25:38 +00:00
Joe Farebrother
aa78050933 Implement checks for elements hidden by their xml attributes 2024-01-29 16:25:38 +00:00
Joe Farebrother
6081f18089 Add unit tests + make some fixes 2024-01-29 16:25:37 +00:00
Joe Farebrother
8582093e65 Implement checks for parent views being hidden 2024-01-29 16:25:37 +00:00
Joe Farebrother
1b13597d72 Implement checks for calls that may safely mask information 2024-01-29 16:25:37 +00:00
Joe Farebrother
5dd0addfc2 Add sensitive text flow query 2024-01-29 16:25:36 +00:00
Marcono1234
d8fe0f5bb8 Java: Document which assignment type is covered by which class 2024-01-28 19:03:36 +01:00
Edward Minnix III
4602f8933d Merge pull request #15292 from egregius313/egregius313/java/dataflow/common-sanitizers/uuid-and-date 
Java: Add `java.util.UUID` and `java.util.Date` to the `SimpleTypeSanitizer` class
 2024-01-26 13:16:18 -05:00
Joe Farebrother
031bd8bd0c Merge pull request #15281 from joefarebrother/android-sensitive-ui-notif 
Java: Add query for exposure of sensitive information to android notifiactions
 2024-01-26 16:42:55 +00:00
Max Schaefer
73130ec665 Merge pull request #15436 from github/max-schaefer-patch-1 
Java: Add models for overloads of DatagramPacket constructor
 2024-01-26 16:13:11 +00:00
Tony Torralba
b8cb514dc4 Rename the other change note 2024-01-26 12:46:51 +01:00
Tony Torralba
19a6b7858b Remove reference to PathCreation 
ZipSlip no longer needs to make this exclusion, since PathCreation arguments are no longer path-injection sinks
 2024-01-26 12:45:00 +01:00
Tony Torralba
19cb7adb6d Migrate path injection sinks to MaD 
Deprecate and stop using PathCreation

Path creation sinks are now summaries
 2024-01-26 12:19:54 +01:00
Tony Torralba
52d7bd93a5 Merge pull request #15420 from github/java/update-mad-decls-after-triage-2024-01-24T10-05-04 
Java: Update MaD Declarations after Triage
 2024-01-26 08:42:49 +01:00
Tony Torralba
d299971086 Fix code review mistake 2024-01-25 17:42:11 +01:00
Max Schaefer
13f0df3588 Add two more models. 2024-01-25 15:00:22 +00:00
Max Schaefer
5235291919 Add models for overloads of DatagramPacket constructor 2024-01-25 14:49:05 +00:00
Stephan Brandauer
1f9a968774 Java: PR discussion 2024-01-25 13:59:47 +01:00
Stephan Brandauer
5d6ee9c0cb Update java/ql/lib/ext/com.fasterxml.jackson.databind.model.yml 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-01-25 10:00:56 +01:00
Stephan Brandauer
4e63cbc993 Merge branch 'main' into java/update-mad-decls-after-triage-2024-01-24T10-05-04 2024-01-24 14:55:20 +01:00
Stephan Brandauer
d5bcbcddab Update MaD Declarations after Triage 2024-01-24 11:05:07 +01:00
Ed Minnix
ef884fa721 Change note 2024-01-23 22:35:05 -05:00
github-actions[bot]
d0b74c00fe Post-release preparation for codeql-cli-2.16.1 2024-01-23 23:02:29 +00:00
github-actions[bot]
7ef611e6dc Release preparation for version 2.16.1 2024-01-23 19:45:16 +00:00
Ed Minnix
dca24ded18 Add UUID and Date to the list of types in the SimpleTypeSanitizer class 2024-01-23 13:36:03 -05:00
Edward Minnix III
3c8b09307d Merge pull request #15291 from egregius313/egregius313/java/dataflow/default-sanitizers 
Java: Introduce a common sanitizer type for types which cannot realistically carry taint.
 2024-01-23 13:28:03 -05:00
Erik Krogh Kristensen
f1d6f56621 Merge pull request #15393 from erik-krogh/deps-jan-2024 
All: delete outdated deprecations
 2024-01-23 13:52:38 +01:00
Tony Torralba
fcd9a5ed71 Update java/ql/lib/change-notes/2023-12-21-new-models.md 2024-01-23 11:18:12 +01:00
Joe Farebrother
dedba1fc54 Address review comments - add barrierIn and fix a model for a PendingIntent sink 2024-01-23 09:51:42 +00:00
Joe Farebrother
b23bbf93d4 Reorder sink models 2024-01-23 09:51:41 +00:00
Joe Farebrother
d806fcae3d Remove sink models involving PendingIntent; as they do not carry sensitive data (including from the original intent they were created with) 2024-01-23 09:51:39 +00:00
Joe Farebrother
2ca164ce35 Generate androidx stubs and correct some models 2024-01-23 09:51:39 +00:00
Joe Farebrother
bafd65b1d2 Add tests to cover each modeled sink + some corrections to the models 2024-01-23 09:51:38 +00:00
Joe Farebrother
a1a2acd3ce Add additional test cases 2024-01-23 09:51:38 +00:00
Joe Farebrother
f9bb004618 Add sink models to notification builder setters 2024-01-23 09:51:38 +00:00
Joe Farebrother
143ce0b94a Add sensitive notification query 2024-01-23 09:51:37 +00:00
Stephan Brandauer
95b439bf31 Merge branch 'main' into java/update-mad-decls-after-triage-2023-12-21T14-39-02 2024-01-23 09:40:50 +01:00
Stephan Brandauer
cd765e7c19 work on review comments 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-01-23 09:35:36 +01:00
Stephan Brandauer
8b34407ab7 Java: java.awt.Desktop::browse is a url-redirection sink 
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>
 2024-01-23 09:28:13 +01:00
Ed Minnix
fcbee1994b Update change note 2024-01-22 23:57:31 -05:00
Ed Minnix
fb80c5ea84 Rename SimpleScalarSanitizer to SimpleTypeSanitizer 2024-01-22 23:55:29 -05:00
Ed Minnix
696788e5b2 Rename semmle.code.java.security.dataflow.CommonSanitizers to semmle.code.java.security.Sanitizers 2024-01-22 23:52:19 -05:00