4076 Commits

Author	SHA1	Message	Date
haby0	effa2b162a	Add spring url redirection detect	2021-05-13 09:55:37 +08:00
Tony Torralba	09b40601a7	Consider ExpressionAccessor	2021-05-12 12:32:38 +02:00
Anders Schack-Mulligen	a247ae4357	Merge pull request #5843 from JLLeitschuh/feat/JLL/improve_kryo_support ... [Java] Fix Kryo FP & Kryo 5 Support	2021-05-12 09:52:24 +02:00
haby0	12f47bcf24	Add UnsafeDeserialization	2021-05-12 12:37:16 +08:00
Marcono1234	8969da7775	Java: Improve not closing resource query; add tests	2021-05-11 19:32:02 +02:00
luchua-bc	e7cd6c9972	Optimize the query	2021-05-11 16:56:12 +00:00
Jonathan Leitschuh	5a68ac88ef	Cleanup Jackson logic after code review	2021-05-11 10:48:22 -04:00
Jonathan Leitschuh	bacc3ef5b3	[Java] Jackson add support for 2 step deserialization taint flow	2021-05-11 10:36:47 -04:00
Jonathan Leitschuh	d0638db6e7	[Java] Add data flow through Iterator deserializers for Jackson	2021-05-11 10:36:47 -04:00
Jonathan Leitschuh	56b1f15dda	[Java] Add taint tracking through Jackson deserialization	2021-05-11 10:36:47 -04:00
Tony Torralba	8754c85a57	Use InlineExpectationsTest	2021-05-11 16:23:12 +02:00
Tony Torralba	fc03b92e11	Moved from experimental to standard	2021-05-11 15:42:13 +02:00
Anders Schack-Mulligen	744c495ac2	Merge pull request #5824 from JLLeitschuh/feat/JLL/guava_first_non_null ... [Java] Add support for com.google.common.base.MoreObjects#firstNonNull	2021-05-11 09:42:20 +02:00
Chris Smowton	0afe22d60c	Merge pull request #5710 from p0wn4j/jsch-os-injection ... [Java] CWE-078: Add JSch lib OS Command Injection sink	2021-05-10 16:12:00 +01:00
Tony Torralba	d99b5bfc66	Reuse previous tests from experimental	2021-05-10 11:17:20 +02:00
Tony Torralba	c70503142f	Require JS enabled even when cross-origin access is enabled in the webviews	2021-05-10 09:45:59 +02:00
Tony Torralba	6884edf52a	Merge branch 'main' into atorralba/promote-unsafe-android-webview-fetch	2021-05-07 16:31:55 +02:00
luchua-bc	fc7d340a89	Query to detect hard-coded Azure credentials	2021-05-07 13:16:41 +00:00
Tony Torralba	dcee1daa31	Mark spurious test results	2021-05-07 13:17:04 +02:00
Tony Torralba	e78e5b9ee4	Merge branch 'main' into promote-jexl-injection	2021-05-07 12:36:49 +02:00
Tony Torralba	b37b15cea4	Re-structure imports, add some new comments to tests	2021-05-07 12:33:51 +02:00
Tony Torralba	2a501956b3	Mark a MISSING test result as suggested in code review	2021-05-07 11:17:51 +02:00
Tony Torralba	b69261727d	Add a new test for	2021-05-06 13:26:25 +02:00
Tony Torralba	1f1f85aeb5	Add change note and fix some QLDocs	2021-05-06 13:13:23 +02:00
Tony Torralba	f1fab854c4	Fix tests for XXE, introduced a dependency with jaxen	2021-05-06 12:11:55 +02:00
Tony Torralba	84504a88e4	Fix tests by adding AndroidManifest.xml	2021-05-06 10:55:56 +02:00
Tony Torralba	76468559ba	Add safe example for dom4j	2021-05-06 10:17:25 +02:00
Tony Torralba	926fedb7fb	Update java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.java ... Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>	2021-05-06 09:18:50 +02:00
Tony Torralba	00a7576679	Rename XPath Injection test file	2021-05-06 09:18:50 +02:00
Tony Torralba	8af7f4a484	New sinks and test cases	2021-05-06 09:18:49 +02:00
Tony Torralba	ccb3ea4453	Fix XPath Injection tests classpath	2021-05-06 09:18:49 +02:00
Tony Torralba	509fc8a640	Add missing docs to stubs	2021-05-06 09:18:49 +02:00
Tony Torralba	26c3ff2cee	Move from experimental to standard	2021-05-06 09:18:49 +02:00
Tony Torralba	720b5d6da3	Refactored sto use CSV sink model. Also, added more sinks	2021-05-06 09:18:49 +02:00
Tony Torralba	ab62bb66f4	Consider second parameter of Node.selectNodes	2021-05-06 09:18:49 +02:00
Tony Torralba	2bb2baf6f7	Support more methods that evaluate XPath expressions	2021-05-06 09:18:49 +02:00
Tony Torralba	d739a8cac2	Moved configuration from XPath.qll back to XPath Injection query	2021-05-06 09:18:48 +02:00
Tony Torralba	fb3e56eac8	Fix imports and stubs so that tests pass	2021-05-06 09:18:48 +02:00
Tony Torralba	a62997463f	Remove unused imports; use set literals in hasName	2021-05-06 09:18:48 +02:00
Tony Torralba	ed5619498c	WIP: XPath Injection promotion	2021-05-06 09:18:48 +02:00
Tony Torralba	a706046a19	Reestructured test	2021-05-06 09:17:53 +02:00
Jonathan Leitschuh	67e9f06304	[Java] Fix Kryo FP & Kryo 5 Support ... Closes #4992	2021-05-05 17:38:34 -04:00
Tony Torralba	03ce8d689f	Refactored to use CSV sink model	2021-05-05 16:34:30 +02:00
Tony Torralba	9b78cee37a	Add tests	2021-05-05 11:59:57 +02:00
Tony Torralba	458b89bf5f	Added Android stubs	2021-05-05 11:57:01 +02:00
Timo Mueller	787a4ede85	Fixed file reference in test cases	2021-05-04 15:33:53 +02:00
Timo Mueller	374ed851a0	Fixed file reference in test cases	2021-05-04 15:12:50 +02:00
luchua-bc	703fbf139a	Add more methods and update the library name	2021-05-04 02:54:49 +00:00
Jonathan Leitschuh	dfad1fc740	[Java] Add support for com.google.common.base.MoreObjects#firstNonNull	2021-05-03 12:58:00 -04:00
Tony Torralba	e68c6e66a5	Remove qlref file	2021-05-03 17:53:37 +02:00