Joe Farebrother
2ca164ce35
Generate androidx stubs and correct some models
2024-01-23 09:51:39 +00:00
Joe Farebrother
bafd65b1d2
Add tests to cover each modeled sink + some corrections to the models
2024-01-23 09:51:38 +00:00
Joe Farebrother
a1a2acd3ce
Add additional test cases
2024-01-23 09:51:38 +00:00
Joe Farebrother
f9bb004618
Add sink models to notification builder setters
2024-01-23 09:51:38 +00:00
Joe Farebrother
143ce0b94a
Add sensitive notification query
2024-01-23 09:51:37 +00:00
Stephan Brandauer
95b439bf31
Merge branch 'main' into java/update-mad-decls-after-triage-2023-12-21T14-39-02
2024-01-23 09:40:50 +01:00
Stephan Brandauer
cd765e7c19
work on review comments
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-23 09:35:36 +01:00
Stephan Brandauer
8b34407ab7
Java: java.awt.Desktop::browse is a url-redirection sink
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-23 09:28:13 +01:00
Ed Minnix
fcbee1994b
Update change note
2024-01-22 23:57:31 -05:00
Ed Minnix
fb80c5ea84
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
Ed Minnix
696788e5b2
Rename semmle.code.java.security.dataflow.CommonSanitizers to semmle.code.java.security.Sanitizers
2024-01-22 23:52:19 -05:00
Ed Minnix
bb44277090
Make import of dataflow private
2024-01-22 23:40:24 -05:00
Ed Minnix
ec3d683186
Change change note category to feature
2024-01-22 23:39:23 -05:00
Ed Minnix
38828672a9
Update change note
2024-01-22 23:38:33 -05:00
Ed Minnix
32fe8e02fb
Change note
2024-01-22 23:38:31 -05:00
Ed Minnix
67dfca2e58
Convert libraries to use instanceof SimpleScalarSanitizer
2024-01-22 23:38:26 -05:00
Ed Minnix
7f7c49d6ce
Add the SimpleScalarSanitizer class
...
The `SimpleScalarSanitizer` class represents common scalar types which
cannot realistically carry taint (e.g. primitives/numbers, and
eventually UUIDs and Dates)
2024-01-22 23:38:24 -05:00
erik-krogh
865df920f9
add change-notes
2024-01-22 19:30:57 +01:00
erik-krogh
8be7eadace
delete outdated deprecations
2024-01-22 09:11:35 +01:00
Alexander Eyers-Taylor
934474681d
Merge pull request #15254 from github/post-release-prep/codeql-cli-2.16.0
...
Post-release preparation for codeql-cli-2.16.0
2024-01-16 14:50:40 +00:00
Tony Torralba
2246c969a3
Merge pull request #15244 from Marcono1234/marcono1234/regex-flags
...
Java: Improve Regex flag parsing
2024-01-16 08:25:49 +01:00
github-actions[bot]
57df8b92df
Post-release preparation for codeql-cli-2.16.0
2024-01-15 15:00:50 +00:00
Owen Mansel-Chan
6945289afc
Merge pull request #15246 from owen-mc/java/manual-neutral-overrides-generated
...
C#/Java: Manual neutral summaries should block generated summaries
2024-01-12 10:05:18 +00:00
Owen Mansel-Chan
2f01688319
Merge pull request #15280 from owen-mc/java/add-manual-models-for-df-generation
...
Java: improve models for some important JDK methods
2024-01-11 12:47:37 +00:00
Owen Mansel-Chan
7824e60acd
Manual neutral summaries should block generated summaries
2024-01-10 22:25:06 +00:00
Owen Mansel-Chan
33030417b4
Add change note
2024-01-10 15:48:28 +00:00
Tom Hvitved
c9cf2a899c
Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify
...
Data flow: Remove column from `mayBenefitFromCallContext`
2024-01-10 11:43:15 +01:00
Tom Hvitved
f90201eb56
Data flow: Remove column from mayBenefitFromCallContext
2024-01-09 11:34:43 +01:00
Eric Bickle
f6fa7120d9
Merge branch 'main' into fix/update-gson-model
2024-01-08 15:46:14 -08:00
Eric Bickle
929ce65af1
Remove zero width space characters.
2024-01-08 13:15:38 -08:00
Ed Minnix
a528db8958
Use MapMutation instead of MethodCall
2024-01-08 09:39:05 -05:00
Ed Minnix
709649e9df
Model replace and putIfAbsent
2024-01-08 09:39:03 -05:00
Ed Minnix
1544330f3f
Minor fixes for code review
2024-01-08 09:38:53 -05:00
Edward Minnix III
1f37e70d83
Fix typos
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-08 09:38:51 -05:00
Ed Minnix
6eff72f99a
Include other map mutations
2024-01-08 09:38:49 -05:00
Ed Minnix
f1f0f50c92
TaintedEnvironmentVariableQuery docs
2024-01-08 09:38:47 -05:00
Ed Minnix
d4e2b84348
Cleanup helper dataflow configuration
2024-01-08 09:38:45 -05:00
Ed Minnix
8ed3f3c865
Move to library
2024-01-08 09:38:44 -05:00
Ed Minnix
814885f7f6
Hudson environment variables models
2024-01-08 09:38:43 -05:00
Ed Minnix
028bd49211
org.apache.commons.exec models
2024-01-08 09:38:42 -05:00
Ed Minnix
ad32b81492
environment-injection sink
2024-01-08 09:38:41 -05:00
Tony Torralba
7e6f2d1fc5
Merge pull request #14681 from atorralba/atorralba/java/weak-randomness-cve-coverage
...
Java: Add more sinks to the Insecure Randomness query
2024-01-08 15:33:03 +01:00
github-actions[bot]
a6c8cc9551
Release preparation for version 2.16.0
2024-01-08 13:11:26 +00:00
Marcono1234
3edfdc5ceb
Java: Improve Regex flag parsing
...
Fixes:
- Flag `d` not being recognized
- Syntax for disabling flags (`-`) not being recognized
- Non-capturing group with flags erroneously containing `:` as literal
2024-01-06 04:15:09 +01:00
Owen Mansel-Chan
ce3097e9ce
Fix manual models for String.valueOf(Object)
...
Add a neutral model for it, but also a summary model for `String.valueOf(CharSequence)`
2024-01-04 11:31:20 +00:00
Owen Mansel-Chan
0076f06ce7
Improve manual models of java.lang.Exception
2024-01-04 11:31:18 +00:00
Owen Mansel-Chan
e415c54c5e
Reorder manual models of java.lang.Throwable
2024-01-04 11:31:16 +00:00
Owen Mansel-Chan
f52ea5c2fd
Improve manual models of java.lang.Throwable
2024-01-04 11:31:14 +00:00
Eric Bickle
4fa5b2ae41
Add change nodes for GSON coverage
2024-01-02 14:17:23 -08:00
Eric Bickle
0cd89bf815
Merge branch 'main' into fix/update-gson-model
2024-01-02 14:05:33 -08:00
