Tony Torralba
c1ac09a063
Added query for Cleartext Storage in Android Filesystem
2022-01-17 11:11:00 +01:00
Artem Smotrakov
825fe1797a
Fixed another false-positive in CWE-297/IgnoredHostnameVerification.ql
2022-01-16 18:55:49 +00:00
Artem Smotrakov
6dad0e21d9
Ignore wrapped HostnameVerifier.vefify() calls
2022-01-16 18:29:30 +00:00
Fosstars
2b33265d0f
Added a query for ignored hostname verification
...
- Added IgnoredHostnameVerification.ql
- Added a qhelp file with examples
- Added tests
2022-01-16 18:27:49 +00:00
Artem Smotrakov
f78002bc02
Fixed a false-positive in CWE-297/IgnoredHostnameVerification.ql
2022-01-16 18:25:18 +00:00
Fosstars
e11cb943a6
Added a query for ignored hostname verification
...
- Added IgnoredHostnameVerification.ql
- Added a qhelp file with examples
- Added tests
2022-01-16 18:25:18 +00:00
Tony Torralba
9f616e7cbe
Refactor to use FlowState
...
Remove the auxiliary DataFlow configuration
2022-01-14 12:24:35 +01:00
Benjamin Muskalla
a4429d01a3
Add tests for writer models
2022-01-14 11:12:35 +01:00
Tony Torralba
df95317a58
Fix tests after stub change
2022-01-14 10:33:21 +01:00
Tony Torralba
bd4abf4fd0
Additional Notification models
2022-01-14 10:32:38 +01:00
Tony Torralba
a9757fbc83
Setting null Components is not a sanitizer
2022-01-14 10:32:37 +01:00
Tony Torralba
a59a4024a5
Update stubs
2022-01-14 10:32:36 +01:00
Tony Torralba
a0a914466c
Rewording
2022-01-14 10:32:33 +01:00
Tony Torralba
f963887c58
Change test to avoid collision with SensitiveCommunication.ql
2022-01-14 10:32:01 +01:00
Tony Torralba
9e3594fcf1
Added more sinks
2022-01-14 10:32:00 +01:00
Tony Torralba
d49e52fb73
Add support for PendingIntents in Notifications
2022-01-14 10:31:58 +01:00
Tony Torralba
7f85dae63b
Add support for implicit field read flows
2022-01-14 10:31:57 +01:00
Tony Torralba
e58a8587db
Add support for Slices
2022-01-14 10:31:56 +01:00
Tony Torralba
d43242d09e
Added tests
2022-01-14 10:31:56 +01:00
Anders Schack-Mulligen
0b24af901d
Merge pull request #7349 from aschackmull/dataflow/state
...
Dataflow: Add support for flow state
2022-01-14 09:12:38 +01:00
Tony Torralba
81feaaec02
Refactor PathMatchGuard
2022-01-13 15:24:41 +01:00
Anders Schack-Mulligen
a34c981209
Dataflow: Address comments.
2022-01-13 13:28:24 +01:00
Anders Schack-Mulligen
69973dadb3
Merge pull request #7548 from zbazztian/spring-taint-summaries
...
Java: Add Spring and Apache Common Langs taint flow steps
2022-01-13 13:00:41 +01:00
Sebastian Bauersfeld
69f329ffec
Java: Add test cases for AbstractMessageSource.getMessage() methods
2022-01-13 14:13:27 +07:00
Sebastian Bauersfeld
39b6678b7d
Java: Add test case for StringEscapeUtils.escapeJson() taint step.
2022-01-13 11:18:37 +07:00
Tamás Vajk
9065a7f320
Merge pull request #7573 from tamasvajk/fix/java-field-decl-tostr
...
Java: Fix toString on field declarations with single field
2022-01-12 13:03:16 +01:00
Tony Torralba
c2105e506b
Added test cases
2022-01-12 11:06:58 +01:00
Tamas Vajk
b9e0310aa2
Java: Fix toString on field declarations with single field
2022-01-12 09:22:16 +01:00
luchua-bc
263dbd33f6
Optimize the query
2022-01-12 02:33:17 +00:00
Tony Torralba
7b0d9ea525
Merge pull request #7054 from atorralba/atorralba/promote-log-injection
...
Java: Promote Log Injection from experimental
2022-01-11 17:26:18 +01:00
Tony Torralba
4aacba8594
Merge pull request #6468 from atorralba/atorralba/promote-cleartext-sharedprefs
...
Java: Promote Cleartext storage of sensitive information using SharedPreferences from experimental
2022-01-11 16:23:53 +01:00
Chris Smowton
e352a4b994
Note that parameterizations of local classes are themselves local
...
Previously `LocalClass` itself would match `.isLocal()` whereas `LocalClass<Param>` would not. Rather than require each individual user to check for `.getSourceDeclaration().isLocal()`, let's note that the specializations themselves are local.
2022-01-10 18:19:31 +00:00
Tony Torralba
0e738622df
Merge branch 'main' into atorralba/promote-log-injection
2022-01-10 17:24:25 +01:00
Tony Torralba
ec8c234872
Fix predicate name
2022-01-10 17:09:41 +01:00
Tony Torralba
55dc783f28
Move from experimental and refactor
2022-01-10 17:09:37 +01:00
Anders Schack-Mulligen
f590d2566e
DataFlow: Fix test.
2022-01-10 11:25:52 +01:00
Tony Torralba
6f2d91a8ad
Sinks for CloseableThreadContext
2021-12-17 09:17:04 +01:00
Tony Torralba
7d6cba77a0
Add tests
2021-12-16 13:44:01 +01:00
Tony Torralba
2e0ca6ce2b
Add stubs
2021-12-16 13:44:01 +01:00
Tony Torralba
65b6c16254
Fix stub after merge
2021-12-15 16:53:47 +01:00
Tony Torralba
85526d71da
Add Fragment injection in PreferenceActivity query
2021-12-15 16:53:46 +01:00
Tony Torralba
701d12fb5b
Add Fragment injection query
2021-12-15 16:53:45 +01:00
Tony Torralba
efb471687c
Add stubs
2021-12-15 16:53:42 +01:00
Tony Torralba
a3b25f0eb5
Don't consider subtypes of fields
2021-12-15 13:00:16 +01:00
Tony Torralba
47002a3bd7
Fix test
2021-12-15 13:00:16 +01:00
Tony Torralba
1426c5b406
Consider parameterized types
2021-12-15 13:00:16 +01:00
Tony Torralba
5e80044f11
Preserve taint on field-read-steps on entrypoint types
2021-12-15 13:00:15 +01:00
Andrew Eisenberg
66c1629974
Merge pull request #7285 from github/post-release-prep-2.7.3-ddd4ccbb
...
Post-release preparation 2.7.3
2021-12-10 09:59:45 -08:00
Anders Schack-Mulligen
32cb8f362b
Dataflow: Add test for FlowState.
2021-12-10 11:20:01 +01:00
Chris Smowton
753d886b0d
Merge pull request #6319 from haby0/java/MyBatisSqlInjection
...
[Java] CWE-089 MyBatis Mapper Sql Injection
2021-12-09 19:57:18 +00:00
