13070 Commits

Author	SHA1	Message	Date
Dave Bartolomeo	f85aff869c	Java: Fix PR feedback	2021-05-10 16:37:23 -04:00
Marcono1234	2e098f050e	Java: Ignore char array based closeables for CloseReader.ql and CloseWriter.ql	2021-05-10 18:33:07 +02:00
Jonathan Leitschuh	d27316eb3e	Apply suggestions from code review ... Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>	2021-05-10 11:55:31 -04:00
Chris Smowton	0afe22d60c	Merge pull request #5710 from p0wn4j/jsch-os-injection ... [Java] CWE-078: Add JSch lib OS Command Injection sink	2021-05-10 16:12:00 +01:00
Tony Torralba	8553ca1019	Autoformatting	2021-05-10 15:42:20 +02:00
Tony Torralba	d99b5bfc66	Reuse previous tests from experimental	2021-05-10 11:17:20 +02:00
Tony Torralba	c70503142f	Require JS enabled even when cross-origin access is enabled in the webviews	2021-05-10 09:45:59 +02:00
Dave Bartolomeo	d9f243d18a	Java: Fix QLDoc for Container.toString() ... Fixes #5828 The QLDoc was just too specific about the default implementation. I've improved the wording.	2021-05-08 11:14:02 -04:00
Hayk Andriasyan	fd88b72101	Delete JSchOSInjection.qhelp	2021-05-08 12:51:15 +04:00
Tony Torralba	6884edf52a	Merge branch 'main' into atorralba/promote-unsafe-android-webview-fetch	2021-05-07 16:31:55 +02:00
Tony Torralba	1f1a1bdb41	Remove unnecessary CWE reference	2021-05-07 16:29:00 +02:00
luchua-bc	fc7d340a89	Query to detect hard-coded Azure credentials	2021-05-07 13:16:41 +00:00
Tony Torralba	dcee1daa31	Mark spurious test results	2021-05-07 13:17:04 +02:00
Tony Torralba	e6b7da1926	Add import for Android sinks in ExternalFlow	2021-05-07 12:41:39 +02:00
Tony Torralba	e78e5b9ee4	Merge branch 'main' into promote-jexl-injection	2021-05-07 12:36:49 +02:00
Tony Torralba	b37b15cea4	Re-structure imports, add some new comments to tests	2021-05-07 12:33:51 +02:00
Tony Torralba	e2e65aca3c	Add new sink for Android XSS	2021-05-07 12:25:19 +02:00
Tony Torralba	2a501956b3	Mark a MISSING test result as suggested in code review	2021-05-07 11:17:51 +02:00
Tony Torralba	b69be30b88	Fix imports as suggested in code review	2021-05-07 11:07:06 +02:00
Tony Torralba	f16605b3c1	Apply suggestions from code review ... Co-authored-by: Felicity Chapman <felicitymay@github.com>	2021-05-06 15:17:55 +02:00
Tony Torralba	b69261727d	Add a new test for	2021-05-06 13:26:25 +02:00
Tony Torralba	1f1f85aeb5	Add change note and fix some QLDocs	2021-05-06 13:13:23 +02:00
Tony Torralba	f1fab854c4	Fix tests for XXE, introduced a dependency with jaxen	2021-05-06 12:11:55 +02:00
Tony Torralba	e14294a2f7	Remove XSS sink since it's better handled in this query	2021-05-06 11:20:37 +02:00
Tony Torralba	84504a88e4	Fix tests by adding AndroidManifest.xml	2021-05-06 10:55:56 +02:00
Tony Torralba	76468559ba	Add safe example for dom4j	2021-05-06 10:17:25 +02:00
Tony Torralba	926fedb7fb	Update java/ql/test/query-tests/security/CWE-643/XPathInjectionTest.java ... Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>	2021-05-06 09:18:50 +02:00
Tony Torralba	00a7576679	Rename XPath Injection test file	2021-05-06 09:18:50 +02:00
Tony Torralba	8af7f4a484	New sinks and test cases	2021-05-06 09:18:49 +02:00
Tony Torralba	ccb3ea4453	Fix XPath Injection tests classpath	2021-05-06 09:18:49 +02:00
Tony Torralba	509fc8a640	Add missing docs to stubs	2021-05-06 09:18:49 +02:00
Tony Torralba	26c3ff2cee	Move from experimental to standard	2021-05-06 09:18:49 +02:00
Tony Torralba	215118c7ea	Fixes in QLDocs and imports	2021-05-06 09:18:49 +02:00
Tony Torralba	720b5d6da3	Refactored sto use CSV sink model. Also, added more sinks	2021-05-06 09:18:49 +02:00
Tony Torralba	ab62bb66f4	Consider second parameter of Node.selectNodes	2021-05-06 09:18:49 +02:00
Tony Torralba	d72dd9b861	javax.xml.xpath.XPath is an interface	2021-05-06 09:18:49 +02:00
Tony Torralba	2bb2baf6f7	Support more methods that evaluate XPath expressions	2021-05-06 09:18:49 +02:00
Tony Torralba	3705970bfd	Refactored XPath.qll to remove redundant classes and restrict visibility	2021-05-06 09:18:49 +02:00
Tony Torralba	d739a8cac2	Moved configuration from XPath.qll back to XPath Injection query	2021-05-06 09:18:48 +02:00
Tony Torralba	ee269fbc69	Added missing doc comments	2021-05-06 09:18:48 +02:00
Tony Torralba	fb3e56eac8	Fix imports and stubs so that tests pass	2021-05-06 09:18:48 +02:00
Tony Torralba	a62997463f	Remove unused imports; use set literals in hasName	2021-05-06 09:18:48 +02:00
Tony Torralba	ed5619498c	WIP: XPath Injection promotion	2021-05-06 09:18:48 +02:00
Tony Torralba	a706046a19	Reestructured test	2021-05-06 09:17:53 +02:00
Jonathan Leitschuh	67e9f06304	[Java] Fix Kryo FP & Kryo 5 Support ... Closes #4992	2021-05-05 17:38:34 -04:00
Tony Torralba	c138ed3e4d	QLDocs	2021-05-05 16:51:15 +02:00
Tony Torralba	03ce8d689f	Refactored to use CSV sink model	2021-05-05 16:34:30 +02:00
Felicity Chapman	8b2009cfb1	Minor updates to qhelp file	2021-05-05 12:36:29 +01:00
Tony Torralba	9b78cee37a	Add tests	2021-05-05 11:59:57 +02:00
Tony Torralba	be50e8f30c	Moved from experimental to standard	2021-05-05 11:59:49 +02:00