Chris Smowton
a5220bf616
Convert StrBuilder models to CSV
2021-03-25 15:11:52 +00:00
Chris Smowton
25a0e09130
Convert StringUtils models to CSV
2021-03-25 15:11:52 +00:00
Chris Smowton
1beac06236
Translate ArrayUtils models to CSV
2021-03-25 15:11:51 +00:00
Chris Smowton
7fb5bd0cab
Add tests for and slightly expand models of Commons Lang's ArrayUtils class
2021-03-25 15:11:51 +00:00
Anders Schack-Mulligen
344c2d3c3d
Update java/ql/src/experimental/Security/CWE/CWE-759/HashWithoutSalt.ql
2021-03-25 15:42:57 +01:00
Anders Schack-Mulligen
75afa011ff
Java: Add metadata to several more experimental queries.
2021-03-25 13:09:26 +01:00
luchua-bc
57bd3f3c14
Optimize the taint flow source
2021-03-25 10:44:26 +00:00
Anders Schack-Mulligen
d53c334488
Merge branch 'java/fix-experimental-query-metadata' into java/cleanup
2021-03-25 10:36:36 +01:00
Anders Schack-Mulligen
28ff3f412d
Java: Add severity and precision metadata to experimental queries.
2021-03-25 10:29:47 +01:00
Anders Schack-Mulligen
5b905cfe18
Java: Add change note for code duplication library removal.
2021-03-25 10:12:58 +01:00
Anders Schack-Mulligen
1564aee57a
Java: Add change note for filter query removal.
2021-03-25 10:11:30 +01:00
Anders Schack-Mulligen
c82b5eb040
Java: Remove code duplication library.
2021-03-25 10:06:10 +01:00
Anders Schack-Mulligen
4b7440d4d5
Java: Remove precision tag from metric queries.
2021-03-25 09:52:05 +01:00
Anders Schack-Mulligen
70824b3f0b
Java: Delete filter queries.
2021-03-25 09:47:31 +01:00
luchua-bc
fe0e7f5eac
Change method check to taint flow
2021-03-25 01:45:13 +00:00
luchua-bc
08c3bf26d5
Update the query to accommodate more cases
2021-03-24 23:32:27 +00:00
yo-h
72ae902e0d
Merge pull request #5371 from aschackmull/java/framework-coverage
...
Java: Add query for CSV framework coverage.
2021-03-24 17:36:13 -04:00
Anders Schack-Mulligen
d3485cac34
Merge pull request #5512 from aschackmull/java/csv-argument-ranges
...
Java: Support argument and parameter ranges in CSV models.
2021-03-24 15:03:22 +01:00
Anders Schack-Mulligen
4955f95f64
Apply suggestions from code review
...
Clarify documentation.
Co-authored-by: Chris Smowton <smowton@github.com >
2021-03-24 14:32:18 +01:00
Anders Schack-Mulligen
63831cc62b
Merge pull request #5099 from porcupineyhairs/javaLogInjection
...
Java : Add Log Injection Vulnerability
2021-03-24 14:30:34 +01:00
Anders Schack-Mulligen
a1ccbcdaf1
Merge pull request #5260 from artem-smotrakov/spring-http-invoker
...
Java: Query for detecting unsafe deserialization with Spring exporters
2021-03-24 13:57:17 +01:00
Anders Schack-Mulligen
41168e2b36
Java: Support argument and parameter ranges.
2021-03-24 13:32:30 +01:00
Anders Schack-Mulligen
234f62fd05
Java: Merge packages that likely belong to the same framework.
2021-03-24 13:17:04 +01:00
haby0
3df23eecb6
Merge remote-tracking branch 'upstream/main' into JsonHijacking
2021-03-24 15:52:01 +08:00
Chris Smowton
fa90655dd0
Partial revert: only introduce inferred taint edges from callsite-crossing value edges if an original taint edge targets the *start* of the value edge.
...
Previously we would also take a taint edge targeting a result and a value-preserving edge propagating another argument to the result to imply a taint edge targeting that argument.
2021-03-23 14:35:03 +00:00
Anders Schack-Mulligen
27408fefe2
Merge pull request #5008 from torque59/cwe-346
...
Java: Queries to detect remote source flow origins to CORS header.
2021-03-23 13:54:00 +01:00
Anders Schack-Mulligen
9a56601dd3
Merge pull request #5164 from luchua-bc/java/insecure-ldap-endpoint
...
Java: CWE-297 Query to detect insecure LDAP endpoint configuration
2021-03-23 13:53:51 +01:00
Anders Schack-Mulligen
1e6b5391d6
Merge pull request #4994 from haby0/main
...
Java: CWE-652: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
2021-03-23 12:05:53 +01:00
Marcono1234
993999f64f
Java: Add test for negative numeric literals
2021-03-22 17:43:34 +01:00
yo-h
b495e1efab
Merge pull request #5411 from aschackmull/java/dataflow-lambda-dispatch
...
Java: Bugfix dispatch to lambda in call context.
2021-03-22 08:25:21 -04:00
Anders Schack-Mulligen
f681d584bd
Merge pull request #5474 from Marcono1234/marcono1234/string-building-type
...
Java: Add StringBuildingType
2021-03-22 13:16:54 +01:00
haby0
fe046ec71e
Merge remote-tracking branch 'upstream/main' into main
2021-03-22 17:25:37 +08:00
Marcono1234
1534b387bb
Java: Improve documentation regarding minus in front of numeric literals
2021-03-22 00:54:14 +01:00
Marcono1234
cd059eb965
Java: Add StringBuildingType
2021-03-22 00:19:23 +01:00
Artem Smotrakov
6c24699403
Cover both javax.el and jakarta.el packages
2021-03-21 21:19:39 +03:00
Artem Smotrakov
adb1ed380a
Added tests for Jakarta expression injection
2021-03-21 21:19:39 +03:00
Artem Smotrakov
73e940de74
Added query for Jakarta EL injections
...
- Added JakartaExpressionInjection.ql
- Added a qhelp file with examples
2021-03-21 21:19:39 +03:00
Marcono1234
fa98443bb7
Java: Add value predicates for float and double literals; improve tests
2021-03-21 18:07:55 +01:00
yo-h
0200aedc2e
Java 16: adjust test options
2021-03-21 12:55:25 -04:00
Tom Hvitved
09a49e4580
Merge pull request #5311 from hvitved/dataflow/lambda
...
Data flow: Move C# lambda flow logic into shared library
2021-03-19 11:44:15 +01:00
Porcuiney Hairs
a88c3682ff
remove sanitiserGuards
2021-03-18 16:12:00 +05:30
Porcuiney Hairs
84c9137152
Include suggestions from review
2021-03-18 16:12:00 +05:30
porcupineyhairs
f27d2bdf6d
Update java/ql/src/experimental/semmle/code/java/Logging.qll
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-03-18 16:12:00 +05:30
Porcuiney Hairs
d0c82d3756
Add flogger and android logging support
2021-03-18 16:12:00 +05:30
Porcuiney Hairs
17d7ba8049
Add Log Injection Vulnerability
2021-03-18 16:12:00 +05:30
haby0
c516d69b98
Merge remote-tracking branch 'upstream/main' into main
2021-03-17 16:42:48 +08:00
haby0
15206fd2ce
JsonpInjection.ql autoformatted
2021-03-17 15:52:05 +08:00
haby0
98204a15a6
Fix the problem
2021-03-17 15:28:04 +08:00
Joe Farebrother
f5e4b87d1e
Remove redundant rows and add note on collection flow
2021-03-16 14:28:24 +00:00
Joe Farebrother
1e3c4d0eb1
Add stubs to fix broken test case
2021-03-16 14:24:49 +00:00
