Tom Hvitved
f7a5a33474
Address review comment
2023-02-13 09:01:15 +01:00
Jami Cogswell
c87c3e30c7
Java: update getInvalidModelKind with 'read-file' kind
2023-02-11 17:07:25 -05:00
Anders Schack-Mulligen
770f3c24bb
Java: Improve performance of GeneratedFileMarker.
2023-02-09 15:08:32 +01:00
Tom Hvitved
8e8897b08b
Data flow: Sync files
2023-02-07 15:15:04 +01:00
Anders Schack-Mulligen
3c580896dc
Merge pull request #11712 from aschackmull/java/constant-guards
...
Java: Apply deadcode guard to data flow nodes.
2023-02-07 09:14:20 +01:00
Mathias Vorreiter Pedersen
00fe448e3a
Merge pull request #12072 from aschackmull/dataflow/stage3-perf
...
Dataflow: Fix join in `fwdFlowRead` (take 2)
2023-02-06 10:43:11 +00:00
Jami
b6805c6913
Merge pull request #11863 from jcogs33/jcogs33/update-paramsString
...
Java: update paramsString
2023-02-03 15:47:38 -05:00
Anders Schack-Mulligen
a1aeb995e6
Java: Apply deadcode guard to data flow nodes.
2023-02-03 16:16:39 +01:00
Anders Schack-Mulligen
e8dbd65d77
Java: Refactor compile-time constant calculation and apply to ConstantIntegerExpr.
2023-02-03 16:16:27 +01:00
Anders Schack-Mulligen
67d4ed53b9
Dataflow: Sync.
2023-02-02 16:33:00 +01:00
Anders Schack-Mulligen
8cb233df1a
Dataflow: A proper perf fix for the stage-dependent fanout direction of the Content-to-Ap relation.
2023-02-02 16:31:07 +01:00
Joe Farebrother
97b2e852c9
Merge pull request #11713 from joefarebrother/sensitive-result-receiver
...
Java: Add query for leaking sensitive data through a ResultReceiver
2023-02-01 16:34:17 +00:00
Mathias Vorreiter Pedersen
95b15825f9
DataFlow: Sync identical files.
2023-01-27 16:24:31 +00:00
Alex Ford
55550e7980
Merge pull request #11941 from alexrford/summary-component-tostring-syntheticglobal
...
Add missing toString case for synthetic globals
2023-01-23 10:00:00 +00:00
Alex Ford
e4df1f5a6f
Ruby: add missing toString case for synthetic globals
2023-01-20 13:31:43 +00:00
Michael Nebel
dc223cb82e
Sync files and make corresponding changes for other languages.
2023-01-19 15:14:06 +01:00
Rasmus Wriedt Larsen
e0ccb9306a
Merge pull request #11908 from RasmusWL/dataflow-consistency-more-excludes
...
DataFlow: Add `uniqueParameterNodePositionExclude`
2023-01-18 10:44:51 +01:00
Edward Minnix III
4c018759c8
Merge pull request #11283 from egregius313/egregius313/webview-setAllowContentAccess
...
Java: Android WebView Content Access Query
2023-01-17 11:02:47 -05:00
Jami
babdee36aa
Merge pull request #11779 from jcogs33/jcogs33/model-more-top-jdk-apis
...
Java: model top JDK APIs
2023-01-17 10:20:32 -05:00
Rasmus Wriedt Larsen
a0b1c2ea79
DataFlow: Add uniqueParameterNodePositionExclude
2023-01-17 14:05:22 +01:00
Rasmus Wriedt Larsen
2b0a5fd5d1
DataFlow: Add uniqueParameterNodeAtPositionExclude
2023-01-17 14:05:17 +01:00
Jami Cogswell
ffb267937a
Java: add endsWith additionalTaintStep to ConditionalBypassFlowConfig
2023-01-12 16:24:05 -05:00
Michael Nebel
5c466f3319
Java: Sync files and update other relavant files related to the new naming of shift.
2023-01-12 19:06:29 +01:00
Jami
c725c447ac
Merge branch 'main' into jcogs33/update-paramsString
2023-01-12 08:24:57 -05:00
Joe Farebrother
a88759283a
Fix typo in qldoc
2023-01-12 11:44:39 +00:00
Joe Farebrother
8449dabefe
Add qldoc
2023-01-12 11:44:39 +00:00
Joe Farebrother
de565f9ccc
Add test and fix a bug
2023-01-12 11:44:39 +00:00
Joe Farebrother
b96edb9c64
Add Sensitive Result Receiver query
2023-01-12 11:44:39 +00:00
Michael Nebel
7e4f7a0c17
C#: Address review comments and sync files.
2023-01-11 16:29:24 +01:00
Michael Nebel
8112058a0a
Java: Adapt TopJdpApi library to the re-factor.
2023-01-11 16:20:55 +01:00
Michael Nebel
6a047d6916
Java: Re-factor provenance related predicates for summarized callable.
2023-01-11 16:20:55 +01:00
Michael Nebel
ea173f9516
Sync files.
2023-01-11 16:20:55 +01:00
Jami Cogswell
faae811be7
Java: try simplification of paramsString and paramsStringPart
2023-01-10 13:35:52 -05:00
Jami Cogswell
65aa064838
Java: update paramsString qldoc
2023-01-10 13:33:47 -05:00
Edward Minnix III
ce06df3152
Merge pull request #11628 from egregius313/egregius313/android-webview-addjavascriptinterface-dataflow
...
Java: Add parameters of methods annotated @JavascriptInterface as remote flow sources
2023-01-10 12:41:52 -05:00
Tony Torralba
32471d326e
Java: Remove omittable exists variables
2023-01-10 13:37:19 +01:00
Tony Torralba
da90ae0e8f
Update java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
2023-01-10 11:18:53 +01:00
Michael Nebel
16cd148961
Merge pull request #11711 from michaelnebel/externalflowcleanup
...
C#/Java: Delete deprecated ModelCsv classes and related predicates.
2023-01-10 10:22:50 +01:00
Ed Minnix
293a203756
Move JavascriptInterfaceMethod to WebView.qll
2023-01-09 15:10:23 -05:00
Chris Smowton
45c732a6f9
Java: improve naming and description of SqlUnescaped.ql
...
Since the main thing it's objecting to is concatenation not lack of escaping (in particular it doesn't look for escaping sanitizers), rename and re-describe it accordingly.
2023-01-09 10:56:13 +00:00
Ed Minnix
ab7ca1d642
Java: Add parameters of @JavascriptInterface methods as a remote flow sources
2023-01-03 15:31:40 -05:00
Ed Minnix
e259ef5d1d
Java: Add class for android.webkit.WebSettings.setAllowContentAccess
2022-12-31 15:00:28 -05:00
Jami
c9258effb6
Merge pull request #11572 from jcogs33/jcogs33/model-top-jdk-apis
...
Java: model top 100 JDK APIs
2022-12-20 09:13:53 -05:00
Tony Torralba
149cae9603
Merge pull request #10971 from joefarebrother/android-certificate-pinning
...
Java: Add Android missing certificate pinning query (CWE-295)
2022-12-20 11:03:16 +01:00
Tony Torralba
3e7a819fe7
Simplification
2022-12-20 09:42:25 +01:00
Jeroen Ketema
edc768b43b
Merge pull request #11707 from smowton/smowton/fix/java-empty-multiline-comment
...
Java: handle printing an empty comment (/**/); add relevant tests
2022-12-20 08:07:42 +01:00
Edward Minnix III
39a7c7bb12
Merge pull request #11282 from egregius313/egregiu313/webview-addjavascriptinterface
...
Java: Query for detecting addJavascriptInterface method calls
2022-12-19 11:28:45 -05:00
Chris Smowton
2ca56e0c1e
Java: handle printing an empty comment (/**/); add relevant tests
2022-12-19 14:12:09 +01:00
erik-krogh
ba7321ac5c
add qldoc to RegExpCharEscape
2022-12-18 17:23:45 +01:00
erik-krogh
26c5480ee6
share {js,rb}/regex/missing-regexp-anchor
2022-12-18 17:23:41 +01:00
