Tom Hvitved
|
d5a0df3f87
|
Go/Java: Share more PrettyPrintModels.ql logic
|
2024-08-13 12:48:22 +02:00 |
|
Michael Nebel
|
4a5c9f0ec4
|
Merge pull request #17007 from michaelnebel/shared/neutralimplementation
C#/Java/Go: Neutrals are split into separate classes.
|
2024-08-12 13:58:12 +02:00 |
|
Anders Schack-Mulligen
|
f28f42bcba
|
Merge pull request #17049 from aschackmull/dataflow/bugfix-flowfeature-sinkctx
Dataflow: Fix bug causing spurious flow for FeatureHasSinkCallContext
|
2024-08-12 13:29:42 +02:00 |
|
Dave Bartolomeo
|
a6e2fbb241
|
Merge remote-tracking branch 'origin/main' into dbartol/provenance/qltest
|
2024-08-05 13:16:31 -04:00 |
|
Chris Smowton
|
95e504a5ff
|
Merge branch 'main' into am0o0-java-PathInjection
|
2024-08-05 11:41:25 +01:00 |
|
am0o0
|
4169cfac9f
|
use the current slf4j stubs instead of new one
|
2024-08-03 14:12:18 +02:00 |
|
Dave Bartolomeo
|
6596705811
|
Update test expectations after extension numbering fix
|
2024-08-02 16:55:02 -04:00 |
|
Anders Schack-Mulligen
|
4d023f14a6
|
Merge pull request #17075 from RobbingDaHood/17052-second-try-do-not-expose-error-message
Java: 17052 Second try: do not expose error message
|
2024-08-02 12:44:27 +02:00 |
|
am0o0
|
a645e01b4b
|
delete wrong stubs
|
2024-08-02 01:03:47 +02:00 |
|
am0o0
|
d52826879b
|
delete wrong stubs
|
2024-08-02 01:02:49 +02:00 |
|
am0o0
|
ee9f134828
|
update current springframework core stub and use this instead of creating a new stubs
|
2024-08-02 01:00:34 +02:00 |
|
am0o0
|
af43178602
|
move slf4j to a separate dir
|
2024-08-02 00:35:20 +02:00 |
|
am0o0
|
1551cf0093
|
move java/ql/test/experimental/stubs/org-springframework-6.1.4/org/reactivestreams into a separate dir
|
2024-08-02 00:06:02 +02:00 |
|
Anders Schack-Mulligen
|
377301a55a
|
Merge pull request #17108 from aschackmull/dataflow/flowthrough-provenance
Dataflow: Propagate provenance correctly for flow-through wrappers.
|
2024-08-01 09:35:56 +02:00 |
|
Owen Mansel-Chan
|
6280ed2a6b
|
Merge pull request #13555 from am0o0/amammad-java-bombs
Java: Decompression Bombs
|
2024-07-31 14:55:28 +01:00 |
|
Anders Schack-Mulligen
|
9724516c84
|
C#/Go/Java/Python/Ruby: Accept qltest .expected changes.
|
2024-07-31 14:45:10 +02:00 |
|
Jami
|
05b0a3f41c
|
Merge pull request #17093 from jcogs33/jcogs33/java/provenance-postprocess-qltest-remaining-lib-tests
Java: Add support for post-process provenance pretty-printing in `.ql` library-tests
|
2024-07-31 08:11:15 -04:00 |
|
Owen Mansel-Chan
|
8901b1fd14
|
Merge pull request #17100 from owen-mc/java/sensitive-log/ignore-tokenizer
Java: whitelist variable names containing "tokenizer" for `java/sensitive-log`
|
2024-07-31 12:16:03 +01:00 |
|
Owen Mansel-Chan
|
59e22f6cd9
|
Merge pull request #17101 from owen-mc/java/dead-ref-types-junit-4-5
Java: Fix FPs in `java/unused-reference-type` for JUnit 4-style tests
|
2024-07-31 11:11:35 +01:00 |
|
am0o0
|
701e3d7e53
|
add same query but with local source support to comply with the CVE-2021-37580
|
2024-07-31 10:58:22 +02:00 |
|
Jami Cogswell
|
2db07bdbf3
|
Java: add missing models to experimental expected files
|
2024-07-30 12:13:18 -04:00 |
|
am0o0
|
591b1b4f07
|
use $ SPURIOUS: instead of "this test gives a FP"
|
2024-07-30 17:53:23 +02:00 |
|
Owen Mansel-Chan
|
cd0af0fc57
|
Ignore types with methods which have annotations
The motivation is test classes in JUnit 4 and 5 are currently FPs for this. They have methods with `@Test`, so this should fix the FPs.
|
2024-07-30 16:29:35 +01:00 |
|
Owen Mansel-Chan
|
050dcb1370
|
Add some tests for java/unused-reference-type
|
2024-07-30 16:29:11 +01:00 |
|
Owen Mansel-Chan
|
e259b25428
|
Add "tokenizer" to sensitive variable name FPs
|
2024-07-30 15:38:32 +01:00 |
|
Owen Mansel-Chan
|
bdff0fdcc5
|
Add test for "tokenizer"
|
2024-07-30 15:37:46 +01:00 |
|
Owen Mansel-Chan
|
0d71072f94
|
Make test more compact
|
2024-07-30 15:36:59 +01:00 |
|
am0o0
|
9662950405
|
add comments for FPs
|
2024-07-30 13:24:46 +02:00 |
|
am0o0
|
4dc1a10f71
|
update tests for zip4j, add aditional flow steps for zip4j, remove BombTypeInputStream class since we don't need it anymore, add a predicate which was for testing porpose and was junk
|
2024-07-29 18:10:04 +02:00 |
|
Jami Cogswell
|
e226da4f04
|
Java: use post-process provenance pretty-printing in .ql library-tests
|
2024-07-29 11:46:28 -04:00 |
|
Jami Cogswell
|
bab89c46b6
|
Java: use post-process provenance pretty-printing in library-tests
|
2024-07-28 18:13:58 -04:00 |
|
Jami Cogswell
|
0a382bf0cf
|
Java: use post-process provenance pretty-printing in experimental/query-tests
|
2024-07-28 18:13:20 -04:00 |
|
Jami Cogswell
|
c70d39539e
|
Java: use post-process provenance pretty-printing in query-tests
|
2024-07-28 18:12:17 -04:00 |
|
am0o0
|
c8749ff82e
|
Merge branch 'amammad-java-bombs' of https://github.com/am0o0/codeql into amammad-java-bombs
|
2024-07-28 12:15:23 +02:00 |
|
am0o0
|
209fa1a10a
|
update tests
|
2024-07-28 12:15:07 +02:00 |
|
am0o0
|
7689db7d42
|
change apache commons sink
|
2024-07-28 12:09:33 +02:00 |
|
am0o0
|
1b97804f45
|
update tests
|
2024-07-28 11:45:48 +02:00 |
|
Am
|
96c142bf0a
|
Merge branch 'main' into amammad-java-JWT
|
2024-07-28 13:03:23 +03:30 |
|
am0o0
|
6538a06f29
|
update tests
|
2024-07-28 11:30:59 +02:00 |
|
am0o0
|
46ddddc8cf
|
Merge tag 'codeql-cli/v2.18.1' into amammad-java-JWT
Compatible with CodeQL CLI 2.18.1
|
2024-07-28 11:23:20 +02:00 |
|
am0o0
|
494f0b709e
|
Merge branch 'main' into amammad-java-JWT
|
2024-07-28 10:37:26 +02:00 |
|
Chris Smowton
|
e3559d8f93
|
Adjust test expectations
|
2024-07-28 10:27:11 +02:00 |
|
Chris Smowton
|
142d7ae005
|
Make test compatible with Servlet 2.5; use old Servlet stubs
|
2024-07-28 10:26:58 +02:00 |
|
Owen Mansel-Chan
|
c051d33cc7
|
Merge branch 'main' into dataflow/provenance-postprocess-qltest
|
2024-07-26 08:04:05 +01:00 |
|
RobbingDaHood
|
feb31d2006
|
Merge branch 'main' into 17052-second-try-do-not-expose-error-message
|
2024-07-25 18:13:49 +02:00 |
|
Daniel Winther Petersen
|
1c1ba7734f
|
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
|
2024-07-25 18:12:45 +02:00 |
|
Jami
|
91f5f086fb
|
Merge pull request #17025 from jcogs33/jcogs33/java/adjust-url-syntheticfield
Java: add TaintInheritingContent for URL synthetic fields
|
2024-07-25 12:11:39 -04:00 |
|
Anders Schack-Mulligen
|
86c63dbedf
|
Dataflow: Fix bug causing spurious flow for FeatureHasSinkCallContext.
|
2024-07-23 14:59:24 +02:00 |
|
Anders Schack-Mulligen
|
f598a0b607
|
Dataflow: Add test highlighting bug.
|
2024-07-23 14:34:33 +02:00 |
|
Owen Mansel-Chan
|
ff8bb2b1f8
|
Merge pull request #16760 from owen-mc/java/reverse-dns-separate-threat-model-kind
Java: make a separate threat model kind for reverse DNS sources
|
2024-07-23 10:08:52 +01:00 |
|