Marcono1234
3edfdc5ceb
Java: Improve Regex flag parsing
...
Fixes:
- Flag `d` not being recognized
- Syntax for disabling flags (`-`) not being recognized
- Non-capturing group with flags erroneously containing `:` as literal
2024-01-06 04:15:09 +01:00
Tony Torralba
8ad787f3b8
Java: Generelize MaybeBrokenCryptoAlgorithmQuery.qll
2023-12-22 10:15:40 +01:00
Ed Minnix
7f9dff2dc7
Fix minor error in Weak Hashing
2023-12-21 22:48:07 -05:00
Ed Minnix
ce130c6ed5
Add replace to MapMutator
2023-12-19 10:23:06 -05:00
Edward Minnix III
56921a6e21
Merge pull request #14040 from egregius313/egregius313/weak-hashing-properties
...
Java: Add support for algorithm names specified in `.properties` files to `java/potentially-weak-cryptographic-algorithm`
2023-12-18 09:38:58 -05:00
Tony Torralba
9446249e94
Merge pull request #15012 from atorralba/atorralba/java/fix-missing-pinning-fp
...
Java: Fix FPs in Missing certificate pinning
2023-12-18 09:37:18 +01:00
Ed Minnix
09a0730491
QLdoc fix
2023-12-15 11:13:09 -05:00
Ed Minnix
02581a3850
Move class for getProperty method call to Properties.qll
2023-12-15 11:09:08 -05:00
Ed Minnix
1c3993e632
QLDocs
2023-12-15 11:09:07 -05:00
Ed Minnix
83c6ece405
Move weak hashing into MaybeBrokenCryptoAlgorithm
2023-12-15 11:09:07 -05:00
Ed Minnix
fbc2a33597
Replace MethodAccess with MethodCall
2023-12-15 11:09:07 -05:00
Ed Minnix
25fa8d5ae7
Move some logic to class
2023-12-15 11:09:07 -05:00
Ed Minnix
93cf5b8eb9
Weak Hashing Property initial query
2023-12-15 11:09:07 -05:00
Anders Schack-Mulligen
337e5e458c
Update java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2023-12-15 08:48:50 +01:00
Anders Schack-Mulligen
7623432c76
Java: Remove/deprecate FlowStateString-based extension points.
2023-12-14 15:15:58 +01:00
Anders Schack-Mulligen
a1068ce2f9
Dataflow: deprecate references
2023-12-14 15:05:33 +01:00
Tom Hvitved
c8b4a215bc
Merge pull request #14573 from hvitved/flow-summary-impl-param
...
Move `FlowSummaryImpl.qll` to `dataflow` pack
2023-12-14 12:24:15 +01:00
Tom Hvitved
098afb935b
Address more review comments
2023-12-14 09:48:45 +01:00
Tony Torralba
d955dce72a
Improve source of randomness detection
...
Also sanitize flow out of sinks to avoid overlapping paths
2023-12-13 11:15:27 +01:00
Tony Torralba
3a5d711711
Add cookie sinks
2023-12-13 11:15:27 +01:00
Tony Torralba
435d1f97a3
Add sink for OpenSAML's RequestType.setID
2023-12-13 11:15:27 +01:00
Tony Torralba
bd8f35bef7
Java: Fix FPs in Missing certificate pinning
...
Local URIs should never require pinning
2023-12-12 18:02:12 +01:00
Ed Minnix
3ca039bc8f
Rename to InsecureRandomness
2023-12-11 11:18:40 -05:00
Ed Minnix
6e70e6c85a
Use pre-exisiting type for SecureRandom
2023-12-11 11:18:39 -05:00
Ed Minnix
bbf99375c7
Alter cookie sinks to instead focus on creation of a cookie
2023-12-11 11:18:39 -05:00
Ed Minnix
b9d2a26e6e
Move ESAPI models into the Weak Randomness query
...
These models don't need to apply to all queries. So instead they are
better suited to be within the weak randomness query itself.
2023-12-11 11:18:39 -05:00
Ed Minnix
7241e0920c
Replace convertBytesToString with models
2023-12-11 11:18:39 -05:00
Ed Minnix
e9ca4a25d4
Update to new MethodCall name
2023-12-11 11:18:39 -05:00
Ed Minnix
a1e9564cc5
Add more sources
2023-12-11 11:18:39 -05:00
Ed Minnix
b8b2de2f3c
Remove use of crypto-parameter sink kind
2023-12-11 11:18:39 -05:00
Ed Minnix
646254c9b2
Add credentials sinks from SensitiveApi
2023-12-11 11:18:39 -05:00
Ed Minnix
057a74d914
Remove unnused class
2023-12-11 11:18:39 -05:00
Ed Minnix
ba3c38c226
Restrict addCookie to specific interface
2023-12-11 11:18:38 -05:00
Ed Minnix
dc3e4cd928
Refactored method accesses to the RandomDataSource library
2023-12-11 11:18:38 -05:00
Ed Minnix
ce7690b53f
Make imports private
2023-12-11 11:18:38 -05:00
Edward Minnix III
bc0655573f
Simplifications
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2023-12-11 11:18:38 -05:00
Ed Minnix
0313f39229
Cryptographic sinks
2023-12-11 11:18:38 -05:00
Ed Minnix
b713efb711
Add ThreadLocalRandom.current as another source
2023-12-11 11:18:38 -05:00
Ed Minnix
bf0123d6ae
Add org.apache.commons.lang.RandomStringUtils as a source
2023-12-11 11:18:38 -05:00
Ed Minnix
e69ff7b601
Move to library and add docs
2023-12-11 11:18:38 -05:00
Tom Hvitved
f9dbf676a6
Java: Use FlowSummaryImpl from dataflow pack
2023-12-10 11:25:45 +01:00
Ed Minnix
aebbc7d4ab
Add private imports to prevent compile warnings
2023-12-08 10:42:11 -05:00
Ed Minnix
1b8f3f3450
Deprecate or remove imports of dataflow library copies
2023-12-08 10:42:10 -05:00
Anders Schack-Mulligen
0618568cdc
Merge pull request #15045 from aschackmull/java/fix-cp
...
Java: Fix accidental cartesian product.
2023-12-08 15:43:01 +01:00
Anders Schack-Mulligen
64eb4ff753
Merge pull request #14983 from aschackmull/dataflow/deprecate-old-api
...
Data Flow: Deprecate old data flow api.
2023-12-08 14:27:25 +01:00
Anders Schack-Mulligen
7ee3068fe7
Java: Fix accidental cartesian product.
2023-12-08 13:27:05 +01:00
Ian Lynagh
fc11a87882
Kotlin: Fix dataflow with Array.set wrappers
2023-12-06 12:19:46 +00:00
Ian Lynagh
2c625e34b5
Merge pull request #15008 from igfoo/igfoo/kot-arr-taint
...
Kotlin: Track taint through Array.get/set
2023-12-05 18:30:21 +00:00
Ian Lynagh
babf1d6648
Kotlin: Track Kotlin's Array.set when tracking taint
2023-12-05 14:42:45 +00:00
Ian Lynagh
821b4c727e
Kotlin: Add Array.get(_) support to taint tracking
2023-12-05 14:41:32 +00:00
