Joe Farebrother
2eb93b7a3b
Add unit tests
2024-02-12 13:49:45 +00:00
Joe Farebrother
d8985f9f5b
Move tests for local auth to a folder
2024-02-12 13:49:45 +00:00
Joe Farebrother
c79a3eb6ae
Add query for insecure key generation
2024-02-12 13:49:44 +00:00
Joe Farebrother
75a2b9415c
Merge pull request #15481 from joefarebrother/android-local-auth
...
Java: Add query for insecure local authentication
2024-02-12 13:48:53 +00:00
Tony Torralba
cf7091ae5f
Merge branch 'main' into atorralba/java/open-redirect-sanitizer
2024-02-12 10:31:52 +01:00
Joe Farebrother
16aed18821
Address reviews - Elaborate on docs and update severity
2024-02-09 13:53:36 +00:00
Tom Hvitved
1ea7717714
Capture flow: Take overwrites in nested scopes into account
2024-02-09 14:49:23 +01:00
Anders Schack-Mulligen
8fc4fae7d2
Java: Cache interpretElement.
2024-02-09 14:43:36 +01:00
Tony Torralba
4c0d535cc2
Merge pull request #12886 from atorralba/atorralba/java/path-injection-mad-sinks
...
Java: Refactor path injection sinks
2024-02-09 10:48:49 +01:00
Tony Torralba
34f74869c8
Java: Add extension point and default sanitizer to Open Redirect query
2024-02-09 09:11:07 +01:00
Joe Farebrother
71852868ac
Add case for androidx.biometric api
2024-02-02 17:19:20 +00:00
Joe Farebrother
9130603334
Address reviews - use SimpleTypeSanitizer and alter qldoc style
2024-01-31 11:31:25 +00:00
Joe Farebrother
8bd79908a6
Implement local auth query
2024-01-30 16:49:55 +00:00
Joe Farebrother
94075ef148
Fix FPs - consider flow through fields when determining whether a view is masked, and find more instances of findViewById.
2024-01-29 16:25:38 +00:00
Joe Farebrother
aa78050933
Implement checks for elements hidden by their xml attributes
2024-01-29 16:25:38 +00:00
Joe Farebrother
6081f18089
Add unit tests + make some fixes
2024-01-29 16:25:37 +00:00
Joe Farebrother
8582093e65
Implement checks for parent views being hidden
2024-01-29 16:25:37 +00:00
Joe Farebrother
1b13597d72
Implement checks for calls that may safely mask information
2024-01-29 16:25:37 +00:00
Joe Farebrother
5dd0addfc2
Add sensitive text flow query
2024-01-29 16:25:36 +00:00
Marcono1234
d8fe0f5bb8
Java: Document which assignment type is covered by which class
2024-01-28 19:03:36 +01:00
Edward Minnix III
4602f8933d
Merge pull request #15292 from egregius313/egregius313/java/dataflow/common-sanitizers/uuid-and-date
...
Java: Add `java.util.UUID` and `java.util.Date` to the `SimpleTypeSanitizer` class
2024-01-26 13:16:18 -05:00
Joe Farebrother
031bd8bd0c
Merge pull request #15281 from joefarebrother/android-sensitive-ui-notif
...
Java: Add query for exposure of sensitive information to android notifiactions
2024-01-26 16:42:55 +00:00
Tony Torralba
19a6b7858b
Remove reference to PathCreation
...
ZipSlip no longer needs to make this exclusion, since PathCreation arguments are no longer path-injection sinks
2024-01-26 12:45:00 +01:00
Tony Torralba
19cb7adb6d
Migrate path injection sinks to MaD
...
Deprecate and stop using PathCreation
Path creation sinks are now summaries
2024-01-26 12:19:54 +01:00
Ed Minnix
dca24ded18
Add UUID and Date to the list of types in the SimpleTypeSanitizer class
2024-01-23 13:36:03 -05:00
Edward Minnix III
3c8b09307d
Merge pull request #15291 from egregius313/egregius313/java/dataflow/default-sanitizers
...
Java: Introduce a common sanitizer type for types which cannot realistically carry taint.
2024-01-23 13:28:03 -05:00
Joe Farebrother
dedba1fc54
Address review comments - add barrierIn and fix a model for a PendingIntent sink
2024-01-23 09:51:42 +00:00
Joe Farebrother
a1a2acd3ce
Add additional test cases
2024-01-23 09:51:38 +00:00
Joe Farebrother
f9bb004618
Add sink models to notification builder setters
2024-01-23 09:51:38 +00:00
Joe Farebrother
143ce0b94a
Add sensitive notification query
2024-01-23 09:51:37 +00:00
Ed Minnix
fb80c5ea84
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
Ed Minnix
696788e5b2
Rename semmle.code.java.security.dataflow.CommonSanitizers to semmle.code.java.security.Sanitizers
2024-01-22 23:52:19 -05:00
Ed Minnix
bb44277090
Make import of dataflow private
2024-01-22 23:40:24 -05:00
Ed Minnix
67dfca2e58
Convert libraries to use instanceof SimpleScalarSanitizer
2024-01-22 23:38:26 -05:00
Ed Minnix
7f7c49d6ce
Add the SimpleScalarSanitizer class
...
The `SimpleScalarSanitizer` class represents common scalar types which
cannot realistically carry taint (e.g. primitives/numbers, and
eventually UUIDs and Dates)
2024-01-22 23:38:24 -05:00
erik-krogh
8be7eadace
delete outdated deprecations
2024-01-22 09:11:35 +01:00
Tony Torralba
2246c969a3
Merge pull request #15244 from Marcono1234/marcono1234/regex-flags
...
Java: Improve Regex flag parsing
2024-01-16 08:25:49 +01:00
Owen Mansel-Chan
6945289afc
Merge pull request #15246 from owen-mc/java/manual-neutral-overrides-generated
...
C#/Java: Manual neutral summaries should block generated summaries
2024-01-12 10:05:18 +00:00
Owen Mansel-Chan
7824e60acd
Manual neutral summaries should block generated summaries
2024-01-10 22:25:06 +00:00
Tom Hvitved
c9cf2a899c
Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify
...
Data flow: Remove column from `mayBenefitFromCallContext`
2024-01-10 11:43:15 +01:00
Tom Hvitved
f90201eb56
Data flow: Remove column from mayBenefitFromCallContext
2024-01-09 11:34:43 +01:00
Ed Minnix
a528db8958
Use MapMutation instead of MethodCall
2024-01-08 09:39:05 -05:00
Ed Minnix
709649e9df
Model replace and putIfAbsent
2024-01-08 09:39:03 -05:00
Ed Minnix
1544330f3f
Minor fixes for code review
2024-01-08 09:38:53 -05:00
Edward Minnix III
1f37e70d83
Fix typos
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-01-08 09:38:51 -05:00
Ed Minnix
6eff72f99a
Include other map mutations
2024-01-08 09:38:49 -05:00
Ed Minnix
f1f0f50c92
TaintedEnvironmentVariableQuery docs
2024-01-08 09:38:47 -05:00
Ed Minnix
d4e2b84348
Cleanup helper dataflow configuration
2024-01-08 09:38:45 -05:00
Ed Minnix
8ed3f3c865
Move to library
2024-01-08 09:38:44 -05:00
Tony Torralba
7e6f2d1fc5
Merge pull request #14681 from atorralba/atorralba/java/weak-randomness-cve-coverage
...
Java: Add more sinks to the Insecure Randomness query
2024-01-08 15:33:03 +01:00
