4445 Commits

Author	SHA1	Message	Date
Nicolas Will	8707e4d9a3	Continue Artifact data-flow WIP	2025-02-18 18:35:49 +01:00
Anders Schack-Mulligen	194afbb7f8	Java: Simplify SSA for variable capture.	2025-02-18 14:01:20 +01:00
Jami	d94dc5aa40	Merge pull request #18504 from jcogs33/jcogs33/java/file-constructor-path-sanitizer ... Java: `File` constructor path sanitizer	2025-02-18 08:00:32 -05:00
Jami Cogswell	9bb5fe837d	Java: address review comments	2025-02-17 15:47:45 -05:00
github-actions[bot]	ad24f94a77	Post-release preparation for codeql-cli-2.20.5	2025-02-17 17:58:24 +00:00
github-actions[bot]	6f4562f3bd	Release preparation for version 2.20.5	2025-02-17 16:55:54 +00:00
Nicolas Will	df01fa7a9c	Expand model and JCA modeling	2025-02-17 00:16:08 +01:00
Nicolas Will	b777a22d35	Expand model and specialize newtype relations	2025-02-14 23:43:07 +01:00
Jami Cogswell	2bb6a3914b	Java: update tests	2025-02-14 15:16:08 -05:00
Jami Cogswell	c0ebeb9c7b	Java: use AdditionalTaintStep	2025-02-14 13:52:43 -05:00
Nicolas Will	874e3b5e06	Modify model to use newtypes, expand modeling	2025-02-12 17:58:15 +01:00
Jami	2a8cc00284	Merge pull request #18288 from jcogs33/jcogs33/csrf-unprotected-request-type ... Java: add CSRF query	2025-02-11 15:32:56 -05:00
Nicolas Will	4d44755945	Refactor Model and CBOM print queries	2025-02-11 15:37:15 +01:00
Jonas Jensen	76440120d1	Merge pull request #18737 from jbj/NumericCastTaintedQuery-selectedLocation ... Java: precise diff-informed NumericCastTainted	2025-02-11 15:33:28 +01:00
Jonas Jensen	71c078dbdd	Java: precise diff-informed NumericCastTainted ... It was discovered by the upcoming support for exact locations matching in diff-informed testing that this data-flow configuration did not correspond exactly to the query.	2025-02-11 13:49:15 +01:00
Tom Hvitved	e5e88435bc	Java: Remove ExitBasicBlock from SsaInput	2025-02-11 10:07:18 +01:00
Tom Hvitved	6fbb1e2571	Apply suggestions from code review ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2025-02-11 10:06:50 +01:00
Anders Schack-Mulligen	e955f58eb1	Java: Bugfix for samevar in useReaches.	2025-02-11 10:06:49 +01:00
Anders Schack-Mulligen	ed284353ef	Java: Bugfix for qualifier-of-qualifier update in hasExplicitQualifierUpdate.	2025-02-11 10:06:47 +01:00
Anders Schack-Mulligen	284e48cfbe	Java: Fixup private	2025-02-11 10:06:45 +01:00
Tom Hvitved	75137a0f4c	Java: Adopt shared SSA library	2025-02-11 10:06:43 +01:00
Kristen Newbury	1a12fb3099	Update JCA model, refactor modes	2025-02-10 13:49:32 -05:00
Kristen Newbury	59208bdb85	Update JCA model to use shared lib	2025-02-10 12:22:22 -05:00
Kristen Newbury	6005437001	Update JCA model with flow to call as AESuse and format JCA model	2025-02-10 11:26:48 -05:00
Kristen Newbury	60d931af9f	Update progress on JCA	2025-02-07 15:46:13 -05:00
Jami Cogswell	d21c8d789b	Java: restrict sink to first arg of two-arg constructor call	2025-02-05 21:19:59 -05:00
Kristen Newbury	efcf7eab0c	Add broken crypto query	2025-02-05 17:24:25 -05:00
Jami Cogswell	bd47dcc87d	Java: check first arg for taint	2025-02-05 16:56:16 -05:00
Jami Cogswell	e8724ab220	Java: sanitize constructor call instead and update test cases	2025-02-05 15:46:10 -05:00
Kristen Newbury	86e51dad8a	Improve JCA aes alg model, add test	2025-02-05 13:39:48 -05:00
Jami Cogswell	4a4585a526	Java: move comment	2025-02-05 11:36:58 -05:00
Jami Cogswell	60cc16cc0e	Java: change note	2025-02-04 17:51:34 -05:00
Jami Cogswell	59d454771d	Java: add FileConstructorSanitizer and tests	2025-02-04 17:51:23 -05:00
Kristen Newbury	5f355c7f55	Add first sample JCA encryption model	2025-02-04 11:55:09 -05:00
github-actions[bot]	f1b05a79a4	Post-release preparation for codeql-cli-2.20.4	2025-02-04 09:25:09 +00:00
Arthur Baars	dd34690c17	Merge branch 'codeql-cli-2.20.4' into release-prep/2.20.4	2025-02-03 18:37:16 +01:00
github-actions[bot]	573e53e454	Release preparation for version 2.20.4	2025-02-03 15:19:35 +00:00
Jonas Jensen	0584aee72a	Merge pull request #18636 from jbj/diff-informed-java-location-fixups ... Java: make diff-informed queries exact	2025-02-03 15:22:43 +01:00
Jonas Jensen	7ad6f13bf5	Java: adjust CommandLineQuery locations ... It turns out these locations need to be precise.	2025-01-31 11:37:16 +01:00
Jami Cogswell	530103e2d9	Java: narrow query ... remove PUT and DELETE from StaplerCsrfUnprotectedMethod remove OPTIONS and TRACE from SpringCsrfUnprotectedMethod	2025-01-30 10:14:31 -05:00
Jami Cogswell	f3721ebccf	Java: refactor unprotectedDatabaseUpdate	2025-01-30 10:14:26 -05:00
Jami Cogswell	530a77e5a0	Java: refactor into canTargetDatabaseUpdateMethod	2025-01-30 10:14:24 -05:00
Jami Cogswell	8173fd01b8	Java: use two negations	2025-01-30 10:14:22 -05:00
Jami Cogswell	0462425191	Java: rename getMethod to getMethodValue	2025-01-30 10:14:20 -05:00
Jami Cogswell	20e8eb4323	Java: some clean-up and refactoring	2025-01-30 10:14:18 -05:00
Jami Cogswell	26b7c1a572	Java: qldocs for CallGraph module	2025-01-30 10:14:09 -05:00
Jami Cogswell	48d55ec518	Java: performance fix	2025-01-30 10:14:03 -05:00
Jami Cogswell	48d1fe062b	Java: remove exists variable	2025-01-30 10:13:59 -05:00
Jami Cogswell	39ccde0c9d	Java: add name-based heuristic	2025-01-30 10:13:54 -05:00
Jami Cogswell	286c655264	Java: add class for Stapler web methods that are not default-protected from CSRF	2025-01-30 10:13:52 -05:00