Jami Cogswell
2ce5920c5e
Java: copy out of experimental
2025-02-24 18:24:12 -05:00
Jonas Jensen
11a0a9f8af
Java: StaticInitializationVector with postprocess
...
Use the new `postprocess` feature for the test of
`StaticInitializationVector.ql`. This makes it easier to modify and test
this query for diff-informed operation.
2025-02-24 13:33:02 +01:00
Chris Smowton
32e4c741cc
Merge pull request #18554 from smowton/smowton/admin/test-gbk-xml-extraction
...
Java: Add tests for XML and Java extraction with GBK charset
2025-02-21 17:27:32 +00:00
Anders Schack-Mulligen
1c616d10d4
Merge pull request #18819 from aschackmull/ssa/refactor-phiread3
...
Ssa: Refactor shared SSA in preparation for eliminating phi-read definitions
2025-02-21 08:56:38 +01:00
Chris Smowton
9162ce7d73
Add test for extraction of a Java file with a non-UTF-8 charset
2025-02-20 12:31:36 +00:00
Anders Schack-Mulligen
291ea6f6eb
Java: Move SSA data flow test and extend it to cover phi-read input edges.
2025-02-19 16:17:22 +01:00
Jami
d94dc5aa40
Merge pull request #18504 from jcogs33/jcogs33/java/file-constructor-path-sanitizer
...
Java: `File` constructor path sanitizer
2025-02-18 08:00:32 -05:00
Jami Cogswell
61a184c1d7
Java: update more tests
2025-02-14 16:08:06 -05:00
Jami Cogswell
2bb6a3914b
Java: update tests
2025-02-14 15:16:08 -05:00
Jami Cogswell
c0ebeb9c7b
Java: use AdditionalTaintStep
2025-02-14 13:52:43 -05:00
Jami
2a8cc00284
Merge pull request #18288 from jcogs33/jcogs33/csrf-unprotected-request-type
...
Java: add CSRF query
2025-02-11 15:32:56 -05:00
Tom Hvitved
75137a0f4c
Java: Adopt shared SSA library
2025-02-11 10:06:43 +01:00
Jami Cogswell
e8724ab220
Java: sanitize constructor call instead and update test cases
2025-02-05 15:46:10 -05:00
Jami Cogswell
59d454771d
Java: add FileConstructorSanitizer and tests
2025-02-04 17:51:23 -05:00
Jami Cogswell
530103e2d9
Java: narrow query
...
remove PUT and DELETE from StaplerCsrfUnprotectedMethod
remove OPTIONS and TRACE from SpringCsrfUnprotectedMethod
2025-01-30 10:14:31 -05:00
Jami Cogswell
d4114f66c2
Java: more name-based heuristic tests to test regex
2025-01-30 10:14:16 -05:00
Jami Cogswell
0ab37684e1
Java: more database update tests and stubs
2025-01-30 10:14:14 -05:00
Jami Cogswell
3bf6dc24c1
Java: Stapler tests and stubs
2025-01-30 10:14:11 -05:00
Jami Cogswell
fa27689719
Java: update InlineExpectationsTest import for new location
2025-01-30 10:14:05 -05:00
Jami Cogswell
ede9e78645
Java: remove exists variable in test
2025-01-30 10:14:01 -05:00
Jami Cogswell
c9ad15cc83
Java: update .expected file contents
2025-01-30 10:13:57 -05:00
Jami Cogswell
39ccde0c9d
Java: add name-based heuristic
2025-01-30 10:13:54 -05:00
Jami Cogswell
0f39011122
Java: add taint-tracking config for execute to exclude FPs from non-update queries like select
2025-01-30 10:13:50 -05:00
Jami Cogswell
97aaf4c011
Java: handle MyBatis annotations for insert/update/delete
2025-01-30 10:13:48 -05:00
Jami Cogswell
df77d4914f
Java: initial tests
2025-01-30 10:13:45 -05:00
Owen Mansel-Chan
0ccf4cecb8
Fix XSS FPs when content type is safe
2025-01-28 15:32:30 +00:00
Owen Mansel-Chan
9f3572d15a
Reformat inline expectations (space after $)
2025-01-27 14:36:26 +00:00
Owen Mansel-Chan
05fb22e8ff
Make test easier to understand
2025-01-27 14:10:19 +00:00
Michael Nebel
999f1f21e2
Java: Accept expected test output.
2025-01-27 10:22:20 +01:00
Michael Nebel
e3997f65ed
Java: Deprecate experimental queries.
2025-01-27 10:22:16 +01:00
Jonas Jensen
773a98a9eb
Merge pull request #18340 from jbj/diff-informed-getASelectedLocation
...
Java: make more queries diff-informed with getASelectedLocation
2025-01-22 14:25:33 +01:00
Owen Mansel-Chan
b4c8390991
Merge pull request #18137 from owen-mc/java/jax-rs-annotation-inheritance
...
Java: Update JAX-RS annotation inheritance
2025-01-21 15:26:47 +00:00
Owen Mansel-Chan
19df33fb43
Remove another erroneous comment
...
Co-authored-by: Jami <57204504+jcogs33@users.noreply.github.com >
2025-01-21 09:25:37 +00:00
Owen Mansel-Chan
6fa18be0cc
Fix QLDocs
2025-01-20 22:07:01 +00:00
Owen Mansel-Chan
883301938b
Merge pull request #18161 from owen-mc/java/weak-crypto-algo-more-informative
...
Java: Make `java/weak-cryptographic-algorithm` give a reason why the algo is insecure
2025-01-13 23:43:04 +00:00
Owen Mansel-Chan
0728b3bd60
Update test expectation
2025-01-10 10:37:05 +00:00
Owen Mansel-Chan
9cc614ac2d
Allow jax-rs path annotation inheritance
2025-01-07 16:44:12 +00:00
Owen Mansel-Chan
de1b374e0e
Test JAX-RS class/interface annotation inheritance
2025-01-07 15:28:41 +00:00
Chris Smowton
03c6529961
Spelling
2025-01-06 22:46:22 +01:00
Chris Smowton
5c2df36786
Exclude classes with a writeReplace method from serializability checks
2025-01-06 14:42:44 +00:00
Jonas Jensen
fea260bd55
Java: Diff-informed UnsafeHostnameVerification.ql
...
This commit also adds a test case that would fail under `codeql test run
--check-diff-informed` if not for the override of
`getASelectedSourceLocation`. There was no existing such test since all
the existing tests used anonymous classes whose location was on the same
line as the source.
2024-12-20 12:58:59 +01:00
Asger F
be939dca29
Merge pull request #14350 from asgerf/shared/deduplicate-path-graph
...
Shared: Add DataFlow::DeduplicatePathGraph
2024-12-18 14:04:29 +01:00
Asger F
8340841d54
Shared: Fix propagation of call bit
2024-12-17 11:16:04 +01:00
Asger F
950ae44d03
Shared: Show test failures
2024-12-17 11:15:57 +01:00
Asger F
f2968f4e14
Shared: Ensure subpath-induced edges are handled properly
...
Argument-passing and flow-through edges are present in 'edges' in addition to 'subpaths', but the implementation didn't take this into account.
2024-12-16 13:21:43 +01:00
Michael Nebel
0a1d2d0bbb
Java: Update all test util paths to point to the new location.
2024-12-12 13:21:25 +01:00
Michael Nebel
91cfb30513
Java: Move test utilities to the java query pack.
2024-12-12 13:21:22 +01:00
Owen Mansel-Chan
066db766ef
Merge pull request #18153 from owen-mc/java/resttemplate-getforobject
...
Java: add SSRF sink model for the third parameter of `RestTemplate.getForObject`
2024-12-11 16:37:35 +00:00
Jami
538dee81b6
Merge pull request #18214 from jcogs33/jcogs33/java/file-getname-path-sanitizer
...
Java: add File.getName as a path injection sanitizer
2024-12-11 10:18:02 -05:00
Anders Schack-Mulligen
066cfa31d2
Merge pull request #18258 from aschackmull/dataflow/simplify-apapprox3
...
Dataflow: Simplify references to access paths from prior stage.
2024-12-11 14:23:31 +01:00
