4465 Commits

Author	SHA1	Message	Date
Nora Dimitrijević	0cf1195678	[DIFF-INFORMED] Java: ConditionalBypass ... https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-807/ConditionalBypass.ql#L26	2025-07-17 18:59:14 +02:00
Nora Dimitrijević	0bcdb421ed	[DIFF-INFORMED] Java: ArithmeticUncontrolled ... https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql#L36	2025-07-17 18:59:11 +02:00
Nora Dimitrijević	54546f6e99	[DIFF-INFORMED] Java: ArithmeticTainted ... https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql#L35	2025-07-17 18:59:09 +02:00
Nora Dimitrijević	8353fdd041	[DIFF-INFORMED] Java: (Android)SensitiveCommunication ... https://github.com/d10c/codeql/blob/d10c/diff-informed-phase-3/java/ql/src/Security/CWE/CWE-927/SensitiveCommunication.ql#L20	2025-07-17 18:59:06 +02:00
Anders Schack-Mulligen	996de78a66	Java: Prune PathGraph for CsrfUnprotectedRequestType.ql	2025-07-17 15:06:38 +02:00
Anders Schack-Mulligen	1485d7072d	Merge pull request #19885 from aschackmull/java/annotated-exit-cfg ... Java: Add AnnotatedExitNodes to the CFG.	2025-07-17 15:02:24 +02:00
Owen Mansel-Chan	af977e9ac7	Merge pull request #20067 from owen-mc/java/unsafe-deserialization-mad-sinks ... Java: allow the definition of `java/unsafe-deserialization` sinks using data extensions	2025-07-17 13:42:31 +01:00
Owen Mansel-Chan	6629bd8279	No need to deprecate classes when module is deprecated	2025-07-17 11:52:31 +01:00
Owen Mansel-Chan	b361f76643	Delete unused private class	2025-07-17 11:36:06 +01:00
Anders Schack-Mulligen	54775e0958	Java: Adjust Paths.qll	2025-07-17 11:21:26 +02:00
Anders Schack-Mulligen	fbe79e8a52	Java: Add AnnotatedExitNodes to the CFG.	2025-07-17 11:21:26 +02:00
Owen Mansel-Chan	7d4a70cc1d	Add change notes	2025-07-16 14:44:24 +01:00
Owen Mansel-Chan	fdd1e3fefe	Use MaD models for unsafe deserialization sinks when possible ... Many of the unsafe deserialization sinks have to stay defined in QL because they have custom logic that cannot be expressed in MaD models.	2025-07-16 14:42:07 +01:00
Kasper Svendsen	10a678dcbd	Java lib qlpack: Enable overlay compilation	2025-07-15 16:23:40 +02:00
Kasper Svendsen	9c3e275e66	Merge pull request #20011 from kaspersv/kaspersv/discard-xml ... Overlay: Add XML and Java property discarding	2025-07-15 16:13:38 +02:00
Kasper Svendsen	f84a3084f0	Address review comment about ignored QL variable ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2025-07-15 15:34:08 +02:00
Nick Rolfe	c199d0cbbe	Java: use overlayChangedFiles in discard prediactes	2025-07-15 10:10:32 +01:00
Owen Mansel-Chan	03e8865933	Merge pull request #20025 from owen-mc/java/unsafe-deserialization ... Java: add extra sink for `java/unsafe-deserialization`	2025-07-11 23:59:22 +01:00
Owen Mansel-Chan	7764fbb664	Change note	2025-07-11 11:05:48 +01:00
Owen Mansel-Chan	8e4bd1a102	Add sink for ObjectInput.readObject to make test pass	2025-07-11 11:05:38 +01:00
Owen Mansel-Chan	006d77ffdd	Refactor QL to make type check more concise	2025-07-11 06:13:01 +01:00
Kasper Svendsen	0739c03d03	Overlay: Add discarding of base XML locatables for Java	2025-07-10 12:31:16 +02:00
Kasper Svendsen	d7094a96b5	Overlay: Add discarding of all Java base properties	2025-07-10 12:31:15 +02:00
Jonas Jensen	5a1246a586	Merge remote-tracking branch 'upstream/main' into approximate-related-location	2025-07-09 10:10:20 +02:00
github-actions[bot]	24a0ac1223	Post-release preparation for codeql-cli-2.22.2	2025-07-07 18:15:04 +00:00
github-actions[bot]	f12daefabe	Release preparation for version 2.22.2	2025-07-07 14:00:26 +00:00
Arthur Baars	84e5f2846b	Merge branch 'main' into nickrolfe/overlay-deleted-files	2025-07-04 16:19:59 +02:00
Kasper Svendsen	785e0273f2	Merge pull request #19968 from kaspersv/kaspersv/overlay-java-getastrictancestor-caller ... Overlay: Mark `RefType.getAStrictAncestor`` overlay[caller?]`	2025-07-04 09:38:02 +02:00
Nick Rolfe	a02aabe797	Java: add upgrade scripts for overlayChangedFiles dbscheme addition	2025-07-03 12:44:12 +01:00
Nick Rolfe	72b4e67477	Java/Ruby/Rust/QL: add overlayChangedFiles relation to dbscheme	2025-07-03 12:44:09 +01:00
Kasper Svendsen	dd8af3baf7	Overlay: Mark RefType.getAStrictAncestor overlay[caller?]	2025-07-03 12:23:20 +02:00
Kasper Svendsen	649091c0ed	Fix java/local-temp-file-or-directory-information-disclosure overlay compilation regression	2025-07-03 10:47:33 +02:00
Asger F	4a2d795076	Shared: Make approximate location filtering the default behaviour	2025-07-02 14:41:02 +02:00
Asger F	82d190f4bf	Java: use approximate related sink locations in polynomial redos	2025-07-02 14:40:56 +02:00
Kasper Svendsen	3d7343273e	Merge pull request #19813 from github/kaspersv/overlay-java-discarding ... Overlay: Add manual Java overlay annotations & discard predicates	2025-06-30 11:17:31 +02:00
Kasper Svendsen	c7194a4012	Overlay: Add missing QLDoc	2025-06-30 08:40:46 +02:00
Nicolas Will	38fdf7eea0	Merge pull request #19880 from bdrodes/operation_step_refactor ... Crypto: Refactor OpenSSL operation step data-flow logic	2025-06-27 17:19:11 +02:00
Kasper Svendsen	e02affd327	Merge pull request #19901 from github/kaspersv/overlay-guards-inline ... Overlay: Add missing `overlay[caller?]` annotation	2025-06-27 15:13:09 +02:00
Nicolas Will	976364fcaa	Merge branch 'main' into operation_step_refactor	2025-06-27 12:05:14 +02:00
Kasper Svendsen	5096ce405f	Overlay: Add missing overlay[caller?] annotation	2025-06-27 10:50:28 +02:00
Jonas Jensen	b446fe74c2	Merge pull request #19846 from jbj/diff-informed-CleartextStorageCookie ... Java: Diff-informed CleartextStorageCookie.ql	2025-06-27 08:45:11 +02:00
Kasper Svendsen	e6ef6a3326	Merge branch 'main' into kaspersv/overlay-java-discarding	2025-06-27 08:28:34 +02:00
Kasper Svendsen	da1b99b921	Merge pull request #19779 from github/kaspersv/overlay-java-annotations ... Overlay: Add overlay annotations to Java & shared libraries	2025-06-27 08:26:33 +02:00
REDMOND\brodes	0aee4f76f9	Crypto: Minor change to force CI/CD checks to restart, prior ql check failures do not make sense.	2025-06-26 16:35:01 -04:00
REDMOND\brodes	dc8d22a468	Crypto: Fix JCA to account for new key gen instance API in model.qll.	2025-06-26 15:48:10 -04:00
Nicolas Will	c54e68c855	Merge branch 'main' into pr/19880	2025-06-26 16:47:38 +02:00
Nicolas Will	652e7ba15b	Merge branch 'main' into codescanning_fixes_cpp	2025-06-26 14:54:36 +02:00
Kasper Svendsen	9d2dd782d9	Merge remote-tracking branch 'github/main' into kaspersv/overlay-java-annotations	2025-06-26 13:18:25 +02:00
Anders Schack-Mulligen	321a4afd5c	Merge pull request #19883 from aschackmull/java/fix-assert-cfg ... Java: Fix assert CFG by properly tagging the false successor.	2025-06-26 11:43:27 +02:00
Kasper Svendsen	64f27e2adf	Java: Add abstraction for discardable locatables	2025-06-26 11:35:37 +02:00