Paul Hodgkinson
bfbb77a796
Merge branch 'main' into java/experimental/command-injection
2023-06-29 09:51:14 +01:00
aegilops
01798f63f8
Switched to new dataflow and added a test (but it doesn't produce results yet)
2023-06-28 17:14:39 +01:00
Koen Vlaswinkel
fcb2f1082c
Java: Fix external API name for nested types
...
This fixes the name of reported external APIs for nested types.
The `toString()` method of `getSourceDeclaration()` would report the
name of a type, but not the name of the enclosing type. This results
in missing information in the `UnsupportedExternalAPIs.ql` query.
For example, previously it would report:
```
org.zapodot.junit.db.Builder#build()
```
However, the `Builder` class does not exist in the package and is only
a nested type within `EmbeddedDatabaseRule`. The correct name should be:
```
org.zapodot.junit.db.EmbeddedDatabaseRule$Builder#build()
```
This name also matches the format of MaD.
2023-06-27 15:23:55 +02:00
Tony Torralba
a7c2a25cac
Merge pull request #12879 from atorralba/atorralba/java/command-injection-mad-sinks
...
Java: Convert all command injection sinks to MaD format
2023-06-27 14:06:45 +02:00
Tony Torralba
3c3b53001f
Merge pull request #13550 from jorgectf/jorgectf/lang2-models
...
Java: Add models for `org.apache.commons.lang`
2023-06-27 11:20:59 +02:00
amammad
45499b03d2
change qury file name same as qhelp name
2023-06-26 21:23:22 +10:00
amammad
21b5571bff
V1.1 add additional steps for read methods which I can summarize every single declared sanitizer on the sink whitin isSink predicate
2023-06-25 00:35:37 +10:00
amammad
7354db873a
V1 Bombs
2023-06-24 08:57:57 +10:00
jorgectf
2dc4f23dbb
Add models for org.apache.commons.lang
2023-06-23 19:34:21 +02:00
Jorge
7d0b880bf7
Merge branch 'main' into jorgectf/deserialization-lookahead
2023-06-23 18:24:39 +02:00
jorgectf
b6e4ba6f9d
Add SerialKiller model
2023-06-23 18:19:43 +02:00
Henry Mercer
5afdaf8fe1
Merge pull request #13525 from github/rc/3.10
...
Merge `rc/3.10` back to `main`
2023-06-21 17:13:36 +01:00
github-actions[bot]
18b678e69e
Post-release preparation for codeql-cli-2.13.4
2023-06-20 10:20:05 +00:00
aegilops
23bf8470ce
Removed .md and made class change
2023-06-19 17:29:17 +01:00
Jeroen Ketema
9c774ac97f
Merge pull request #13426 from jketema/inline-3
...
Update inline flow tests to use parameterized module
2023-06-19 17:39:29 +02:00
Jean Helie
423336310c
Merge pull request #13480 from github/jhelie/clean-up-mad-kinds-use
...
Java: clean up mad kinds use
2023-06-19 16:21:20 +02:00
aegilops
8c9ccab9c9
Autoformat
2023-06-19 11:53:53 +01:00
aegilops
2112d73a6a
Autoformat
2023-06-19 11:50:54 +01:00
aegilops
1a108fb1c9
Changed to for constant string
2023-06-19 11:46:08 +01:00
aegilops
7c235e3786
Fixed linting issues. Will not fix instanceof, that is necessary
2023-06-19 11:41:23 +01:00
Tony Torralba
8f6d2ed2f9
Adjust ZipSlip query description according to review suggestions.
2023-06-19 10:27:41 +02:00
Tony Torralba
3c4d938cf1
Apply code review suggestions.
...
Co-authored-by: Asger F <asgerf@github.com >
2023-06-19 10:20:19 +02:00
Tony Torralba
433fc680ec
Apply suggestions from code review
...
Co-authored-by: mc <42146119+mchammer01@users.noreply.github.com >
2023-06-19 10:17:40 +02:00
aegilops
8c73fbeabe
Formatted
2023-06-16 17:33:21 +01:00
aegilops
55eeb00309
Added experimental tag
2023-06-16 17:27:01 +01:00
aegilops
b6c35dd88c
Added experimental version of Java Command Injection query, to be more sensitive to unusual code constructs
2023-06-16 17:12:53 +01:00
Jean Helie
baf6b74945
use new sink mad kinds and simplify isKnownKind predicate
2023-06-16 13:58:23 +02:00
Jean Helie
daf2743143
only use neutral models of kind "sink"
2023-06-16 13:58:23 +02:00
Tony Torralba
c97868f774
Add change notes
2023-06-16 09:01:02 +02:00
Tony Torralba
3e96fe60c5
Go/Java/JS/Python/Ruby: Update the description and qhelp of the ZipSlip query
...
All filesystem operations, not just writes, with paths built from untrusted archive entry names are dangerous
2023-06-16 08:52:44 +02:00
Jeroen Ketema
742eb8dd12
Java: Rewrite InlineFlowTest as a parameterized module
2023-06-15 10:52:10 +02:00
Jean Helie
209f3e26d4
Merge pull request #13239 from github/tausbn/automodel-application-mode
...
Java: Add QL support for automodel application mode
2023-06-14 11:42:26 +02:00
Tony Torralba
ffe67689ec
Merge branch 'main' into atorralba/java/command-injection-mad-sinks
2023-06-13 09:27:33 +02:00
Stephan Brandauer
b38bc52019
Java: fix bug in ExcludedFromModeling Characteristic
2023-06-09 14:57:56 +02:00
Anders Schack-Mulligen
a0a9d30286
Java: Fix qltests.
2023-06-09 08:37:35 +02:00
github-actions[bot]
e4be303a23
Release preparation for version 2.13.4
2023-06-08 19:57:37 +00:00
Stephan Brandauer
2921df41da
Java: fix import
2023-06-07 15:22:59 +02:00
Stephan Brandauer
ec3a7e39ad
Java: qldoc style
2023-06-07 14:57:38 +02:00
Stephan Brandauer
715b1351f3
Java: share considerSubtypes predicate between Java modes
2023-06-07 14:55:00 +02:00
Stephan Brandauer
7e77e2ea82
Java: comment why we're using erased types in MaD
2023-06-07 14:42:20 +02:00
Stephan Brandauer
a8799fe981
Java: share getCallable interface between automodel extraction modes
2023-06-07 14:38:52 +02:00
Tony Torralba
6d7234f8ed
Merge pull request #13225 from atorralba/atorralba/java/path-injection-mad-sinks-2
...
Java: Migrate path injection sinks to models-as-data (simplified)
2023-06-07 14:27:36 +02:00
Stephan Brandauer
92ad02a752
Java: update getRelatedLocation qldoc
2023-06-07 14:09:07 +02:00
Stephan Brandauer
be6b1d8aaf
Java: remove SkipFrameworkModeling characteristic in favour of later evaluation
2023-06-07 13:58:56 +02:00
Stephan Brandauer
2e16b71215
Java: update qldoc of ClassQualifierCharacteristic
2023-06-07 13:52:57 +02:00
Stephan Brandauer
1bfbfec1bc
Java: use problem.severity in automodel extraction queries
2023-06-07 13:44:52 +02:00
Erik Krogh Kristensen
6ba7f9a238
Merge pull request #13352 from erik-krogh/once-again-deps-not-py-cpp
...
delete old deprecations
2023-06-07 13:00:57 +02:00
Ian Lynagh
f690d150b0
Merge pull request #13373 from igfoo/igfoo/kotlin-loc
...
Java/Kotlin: Split lines of code by language
2023-06-06 11:49:18 +01:00
Nick Rolfe
6c5c338e6b
Merge pull request #13348 from github/nickrolfe/java-location-tostring
...
Java: avoid call to `Location.toString()`
2023-06-06 09:55:42 +01:00
Ian Lynagh
e49b278d61
Java/Kotlin: Add a changenote for the lines-of-code changes.
2023-06-05 16:33:12 +01:00
