Tony Torralba
5be30209c1
Merge pull request #9036 from luchua-bc/java/hardcoded-jwt-key
...
Java: CWE-321 Query to detect hardcoded JWT secret keys
2022-05-11 16:31:34 +02:00
Chris Smowton
f7e1f3e1a5
Remove URL fragment from Google search
2022-05-11 14:38:09 +01:00
Ian Lynagh
c0a755e061
Merge remote-tracking branch 'upstream/main' into igfoo/kotlin_merge
...
Resolving conflicts:
java/ql/lib/semmle/code/java/Expr.qll
2022-05-11 14:13:09 +01:00
Henry Mercer
b6f1ddcdab
Java: Tag telemetry queries with telemetry
...
This will exclude the results of these queries from the summary tables
produced by `codeql database analyze` in a future version of the CodeQL
CLI.
2022-05-11 13:29:25 +01:00
Anders Schack-Mulligen
9a4d86e9b4
Merge pull request #8571 from Marcono1234/marcono1234/statement-expression
...
Java: Add `ValueDiscardingExpr`
2022-05-11 13:37:24 +02:00
Chris Smowton
0044326884
Add change note
2022-05-11 12:06:27 +01:00
Chris Smowton
c17ef42cc7
Insecure cookie query: accept ServletRequest.isSecure(), and allow more than one possible input to a setSecure(...) call.
2022-05-11 11:59:37 +01:00
luchua-bc
f85c01c975
Correct string source
2022-05-11 10:37:22 +00:00
Tony Torralba
43b425d0e4
Merge pull request #9002 from atorralba/atorralba/https-urls-improvs
...
Java: Add OkHttp and Retrofit models
2022-05-11 10:48:08 +02:00
Ian Lynagh
b5572422df
Kotlin: Autoformat
2022-05-10 19:51:31 +01:00
Tony Torralba
a5a31db835
Rename AnyEqualsExpr and AnyNotEqualsExpr
2022-05-10 19:51:31 +01:00
Ian Lynagh
2e3d2b8e11
Java: Use the Diagnostics class in DiagnosticsReporting.qll
...
We shouldn't use database types/tables directly in src/
2022-05-10 19:51:31 +01:00
Ian Lynagh
2647a45239
Kotlin: Fix TypeVariableHidesType performance regression
2022-05-10 19:51:30 +01:00
Tamas Vajk
47799ae040
Code quality improvements + add dedicated DeadRefTypes test
2022-05-10 19:51:28 +01:00
Tamas Vajk
cdc7ed0e14
Extract container of adapter function as compiler generated
2022-05-10 19:51:28 +01:00
Tamas Vajk
505ccbbcf6
Extract override modifier
2022-05-10 19:51:28 +01:00
Chris Smowton
7dec3f4835
Use EqualityTest for either value or ref comparions, and ReferenceEqualityTest for strictly ref comparison.
2022-05-10 19:51:17 +01:00
Chris Smowton
f95effcf82
Always extract ValueEQ/NEExpr for Kotlin ==/!=
...
I introduce AnyEqualsExpr for either reference or value equality and AnyEqualityTest for the same concept including not-equals operators, and use them wherever the written QL clearly doesn't care about the difference between reference and value comparison, typically because it is concerned with testing against null or against a primitive constant.
2022-05-10 19:51:17 +01:00
Ian Lynagh
6566f7b69f
Kotlin: Add types for the different kinds of casts that Kotlin has
...
We might want to unify some of these in future, but doing that
correctly is easier than splitting them up correctly, so I've given each
one its own QL class for now.
I am not familiar with many of the libraries/queries that use CastExpr.
I've briefly looked at them and updated them in a way that looks
superficially reasonable, but some of the uses will probably want to be
refined later.
2022-05-10 19:51:13 +01:00
Ian Lynagh
8853489f04
Kotlin: Add a "generted by" field to the diagnostics table
2022-05-10 19:51:01 +01:00
luchua-bc
75e7148912
Standardize the query and update qldoc
2022-05-09 16:10:11 +00:00
Michael Nebel
1401e7ddb3
Merge pull request #8855 from michaelnebel/csharp/singlereadstore
...
C#: Only allow two read and two store steps in model capturing.
2022-05-09 10:05:53 +02:00
Michael Nebel
83aa65ff53
C#/Java: Remove redudandant QL comment in CaptureModel.
2022-05-09 07:36:41 +02:00
Marcono1234
c760d39d59
Merge remote-tracking branch 'remotes/origin/main' into marcono1234/statement-expression
2022-05-09 00:28:19 +02:00
Marcono1234
36f56b5a18
Java: Rename StmtExpr to ValueDiscardingExpr
...
As mentioned by aschackmull during review, StatementExpression as defined
by the JLS only lists possible types of expressions, it does _not_ specify
that their value is discarded. Therefore, for example any method call could
be considered a StatementExpression.
The name ValueDiscardingExpr was chosen as replacement because the JLS uses
the phrase "if the expression has a value, the value is discarded" multiple
times.
2022-05-09 00:27:15 +02:00
Mathias Vorreiter Pedersen
176e40f139
Merge pull request #9052 from github/post-release-prep/codeql-cli-2.9.1
...
Post-release preparation for codeql-cli-2.9.1
2022-05-06 13:15:17 +01:00
github-actions[bot]
1a25457178
Post-release preparation for codeql-cli-2.9.1
2022-05-05 19:05:50 +00:00
Tony Torralba
ca2959cf37
Merge pull request #8537 from atorralba/atorralba/unsafe_android_access_improvs
...
Java: Improvements to UnsafeAndroidAccess
2022-05-05 16:46:54 +02:00
luchua-bc
937ab417b1
Query to detect hardcoded JWT secret keys
2022-05-04 23:09:48 +00:00
Joe Farebrother
64227c9109
Fix codescanning alerts
2022-05-04 15:58:30 +01:00
Joe Farebrother
1605d36ddf
Refine polynomial redos sources to exclude length limited methods
2022-05-04 15:41:39 +01:00
Joe Farebrother
6794268a3c
Split PolynomialRedos definition into a library to avoid duplication in the tests
2022-05-04 15:41:38 +01:00
Joe Farebrother
2d963176bf
Fix change note
2022-05-04 15:41:37 +01:00
Joe Farebrother
5364001aa2
Update docs to be about Java
2022-05-04 15:41:36 +01:00
Joe Farebrother
5143585080
Fix to PolynomialRedos not finding results and to test cases not finding that
2022-05-04 15:41:36 +01:00
Joe Farebrother
5b61de67de
Implement style/doc suggestions from code review
2022-05-04 15:41:33 +01:00
Joe Farebrother
59945cd8b3
Add dataflow logic to PolynomialRedDoS
2022-05-04 15:41:30 +01:00
Joe Farebrother
37240f01d2
Copy Redos queries from python
...
Todo: Implement dataflow for polynomialredos; update docs to reference java rather than python
2022-05-04 15:40:58 +01:00
Michael Nebel
5f1a176a02
Java: Sync CaptureModels implementation to only allow at most two reads and two stores.
2022-05-04 12:29:57 +02:00
Tony Torralba
192017635a
Update java/ql/src/change-notes/2022-03-24-unsafe-android-access-improvements.md
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-05-04 10:53:31 +02:00
Tony Torralba
b9859fe165
Add change note
2022-05-04 10:53:29 +02:00
Tony Torralba
b876431950
Merge pull request #8706 from luchua-bc/java/unsafe-get-resource
...
Java: CWE-552 Add sources and sinks to to detect unsafe getResource calls in Java EE applications
2022-05-04 10:12:28 +02:00
Joe Farebrother
f65f833b11
Merge pull request #9020 from joefarebrother/predictable-seed
...
Java: Add CWE-377 tag to java/predictable-seed
2022-05-03 15:13:58 +01:00
Tony Torralba
02822c6284
Merge pull request #9013 from atorralba/atorralba/private-externalflow-imports
...
Java: Make more ExternalFlow imports private
2022-05-03 16:02:09 +02:00
Joe Farebrother
61f13817cf
Add change note
2022-05-03 14:27:47 +01:00
Joe Farebrother
f7d0884db1
Java: Add cwe-377 tag to predictable-seed
2022-05-03 12:28:14 +01:00
Anders Schack-Mulligen
249f771fad
Merge pull request #8952 from cklin/fix-ql-comments-syntax
...
Fix syntax errors in QL comments
2022-05-03 11:15:56 +02:00
Tony Torralba
c66e583aea
Make more ExternalFlow imports private
2022-05-03 10:31:29 +02:00
Anders Schack-Mulligen
86516b157b
Merge pull request #8884 from JLLeitschuh/feat/JLL/additional-file-taint-flow
...
Java: Add additional `File` taint value flow models
2022-05-02 16:30:45 +02:00
Tony Torralba
9a35aba465
Add change notes
2022-05-02 15:45:44 +02:00
