Jami Cogswell
c414ee0e25
add ECC dataflow config; passes all test cases; still don't have algo name tracking
2022-10-11 16:56:10 -04:00
Jami Cogswell
5e2ef66014
refactoring to use both dataflow configs; commit before deleting unused code
2022-10-11 16:56:10 -04:00
Jami Cogswell
8ffd2522e7
add draft code to find algo type to replace tainttracking configs
2022-10-11 16:56:10 -04:00
Jami Cogswell
d3b1a04c13
handle FN case with simple VarAccess; add draft of dataflow config to handle complex VarAccess
2022-10-11 16:56:10 -04:00
Jami Cogswell
7d94590d79
add change note
2022-10-11 16:56:10 -04:00
Jami Cogswell
9eb45c3787
refactor tests and code, update help file
2022-10-11 16:56:10 -04:00
Jami Cogswell
657e1e62ca
start refactoring query logic into lib file
2022-10-11 16:56:10 -04:00
Jami Cogswell
3643c9e658
update metadata
2022-10-11 16:56:10 -04:00
Jami Cogswell
9b7df354e6
move files
2022-10-11 16:56:10 -04:00
Ed Minnix
80cc3fc518
Reword first sentence of documentation
2022-10-11 11:02:37 -04:00
Edward Minnix III
1f0a48de28
Documentation suggestion
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2022-10-11 10:59:00 -04:00
Tamas Vajk
9b2cc6c318
Kotlin/Java: Exclude generated code from java/missing-override-annotation
2022-10-11 15:48:46 +02:00
Josh Soref
22141e378e
spelling: necessary
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 03:59:17 -04:00
Josh Soref
8f7e76f0cb
spelling: initialization
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 03:59:08 -04:00
Josh Soref
b5bed9cbf5
spelling: explicitly
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
Josh Soref
3b9546f02e
spelling: deserialization
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
Josh Soref
3e6477f878
spelling: currently
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
Josh Soref
5755159f08
spelling: authentication
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:36 -04:00
Josh Soref
6db36616cd
spelling: arbitrary
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:35 -04:00
Josh Soref
c2a0dbe715
spelling: application
...
Signed-off-by: Josh Soref <2119212+jsoref@users.noreply.github.com >
2022-10-11 00:23:35 -04:00
Edward Minnix III
b6270ebe52
Apply suggestions from documentation review
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2022-10-10 14:57:14 -04:00
Edward Minnix III
b94b78115e
Style fix.
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2022-10-10 14:52:17 -04:00
Tamás Vajk
1cf2db1a0b
Merge pull request #10718 from tamasvajk/kotlin-internal-repr
...
Kotlin: ignore properties in `java/internal-representation-exposure` check
2022-10-10 13:58:55 +02:00
Tamás Vajk
cd8ac1a835
Merge pull request #10720 from tamasvajk/kotlin-equals-fix
...
Kotlin: Consider `::class` type check in `java/unchecked-cast-in-equals`
2022-10-10 13:58:15 +02:00
github-actions[bot]
b8ef9e0ddc
Post-release preparation for codeql-cli-2.11.1
2022-10-07 15:59:45 +00:00
Tamas Vajk
51f9314a50
Kotlin: Consider ::class type check in equals
2022-10-07 09:23:01 +02:00
Tamas Vajk
cd64faf635
Kotlin: ignore properties in java/internal-representation-exposure check
2022-10-07 09:13:14 +02:00
github-actions[bot]
a02dcdc5e1
Release preparation for version 2.11.1
2022-10-07 02:20:28 +00:00
Tony Torralba
015d48ef66
Fix select message
2022-10-06 16:28:17 +02:00
Tony Torralba
39b5ebfd7b
Fix qhelp
2022-10-06 16:28:17 +02:00
Tony Torralba
76ea255277
Add security-severity
2022-10-06 16:28:17 +02:00
Tony Torralba
4a18892da9
Second query version
...
Remove sinks flowing to write operations requirement
2022-10-06 16:28:17 +02:00
Tony Torralba
153ec5368e
First query version requiring sinks to flow to write operations
2022-10-06 16:28:17 +02:00
Henry Mercer
7a7d164b07
Merge pull request #10698 from github/henrymercer/successfully-extracted-files-tag
...
Tag successfully extracted files queries
2022-10-06 13:21:52 +01:00
Anders Schack-Mulligen
5b67ba2939
Merge pull request #10177 from atorralba/atorralba/path-sanitizer
...
Java: Promote `PathSanitizer.qll` from experimental
2022-10-06 10:29:33 +02:00
Henry Mercer
d80d39504f
Tag successfully extracted files queries
...
Tag the successfully extracted files queries with
`successfully-extracted-files` to make them easier to identify
programmatically in a language-independent way.
This follows the prior art for lines of code queries, which are tagged
`lines-of-code`.
2022-10-05 19:19:43 +01:00
Chris Smowton
7f8bcf76bf
Merge pull request #10665 from dilanbhalla/dilan-java/guidance-exectainted
...
Java Guidance: ExecTainted.ql (experimental version)
2022-10-05 15:05:10 +01:00
Ed Minnix
3c7f5420db
Update metadata to match CWE-926
2022-10-04 10:48:05 -04:00
Ed Minnix
f888c4b279
Move files from CWE-276 to CWE-926
2022-10-04 10:40:34 -04:00
Michael Nebel
52d2dd71c0
Java: Make equivalent fix to the telemetry queries as made for C#.
2022-10-04 15:16:21 +02:00
Tony Torralba
9db65eae7f
Address review comments
2022-10-04 12:27:01 +02:00
Tony Torralba
f19eb783be
Generalize file/path taint steps
...
This is needed by PathSanitizer but also helps simplify ZipSlip.ql
2022-10-04 12:27:01 +02:00
Tony Torralba
4e29c39c78
Merge ZipSlip sanitization logic into PathSanitizer.qll
...
Apply code review suggestions regarding weak sanitizers
2022-10-04 12:27:01 +02:00
Tony Torralba
89d905cc03
Add change note
2022-10-04 12:27:01 +02:00
Tony Torralba
08c67fb174
Use PathInjectionSanitizer in relevant queries
2022-10-04 12:27:01 +02:00
Tony Torralba
dff878e531
Apply TaintedPath recent changes to TaintedPathLocal
2022-10-04 12:26:59 +02:00
Tony Torralba
5706e8b377
Improve PathSanitizer
...
Rename PathTraversalSanitizer to PathInjectionSanitizer
2022-10-04 12:26:17 +02:00
Tony Torralba
50ad234694
Move PathSanitizer to the main library
2022-10-04 12:26:17 +02:00
Tony Torralba
2deb3e5625
Reapply "Java: Fix cartesian product"
...
This reverts commit c1654ce7cc
2022-10-04 11:11:44 +02:00
Tony Torralba
281e49daf7
Revert "Java: Add CompilationUnit.getATypeAvailableBySimpleName()"
...
This reverts commit 431aa2cb79
2022-10-04 10:59:45 +02:00
