REDMOND\brodes
db6d3ad054
Crypto: Fix typo in not_included_in_qls.expected.
2025-10-22 10:31:19 -04:00
REDMOND\brodes
dd60cf9395
Crypto: Adjust output of bad mac order queries, update associated bad mac order expected results, fix erroneous change to ID for a slicing query, update model to specify elliptic curve type as a property, update associated graph test expected files, update the not_included_in_qls.expected to reflect all queries now under quantum.
2025-10-22 10:29:31 -04:00
REDMOND\brodes
b374ba3d0c
Crypto: Updating java 'location' information to be just a location's toString to be more verbose/precise.
2025-10-21 11:48:37 -04:00
REDMOND\brodes
ddeb42cddb
Crypto: Adding false positive to BadMacUse.java, we have no way to avoid this FP currently but should note it exists in the test case.
2025-10-21 11:04:57 -04:00
REDMOND\brodes
c50175bc9b
Crypto: ql-for-ql alert fixes.
2025-10-21 10:32:00 -04:00
yoff
9e77e5b046
java: add test with deeper paths
...
also format test files
2025-10-21 14:02:36 +02:00
yoff
f183a7223f
java: add test for notFullyMonitored
2025-10-21 13:40:29 +02:00
yoff
f4878b3806
java: make as many predicates private as possible
2025-10-21 13:25:26 +02:00
yoff
de05bfbce3
java: address review comments
...
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
2025-10-21 13:25:26 +02:00
yoff
715acefacc
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2025-10-21 12:52:59 +02:00
REDMOND\brodes
22c0f9fa91
Crypto: Adding a proof of concept bad mac ordering predicate that takes in an ArtifactNode to be used for graph generation to intercept nodes with known mac ordering issues, in order to format the node and output error messages in the graph.
2025-10-20 16:24:31 -04:00
REDMOND\brodes
eff94ef91f
Crypto: To allow for graph generation to have properties informed by assessments, altering a few queries weak/vuln/bad crypto to have qll files that can be accessed for other purposes, like graph generation. Also altering weak symmetric cipher to look for non-aes algorithms to be more comprehensive.
2025-10-20 15:51:07 -04:00
REDMOND\brodes
cc436e897d
Merge branch 'santander-java-crypto-check' of https://github.com/bdrodes/codeql into santander-java-crypto-check
2025-10-20 15:24:40 -04:00
REDMOND\brodes
354effe829
Crypto: Missing hash algorithms for HMAC operations in jca.
2025-10-20 15:24:18 -04:00
Ben Rodes
2b683c210f
Merge branch 'main' into santander-java-crypto-check
2025-10-18 17:56:43 -04:00
REDMOND\brodes
c01c060476
Crypto: more ID renaming to include "examples", fix singleton issues with ql-for-ql, use formatted test for WeakAsymmetricKeyGenSize (add post processing in the qlref), misc expected files updated (test passed locally but on rerun vscode reports failures, known bug with vscode unit tests).
2025-10-17 14:13:53 -04:00
REDMOND\brodes
540daa6df2
Crypto: weak symmetric cipher tests.
2025-10-17 13:40:15 -04:00
REDMOND\brodes
b06e05362b
Crypto: altering all query IDs in examples to have "examples" in the ID, to make clear the query is not intended for production.
2025-10-17 13:39:50 -04:00
REDMOND\brodes
1b205d8673
Removing WeakRSA, this is redundant with weak asymmetric key size.
2025-10-17 13:39:05 -04:00
REDMOND\brodes
b4ecb91c83
Crypto: Add missing cipher algorithms to JCA. Update node tests to account for missing cipher algorithms.
2025-10-17 13:38:47 -04:00
REDMOND\brodes
f480d90a68
Crypto: Add missing block mode JCA Models, add block mode unit tests
2025-10-17 13:13:14 -04:00
REDMOND\brodes
e12734162f
Crypto: WeakKDFKeySize tests.
2025-10-17 12:32:24 -04:00
REDMOND\brodes
628bab92fc
Crypto: Modify BadMacOrderMacOnEncryptPlaintext to be a path query that traces through any intermediate encrypt or mac to the final encrypt or mac.
2025-10-17 12:06:34 -04:00
REDMOND\brodes
ff7840dc9f
Crypto: removing precision tags on experimental queries.
2025-10-17 10:52:32 -04:00
Owen Mansel-Chan
66f95bcbcd
Merge pull request #20603 from owen-mc/update-broken-algo-qhelp
...
Many languages: Update broken algo qhelp
2025-10-17 12:30:43 +01:00
yoff
3a0a8999d5
java: fix ql alerts
2025-10-17 01:52:23 +02:00
yoff
61a3e9630f
java: rewrite conflict detection
...
- favour unary predicates over binary ones
(the natural "conflicting access" is binary)
- switch to a dual solution to trade recursion through forall for simple existentials.
Co-authored-by: Anders Schack-Mulligen <aschackmull@github.com >
2025-10-17 01:43:04 +02:00
REDMOND\brodes
ef6f0222f2
Crypto: Addressing FPs in BadMacOrderMacOnEncryptPlaintext
2025-10-16 16:11:42 -04:00
REDMOND\brodes
5923e5cbb0
Crypto: Bad expected files in last push.
2025-10-16 15:45:27 -04:00
REDMOND\brodes
700f34e53a
Crypto: Bad Mac use tests, and fix for BadMacOrderMacOnEncryptPlaintext (barriers were blocking flow through an encrypt to a subsequent mac on the same plaintext)
2025-10-16 15:44:57 -04:00
REDMOND\brodes
b9b0037e07
Crypto: Comment todo for observed missing modeled case. Tests for weak and unknown KDF iteration count.
2025-10-16 14:07:45 -04:00
REDMOND\brodes
3f36b09b3c
Crypto: Rename tests for weak asymmetric key gen size.
2025-10-16 11:18:36 -04:00
REDMOND\brodes
a64a24d25d
Crypto: Comment in Language.qll
2025-10-16 11:03:49 -04:00
REDMOND\brodes
79ccef3a58
Crypto: Initial sketch for unknown hash, the model needs to recognize unknowns but where the algorithm category (e.g., hashing) is known.
2025-10-16 11:03:16 -04:00
REDMOND\brodes
d2598d4f5d
Crypto: Updating weak hash tests
2025-10-16 10:56:08 -04:00
REDMOND\brodes
4860034d41
Crypto: Weak Hash test cases update and expected file.
2025-10-16 10:40:53 -04:00
REDMOND\brodes
25599e9b4b
crypto: Update JCA model macs to take into consideration update calls (use prior pattern for signatures). Misc. bug fixes.
2025-10-15 16:25:36 -04:00
REDMOND\brodes
15e266db94
Crypto: Tweaks to bad crypto ordering queries.
2025-10-15 14:20:40 -04:00
REDMOND\brodes
9a6aac1300
Crypto: To get unreferenced parameters as general sources for Java, I've included the caveat that if a function is called, all the calls appear to be in test files.
2025-10-15 14:20:16 -04:00
REDMOND\brodes
c6174fbb93
Crypto: remove precision tag
2025-10-15 14:10:16 -04:00
REDMOND\brodes
c7be23e1fe
Crypto: Remove all precision tags from all experimental queries. Precision is largely in flux while the models are being developed.
2025-10-15 09:22:04 -04:00
REDMOND\brodes
bf9a249624
Crypto: Experimental queries for mac ordering
2025-10-15 08:06:50 -04:00
REDMOND\brodes
ee08385e31
Crytpo: Update JCA keyagreement to type conversion, XDH is a type of ECDH.
2025-10-15 08:06:19 -04:00
Joe Farebrother
f57526eedc
Merge pull request #20572 from joefarebrother/java-httponly-cookie-promote
...
Java: Promote Sensitive Cookie without HttpOnly query from experimental
2025-10-15 10:28:40 +01:00
Joe Farebrother
e95e1a0386
Update integration test
2025-10-14 16:27:28 +01:00
Joe Farebrother
d8b37d0cde
Review suggestions - update comments and description
2025-10-14 16:03:40 +01:00
github-actions[bot]
6dd07790ac
Post-release preparation for codeql-cli-2.23.3
2025-10-14 11:16:33 +00:00
github-actions[bot]
33542f7d40
Release preparation for version 2.23.3
2025-10-14 09:30:24 +00:00
REDMOND\brodes
55bbcee301
Crypto: Make WeakAsymmetricKeyGenSize a path problem.
2025-10-13 17:04:29 -04:00
REDMOND\brodes
7e8acd76c3
Crypto: Update WeakAsymmetricKeyGenSize to a path problem.
2025-10-13 15:48:32 -04:00
