Michael Nebel
01307e1255
Update java/ql/src/utils/flowtestcasegenerator/FlowTestCase.qll
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-12-02 09:47:14 +01:00
Michael Nebel
c145678323
Java: Address review comments.
2022-12-02 09:46:39 +01:00
Jami Cogswell
aa633412f4
add change notes
2022-12-01 15:25:45 -05:00
github-actions[bot]
31ab22e3a0
Release preparation for version 2.11.5
2022-12-01 20:05:14 +00:00
Michael Nebel
cd0d09d806
Java: Refactor to avoid using SummaryModelCsv.
2022-12-01 13:07:31 +01:00
Jami Cogswell
22c4d975ad
remove old import
2022-11-30 18:07:45 -05:00
Jami Cogswell
210d8529b6
add query for SupportedExternalApis
2022-11-30 18:07:45 -05:00
Ed Minnix
04829fc38e
Java: SQLInjection example for addJavaScriptInterface query
2022-11-30 13:32:28 -05:00
Ian Lynagh
cd8c40e063
Kotlin: Enable java/non-serializable-field for Kotlin
...
It now ignores compiler-generated classes
2022-11-30 17:58:43 +00:00
Ed Minnix
d35321f40e
Java: change WebView addJavascriptInterface query precision to medium
2022-11-30 11:35:14 -05:00
Ed Minnix
e31521bd14
Java: mention the default negative value for setJavaScriptEnabled
2022-11-30 10:56:17 -05:00
Edward Minnix III
b189e5b365
Java: fix precision in setJavascriptEnabled query
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-11-30 10:45:31 -05:00
Ed Minnix
5ac1e012ae
Java: Mention AssetLoader in WebView file access query documentation
2022-11-30 10:43:53 -05:00
Ed Minnix
c836c4feb7
Java: Specify default value in WebView file access query
2022-11-30 10:43:05 -05:00
Edward Minnix III
710e012e09
Java: fix precision of Android WebView File access query
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-11-30 10:41:45 -05:00
Ian Lynagh
7eaef0cd3d
Merge pull request #11436 from igfoo/igfoo/NamingConventionsRefTypes
...
Kotlin: Enable java/misnamed-type query
2022-11-29 18:39:18 +00:00
Michael Nebel
984124b3b5
Java: Improve flow test case generator to emit a data extensions YAML file and qlpack file if needed.
2022-11-29 12:54:54 +01:00
Michael Nebel
48290c95a7
Java: Update the flow test case generator to emit data extension like model data.
2022-11-29 12:54:54 +01:00
Michael Nebel
9507dc15fd
Java: Remove un-needed qlfrag files.
2022-11-29 12:54:54 +01:00
Michael Nebel
b96540c937
Java: Convert permissve-dot-regex-query to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
91840c613e
Java: Convert unsafe-url-forward to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
aed5ee4edc
Java: Convert thread-resource-abuse to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
07578f11d4
Java: Convert hardcoded-jwt-key models to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
ab12b6cc2b
Java: Convert android-web-resource-response to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
5c15ad412c
Java: Convert log4j-injection to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
665d40dc4b
Java: Convert file-path-injection to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
805430983c
Java: Convert commons-io to data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
d7aafbfe64
Java: Add model generator script that emits data extensions.
2022-11-28 12:30:35 +01:00
Michael Nebel
0abeb831c7
Java: Move summaryModel predicate, which constructs a CSV row to the testcode where it is used.
2022-11-28 12:30:34 +01:00
Michael Nebel
fc4b9827b9
Java: Add script for converting extensions.
2022-11-28 12:30:34 +01:00
Michael Nebel
9f7103c4fb
Java: Add queries for extracting sources, sinks and summaries.
2022-11-28 12:30:34 +01:00
Michael Nebel
24e830f91d
Java: Fix some minor bugs in the CSV printing of summaries for flow test generation.
2022-11-28 09:07:40 +01:00
Ian Lynagh
a423f5f695
Kotlin: Enable java/misnamed-type query
...
We used to get alerts for the class around a local function, a lambda,
or a function reference, which we give name "". Now those are marked as
compiler-generated, and the query ignores compiler-generated types.
2022-11-25 17:11:40 +00:00
Tony Torralba
adf905d838
Merge pull request #11368 from ka1n4t/main
...
Java: Add binding between annotation and sink-param in MyBatis SQL Injection query
2022-11-24 14:34:57 +01:00
Tony Torralba
17218fa663
Formatting
2022-11-24 11:14:16 +01:00
Tony Torralba
443d0f50c1
Apply suggestions from code review
2022-11-24 11:10:07 +01:00
Erik Krogh Kristensen
1eec067474
Merge pull request #11294 from erik-krogh/fileDoc
...
QL: improve the "this block-comment should have been a QLDoc"-query
2022-11-23 22:23:36 +01:00
Ian Lynagh
d401be1845
Java: Fix typo: ceritificate
2022-11-23 12:12:32 +00:00
Tony Torralba
92ee0aa7ae
Merge pull request #11367 from atorralba/atorralba/java/add-bitwise-implicit-intents
...
Java: Consider taint through bitwise operations on PendingIntent flags
2022-11-22 17:08:52 +01:00
Erik Krogh Kristensen
b2267c0e49
Merge pull request #11343 from erik-krogh/redundantAssignment
...
QL: add redundant-assignment query
2022-11-22 13:03:14 +01:00
Tony Torralba
1667fbad88
Add change note
2022-11-22 11:48:21 +01:00
ka1n4t
ce2ba21240
Add binding between annotation and sink-param
2022-11-22 18:32:14 +08:00
Jami
8a73675483
Merge pull request #11070 from jcogs33/java-regex-injection
...
Java: Promote regex injection query from experimental
2022-11-21 15:04:26 -05:00
Jami Cogswell
9e2ec9d12f
apply docs review suggestion
2022-11-21 13:39:46 -05:00
Edoardo Pirovano
6c33ddcd47
Merge pull request #11349 from github/edoardo/2.11.4-mergeback
...
Merge `rc/3.8` into `main`
2022-11-21 18:08:27 +00:00
erik-krogh
64707f4f7b
remove redundant assignments
2022-11-21 17:45:05 +01:00
Tony Torralba
aa2c7426ad
Add change note
2022-11-21 11:42:40 +01:00
Tony Torralba
2809c3a77c
Handle disabled Maven repositories
2022-11-21 10:11:57 +01:00
github-actions[bot]
5b14ebf22a
Post-release preparation for codeql-cli-2.11.4
2022-11-18 11:26:00 +00:00
Chris Smowton
d45c35a02e
Copyedit the Java src qlpack 0.4.4 release nnotes
2022-11-17 16:57:08 +00:00
