3229 Commits

Author	SHA1	Message	Date
Ed Minnix	25fa8d5ae7	Move some logic to class	2023-12-15 11:09:07 -05:00
Ed Minnix	93cf5b8eb9	Weak Hashing Property initial query	2023-12-15 11:09:07 -05:00
Anders Schack-Mulligen	337e5e458c	Update java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-12-15 08:48:50 +01:00
Anders Schack-Mulligen	7623432c76	Java: Remove/deprecate FlowStateString-based extension points.	2023-12-14 15:15:58 +01:00
Anders Schack-Mulligen	a1068ce2f9	Dataflow: deprecate references	2023-12-14 15:05:33 +01:00
Tom Hvitved	c8b4a215bc	Merge pull request #14573 from hvitved/flow-summary-impl-param ... Move `FlowSummaryImpl.qll` to `dataflow` pack	2023-12-14 12:24:15 +01:00
Tom Hvitved	098afb935b	Address more review comments	2023-12-14 09:48:45 +01:00
Tony Torralba	d955dce72a	Improve source of randomness detection ... Also sanitize flow out of sinks to avoid overlapping paths	2023-12-13 11:15:27 +01:00
Tony Torralba	3a5d711711	Add cookie sinks	2023-12-13 11:15:27 +01:00
Tony Torralba	435d1f97a3	Add sink for OpenSAML's RequestType.setID	2023-12-13 11:15:27 +01:00
Tony Torralba	bd8f35bef7	Java: Fix FPs in Missing certificate pinning ... Local URIs should never require pinning	2023-12-12 18:02:12 +01:00
Ed Minnix	3ca039bc8f	Rename to InsecureRandomness	2023-12-11 11:18:40 -05:00
Ed Minnix	6e70e6c85a	Use pre-exisiting type for SecureRandom	2023-12-11 11:18:39 -05:00
Ed Minnix	bbf99375c7	Alter cookie sinks to instead focus on creation of a cookie	2023-12-11 11:18:39 -05:00
Ed Minnix	b9d2a26e6e	Move ESAPI models into the Weak Randomness query ... These models don't need to apply to all queries. So instead they are better suited to be within the weak randomness query itself.	2023-12-11 11:18:39 -05:00
Ed Minnix	7241e0920c	Replace convertBytesToString with models	2023-12-11 11:18:39 -05:00
Ed Minnix	e9ca4a25d4	Update to new MethodCall name	2023-12-11 11:18:39 -05:00
Ed Minnix	a1e9564cc5	Add more sources	2023-12-11 11:18:39 -05:00
Ed Minnix	b8b2de2f3c	Remove use of crypto-parameter sink kind	2023-12-11 11:18:39 -05:00
Ed Minnix	646254c9b2	Add credentials sinks from SensitiveApi	2023-12-11 11:18:39 -05:00
Ed Minnix	057a74d914	Remove unnused class	2023-12-11 11:18:39 -05:00
Ed Minnix	ba3c38c226	Restrict addCookie to specific interface	2023-12-11 11:18:38 -05:00
Ed Minnix	dc3e4cd928	Refactored method accesses to the RandomDataSource library	2023-12-11 11:18:38 -05:00
Ed Minnix	ce7690b53f	Make imports private	2023-12-11 11:18:38 -05:00
Edward Minnix III	bc0655573f	Simplifications ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-12-11 11:18:38 -05:00
Ed Minnix	0313f39229	Cryptographic sinks	2023-12-11 11:18:38 -05:00
Ed Minnix	b713efb711	Add ThreadLocalRandom.current as another source	2023-12-11 11:18:38 -05:00
Ed Minnix	bf0123d6ae	Add org.apache.commons.lang.RandomStringUtils as a source	2023-12-11 11:18:38 -05:00
Ed Minnix	e69ff7b601	Move to library and add docs	2023-12-11 11:18:38 -05:00
Tom Hvitved	f9dbf676a6	Java: Use FlowSummaryImpl from dataflow pack	2023-12-10 11:25:45 +01:00
Ed Minnix	aebbc7d4ab	Add private imports to prevent compile warnings	2023-12-08 10:42:11 -05:00
Ed Minnix	1b8f3f3450	Deprecate or remove imports of dataflow library copies	2023-12-08 10:42:10 -05:00
Anders Schack-Mulligen	0618568cdc	Merge pull request #15045 from aschackmull/java/fix-cp ... Java: Fix accidental cartesian product.	2023-12-08 15:43:01 +01:00
Anders Schack-Mulligen	64eb4ff753	Merge pull request #14983 from aschackmull/dataflow/deprecate-old-api ... Data Flow: Deprecate old data flow api.	2023-12-08 14:27:25 +01:00
Anders Schack-Mulligen	7ee3068fe7	Java: Fix accidental cartesian product.	2023-12-08 13:27:05 +01:00
Ian Lynagh	fc11a87882	Kotlin: Fix dataflow with Array.set wrappers	2023-12-06 12:19:46 +00:00
Ian Lynagh	2c625e34b5	Merge pull request #15008 from igfoo/igfoo/kot-arr-taint ... Kotlin: Track taint through Array.get/set	2023-12-05 18:30:21 +00:00
Ian Lynagh	babf1d6648	Kotlin: Track Kotlin's Array.set when tracking taint	2023-12-05 14:42:45 +00:00
Ian Lynagh	821b4c727e	Kotlin: Add Array.get(_) support to taint tracking	2023-12-05 14:41:32 +00:00
Anders Schack-Mulligen	67f0529cda	Dataflow: Sync.	2023-12-04 12:36:57 +01:00
Anders Schack-Mulligen	fd920b8585	Java: Deprecate old data flow api.	2023-12-04 12:36:57 +01:00
Chris Smowton	aa8f798853	Move condition into isNonFallThroughPredecessor	2023-11-30 11:24:07 +00:00
Chris Smowton	94819e37c4	More StmtParent -> SwitchBlock	2023-11-30 11:24:07 +00:00
Chris Smowton	53ca8e5fe9	autoformat	2023-11-30 11:24:07 +00:00
Chris Smowton	633b92da62	Introduce and use SwitchBlock instead of StmtParent for switch-statement-or-expression	2023-11-30 11:24:07 +00:00
Chris Smowton	e50a0eee59	Remove duplicate of expr exception propagation logic	2023-11-30 11:24:07 +00:00
Chris Smowton	6f3bff19cc	Expose getFirstPatternCase, not getPatternCase/2	2023-11-30 11:24:07 +00:00
Chris Smowton	40464ed1f9	Eliminate duplicate predicate	2023-11-30 11:24:07 +00:00
Chris Smowton	3971817c92	Fix: ensure is a switch block	2023-11-30 11:24:07 +00:00
Chris Smowton	b1cea1d91e	autoformat	2023-11-30 11:24:07 +00:00