Owen Mansel-Chan
2c061b0d56
Add QLDoc for HostnameSanitizingPrefix
2024-11-29 09:46:44 +00:00
Owen Mansel-Chan
7648d397f8
Improve model to remove some false positives
2024-11-29 09:46:41 +00:00
Owen Mansel-Chan
617f4f140e
Make HostnameSanitizingPrefix public
2024-11-29 09:46:39 +00:00
Owen Mansel-Chan
ba3f9d6134
Convert model to QL
2024-11-29 09:46:38 +00:00
Owen Mansel-Chan
65fb895ed5
(Unrelated) Fix typo in class name
2024-11-28 16:51:09 +00:00
Anders Schack-Mulligen
df2e2e503a
Merge pull request #17901 from aschackmull/java/allowlist-sanitizer
...
Java: Add a default taint sanitizer for contains-checks on lists of constants
2024-11-27 11:09:05 +01:00
Anders Schack-Mulligen
5ef496dd1b
Java: Add more qldoc.
2024-11-27 09:07:35 +01:00
Anders Schack-Mulligen
408a38d9fb
Java: Address review comment, include addFirst,addLast.
2024-11-26 13:25:43 +01:00
Anders Schack-Mulligen
6f32c4129d
Java: Add a default taint sanitizer for contains-checks on lists of constants.
2024-11-26 13:25:41 +01:00
Anders Schack-Mulligen
7f86f8cac7
Java: Prepare TypeFlow for separate instantiation of universal flow.
2024-11-26 13:25:41 +01:00
Jami Cogswell
05b6700607
Java: add SHA384 to list of secure algorithms
2024-11-25 09:27:53 -05:00
Arthur Baars
c2b342f1a0
Merge pull request #18084 from github/aibaars/java-sha3
...
Java: add SHA3 family to list of secure crypto algorithms
2024-11-25 15:07:43 +01:00
Arthur Baars
5eb91fd516
Drop SHA3-224
...
Drop the 224bits variant as it looks like SHA3-224 may be deprecated soon based on NIST's most recent draft revision of Transitioning the Use of Cryptographic Algorithms and Key Lengths
2024-11-25 11:25:45 +01:00
Jami
f0045692a7
Merge pull request #17869 from jcogs33/jcogs33/improve-weak-crypto
...
Java: Improve weak crypto query
2024-11-24 12:04:00 -05:00
Arthur Baars
c6eaed343d
Java: add SHA3 family to list of secure crypto algorithms
2024-11-22 19:03:00 +01:00
Rasmus Lerchedahl Petersen
cd5509a0f9
Java: locations for range analysis
2024-11-15 13:11:25 +01:00
Owen Mansel-Chan
bf0fba6c49
Refactor UnreachableBasicBlock to make it clearer
2024-11-14 14:53:12 +00:00
Owen Mansel-Chan
efb34aea45
Fix bug in UnreachableBlocks
2024-11-14 14:50:25 +00:00
Anders Schack-Mulligen
5602570e18
Kotlin: Support NotNullExpr in TypeFlow.
2024-11-07 15:25:23 +01:00
Anders Schack-Mulligen
4df4a1e6c6
Merge pull request #17863 from aschackmull/shared/universal-flow
...
Shared: Add a Universal Flow library and refactor TypeFlow to use it.
2024-11-06 13:46:13 +01:00
Jami Cogswell
459d16824e
Java: weak crypto: do not report weak hash algorithms
2024-11-03 18:22:06 -05:00
Anders Schack-Mulligen
b556590ef8
Merge pull request #17663 from aschackmull/dataflow/speculative-flow
...
Dataflow: Add support for speculative taint flow.
2024-10-31 08:12:43 +01:00
Anders Schack-Mulligen
9b493c1e1b
Java: Fix bug related to null inference for pattern initializer.
2024-10-30 15:05:36 +01:00
Ian Lynagh
6c9739023d
Java: Remove redundant getErasure overrides
...
The root definition covers these cases already
2024-10-29 11:32:16 +00:00
Anders Schack-Mulligen
fba4d09e65
TypeFlow: Simplify interface.
2024-10-28 15:09:09 +01:00
Anders Schack-Mulligen
3939eff260
TypeFlow: Rename step to uniqStep.
2024-10-28 15:00:05 +01:00
Michael Nebel
786d04e939
Java: Add the clone method to the model generation exclusions.
2024-10-21 15:19:43 +02:00
Rasmus Lerchedahl Petersen
22d621c625
shared: add locations to typetracking nodes
2024-10-16 15:16:18 +02:00
Anders Schack-Mulligen
c20f12fa6c
Add qldoc.
2024-10-16 14:35:23 +02:00
Anders Schack-Mulligen
8b99154a00
Java: Add support for speculative taint flow.
2024-10-16 14:35:19 +02:00
Anders Schack-Mulligen
c80627a3d3
Dataflow: add plumbing for adding provenance to state-steps.
2024-10-16 14:35:18 +02:00
Owen Mansel-Chan
927b402a3a
Merge pull request #17668 from igfoo/igfoo/typo
...
Java: Typo in a comment
2024-10-06 13:22:08 +01:00
Ian Lynagh
d24bdbb4e4
Java: Typo in a comment
2024-10-04 17:34:39 +01:00
Tom Hvitved
2832318711
Java: Account for top-level res folders in AndroidLayoutXmlFile
2024-10-04 08:35:28 +02:00
Anders Schack-Mulligen
6081ba5902
Merge pull request #17604 from aschackmull/java/neutral-overrides
...
Java/C#: Add overrides to the interpretation of neutral MaD models.
2024-10-01 14:55:54 +02:00
Anders Schack-Mulligen
ec0bd4494c
Java: Add overrides to the interpretation of neutral MaD models.
2024-09-30 13:11:49 +02:00
Anders Schack-Mulligen
a017f92b78
Merge pull request #17579 from aschackmull/java/type-sanitizers
...
Java: Add more type-based sanitizers.
2024-09-30 10:07:06 +02:00
Rasmus Wriedt Larsen
381ea93ec3
Merge pull request #17424 from RasmusWL/active-threat-model-source
...
Go/Java/C#: Rename `ThreatModelFlowSource` to `ActiveThreatModelSource`
2024-09-26 13:08:17 +02:00
Michael Nebel
dd993c3900
Merge pull request #17509 from michaelnebel/modelgen/parammodule
...
C#/Java: Re-factor the model generator to be a parameterized module.
2024-09-26 10:57:16 +02:00
Anders Schack-Mulligen
aaecb9bb7a
Java: Add more type-based sanitizers.
2024-09-25 10:38:17 +02:00
Ian Lynagh
bda779a58d
Java: Deprecate Field.getSourceDeclaration() and Field.isSourceDeclaration()
...
Also follows the removal of the sourceid column of fields.
2024-09-24 14:06:54 +01:00
Chuan-kai Lin
1cd8af54f2
Merge pull request #17190 from github/cklin/diff-informed-java-queries
...
Java: add support for alert location restrictions
2024-09-23 08:39:24 -07:00
Rasmus Wriedt Larsen
63c3a71d95
Merge branch 'main' into active-threat-model-source
2024-09-23 11:18:14 +02:00
Chuan-kai Lin
75ec8ce58e
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
Anders Schack-Mulligen
3a1e50dcf9
Dataflow: Simplify diff-informed implementation and tweak flag name.
2024-09-20 07:07:10 -07:00
Michael Nebel
2033818e39
Java: Use the shared model generator implementation.
2024-09-19 12:20:51 +02:00
Anders Schack-Mulligen
2837d2551a
Merge pull request #17490 from aschackmull/java/capture-in-obinit
...
Java: Fix support for variable capture inside object initializers.
2024-09-18 09:29:01 +02:00
Ian Lynagh
9f1c251809
Java: Follow removeal of typeVars.kind in qlls
2024-09-17 11:39:07 +01:00
Anders Schack-Mulligen
20661a3c56
Java: Fix support for variable capture inside object initializers.
2024-09-17 10:42:21 +02:00
Ian Lynagh
41ed6e6695
Java: Deprecate RefType.nestedName(), and add RefType.getNestedName()
2024-09-16 17:16:25 +01:00
