Geoffrey White
cf75397ef1
Java: Rename tests.
2020-06-30 14:33:05 +01:00
Geoffrey White
5c11c9ee43
Java: Rename additional private predicates.
2020-06-30 13:05:46 +01:00
Geoffrey White
f8425b8a58
Java: Update uses.
2020-06-30 13:02:48 +01:00
Geoffrey White
db0500b9ef
Java: Direct port of changes to Java.
2020-06-30 13:02:48 +01:00
luchua-bc
d978f28822
Simplify the query for subtype check
2020-06-30 11:15:18 +00:00
Anders Schack-Mulligen
13cb853af5
Merge pull request #3294 from ggolawski/ognl-injection
...
CodeQL query to detect OGNL injections
2020-06-30 09:46:02 +02:00
Tom Hvitved
b57cfc965a
Merge pull request #3804 from aschackmull/dataflow/dispatch-refactor
...
Dataflow: Refactor dispatch with call context.
2020-06-30 08:28:27 +02:00
luchua-bc
382e5a5a7a
Revert "Add remote source of Android intent extra"
...
This reverts commit 65e76ab18f
2020-06-30 00:55:05 +00:00
luchua-bc
3e8e9f9969
Revert "Add method access qualifier as source"
...
This reverts commit 87668bf075
2020-06-30 00:54:27 +00:00
luchua-bc
065b90ab6b
Revert "text changes"
...
This reverts commit 0f8dd7c328
2020-06-30 00:53:03 +00:00
luchua-bc
ede9cec4a9
Uncaught Servlet Exception
2020-06-29 20:07:53 +00:00
Anders Schack-Mulligen
d297ce2279
Merge pull request #3436 from artem-smotrakov/revocation-checking
...
Java: Added a query for disabled certificate revocation checking
2020-06-29 16:42:36 +02:00
Anders Schack-Mulligen
b53b90501b
Merge pull request #3550 from luchua-bc/java-unsafe-cert-trust
...
Java: CWE-273 Unsafe certificate trust
2020-06-29 16:39:39 +02:00
Anders Schack-Mulligen
0bd81eb4b8
Dataflow: Fix reference to viableCallable.
2020-06-29 16:22:58 +02:00
luchua-bc
0f8dd7c328
text changes
2020-06-27 22:56:00 +00:00
Bt2018
87668bf075
Add method access qualifier as source
2020-06-27 18:00:52 -04:00
Grzegorz Golawski
aff0e0eb25
Cleanup according to review comments.
2020-06-27 18:30:36 +02:00
Artem Smotrakov
f5f30ce25e
Java: Simplified the query for disabled certificate revocation checking
...
Removed a dataflow cofiguration for setting a revocation checker.
Instead, the query just checks if addCertPathChecker() or setCertPathCheckers()
methods are called.
2020-06-27 11:37:20 +03:00
Artem Smotrakov
a2fa03e4f5
Java: Improved the query for disabled certificate revocation checking
...
- Added a taint propagation step for List.of() methods
- Added a testcase with one of the List.of() method
- Simplified conditions
- Fixed typos
2020-06-27 11:37:20 +03:00
Artem Smotrakov
06e3f101ce
Java: Added a query for disabled certificate revocation checking
...
- Added experimental/Security/CWE/CWE-299/DisabledRevocationChecking.ql
The query looks for PKIXParameters.setRevocationEnabled(false) calls.
- Added RevocationCheckingLib.qll
- Added a qhelp file with examples
- Added tests in java/ql/test/experimental/Security/CWE/CWE-299
2020-06-27 11:37:20 +03:00
luchua-bc
65e76ab18f
Add remote source of Android intent extra
2020-06-25 20:20:18 +00:00
Anders Schack-Mulligen
6c679c328d
Dataflow: Refactor dispatch with call context.
2020-06-25 14:28:35 +02:00
luchua-bc
0779aab28f
Clean up the QL code
2020-06-24 15:02:16 +00:00
Anders Schack-Mulligen
791f31fa65
Merge pull request #3595 from luchua-bc/j2ee-server-directory-listing
...
Java: Add check for J2EE server directory listing
2020-06-24 16:45:34 +02:00
Anders Schack-Mulligen
941177ee25
Merge pull request #3762 from hvitved/dataflow/clear-contents
...
Data flow: Model field clearing
2020-06-24 10:19:50 +02:00
Anders Schack-Mulligen
3b62bd254c
Merge pull request #3723 from JLLeitschuh/fix/JLL/gitignore_vs_code_generated_files
...
Add .gitignore for VS Code Generated maven project files
2020-06-24 09:35:01 +02:00
Tom Hvitved
a3e7fd60f2
Data flow: Enable syntax highlighting in QLDoc snippets
2020-06-23 16:54:34 +02:00
Bt2018
fffc88ea5b
Metadata update
2020-06-23 10:34:28 -04:00
luchua-bc
f8c494716f
Fix ending line error
2020-06-23 12:48:07 +00:00
luchua-bc
89260d6f8a
Fix ending line error
2020-06-23 12:36:07 +00:00
luchua-bc
deabfe6e5c
Adjust id tag and fix ending line error
2020-06-23 12:24:03 +00:00
luchua-bc
7642b43990
Adjust id tag and fix ending line error
2020-06-23 12:10:07 +00:00
Tom Hvitved
ff751ac0f8
Data flow: Sync files
2020-06-23 10:55:12 +02:00
Tom Hvitved
c01f570d9e
Java: Implement clearsContent()
2020-06-23 10:55:12 +02:00
Tom Hvitved
c057e82efa
Data flow: Sync files
2020-06-23 10:55:11 +02:00
Tom Hvitved
e578827626
Java: Add more field-flow tests
2020-06-23 10:55:11 +02:00
semmle-qlci
e06a54c33d
Merge pull request #3494 from hvitved/dataflow/partial-flow-access-path-limit
...
Approved by aschackmull
2020-06-22 12:09:00 +01:00
Anders Schack-Mulligen
71665a02fa
Merge pull request #3737 from Marcono1234/patch-1
...
Simplify NoAssignInBooleanExprs.ql
2020-06-22 10:46:00 +02:00
Tom Hvitved
72e6c9c2b1
Data flow: Use accessPathLimit() in partial flow as well
2020-06-22 10:08:51 +02:00
Anders Schack-Mulligen
8107fbadc2
Merge pull request #3456 from hvitved/dataflow/precise-field-types
...
Data flow: Track precise types during field flow
2020-06-19 11:50:10 +02:00
Marcono1234
161ba92123
Simplify NoAssignInBooleanExprs.ql
2020-06-18 15:16:09 +02:00
Anders Schack-Mulligen
74eab3cbc0
Dataflow: Fix qltest.
2020-06-17 17:23:35 +02:00
Anders Schack-Mulligen
cedfaf6aaf
Dataflow: autoformat
2020-06-17 17:09:55 +02:00
Anders Schack-Mulligen
543ab71dfe
Dataflow: minor review fixes.
2020-06-17 17:03:22 +02:00
Anders Schack-Mulligen
d28b5ace63
Dataflow: Sync.
2020-06-17 15:40:48 +02:00
Anders Schack-Mulligen
10b64fc47a
Dataflow: Record content type for stores.
2020-06-17 15:40:42 +02:00
luchua-bc
f40e27a3c5
Hardcoded AWS credentials
2020-06-17 02:46:02 +00:00
lcartey@github.com
2978af34cd
Java: Add RestTemplate as flow source.
2020-06-16 09:50:37 +01:00
lcartey@github.com
f2edc53144
Java: Add Spring RestTemplate return values to untrusted data types
...
- Also improve unwrapping of lists/arrays/maps etc.
2020-06-16 09:50:37 +01:00
lcartey@github.com
9625e82afd
Java: Model Spring WebClients/RestTemplates.
2020-06-16 09:50:37 +01:00
