13974 Commits

Author	SHA1	Message	Date
Artem Smotrakov	c6c4c2c99b	Java: Add a query for MVEL injections ... - Added experimental/Security/CWE/CWE-094/MvelInjection.ql - Added experimental/Security/CWE/CWE-094/MvelInjectionLib.qll - Added a qhelp file with an example of vulnerable code - Added tests and stubs for mvel2-2.4.7	2020-06-05 17:13:24 +03:00
Anders Schack-Mulligen	e4e51b5027	Merge pull request #3291 from artem-smotrakov/spel-injection ... Java: Add a query for SpEL injections	2020-06-05 15:51:38 +02:00
Anders Schack-Mulligen	64225c31a6	Java: Add test case.	2020-06-04 10:31:08 +02:00
Anders Schack-Mulligen	8d6e39eb18	Java: Add instanceof type bounds for ArrayAccess.	2020-06-03 09:42:37 +02:00
luchua-bc	9affa157b6	Add Log4J 2 and a new search string secret	2020-06-02 03:21:27 +00:00
Robert Brignull	6e0552c074	add more code-scanning suites	2020-06-01 11:45:46 +01:00
Artem Smotrakov	df3adeec36	Java: Add a query for SpEL injections ... - Added experimental/Security/CWE/CWE-094/SpelInjection.ql and a couple of libraries - Added a qhelp file with a few examples - Added tests and stubs for Spring	2020-05-31 20:52:45 +03:00
luchua-bc	3d4a5a337d	Add check for J2EE server directory listing	2020-05-30 10:58:16 +00:00
yo-h	1fea545160	Merge pull request #3573 from aschackmull/java/private-interface-methods ... Java: Fix for private interface methods.	2020-05-28 20:31:55 -04:00
yo-h	c2de08ca51	Merge pull request #3499 from aschackmull/java/instanceof-pattern-cfg ... Java: Add CFG edges for Java 14 pattern-matching instanceof.	2020-05-28 20:24:39 -04:00
luchua-bc	104f1c3197	Add validation query for SSL Engine/Socket and com.rabbitmq.client.ConnectionFactory	2020-05-28 03:34:29 +00:00
Anders Schack-Mulligen	a858a8cd42	Java: Fix for private interface methods.	2020-05-27 11:05:41 +02:00
Anders Schack-Mulligen	796eac108f	Java: Autoformat	2020-05-27 09:19:59 +02:00
yo-h	f952293ba0	Merge pull request #3526 from aschackmull/java/qltest-fps-nullness-rangeanalyis ... Java: Add a few qltest cases for nullness and range analysis FPs.	2020-05-26 14:09:27 -04:00
Jonas Jensen	5deeda0337	Merge pull request #3387 from geoffw0/tostringperf ... C++: Eliminate recursion from toString().	2020-05-26 13:24:43 +02:00
Anders Schack-Mulligen	6bc9624a4c	Merge pull request #3236 from luchua-bc/java-improper-url-validation ... Java: Improper url validation	2020-05-26 09:48:44 +02:00
Jonas Jensen	3d58e6f7af	Merge pull request #3515 from hvitved/dataflow/remove-deprecated ... Data flow: Remove deprecated predicates	2020-05-25 15:08:28 +02:00
Bt2018	2a654af983	Correct the select statement in the query	2020-05-25 08:24:38 -04:00
Anders Schack-Mulligen	0d75c6a5f1	Merge pull request #3506 from ggolawski/spring-actuators-fix ... Fixes FPs in SpringBootActuators query	2020-05-25 13:09:56 +02:00
luchua-bc	6d1ba3f899	Java: CWE-273 Unsafe certificate trust	2020-05-24 16:43:15 +00:00
Alvaro Muñoz	0b20785cce	add support for java.io.StringWriter	2020-05-22 18:13:28 +02:00
Bt2018	74ab6981eb	Fix HTML tag issue	2020-05-20 10:23:40 -04:00
Anders Schack-Mulligen	8cbc01d49b	Java: Add a few qltest cases for nullness and range analysis FPs.	2020-05-20 10:44:15 +02:00
yo-h	bfeaeccf60	Merge pull request #3507 from aschackmull/java/cleanup-deprecated-overrides ... Java: Clean up deprecated overrides.	2020-05-19 09:47:57 -04:00
Tom Hvitved	431403f5db	Data flow: Remove deprecated predicates	2020-05-19 15:42:59 +02:00
Bt2018	19d2a404c9	Add AndroidRString RefType to clarify the Android query	2020-05-19 08:44:26 -04:00
Anders Schack-Mulligen	6f03a0bc39	Merge pull request #3487 from luchua-bc/java-sensitive-jboss-logging ... Add JBoss logging	2020-05-19 11:04:18 +02:00
Anders Schack-Mulligen	c36e6213f1	Merge pull request #3288 from ggolawski/jndi-injection ... CodeQL query to detect JNDI injections	2020-05-19 11:03:29 +02:00
Anders Schack-Mulligen	9d7329de30	Java: Clean up deprecated overrides.	2020-05-19 10:41:41 +02:00
Grzegorz Golawski	73e736b47a	Enhanced comments according to the review comment	2020-05-18 23:37:48 +02:00
Grzegorz Goławski	0075d35346	Update java/ql/src/experimental/Security/CWE/CWE-074/JndiInjectionLib.qll ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2020-05-18 23:18:16 +02:00
Grzegorz Golawski	ac329e81f8	Fixes FPs in SpringBootActuators query ... No evidence that Spring Actuators are being used, e.g. `http.authorizeRequests().anyRequest().permitAll()` Only safe Actuators are enabled, e.g. `EndpointRequest.to("health", "info")`	2020-05-18 22:55:33 +02:00
Bt2018	69f2525e62	Remove the ending blank lines for auto-format check	2020-05-18 10:02:37 -04:00
Bt2018	7a9381f1fb	Add declaring type to the res.getString(R.string.key) call	2020-05-18 07:59:38 -04:00
Anders Schack-Mulligen	37c8917813	Java: Add test.	2020-05-18 13:19:19 +02:00
Anders Schack-Mulligen	bd114db862	Java: Add cfg edges for instanceof-pattern.	2020-05-18 09:49:32 +02:00
luchua-bc	6c24f36068	Java: CWE-297 insecure JavaMail SSL configuration	2020-05-17 02:43:26 +00:00
yo-h	4f00e40257	Merge pull request #3474 from aschackmull/java/string-formatted ... Java: Add taint steps for String.formatted.	2020-05-15 22:04:36 -04:00
yo-h	69ab158910	Merge pull request #3473 from aschackmull/java/switchexpr ... Java: Extend library support for switch expressions.	2020-05-15 20:46:37 -04:00
luchua-bc	4117cd73a7	Add JBoss logging	2020-05-15 16:14:41 +00:00
Tom Hvitved	cd9538d0d9	Merge remote-tracking branch 'upstream/master' into dataflow/precise-field-types	2020-05-15 15:24:05 +02:00
Grzegorz Golawski	14ce049fc6	Add support for Saxon	2020-05-15 00:12:08 +02:00
Anders Schack-Mulligen	1838a7455a	Java: Add taint steps for String.formatted.	2020-05-14 16:17:03 +02:00
Tom Hvitved	e608c53c3f	Java: Follow-up changes	2020-05-14 15:58:50 +02:00
Tom Hvitved	aa83cc1472	Data flow: Sync files	2020-05-14 15:58:50 +02:00
Anders Schack-Mulligen	0aad24e6db	Java: Extend library support for switch expressions.	2020-05-14 15:40:26 +02:00
Bt2018	819a599e2c	Correct the name tag and change the placeholders in the query	2020-05-14 08:13:21 -04:00
Bt2018	9a7ab4ee32	Correct comment of the HostVerificationMethodAccess method access	2020-05-14 07:43:17 -04:00
Anders Schack-Mulligen	5c9fb2312e	Merge pull request #3090 from luchua-bc/java-insert-sensitive-info-into-log ... Java: CWE-532 sensitive info logging	2020-05-14 11:43:47 +02:00
Bt2018	7b88988981	Convert to path-problem query	2020-05-13 08:09:22 -04:00