Kasper Svendsen
3d7343273e
Merge pull request #19813 from github/kaspersv/overlay-java-discarding
...
Overlay: Add manual Java overlay annotations & discard predicates
2025-06-30 11:17:31 +02:00
Kasper Svendsen
c7194a4012
Overlay: Add missing QLDoc
2025-06-30 08:40:46 +02:00
Kasper Svendsen
e02affd327
Merge pull request #19901 from github/kaspersv/overlay-guards-inline
...
Overlay: Add missing `overlay[caller?]` annotation
2025-06-27 15:13:09 +02:00
Kasper Svendsen
5096ce405f
Overlay: Add missing overlay[caller?] annotation
2025-06-27 10:50:28 +02:00
Jonas Jensen
b446fe74c2
Merge pull request #19846 from jbj/diff-informed-CleartextStorageCookie
...
Java: Diff-informed CleartextStorageCookie.ql
2025-06-27 08:45:11 +02:00
Kasper Svendsen
e6ef6a3326
Merge branch 'main' into kaspersv/overlay-java-discarding
2025-06-27 08:28:34 +02:00
Kasper Svendsen
9d2dd782d9
Merge remote-tracking branch 'github/main' into kaspersv/overlay-java-annotations
2025-06-26 13:18:25 +02:00
Anders Schack-Mulligen
321a4afd5c
Merge pull request #19883 from aschackmull/java/fix-assert-cfg
...
Java: Fix assert CFG by properly tagging the false successor.
2025-06-26 11:43:27 +02:00
Kasper Svendsen
64f27e2adf
Java: Add abstraction for discardable locatables
2025-06-26 11:35:37 +02:00
Anders Schack-Mulligen
c091fc585b
Java: Account for AssertionError possibly not being extracted.
2025-06-26 11:03:59 +02:00
Anders Schack-Mulligen
f07d9dda39
Guards: Refactor EqualityTest interface.
2025-06-26 10:26:40 +02:00
Anders Schack-Mulligen
1d4c8197ec
Java: Fix assert CFG by properly tagging the false successor.
2025-06-26 10:18:14 +02:00
Jonas Jensen
fc2b18ae8a
Java: Diff-informed CleartextStorageCookie.ql
...
This query shares implementation with several other queries about
cleartext storage, but it's the only one of them that's in the
code-scanning suite. The sharing mechanism remains the same as before,
but now each query has to override `getASelectedLocation` to become
diff-informed.
Two other data-flow configurations are used in this query, but they
can't easily be made diff-informed.
2025-06-26 09:31:11 +02:00
Anders Schack-Mulligen
73810a6d85
Java: Fix perf issue.
2025-06-26 07:17:35 +02:00
Anders Schack-Mulligen
d4c897f8e2
Java: Fix perf issue.
2025-06-26 07:17:35 +02:00
Anders Schack-Mulligen
5c0dcd980d
Java: Switch to the shared Guards library.
2025-06-26 07:17:34 +02:00
Anders Schack-Mulligen
cc13193cb6
Java: Replace some references to basicNullGuard.
2025-06-26 07:17:33 +02:00
Anders Schack-Mulligen
0607fefc57
Java: Refactor integerGuard.
2025-06-26 07:17:33 +02:00
Anders Schack-Mulligen
a2778eee75
Java: Refactor clearlyNotNullExpr into a base case that does not rely on SSA.
2025-06-26 07:17:32 +02:00
Anders Schack-Mulligen
994c1f6427
Java: Add hasInputFromBlock predicate in BaseSSA.
2025-06-26 07:17:28 +02:00
Nora Dimitrijević
a49999dd5d
PolynomialReDoS: disable diff-informed support
...
This is because it was failing the diff-informed consistency check, and like other ReDoS queries (Python?) the query tries to be helpful by showing a substring of a regex, which has a `hasLocation(...)` (intensional) but no corresponding `getLocation()` (extensional). Until the location overrides get updated to support `hasLocation`-based locations, it's probably best to turn off diff-informed support.
2025-06-24 16:42:41 +02:00
Nora Dimitrijević
b2cb585bf2
UnsafeDeserialization: add missing getASelectedSinkLocation override
...
This fixes the failing diff-informed consistency check.
2025-06-24 16:42:39 +02:00
Kasper Svendsen
0ee6a78a4a
Java: Allow methods with empty bodies for overlay
2025-06-24 10:38:07 +02:00
Kasper Svendsen
6e92d7e247
Java: Add entity discard predicates
2025-06-24 10:38:06 +02:00
Kasper Svendsen
81b677a2d9
rename overlay[caller] to overlay[caller?]
2025-06-24 10:25:07 +02:00
Kasper Svendsen
c207cfdeb7
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
Nora Dimitrijević
aa5dd7bb4e
Java: mass enable diff-informed data flow + none() overrides
...
An auto-generated patch that enables diff-informed data flow in the obvious cases.
Builds on github#18346 and github/codeql-patch#88
2025-06-17 14:05:36 +02:00
Anders Schack-Mulligen
6131c680f6
Update java/ql/lib/semmle/code/java/ControlFlowGraph.qll
...
Co-authored-by: Tom Hvitved <hvitved@github.com >
2025-06-13 14:07:46 +02:00
Anders Schack-Mulligen
f27e310ba3
Java: Adjust references.
2025-06-11 15:53:02 +02:00
Anders Schack-Mulligen
b3bb71f2e2
Java: Update the CFG for assert statements to make them proper guards.
2025-06-11 15:38:29 +02:00
Anders Schack-Mulligen
62000319fe
Rangeanalysis: Simplify Guards integration.
2025-05-23 13:39:53 +02:00
Anders Schack-Mulligen
1d30103559
SSA: Distinguish between has and controls branch edge.
2025-05-23 09:56:22 +02:00
Owen Mansel-Chan
663c83d8c6
Merge pull request #19556 from owen-mc/java/pr/19512
...
Java: Fix SpringRequestMappingMethod URL Extraction #2
2025-05-22 15:08:31 +01:00
Owen Mansel-Chan
476ada13db
Improve QLDoc for SpringRequestMappingMethod.getAValue
2025-05-22 14:22:28 +01:00
Owen Mansel-Chan
59d4f039d8
Deprecate SpringRequestMappingMethod.getValue (which didn't work)
2025-05-22 12:29:29 +01:00
Owen Mansel-Chan
775338ebdd
Rename getArrayValue to getAValue
2025-05-22 12:21:20 +01:00
Anders Schack-Mulligen
10efea1075
Java/Shared: Address review comments.
2025-05-21 09:01:47 +02:00
Anders Schack-Mulligen
3fde675d08
Java: Extend qldoc.
2025-05-21 09:01:47 +02:00
Anders Schack-Mulligen
a98d93b98b
Java: Override dominates to reference the right type.
2025-05-21 09:01:46 +02:00
Anders Schack-Mulligen
db01828717
Java: Deprecate redundant basic block predicates.
2025-05-21 09:01:46 +02:00
Anders Schack-Mulligen
f202586f5e
Java: Use the shared BasicBlocks library.
2025-05-21 09:01:45 +02:00
sentient0being
f575d2f941
get array string url
2025-05-17 19:40:41 +08:00
Jami
02ded89d84
Merge branch 'main' into jcogs33/java/junit5-missing-nested-annotation
2025-04-21 09:46:49 -04:00
Chris Smowton
0a293cf357
Add EnumType to SimpleTypeSanitizer
2025-04-09 12:12:35 +01:00
Chris Smowton
77e4d9e692
Fix stray references to the javax package name
...
Co-authored-by: Jami <57204504+jcogs33@users.noreply.github.com >
2025-04-02 10:03:49 +01:00
Jami Cogswell
faeb7ab890
Java: add blank lines to qldocs
2025-04-01 14:54:46 -04:00
Chris Smowton
20839745bd
Remove redundant import
2025-04-01 16:49:56 +01:00
Chris Smowton
50119ae481
Update docs
2025-04-01 16:20:06 +01:00
Chris Smowton
a5a6fd37df
Enable recognising jakarta.persistence in dead-code queries
2025-04-01 16:19:42 +01:00
Chris Smowton
fb6296a564
Persistence models: recognise jakarta.persistence
2025-04-01 16:07:40 +01:00
