aegilops
26087f6060
Added java-kotlin Sensitive Logging barriers (substrings)
2025-10-31 17:56:04 +00:00
yoff
4461be180a
Merge pull request #19539 from yoff/java/conflicting-access
2025-10-28 20:37:44 +01:00
Nora Dimitrijević
a0975e7e19
Constrain location overrides to actual sources/sinks
2025-10-28 09:42:20 +01:00
Nora Dimitrijević
f24a6f64ab
Java/WebviewDebugEnabledQuery
...
java/ql/src/Security/CWE/CWE-489/WebviewDebuggingEnabled.ql
2025-10-28 09:40:06 +01:00
Nora Dimitrijević
518c0818a4
Java/UnsafeDeserializationQuery
...
java/ql/src/Security/CWE/CWE-502/UnsafeDeserialization.ql
2025-10-28 09:40:03 +01:00
Nora Dimitrijević
4439322e88
Java/TempDirLocalInformationDisclosureQuery
...
java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql
2025-10-28 09:40:01 +01:00
Nora Dimitrijević
2a889f4f98
Java/TaintedPermissionsCheckQuery
...
java/ql/src/Security/CWE/CWE-807/TaintedPermissionsCheck.ql
2025-10-28 09:39:58 +01:00
Nora Dimitrijević
697f428eae
Java/TaintedEnvironmentVariableQuery
...
java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironment.ql
2025-10-28 09:39:55 +01:00
Nora Dimitrijević
72a97773b1
Java/NumericCastTaintedQuery
...
java/ql/src/Security/CWE/CWE-681/NumericCastTainted.ql
2025-10-28 09:39:52 +01:00
Nora Dimitrijević
247ae1d23c
Java/MaybeBrokenCryptoAlgorithmQuery
...
java/ql/src/Security/CWE/CWE-327/MaybeBrokenCryptoAlgorithm.ql
2025-10-28 09:39:50 +01:00
Nora Dimitrijević
eebff9c282
Java/ImproperValidationOfArrayConstructionFlow
...
java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstruction.ql
2025-10-28 09:39:47 +01:00
Nora Dimitrijević
9eeeec336e
Java/ImproperValidationOfArrayConstructionCodeSpecifiedQuery
...
java/ql/src/Security/CWE/CWE-129/ImproperValidationOfArrayConstructionCodeSpecified.ql
2025-10-28 09:39:45 +01:00
Nora Dimitrijević
dc1dff98b0
Java/ConditionalBypass
...
java/ql/src/Security/CWE/CWE-807/ConditionalBypass.ql
2025-10-28 09:39:42 +01:00
Nora Dimitrijević
4482e831d7
Java/CommandLineQuery
...
85a4dd0325/java/ql/src/Security/CWE/CWE-078/ExecTainted.ql857b51be58/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.qlb6e56f26c7/java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.ql
2025-10-28 09:39:39 +01:00
Nora Dimitrijević
b023880a0a
Java/BrokenCryptoAlgorithmQuery
...
java/ql/src/Security/CWE/CWE-327/BrokenCryptoAlgorithm.ql
2025-10-28 09:39:37 +01:00
Nora Dimitrijević
1129230e10
Java/ArithmeticUncontrolledQuery
...
java/ql/src/Security/CWE/CWE-190/ArithmeticUncontrolled.ql
2025-10-28 09:39:34 +01:00
Nora Dimitrijević
a228936c63
Java/ArithmeticTainted
...
java/ql/src/Security/CWE/CWE-190/ArithmeticTainted.ql
2025-10-28 09:39:31 +01:00
Nora Dimitrijević
913550f408
Java/ArbitraryApkInstallationQuery
...
java/ql/src/Security/CWE/CWE-094/ArbitraryApkInstallation.ql
2025-10-28 09:39:29 +01:00
Alexander Eyers-Taylor
227e1fcbde
Merge pull request #20598 from github/alexet/overlay-query-libraries
...
Java: Make some query libraries local.
2025-10-27 17:52:27 +00:00
yoff
406e48b3bb
java: fix aliasing FP
...
reorganise code, adding `LockField`
2025-10-27 14:30:25 +01:00
Tom Hvitved
32f21d6d49
Merge pull request #20688 from hvitved/java/request-forgery-matches-sanitizer
...
Java: Treat `x.matches(regexp)` as a sanitizer for request forgery
2025-10-24 14:34:32 +02:00
Tom Hvitved
7a9cb64e2e
Java: Treat x.matches(regexp) as a sanitizer for request forgery
2025-10-24 09:06:57 +02:00
Anders Schack-Mulligen
72d83cc966
ControlFlowReachability: Align the SSA signature with the one from shared SSA.
2025-10-23 10:57:21 +02:00
Anders Schack-Mulligen
f257c7a570
Guards: Align the SSA signature with the one from shared SSA.
2025-10-23 10:23:22 +02:00
Anders Schack-Mulligen
20147cdd2b
Shared/Java: Rename ControlFlowReachability library.
2025-10-23 09:07:34 +02:00
Anders Schack-Mulligen
8a3f62b9b6
Merge pull request #20558 from aschackmull/csharp/guards3
...
C#: Instantiate shared Guards and shared ControlFlowReachability and replace nullness
2025-10-23 08:43:14 +02:00
REDMOND\brodes
b374ba3d0c
Crypto: Updating java 'location' information to be just a location's toString to be more verbose/precise.
2025-10-21 11:48:37 -04:00
yoff
f4878b3806
java: make as many predicates private as possible
2025-10-21 13:25:26 +02:00
yoff
de05bfbce3
java: address review comments
...
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
2025-10-21 13:25:26 +02:00
yoff
715acefacc
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2025-10-21 12:52:59 +02:00
REDMOND\brodes
cc436e897d
Merge branch 'santander-java-crypto-check' of https://github.com/bdrodes/codeql into santander-java-crypto-check
2025-10-20 15:24:40 -04:00
REDMOND\brodes
354effe829
Crypto: Missing hash algorithms for HMAC operations in jca.
2025-10-20 15:24:18 -04:00
Ben Rodes
2b683c210f
Merge branch 'main' into santander-java-crypto-check
2025-10-18 17:56:43 -04:00
REDMOND\brodes
c01c060476
Crypto: more ID renaming to include "examples", fix singleton issues with ql-for-ql, use formatted test for WeakAsymmetricKeyGenSize (add post processing in the qlref), misc expected files updated (test passed locally but on rerun vscode reports failures, known bug with vscode unit tests).
2025-10-17 14:13:53 -04:00
REDMOND\brodes
b4ecb91c83
Crypto: Add missing cipher algorithms to JCA. Update node tests to account for missing cipher algorithms.
2025-10-17 13:38:47 -04:00
REDMOND\brodes
f480d90a68
Crypto: Add missing block mode JCA Models, add block mode unit tests
2025-10-17 13:13:14 -04:00
yoff
3a0a8999d5
java: fix ql alerts
2025-10-17 01:52:23 +02:00
yoff
61a3e9630f
java: rewrite conflict detection
...
- favour unary predicates over binary ones
(the natural "conflicting access" is binary)
- switch to a dual solution to trade recursion through forall for simple existentials.
Co-authored-by: Anders Schack-Mulligen <aschackmull@github.com >
2025-10-17 01:43:04 +02:00
REDMOND\brodes
b9b0037e07
Crypto: Comment todo for observed missing modeled case. Tests for weak and unknown KDF iteration count.
2025-10-16 14:07:45 -04:00
REDMOND\brodes
a64a24d25d
Crypto: Comment in Language.qll
2025-10-16 11:03:49 -04:00
REDMOND\brodes
25599e9b4b
crypto: Update JCA model macs to take into consideration update calls (use prior pattern for signatures). Misc. bug fixes.
2025-10-15 16:25:36 -04:00
REDMOND\brodes
9a6aac1300
Crypto: To get unreferenced parameters as general sources for Java, I've included the caveat that if a function is called, all the calls appear to be in test files.
2025-10-15 14:20:16 -04:00
REDMOND\brodes
ee08385e31
Crytpo: Update JCA keyagreement to type conversion, XDH is a type of ECDH.
2025-10-15 08:06:19 -04:00
github-actions[bot]
6dd07790ac
Post-release preparation for codeql-cli-2.23.3
2025-10-14 11:16:33 +00:00
github-actions[bot]
33542f7d40
Release preparation for version 2.23.3
2025-10-14 09:30:24 +00:00
REDMOND\brodes
76128ed8dc
Crypto: Update InsecureIVorNonce to be a path problem.
2025-10-13 15:29:57 -04:00
REDMOND\brodes
08abdb8c85
Crypto: Adding a "javaConstant" concept to handle config files.
2025-10-13 12:03:41 -04:00
REDMOND\brodes
36673659ad
Crypto: Weak asymmetric key gen size fixes and test.
2025-10-10 14:49:35 -04:00
yoff
5109babd92
java: add qldoc
...
These interfaces were previously in a .ql file.
Also, use the XXAccess variants.
2025-10-09 14:20:28 +02:00
Nicolas Will
fdba3acc4b
Crypto: Fix QL-for-QL alert and auto-format
2025-10-09 13:59:51 +02:00
