yoff
1ad239459f
java: move shared code into Concurrency.qll
2025-10-09 13:36:35 +02:00
yoff
f90e9dbb5e
java: favour inline_late over inline
...
This gives much greater control over the join-order
2025-10-09 13:01:25 +02:00
yoff
830f02af1f
java: fixes from the CI bots
2025-10-09 09:37:31 +02:00
yoff
93fc287ef1
java: add auto-generated overlay annotations
2025-10-09 09:25:57 +02:00
yoff
a1671ea8af
java: small cleanups
...
- add missing qldoc
- remove use of `getErasure`
- remove use of `getTypeDescriptor`
- define `ExposedField`
2025-10-09 09:16:25 +02:00
yoff
821b1de5b3
java: inline char pred
2025-10-09 09:16:25 +02:00
yoff
01ddc11fa7
java: address some review comments
2025-10-09 09:16:25 +02:00
yoff
77734f83d5
java: better detection of thread safe fields.
...
Identified by triage of DCA results.
Previously, we did not use the erased type, so would not recgnize `CompletableFuture<R>`.
We now also recognize safe initializers.
2025-10-09 09:16:25 +02:00
yoff
096d5f2a56
java: implement SCC contraction of the call graph
...
Our monitor analysis would be fooled by cycles in the call graph,
since it required all edges on a path to a conflicting access to be either
- targetting a method where the access is monitored (recursively) or
- monitored locally, that is the call is monitored in the calling method
For access to be monitored (first case) all outgoing edges (towards an access) need
to satisfy this property. For a loop, that is too strong, only edges out of the loop
actually need to be protected. This led to FPs.
2025-10-09 09:14:16 +02:00
yoff
fe487e8bf0
java: add ThreadSafe query (P3)
...
Co-authored-by: Raúl Pardo <raul.pardo@protonmail.com >
Co-authored-by: SimonJorgensenMancofi <simon.jorgensen@mancofi.dk >
Co-authored-by: Bjørnar Haugstad Jåtten <bjornjaat@hotmail.com >
2025-10-09 09:14:16 +02:00
REDMOND\brodes
11e81395b5
Crypto: Updated default flows to use taint tracking (this is needed to fix false positives in the unknown IV/Nonce query). Add the unknown IV/Nonce query and associated test cases. Fix unknown IV/Nonce query to focus on cases where the oepration isn't known or the operation subtype is not encrypt or wrap.
2025-10-08 14:14:17 -04:00
REDMOND\brodes
83ff70bcd8
Crypto: Adding tests for insecure iv or nonce. Updating generic literal sources to include array literals.
2025-10-08 12:47:58 -04:00
REDMOND\brodes
bd34b6ce02
Crypto: Removing JCA model of random, need to reassess this as this impacts the insecure IV/Nonce query. Updated name of the Insecure nonce query to be InsecureIVorNonce
2025-10-08 11:41:21 -04:00
REDMOND\brodes
cf88e3f52d
Crypto: Standardize naming where use of "family" and "type" have been used. Prefer 'type'.
2025-10-08 09:54:53 -04:00
Alex Eyers-Taylor
77d4af153d
Java: Make some query libraries local.
2025-10-07 18:24:37 +01:00
Alex Eyers-Taylor
542bdf0792
Java: Use Overlay dataflow in java.
2025-10-07 17:52:12 +01:00
Alex Eyers-Taylor
c49e2ab2da
DataFlow: Add code to do overlay informed dataflow.
2025-10-07 17:52:12 +01:00
Anders Schack-Mulligen
18e33b193e
Merge pull request #20589 from aschackmull/java/array-entrypoint-read-taint
...
Java: Allow taint-read-steps for array sources.
2025-10-07 15:04:03 +02:00
Anders Schack-Mulligen
7dadbc43fb
Java: Add change note.
2025-10-07 13:51:49 +02:00
Anders Schack-Mulligen
11665bea0a
Java: Allow taint-read-steps for array sources.
2025-10-07 10:10:02 +02:00
Ben Rodes
b32a6407b9
Update java/ql/lib/experimental/quantum/JCA.qll
...
Co-authored-by: Nicolas Will <nicolaswill@github.com >
2025-10-06 09:04:19 -04:00
Nicolas Will
579da1dbd6
Fix QL-for-QL alerts
2025-10-06 14:45:45 +02:00
REDMOND\brodes
9fa30a3884
Crypto: Updating algorithm string literals and key generation algorithm literal sources to include signatures.
2025-10-03 18:09:27 -04:00
REDMOND\brodes
9c5765a48c
Crypto: Add missing string constants for signature algorithms.
2025-10-03 17:17:07 -04:00
REDMOND\brodes
f1eb6511a7
Crypto: Add modeling for JCA signatures. Make consistent use of "unknown" or "other" for unrecognized types.
2025-10-03 12:07:37 -04:00
Anders Schack-Mulligen
ca7d56023a
ControlFlow: Rename getAPhiInput to getAnInput.
2025-10-03 15:29:31 +02:00
REDMOND\brodes
a46bd4c4ca
Crypto: JCA random number generation model.
2025-10-02 15:21:28 -04:00
Nicolas Will
4901cdf929
Crypto: Refactor and change casts to super
2025-10-02 18:43:38 +02:00
REDMOND\brodes
9673b81677
Crypto: Update JCA 'wihHmac" raw name to be the entire raw string, not just "Hmac"
2025-10-02 11:49:23 -04:00
REDMOND\brodes
704a06e1fa
Crypto: Update JCA PBKDF2 modeling: 1) add further inheritance structures to make the inheritance decomposition and caveats clearer, and 2) use getConsumer to establish the hash and hmac consumer. Update the Model to expect hash node types specifically for HMAC getHashALgorithmOrUnknown.
2025-10-02 11:45:13 -04:00
REDMOND\brodes
850c1ec12d
Crypto: Fix use of a member where a singleton set literal exists
2025-10-02 09:20:40 -04:00
REDMOND\brodes
b08533b322
Crypto: Fix missing output variable
2025-10-02 09:10:50 -04:00
REDMOND\brodes
c37b7c1389
Merge branch 'signature_model_refactor' of https://github.com/bdrodes/codeql into signature_model_refactor
2025-10-02 09:05:09 -04:00
REDMOND\brodes
38421cec94
Crypto: Missing casing fix for JCA classes
2025-10-02 09:04:23 -04:00
Ben Rodes
d251b3f9f7
Merge branch 'main' into signature_model_refactor
2025-10-02 09:02:34 -04:00
REDMOND\brodes
329a7dee1c
Crypto: Fixing JCA class naming casing for PBKDF2 classes.
2025-10-02 09:02:17 -04:00
REDMOND\brodes
d49efefefa
Crypto: Fix for non-monotonic recursion in JCA
2025-10-01 14:36:26 -04:00
REDMOND\brodes
92dac0341c
Crypto: Adding necessary model interfaces for MacOperationCall in JCA.
2025-10-01 11:13:37 -04:00
Nick Rolfe
9688d84f3e
Merge pull request #20549 from github/post-release-prep/codeql-cli-2.23.2
...
Post-release preparation for codeql-cli-2.23.2
2025-09-30 09:45:22 +01:00
github-actions[bot]
a7a4e43991
Post-release preparation for codeql-cli-2.23.2
2025-09-29 15:10:19 +00:00
Kasper Svendsen
b52fff2f81
Merge pull request #20505 from kaspersv/kaspersv/future-proof-java-discarding2
...
Overlay: Discard Java config and XML base entities in overlay extracted files
2025-09-29 13:01:08 +02:00
github-actions[bot]
d2130a589b
Release preparation for version 2.23.2
2025-09-29 10:28:45 +00:00
Kasper Svendsen
f02da68c55
Overlay: Discard base XML entities in overlay extracted files
2025-09-23 12:27:51 +02:00
Kasper Svendsen
718c0abdb6
Overlay: Discard base config entities in overlay extracted files
2025-09-23 12:27:51 +02:00
Simon Friis Vindum
7d6e2060e5
Adapt all languages to changes in shared library
2025-09-22 14:18:58 +02:00
Kasper Svendsen
97d62950a8
Merge pull request #20484 from kaspersv/kaspersv/future-proof-java-discarding
...
Overlay: Future-proof Java config & XML discard predicates
2025-09-22 08:16:44 +02:00
Alexander Eyers-Taylor
c1c0828082
Merge pull request #20378 from github/alexet/java-regex-local
...
Jave: Use force local to make parsing local after global regex finding.
2025-09-19 13:48:43 +01:00
Alexander Eyers-Taylor
27e2c4d580
Merge pull request #20459 from github/alexet/caller_tc
...
Java: Make a TC overlay caller.
2025-09-19 13:48:34 +01:00
Kasper Svendsen
dbb9a26f78
Overlay: Future-proof Java XML discarding
2025-09-18 11:37:38 +02:00
Kasper Svendsen
3cd737e40d
Overlay: Future-proof Java config discarding
2025-09-18 10:57:22 +02:00
