Owen Mansel-Chan
1a59839f3c
Range library recognises long literals now
2025-11-24 14:10:54 +00:00
Owen Mansel-Chan
ec381e4ec5
Use range analysis and improve tests
2025-11-21 10:31:50 +00:00
aegilops
e904520779
Fixed formatting
2025-11-20 17:34:42 +00:00
Paul Hodgkinson
801cd72965
Merge branch 'main' into java-kotlin-sensitive-logging-substring-barriers
2025-11-20 12:24:22 +00:00
aegilops
1e67907516
Merge commit
2025-11-20 12:22:39 +00:00
aegilops
62ee6d3a33
Made changes requested by reviewers - bounded() for range checking, style and better comments
2025-11-20 11:46:42 +00:00
Anders Schack-Mulligen
fe7be22478
Merge pull request #20761 from aschackmull/java/ssa-shared
...
Java: Replace SSA wrapper classes with shared implementation.
2025-11-18 13:31:50 +01:00
Paul Hodgkinson
7b25e22a37
Merge branch 'main' into java-kotlin-sensitive-logging-substring-barriers
2025-11-17 11:03:39 +00:00
aegilops
fa703e3e60
Test cases for sensitive logging sanitizer
2025-11-14 16:53:46 +00:00
Anders Schack-Mulligen
d6800394fa
Guards: Support disjunctive implications.
2025-11-12 14:14:32 +01:00
Anders Schack-Mulligen
2192d75286
Java: Add test for a known FP.
2025-11-12 14:08:18 +01:00
Anders Schack-Mulligen
109a5eb7e7
Java: Accept qltest changes due to dropped UntrackedDef.
2025-11-12 09:06:21 +01:00
Anders Schack-Mulligen
e059ded133
Java: Accept toString changes in qltest.
2025-11-12 09:06:21 +01:00
Anders Schack-Mulligen
f0bd0346f0
Java: Replace usages of SsaVariable.
2025-11-12 09:06:19 +01:00
Anders Schack-Mulligen
f4b9efcdce
Java: Replace getAUse with getARead.
2025-11-12 09:06:18 +01:00
Anders Schack-Mulligen
35caede859
Java: Replace SsaPhiNode with SsaPhiDefinition.
2025-11-12 09:06:18 +01:00
Anders Schack-Mulligen
06df5c0bd1
Java: Introduce SsaCapturedDefinition and replace uses of getAnUltimateDefinition.
2025-11-12 09:06:17 +01:00
Anders Schack-Mulligen
07e635636c
Java: Replace getAFirstUse with top-level predicate.
2025-11-12 09:06:16 +01:00
Owen Mansel-Chan
7ad570b5f5
Pretty print models in test
...
Otherwise the test output changes when unrelated models are added.
2025-10-29 12:03:32 +00:00
yoff
4461be180a
Merge pull request #19539 from yoff/java/conflicting-access
2025-10-28 20:37:44 +01:00
yoff
406e48b3bb
java: fix aliasing FP
...
reorganise code, adding `LockField`
2025-10-27 14:30:25 +01:00
yoff
531b994819
java: add test for aliasing
...
found by triage
2025-10-27 14:27:32 +01:00
Nicolas Will
d4787520fd
Merge pull request #20690 from bdrodes/weak_symmetric_cipher_bug
...
Crypto: Fix bug in weak symmetric cipher query
2025-10-24 22:38:07 +02:00
Nicolas Will
e7bd435bee
Merge pull request #20696 from bdrodes/bad_mac_decrypt_then_mac
...
Crypto: Adding bad decrypt then mac order query.
2025-10-24 22:07:26 +02:00
REDMOND\brodes
0e624f51d5
Crypto: Adding bad decrypt then mac order query. Fixes to BadMacOrderMacOnEncryptPlaintext as well.
2025-10-24 12:44:28 -04:00
Tom Hvitved
32f21d6d49
Merge pull request #20688 from hvitved/java/request-forgery-matches-sanitizer
...
Java: Treat `x.matches(regexp)` as a sanitizer for request forgery
2025-10-24 14:34:32 +02:00
REDMOND\brodes
ed492c7d5a
Crypto: Fixed bug in WeakSymmetricCipher.qll, forgot to not only filter if !=AES but the algorithm must still be a SymmetriCipher algorithm.
2025-10-24 08:16:22 -04:00
Tom Hvitved
a4eab484ce
Address review comments
2025-10-24 13:32:39 +02:00
Tom Hvitved
7a9cb64e2e
Java: Treat x.matches(regexp) as a sanitizer for request forgery
2025-10-24 09:06:57 +02:00
REDMOND\brodes
08379393b3
Crypto: Fix off by one column issue in unit tests.
2025-10-22 15:50:33 -04:00
REDMOND\brodes
3561d01144
Crytpo: Trying to fix in pipeline test failure, experimentally altering a line to see if this forces the test to pass. The test is off by one column in the piepline
2025-10-22 14:16:12 -04:00
REDMOND\brodes
dd60cf9395
Crypto: Adjust output of bad mac order queries, update associated bad mac order expected results, fix erroneous change to ID for a slicing query, update model to specify elliptic curve type as a property, update associated graph test expected files, update the not_included_in_qls.expected to reflect all queries now under quantum.
2025-10-22 10:29:31 -04:00
REDMOND\brodes
ddeb42cddb
Crypto: Adding false positive to BadMacUse.java, we have no way to avoid this FP currently but should note it exists in the test case.
2025-10-21 11:04:57 -04:00
yoff
9e77e5b046
java: add test with deeper paths
...
also format test files
2025-10-21 14:02:36 +02:00
yoff
f183a7223f
java: add test for notFullyMonitored
2025-10-21 13:40:29 +02:00
yoff
de05bfbce3
java: address review comments
...
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
2025-10-21 13:25:26 +02:00
REDMOND\brodes
cc436e897d
Merge branch 'santander-java-crypto-check' of https://github.com/bdrodes/codeql into santander-java-crypto-check
2025-10-20 15:24:40 -04:00
REDMOND\brodes
354effe829
Crypto: Missing hash algorithms for HMAC operations in jca.
2025-10-20 15:24:18 -04:00
Ben Rodes
2b683c210f
Merge branch 'main' into santander-java-crypto-check
2025-10-18 17:56:43 -04:00
REDMOND\brodes
c01c060476
Crypto: more ID renaming to include "examples", fix singleton issues with ql-for-ql, use formatted test for WeakAsymmetricKeyGenSize (add post processing in the qlref), misc expected files updated (test passed locally but on rerun vscode reports failures, known bug with vscode unit tests).
2025-10-17 14:13:53 -04:00
REDMOND\brodes
540daa6df2
Crypto: weak symmetric cipher tests.
2025-10-17 13:40:15 -04:00
REDMOND\brodes
b06e05362b
Crypto: altering all query IDs in examples to have "examples" in the ID, to make clear the query is not intended for production.
2025-10-17 13:39:50 -04:00
REDMOND\brodes
b4ecb91c83
Crypto: Add missing cipher algorithms to JCA. Update node tests to account for missing cipher algorithms.
2025-10-17 13:38:47 -04:00
REDMOND\brodes
f480d90a68
Crypto: Add missing block mode JCA Models, add block mode unit tests
2025-10-17 13:13:14 -04:00
REDMOND\brodes
e12734162f
Crypto: WeakKDFKeySize tests.
2025-10-17 12:32:24 -04:00
REDMOND\brodes
628bab92fc
Crypto: Modify BadMacOrderMacOnEncryptPlaintext to be a path query that traces through any intermediate encrypt or mac to the final encrypt or mac.
2025-10-17 12:06:34 -04:00
yoff
61a3e9630f
java: rewrite conflict detection
...
- favour unary predicates over binary ones
(the natural "conflicting access" is binary)
- switch to a dual solution to trade recursion through forall for simple existentials.
Co-authored-by: Anders Schack-Mulligen <aschackmull@github.com >
2025-10-17 01:43:04 +02:00
REDMOND\brodes
5923e5cbb0
Crypto: Bad expected files in last push.
2025-10-16 15:45:27 -04:00
REDMOND\brodes
700f34e53a
Crypto: Bad Mac use tests, and fix for BadMacOrderMacOnEncryptPlaintext (barriers were blocking flow through an encrypt to a subsequent mac on the same plaintext)
2025-10-16 15:44:57 -04:00
REDMOND\brodes
b9b0037e07
Crypto: Comment todo for observed missing modeled case. Tests for weak and unknown KDF iteration count.
2025-10-16 14:07:45 -04:00
