github-actions[bot]
66c51e979e
Release preparation for version 2.23.8
2025-12-08 14:38:23 +00:00
idrissrio
a0e7afde8e
Java: Add change note for Maven compiler flags
2025-12-08 12:14:03 +01:00
github-actions[bot]
085faa2bdb
Post-release preparation for codeql-cli-2.23.7
2025-12-02 16:39:43 +00:00
github-actions[bot]
a045b317ac
Release preparation for version 2.23.7
2025-12-02 15:31:27 +00:00
github-actions[bot]
19a13467e0
Release preparation for version 2.23.7
2025-12-01 16:07:37 +00:00
Owen Mansel-Chan
220fd08428
Improve formatting of tags #2
2025-11-28 03:34:30 +00:00
Felicity Chapman
caf6b950ac
Remove trailing periods from @name metadata in query files
...
Fixed 73 .ql query files where the @name metadata contained an ending period.
This ensures consistency with the CodeQL query metadata style guidelines.
2025-11-26 14:29:51 +00:00
Paul Hodgkinson
801cd72965
Merge branch 'main' into java-kotlin-sensitive-logging-substring-barriers
2025-11-20 12:24:22 +00:00
aegilops
1e67907516
Merge commit
2025-11-20 12:22:39 +00:00
aegilops
62ee6d3a33
Made changes requested by reviewers - bounded() for range checking, style and better comments
2025-11-20 11:46:42 +00:00
Paolo Tranquilli
773b6c04a1
Merge branch 'main' into post-release-prep/codeql-cli-2.23.6
2025-11-18 13:44:21 +01:00
Anders Schack-Mulligen
fe7be22478
Merge pull request #20761 from aschackmull/java/ssa-shared
...
Java: Replace SSA wrapper classes with shared implementation.
2025-11-18 13:31:50 +01:00
github-actions[bot]
5ee45af3aa
Post-release preparation for codeql-cli-2.23.6
2025-11-18 09:53:12 +00:00
github-actions[bot]
18fa6799ce
Release preparation for version 2.23.6
2025-11-17 16:38:07 +00:00
Paul Hodgkinson
7b25e22a37
Merge branch 'main' into java-kotlin-sensitive-logging-substring-barriers
2025-11-17 11:03:39 +00:00
aegilops
528c451007
Added change note, adjusted spacing in comment
2025-11-17 11:02:59 +00:00
Idriss Riouak
d916ebdc24
Java: Address review comments. Improve Change note
...
Co-authored-by: Chris Smowton <smowton@github.com >
2025-11-14 09:53:09 +01:00
idrissrio
e6d4e515b0
Java: Add change note for Maven Java version auto-detection
2025-11-13 09:41:32 +01:00
Anders Schack-Mulligen
f4b9efcdce
Java: Replace getAUse with getARead.
2025-11-12 09:06:18 +01:00
Anders Schack-Mulligen
06df5c0bd1
Java: Introduce SsaCapturedDefinition and replace uses of getAnUltimateDefinition.
2025-11-12 09:06:17 +01:00
Anders Schack-Mulligen
483b2d89a7
Java: Replace uses of SsaExplicitUpdate.
2025-11-12 09:06:16 +01:00
Anders Schack-Mulligen
07e635636c
Java: Replace getAFirstUse with top-level predicate.
2025-11-12 09:06:16 +01:00
Napalys Klicius
d122534398
Merge pull request #20671 from github/napalys/adjust_query_severity
...
Adjust query severity ratings
2025-11-11 12:37:31 +01:00
github-actions[bot]
4014df9a6e
Post-release preparation for codeql-cli-2.23.4
2025-11-04 17:57:52 +00:00
github-actions[bot]
64fcdd1f2f
Release preparation for version 2.23.4
2025-11-03 14:52:23 +00:00
yoff
4461be180a
Merge pull request #19539 from yoff/java/conflicting-access
2025-10-28 20:37:44 +01:00
Anders Schack-Mulligen
02a942554d
Java: Remove old SSA consistency queries.
2025-10-27 12:55:43 +01:00
yoff
83508ba661
java: adjust qhelp and examples for SafePublication
2025-10-27 11:25:51 +01:00
Nicolas Will
d4787520fd
Merge pull request #20690 from bdrodes/weak_symmetric_cipher_bug
...
Crypto: Fix bug in weak symmetric cipher query
2025-10-24 22:38:07 +02:00
Nicolas Will
e7bd435bee
Merge pull request #20696 from bdrodes/bad_mac_decrypt_then_mac
...
Crypto: Adding bad decrypt then mac order query.
2025-10-24 22:07:26 +02:00
REDMOND\brodes
65d0ca9e53
Crypto: Simplifying expression for ql-for-ql alert.
2025-10-24 14:08:25 -04:00
REDMOND\brodes
0394816756
Crypto: typo fix
2025-10-24 14:06:52 -04:00
REDMOND\brodes
b20689fa46
Crypto: removing comments
2025-10-24 14:06:08 -04:00
REDMOND\brodes
0e624f51d5
Crypto: Adding bad decrypt then mac order query. Fixes to BadMacOrderMacOnEncryptPlaintext as well.
2025-10-24 12:44:28 -04:00
Tom Hvitved
32f21d6d49
Merge pull request #20688 from hvitved/java/request-forgery-matches-sanitizer
...
Java: Treat `x.matches(regexp)` as a sanitizer for request forgery
2025-10-24 14:34:32 +02:00
REDMOND\brodes
ed492c7d5a
Crypto: Fixed bug in WeakSymmetricCipher.qll, forgot to not only filter if !=AES but the algorithm must still be a SymmetriCipher algorithm.
2025-10-24 08:16:22 -04:00
Tom Hvitved
ce379161fc
Add change note
2025-10-24 09:34:11 +02:00
REDMOND\brodes
dd60cf9395
Crypto: Adjust output of bad mac order queries, update associated bad mac order expected results, fix erroneous change to ID for a slicing query, update model to specify elliptic curve type as a property, update associated graph test expected files, update the not_included_in_qls.expected to reflect all queries now under quantum.
2025-10-22 10:29:31 -04:00
Napalys Klicius
9c70ae04fb
Add change note
2025-10-22 11:48:16 +00:00
Napalys Klicius
91b0aaa631
Java: Lower security-severity for Insecure Cookie query to 4.0
2025-10-22 11:45:04 +00:00
Napalys Klicius
fa47174013
CWE-020: Lower security-severity for OverlyLargeRange queries to 4.0
2025-10-22 11:32:33 +00:00
REDMOND\brodes
c50175bc9b
Crypto: ql-for-ql alert fixes.
2025-10-21 10:32:00 -04:00
yoff
de05bfbce3
java: address review comments
...
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
2025-10-21 13:25:26 +02:00
yoff
715acefacc
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2025-10-21 12:52:59 +02:00
REDMOND\brodes
22c0f9fa91
Crypto: Adding a proof of concept bad mac ordering predicate that takes in an ArtifactNode to be used for graph generation to intercept nodes with known mac ordering issues, in order to format the node and output error messages in the graph.
2025-10-20 16:24:31 -04:00
REDMOND\brodes
eff94ef91f
Crypto: To allow for graph generation to have properties informed by assessments, altering a few queries weak/vuln/bad crypto to have qll files that can be accessed for other purposes, like graph generation. Also altering weak symmetric cipher to look for non-aes algorithms to be more comprehensive.
2025-10-20 15:51:07 -04:00
Ben Rodes
2b683c210f
Merge branch 'main' into santander-java-crypto-check
2025-10-18 17:56:43 -04:00
REDMOND\brodes
c01c060476
Crypto: more ID renaming to include "examples", fix singleton issues with ql-for-ql, use formatted test for WeakAsymmetricKeyGenSize (add post processing in the qlref), misc expected files updated (test passed locally but on rerun vscode reports failures, known bug with vscode unit tests).
2025-10-17 14:13:53 -04:00
REDMOND\brodes
b06e05362b
Crypto: altering all query IDs in examples to have "examples" in the ID, to make clear the query is not intended for production.
2025-10-17 13:39:50 -04:00
REDMOND\brodes
1b205d8673
Removing WeakRSA, this is redundant with weak asymmetric key size.
2025-10-17 13:39:05 -04:00
