MarkLee131
da4a2238bc
Address PR review: add Signature.getInstance sink, HMAC/PBKDF2 whitelist, fix test APIs
...
- Model Signature.getInstance() as CryptoAlgoSpec sink (previously only
Signature constructor was modeled)
- Add HMAC-based algorithms (HMACSHA1/256/384/512, HmacSHA1/256/384/512)
and PBKDF2 to the secure algorithm whitelist
- Fix XDH/X25519/X448 tests to use KeyAgreement.getInstance() instead of
KeyPairGenerator.getInstance() to match their key agreement semantics
- Add test cases for SHA384withECDSA, HMACSHA*, and PBKDF2WithHmacSHA1
from user-reported false positives
- Update change note to document all additions
2026-03-28 16:53:46 +08:00
MarkLee131
a9449cc991
Add EC to secure algorithm whitelist for Java CWE-327 query
2026-03-28 16:48:58 +08:00
Nick Rolfe
361fbba39b
Java: fix comma splice in alert message
2025-03-21 14:23:32 +00:00
Owen Mansel-Chan
883301938b
Merge pull request #18161 from owen-mc/java/weak-crypto-algo-more-informative
...
Java: Make `java/weak-cryptographic-algorithm` give a reason why the algo is insecure
2025-01-13 23:43:04 +00:00
Michael Nebel
0a1d2d0bbb
Java: Update all test util paths to point to the new location.
2024-12-12 13:21:25 +01:00
Owen Mansel-Chan
e6409e159f
Give reason why crypto algorithm is insecure
2024-11-29 11:54:27 +00:00
Jami Cogswell
05b6700607
Java: add SHA384 to list of secure algorithms
2024-11-25 09:27:53 -05:00
Arthur Baars
c2b342f1a0
Merge pull request #18084 from github/aibaars/java-sha3
...
Java: add SHA3 family to list of secure crypto algorithms
2024-11-25 15:07:43 +01:00
Arthur Baars
c6eaed343d
Java: add SHA3 family to list of secure crypto algorithms
2024-11-22 19:03:00 +01:00
Arthur Baars
7f84cf6d72
Add test case
2024-11-22 19:02:11 +01:00
Jami Cogswell
459d16824e
Java: weak crypto: do not report weak hash algorithms
2024-11-03 18:22:06 -05:00
Jami Cogswell
c70d39539e
Java: use post-process provenance pretty-printing in query-tests
2024-07-28 18:12:17 -04:00
Anders Schack-Mulligen
37d78249e7
Java: Update provenance ids.
2024-07-16 11:11:54 +02:00
Jami Cogswell
6b497da15f
Java: fix line number changes in tests
2024-07-11 15:33:09 -04:00
Jami Cogswell
be565288f2
Java: update more test cases due to shifted alert provenance line numbers
2024-06-27 22:08:38 -04:00
Tony Torralba
292395b80e
Update test expectations
2024-06-04 10:35:16 +02:00
Anders Schack-Mulligen
c2f5731e8d
Java: Update expected output (uninteresting).
2024-04-12 09:20:26 +02:00
Anders Schack-Mulligen
e9e445b2ba
Java: Add empty provenance column to expected files.
2024-02-09 11:32:00 +01:00
Ed Minnix
8051cfcef5
Fix tests and fix getStringValue method
2023-12-21 22:48:08 -05:00
Ed Minnix
6455e1893d
Add more test cases
2023-12-21 22:48:08 -05:00
Ed Minnix
8826eaf1a3
Move test case to query tests
2023-12-15 11:09:08 -05:00
Marcono1234
020aa4d94c
Java: Address feedback and fix test failures
2021-09-16 14:10:48 +01:00
Anders Schack-Mulligen
f30dad7705
Dataflow: Update test expected outputs.
2021-09-07 13:02:20 +02:00
Tom Hvitved
6318cc9a71
Java: Update expected test output
2019-09-18 13:36:15 +02:00
Anders Schack-Mulligen
2d620698d8
Java: Adjust qltest expected output.
2019-09-12 11:00:49 +02:00
Anders Schack-Mulligen
deb61d6f29
Java: Update test output.
2018-11-16 13:48:50 +01:00
Pavel Avgustinov
846c9d5860
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
