haby0
3df23eecb6
Merge remote-tracking branch 'upstream/main' into JsonHijacking
2021-03-24 15:52:01 +08:00
Anders Schack-Mulligen
27408fefe2
Merge pull request #5008 from torque59/cwe-346
...
Java: Queries to detect remote source flow origins to CORS header.
2021-03-23 13:54:00 +01:00
Anders Schack-Mulligen
9a56601dd3
Merge pull request #5164 from luchua-bc/java/insecure-ldap-endpoint
...
Java: CWE-297 Query to detect insecure LDAP endpoint configuration
2021-03-23 13:53:51 +01:00
Anders Schack-Mulligen
1e6b5391d6
Merge pull request #4994 from haby0/main
...
Java: CWE-652: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
2021-03-23 12:05:53 +01:00
Marcono1234
993999f64f
Java: Add test for negative numeric literals
2021-03-22 17:43:34 +01:00
yo-h
b495e1efab
Merge pull request #5411 from aschackmull/java/dataflow-lambda-dispatch
...
Java: Bugfix dispatch to lambda in call context.
2021-03-22 08:25:21 -04:00
haby0
fe046ec71e
Merge remote-tracking branch 'upstream/main' into main
2021-03-22 17:25:37 +08:00
Artem Smotrakov
adb1ed380a
Added tests for Jakarta expression injection
2021-03-21 21:19:39 +03:00
Marcono1234
fa98443bb7
Java: Add value predicates for float and double literals; improve tests
2021-03-21 18:07:55 +01:00
yo-h
0200aedc2e
Java 16: adjust test options
2021-03-21 12:55:25 -04:00
haby0
c516d69b98
Merge remote-tracking branch 'upstream/main' into main
2021-03-17 16:42:48 +08:00
haby0
98204a15a6
Fix the problem
2021-03-17 15:28:04 +08:00
Joe Farebrother
1e3c4d0eb1
Add stubs to fix broken test case
2021-03-16 14:24:49 +00:00
Joe Farebrother
980b2c1f4c
Convert existing Guava models to CSV system
2021-03-16 14:24:49 +00:00
Anders Schack-Mulligen
45c9428668
Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources
...
Java: Add support for Commons-Lang's RandomUtils
2021-03-15 16:21:01 +01:00
Anders Schack-Mulligen
d1f30d9164
Java: Autoformat.
2021-03-15 15:28:04 +01:00
Anders Schack-Mulligen
662e17ff85
Java: Bugfix dispatch to lambda in call context.
2021-03-15 15:09:03 +01:00
Chris Smowton
58d5c2c32d
Abbreviate redundant value-flow / taint-flow tests
2021-03-12 10:53:27 +00:00
luchua-bc
c8b1bc3a89
Enhance the query
2021-03-11 21:41:34 +00:00
luchua-bc
0a35feef76
Exclude CSRF cookies to reduce FPs
2021-03-11 17:28:07 +00:00
Chris Smowton
6508a223c3
Remove useless =y value specification from inline test expectations
2021-03-11 16:22:56 +00:00
Chris Smowton
b5268def16
Add models for CONST_BYTE and CONST_SHORT
2021-03-11 16:22:56 +00:00
Chris Smowton
1c1ca70027
Add models for flow- and taint-preserving functions in Commons ObjectUtils.
...
These should all be value-preserving, but we don't support value-preserving varargs methods yet.
2021-03-11 16:22:54 +00:00
luchua-bc
eeac7e322a
Query to detect insecure configuration of Spring Boot Actuator
2021-03-11 13:46:32 +00:00
Artem Smotrakov
0a5d58ed8a
Cover more configurations in UnsafeSpringExporterInConfigurationClass.ql
2021-03-10 21:15:19 +03:00
Chris Smowton
189b2215c5
Remove useless value from inline test expectations
2021-03-09 15:11:39 +00:00
Chris Smowton
9163893879
Add models for Commons-Lang's RegExUtils class
2021-03-09 15:11:13 +00:00
Joe Farebrother
7a4ce83169
Merge pull request #5310 from joefarebrother/guava-io
...
Java: Add modelling for Guava IO utilities
2021-03-09 11:19:44 +00:00
Artem Smotrakov
a78f2115f2
Split SpringExporterUnsafeDeserialization.ql
2021-03-09 00:06:38 +03:00
Chris Smowton
f9f143d62c
Merge pull request #5347 from Marcono1234/marcono1234/simplify-tests
...
Java: Simplify tests using InlineExpectationsTest
2021-03-08 14:47:28 +00:00
Anders Schack-Mulligen
e63f81171c
Merge pull request #5349 from p0wn4j/fix-nashorn-engine-1
...
Java: Fix NashornScriptEngine detection in ScriptEngine query
2021-03-08 13:23:36 +01:00
Chris Smowton
6cf15f49bb
Replace hasTaintFlow=y with hasTaintFlow everywhere
2021-03-08 11:57:35 +00:00
Marcono1234
b7353f0bb0
Java: Simplify tests using InlineExpectationsTest
2021-03-08 11:49:52 +00:00
Chris Smowton
4a4f4b01a1
Add support for java.util.concurrent.ThreadLocalRandom
2021-03-08 10:59:53 +00:00
Rasmus Lerchedahl Petersen
cc9a938054
InlineExpectationTest: clarify the nedd for an
...
empty `.expected` file
2021-03-08 09:18:47 +01:00
luchua-bc
0ef3eee4ed
Revamp the source and the sink of the query
2021-03-06 22:41:54 +00:00
Artem Smotrakov
82cb4a8d68
Renamed SpringHttpInvokerUnsafeDeserialization.ql
2021-03-06 21:48:35 +01:00
Artem Smotrakov
dcabce679a
Cover beans from XML configs in SpringHttpInvokerUnsafeDeserialization.ql
2021-03-06 21:40:35 +01:00
p0wn4j
6841f5f7c4
Java: Add NashornScriptEngine detection in ScriptEngine query
...
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
2021-03-06 16:19:07 +04:00
luchua-bc
31eaa80f5b
Revamp the source
2021-03-06 00:56:15 +00:00
Anders Schack-Mulligen
cf4f55d9ab
Merge pull request #5223 from smowton/smowton/feature/backward-dataflow-for-modelled-fluent-methods
...
Java: Add backward dataflow edges through modelled function invocations
2021-03-05 15:11:43 +01:00
Chris Smowton
012058a866
Apply review suggestions: use ArgumentNode.argumentOf, and change more uses of ValuePreservingCallable -> ValuePreservingMethod
2021-03-05 13:34:13 +00:00
Chris Smowton
e3cf5c235e
Add support for Commons-Lang's RandomUtils
...
This is realised by somewhat generalising our interfaces for modelling RNGs. We also add tests for randomness-related queries that didn't have any, and addtest cases checking the Apache random-number generators are interchangeable with the stdlib ones.
2021-03-05 12:09:33 +00:00
Chris Smowton
990bdc20b0
Move value-preserving callable class into FlowSteps
2021-03-05 11:55:53 +00:00
Joe Farebrother
3f3640fcbd
Model ByteArrayDataOutput
2021-03-05 11:19:55 +00:00
Joe Farebrother
470a2ca336
Add CopyTo
2021-03-05 11:19:55 +00:00
Joe Farebrother
d30d1a2ab2
Add unit tests and fix issues
2021-03-05 11:19:52 +00:00
Joe Farebrother
c12f8035c4
Add stubs for unit tests
2021-03-05 11:19:25 +00:00
Joe Farebrother
56e611faaa
Switch existing test cases to inline expectations
2021-03-05 11:19:25 +00:00
Anders Schack-Mulligen
0d7f6ced8f
Merge pull request #5334 from Marcono1234/marcono1234/improve-constant-loop-condition
...
Java: Improve constant-loop-condition
2021-03-05 11:36:25 +01:00
