haby0
b76854a384
*)add CWE-652 test case
2021-01-27 10:14:33 +08:00
Henning Makholm
54f00de3e0
Add "tests" fields to test qlpacks
...
This will allow `codeql resolve tests --ignore-dubious-cases`
(and thus the VSCode extension) to recognize all `.ql` files in those
packs as test cases, even if they don't have accompanying `.expected`
files.
CLI versions prior to 2.1.0 will choke on this, but it's almost 10
months since that came out.
2021-01-26 18:15:22 +01:00
Francis Alexander
19872e9aed
More Feedback integration
2021-01-26 17:24:17 +05:30
luchua-bc
fee0b94cd4
Use isRequestGetParamMethod as the source
2021-01-26 04:41:44 +00:00
Joe Farebrother
d69ecde5c1
Java: Add additional flow steps for guava collection methods and more unit tests
2021-01-25 16:37:40 +00:00
Francis Alexander
81e372d078
Formatting changes
2021-01-24 20:44:21 +05:30
Francis Alexander
a64fc2b24e
Java: Queries to detect remote source flow to CORS header
2021-01-24 18:58:39 +05:30
luchua-bc
b9809b071e
Update the query to work with wrapper classes
2021-01-18 19:22:34 +00:00
luchua-bc
048167d39a
Revamp the query to reduce FPs introduced by wrapper calls
2021-01-18 04:23:30 +00:00
Artem Smotrakov
7d2d27394b
Java: Added a source and a taint step for JexlInjectionConfig
...
- Added TaintedSpringRequestBody source
- Added returningTaintedDataFromBean() taint step
- Added tests
2021-01-17 22:28:42 +01:00
Artem Smotrakov
99401f6e84
Java: Query for detecting JEXL injections
2021-01-17 14:19:26 +01:00
intrigus
a4cbd7037b
Java: Add tests for different versions.
...
Adds a test for version 6.24, because that version is not vulnerable.
The other test is for versions < 6.24, because these versions are
vulnerable.
2021-01-15 17:20:57 +01:00
luchua-bc
3af8773dd6
Add more cases
2021-01-15 16:20:31 +00:00
luchua-bc
e5a703e49c
Revamp the query
2021-01-15 04:05:11 +00:00
Anders Schack-Mulligen
29935e1388
Merge pull request #4771 from intrigus-lgtm/split-cwe-295
...
Java: Add unsafe hostname verification query and remove existing overlapping query
2021-01-13 11:31:38 +01:00
luchua-bc
babe744a30
Add SECURITY_PROTOCOL check
2021-01-13 03:49:08 +00:00
intrigus
5b3086a93a
Java: Fix capitalization of JxBrowser
2021-01-12 22:43:41 +01:00
intrigus
4fa8f5eab2
Java: Accept test changes
2021-01-12 15:29:03 +01:00
intrigus
b30872806d
Java: Add tests and test stubs.
2021-01-12 14:49:12 +01:00
luchua-bc
86c04e6971
Detect the scenario of passwords concatenated with a salt to reduce FPs
2021-01-11 16:59:57 +00:00
intrigus
e11304a1ca
Java: Autoformat
2021-01-11 13:42:08 +01:00
intrigus
c88f07dde4
Java: Accept test output
2021-01-11 13:42:07 +01:00
intrigus
33b0ff28d8
Java: Update test
2021-01-11 13:42:07 +01:00
intrigus
70b0703952
Java: Remove overlapping code
2021-01-11 13:42:07 +01:00
intrigus
3da1cb0879
Java: Add unsafe hostname verification query
2021-01-11 13:42:07 +01:00
luchua-bc
39103af718
Remove additional taint step
2021-01-08 13:02:57 +00:00
Anders Schack-Mulligen
e5b4975450
Merge pull request #4675 from luchua-bc/cleartext-storage-shared-prefs
...
Java: Query to detect cleartext storage of sensitive information using Android SharedPreferences
2021-01-08 12:41:34 +01:00
Francis Alexander
435502e070
missing new lines
2021-01-06 23:05:09 +05:30
luchua-bc
ce2db21f15
Query to detect hash without salt
2021-01-06 17:30:04 +00:00
Francis Alexander
1f5a466e46
Playframework test cases & review fixes
2021-01-06 22:57:14 +05:30
luchua-bc
3d26e5b8a4
Update qldoc
2021-01-06 12:41:00 +00:00
luchua-bc
f1763ae354
Use the sensitive info sink
2021-01-06 01:48:19 +00:00
luchua-bc
367ff99909
Change the source to be the request variable
2021-01-05 17:30:19 +00:00
Chris Smowton
e87fd86e63
Merge pull request #4814 from luchua-bc/java/password-in-configuration
...
Java: Password in Java EE configuration files
2021-01-05 11:42:27 +00:00
Jonathan Leitschuh
ba4a562c9a
Update PrintAst.actual with new test output
2021-01-04 23:37:58 -05:00
luchua-bc
195755d687
Revamp the query to be more selective
2021-01-05 00:04:08 +00:00
Jonathan Leitschuh
028e4756bb
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-01-04 10:13:52 -05:00
luchua-bc
c069a5b4c6
Factor private host regex into the networking library and enhance the query
2021-01-04 14:51:32 +00:00
Jonathan Leitschuh
54950c2f42
Add MethodAccessSystemGetProperty predicate
2021-01-01 20:07:45 -05:00
luchua-bc
ffe9d4a310
Sensitive GET Query
2020-12-26 16:51:30 +00:00
luchua-bc
4ec78d04f8
Insecure LDAP authentication
2020-12-21 00:15:15 +00:00
luchua-bc
b44f01a87b
Enhance the check for embedded passwords
2020-12-17 03:47:38 +00:00
luchua-bc
bed8a68d28
Exclude broken algorithms from the list of secure algorithms
2020-12-17 00:41:23 +00:00
luchua-bc
d7facb42d6
Add missing broken crypto algorithms
2020-12-16 04:32:11 +00:00
luchua-bc
d469e9b24e
Format the code and minor text change
2020-12-13 21:15:18 +00:00
luchua-bc
e27ccd0a81
Format the code and update qldoc
2020-12-13 02:33:03 +00:00
luchua-bc
7ba237120b
Password in Java EE configuration files
2020-12-12 05:15:04 +00:00
Joe Farebrother
24dc631a8f
Java: Fix false positive in XXE query
2020-12-08 16:38:42 +00:00
Joe Farebrother
2fd5d26b1b
Add FP as a test case
2020-12-08 16:37:53 +00:00
Anders Schack-Mulligen
0cc324b715
Merge pull request #3839 from luchua-bc/uncaught-servlet-exception
...
Java: Uncaught servlet exception
2020-12-02 15:12:59 +01:00
