4119 Commits

Author	SHA1	Message	Date
Anders Schack-Mulligen	4884da363f	Java: Bugfix.	2021-05-25 11:48:35 +02:00
Anders Schack-Mulligen	017bf68906	Dataflow: Fix bad join order.	2021-05-25 11:40:53 +02:00
Artem Smotrakov	1b51dd47ec	Added an example with deserialization filter to UnsafeDeserializationRmi.qhelp	2021-05-23 13:24:42 +02:00
Artem Smotrakov	c837605c85	Added test cases with sanitizers for UnsafeDeserializationRmi.ql	2021-05-23 13:01:22 +02:00
Artem Smotrakov	d2e29fc72c	Renamed RmiUnsafeDeserialization.ql -> UnsafeDeserializationRmi.ql	2021-05-23 10:21:05 +02:00
Artem Smotrakov	2d93eeae33	Covered deserialization filters in RmiUnsafeDeserialization.ql	2021-05-23 10:21:05 +02:00
Artem Smotrakov	e28f919f3d	Look for remote callable method only in RmiUnsafeDeserialization.ql	2021-05-23 10:21:05 +02:00
Artem Smotrakov	0182dfe1c0	Added RmiUnsafeDeserialization.qhelp	2021-05-23 10:21:04 +02:00
Artem Smotrakov	5ffe04d6a5	Updated expected output for RmiUnsafeDeserialization.java test	2021-05-23 10:21:04 +02:00
Artem Smotrakov	3d20330a92	More tests for RmiUnsafeDeserialization	2021-05-23 10:21:04 +02:00
Artem Smotrakov	ec6186a1c5	Draft of tests for RmiUnsafeDeserialization.ql	2021-05-23 10:21:04 +02:00
Artem Smotrakov	efa4b4f414	Cover Registry in RmiUnsafeDeserialization.ql	2021-05-23 10:21:04 +02:00
Artem Smotrakov	8b96ff9601	First draft of RmiUnsafeDeserialization.ql	2021-05-23 10:21:04 +02:00
Tony Torralba	7dbdba28cc	Consider search methods with unsafe SearchControls	2021-05-21 15:21:04 +02:00
Anders Schack-Mulligen	d00618f4f4	Java: Improve performance of virtual dispatch calculation.	2021-05-21 15:04:08 +02:00
Sebastian Bauersfeld	ffcca4d5e9	Add change note.	2021-05-20 20:07:14 +07:00
Sebastian Bauersfeld	28f597440f	Add method invocations of Spring's SavedRequest as a remote sources.	2021-05-20 20:00:14 +07:00
Tony Torralba	2613e58916	Remove duplicated class	2021-05-20 12:49:02 +02:00
Tony Torralba	0589dd7e54	Move Jndi.qll from experimental	2021-05-20 12:30:28 +02:00
Tony Torralba	0c1fe9be4f	Add change note	2021-05-20 12:00:11 +02:00
Tony Torralba	c1e71b60b4	Use InlineExpectationsTest	2021-05-20 12:00:11 +02:00
Tony Torralba	3f0b803796	Refactored to use CSV sink models	2021-05-20 12:00:05 +02:00
Anders Schack-Mulligen	4406b8e339	Dataflow: Sync.	2021-05-19 19:22:36 +02:00
Anders Schack-Mulligen	bb258813a1	Dataflow: Improve performance for dispatch-join in flow-through.	2021-05-19 19:20:57 +02:00
Tony Torralba	1351516e9a	Moved JNDI injection related files from experimental to standard	2021-05-19 11:32:51 +02:00
Tony Torralba	43d4575359	Add createParser as taint preserving callable	2021-05-19 11:20:54 +02:00
Tony Torralba	e58746508d	Merge branch 'main' into atorralba/promote-ognl-injection	2021-05-19 10:41:08 +02:00
luchua-bc	02aa9c6fc7	Optimize the sink and update qldoc	2021-05-18 16:12:23 +00:00
luchua-bc	d4323a4a54	Update qldoc	2021-05-18 16:12:23 +00:00
luchua-bc	9d392263a5	Refactor inconsistent method names	2021-05-18 16:12:23 +00:00
luchua-bc	2fa249a8eb	Update method name and qldoc	2021-05-18 16:12:23 +00:00
luchua-bc	2c1374bdcf	Use inline implementation for ScriptEngineFactory	2021-05-18 16:12:23 +00:00
luchua-bc	0ac8453398	Allow all arguments of methods in ScriptEngineFactory	2021-05-18 16:12:23 +00:00
luchua-bc	e4699f7fa9	Optimize the query	2021-05-18 16:12:22 +00:00
luchua-bc	d664aa6d6a	Include more scenarios and update qldoc	2021-05-18 16:12:22 +00:00
luchua-bc	852bcfb5c7	Refactor the ScriptEngine query and the Rhino code injection query into one	2021-05-18 16:12:22 +00:00
luchua-bc	b0b5338359	Rhino code injection	2021-05-18 16:12:22 +00:00
Chris Smowton	4230869ee2	Merge pull request #5819 from luchua-bc/java/jpython-injection ... Java: CWE-094 Jython code injection	2021-05-18 16:38:40 +01:00
Chris Smowton	71f540a755	Merge pull request #5844 from haby0/SpringRedirects ... [Java] CWE-601 Spring url redirection detect	2021-05-18 16:37:40 +01:00
luchua-bc	2a0721b2ae	Optimize the sink and update method name	2021-05-18 12:18:14 +00:00
haby0	e46de44473	Solve errors caused by private ownership	2021-05-18 19:56:32 +08:00
haby0	caf5f4d605	modified comment	2021-05-18 19:10:03 +08:00
Tony Torralba	34a55e77ef	Add missing subtype test	2021-05-18 09:38:35 +02:00
Anders Schack-Mulligen	9b0e3b1950	Merge pull request #5814 from JLLeitschuh/feat/JLL/jackson_as_taint_step ... [Java] Add taint tracking through Jackson deserialization	2021-05-18 09:31:16 +02:00
haby0	a0cd551bae	Add filtering of String.format	2021-05-18 11:05:10 +08:00
luchua-bc	e652d8771c	Update method name and qldoc	2021-05-17 20:36:15 +00:00
Chris Smowton	ef410b9984	Update java/change-notes/2021-05-14-close-resource-leaks-improvements.md	2021-05-17 19:27:10 +01:00
Tony Torralba	347bd2ebc2	Added change note	2021-05-17 17:51:07 +02:00
Tony Torralba	1815656a02	Use set literals for OGNL packages	2021-05-17 16:56:37 +02:00
Tony Torralba	8d682000b4	Fix QLDocs	2021-05-17 16:53:30 +02:00