Anders Schack-Mulligen
57fd397cb3
Merge pull request #7239 from smowton/smowton/fix/useless-comparison-surrogates
...
Range analysis and useless-comparison query: don't treat all unicode surrogates as if they are U+FFFD
2021-11-26 09:00:36 +01:00
Chris Smowton
d3a4dadc7d
Merge pull request #7240 from smowton/smowton/admin/derecognise-xxe-secure-processing
...
Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE
2021-11-25 19:31:06 +00:00
Chris Smowton
36bb84d97f
Copyedit change note
2021-11-25 12:55:55 -05:00
Jonathan Leitschuh
1ddf5fb133
Java: Ratpack HTTP Framework Additional Modeling
...
Adds models for `ratpack.func.Pair`, and `ratpack.exec.Result`.
Improve moels for `ratpack.exec.Promise`.
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com >
2021-11-25 12:55:32 -05:00
Chris Smowton
7ac5791c49
Update charLiterals.expected
2021-11-25 16:13:06 +00:00
Chris Smowton
ce63549425
Apply review comments
2021-11-25 15:20:35 +00:00
Chris Smowton
db39c0b8be
CharacterLiteral.getCodePointValue: fix handling of surrogates
2021-11-25 14:07:21 +00:00
Anders Schack-Mulligen
a06642944f
Merge pull request #7232 from aschackmull/dataflow/perf
...
Data flow: Performance tuning
2021-11-25 15:01:01 +01:00
Chris Smowton
9540beeda9
Update java/ql/test/query-tests/security/CWE-611/DocumentBuilderTests.java
...
Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com >
2021-11-25 12:52:08 +00:00
Chris Smowton
9eb9eb606e
Note that FEATURE_SECURE_PROCESSING isn't a sufficient defence against XXE
2021-11-25 12:22:48 +00:00
Anders Schack-Mulligen
609d6011a2
Merge pull request #7229 from smowton/smowton/admin/document-xxe-sanitisation-policy
...
Document XXE sanitisation policy
2021-11-25 10:55:25 +01:00
Tom Hvitved
6cb00992e8
Data flow: Introduce ConsistencyConfiguration class
2021-11-25 10:01:47 +01:00
haby0
04a3f76a8b
Eliminate false positives of Mybatis Configuration Variable
2021-11-25 15:47:37 +08:00
haby0
d36a7ed10e
add test case
2021-11-25 15:47:32 +08:00
haby0
99c8b291b2
add sink
2021-11-25 15:47:32 +08:00
haby0
b8732859de
Add isSanitizerGuard, verify file path
2021-11-25 15:47:31 +08:00
haby0
31400df0d4
Modify sink and improve SQL injection detection
2021-11-25 15:47:30 +08:00
haby0
69690a2509
Modify sinks
2021-11-25 15:47:30 +08:00
haby0
4438f8c58c
Add MyBatis Mapper Sql Injection
2021-11-25 15:47:29 +08:00
Chris Smowton
3c8f6e3c07
Merge pull request #6717 from luchua-bc/java/thread-resource-abuse
...
Java: CWE-400 - Query to detect uncontrolled thread resource consumption
2021-11-24 18:59:41 +00:00
Anders Schack-Mulligen
7ca3407c86
Dataflow: Sync.
2021-11-24 14:43:00 +01:00
Anders Schack-Mulligen
a7ec0fa900
Dataflow: Remove more disjunction-induced tuple duplication.
2021-11-24 14:39:49 +01:00
Michael Nebel
b9d0a60ce7
C#: Addressed review comments from hvitved
2021-11-24 14:35:52 +01:00
luchua-bc
b0031a0d85
Add local input test case and update qldoc
2021-11-24 13:30:50 +00:00
Anders Schack-Mulligen
4efdcc22a2
Dataflow: Improve barrier handling.
2021-11-24 14:17:05 +01:00
Chris Smowton
c74eac4930
Remove needless casts
2021-11-24 12:18:05 +00:00
Chris Smowton
cec91c4831
Update ThreadResourceAbuse.qhelp
2021-11-24 12:15:48 +00:00
Chris Smowton
5101a8e9f3
Fix qhelp test
2021-11-24 12:12:56 +00:00
Chris Smowton
136ecaf49a
Abbreviate qhelp example
2021-11-24 12:12:22 +00:00
Chris Smowton
120f2045cd
Document XXE sanitisation policy
2021-11-24 12:03:28 +00:00
Michael Nebel
a3ca9ad27d
C#: Sync flow summary implementation files and implement specific parts for ruby and java
2021-11-24 12:09:20 +01:00
Anders Schack-Mulligen
a3b263ee6e
Merge pull request #7181 from bmuskalla/coverageAsDiagnostics
...
Java: Add diagnostic query for framework coverage
2021-11-24 10:57:50 +01:00
luchua-bc
e56737e007
Use value step to optimize the taint step and add a test case for Apache file upload listener
2021-11-23 17:15:28 +00:00
Anders Schack-Mulligen
822890f2bd
Dataflow: Remove disjunction-induced tuple duplication.
2021-11-23 15:05:24 +01:00
Anders Schack-Mulligen
f5f67dd11a
Dataflow: Pull ccc.matchesCall(call) from the recursive loop.
2021-11-23 14:35:33 +01:00
Anders Schack-Mulligen
e711ba9d18
Dataflow: Remove negation materialization.
2021-11-23 11:35:57 +01:00
Benjamin Muskalla
50518b5622
Fix sum of rows
2021-11-23 10:42:24 +01:00
luchua-bc
ed78d39d61
Move duplicate code to the shared library and update qldoc
2021-11-23 03:06:26 +00:00
Anders Schack-Mulligen
344f7bca5b
Merge pull request #7187 from aschackmull/java/dont-clear-in-summary-store
...
Java: Don't clear content in store steps in summaries.
2021-11-19 16:12:37 +01:00
Anders Schack-Mulligen
fc43220864
Java: bugfix
2021-11-19 15:01:29 +01:00
Anders Schack-Mulligen
2b1f34ed9b
Java: Don't clear content in store steps in summaries.
2021-11-19 14:22:28 +01:00
Benjamin Muskalla
cd39d15b40
Simplify diagnostic query
2021-11-19 12:28:24 +01:00
Anders Schack-Mulligen
1f3f7e9ccc
Merge pull request #7169 from erik-krogh/useMatches
...
use matches instead of regexpMatch/prefix/suffix
2021-11-19 11:42:47 +01:00
Benjamin Muskalla
fb9b16325d
Add diagnostic query for framework coverage
2021-11-19 10:30:59 +01:00
luchua-bc
b6a6ed5ba3
Add a recommendation category query for local user input and check Apache file upload
2021-11-19 04:23:19 +00:00
Erik Krogh Kristensen
011fc20963
use matches instead of regexpMatch
2021-11-18 15:41:25 +01:00
Anders Schack-Mulligen
6815a13a00
Merge pull request #6931 from hvitved/dataflow/restrict-derived-summaries
...
Data flow: Restrict derived flow summaries
2021-11-18 15:31:55 +01:00
github-actions[bot]
ecdaeb0c10
Add changed framework coverage reports
2021-11-18 00:09:24 +00:00
Anders Schack-Mulligen
22ebe68b1b
Merge pull request #7132 from aschackmull/java/overrides
...
Java: Fix overrides to not be transitive.
2021-11-17 15:38:11 +01:00
Anders Schack-Mulligen
1645fcf79c
Merge pull request #7088 from aschackmull/java/parameterized-subtyping
...
Java: Improve algorithm for subtyping of parameterized types.
2021-11-17 15:28:28 +01:00
