Anders Schack-Mulligen
fbe79e8a52
Java: Add AnnotatedExitNodes to the CFG.
2025-07-17 11:21:26 +02:00
Owen Mansel-Chan
7d4a70cc1d
Add change notes
2025-07-16 14:44:24 +01:00
Owen Mansel-Chan
fdd1e3fefe
Use MaD models for unsafe deserialization sinks when possible
...
Many of the unsafe deserialization sinks have to stay defined in QL
because they have custom logic that cannot be expressed in MaD models.
2025-07-16 14:42:07 +01:00
Kasper Svendsen
10a678dcbd
Java lib qlpack: Enable overlay compilation
2025-07-15 16:23:40 +02:00
Kasper Svendsen
9c3e275e66
Merge pull request #20011 from kaspersv/kaspersv/discard-xml
...
Overlay: Add XML and Java property discarding
2025-07-15 16:13:38 +02:00
Kasper Svendsen
f84a3084f0
Address review comment about ignored QL variable
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2025-07-15 15:34:08 +02:00
Nick Rolfe
c199d0cbbe
Java: use overlayChangedFiles in discard prediactes
2025-07-15 10:10:32 +01:00
Owen Mansel-Chan
03e8865933
Merge pull request #20025 from owen-mc/java/unsafe-deserialization
...
Java: add extra sink for `java/unsafe-deserialization`
2025-07-11 23:59:22 +01:00
Owen Mansel-Chan
7764fbb664
Change note
2025-07-11 11:05:48 +01:00
Owen Mansel-Chan
8e4bd1a102
Add sink for ObjectInput.readObject to make test pass
2025-07-11 11:05:38 +01:00
Owen Mansel-Chan
006d77ffdd
Refactor QL to make type check more concise
2025-07-11 06:13:01 +01:00
Kasper Svendsen
0739c03d03
Overlay: Add discarding of base XML locatables for Java
2025-07-10 12:31:16 +02:00
Kasper Svendsen
d7094a96b5
Overlay: Add discarding of all Java base properties
2025-07-10 12:31:15 +02:00
Jonas Jensen
5a1246a586
Merge remote-tracking branch 'upstream/main' into approximate-related-location
2025-07-09 10:10:20 +02:00
github-actions[bot]
24a0ac1223
Post-release preparation for codeql-cli-2.22.2
2025-07-07 18:15:04 +00:00
github-actions[bot]
f12daefabe
Release preparation for version 2.22.2
2025-07-07 14:00:26 +00:00
Arthur Baars
84e5f2846b
Merge branch 'main' into nickrolfe/overlay-deleted-files
2025-07-04 16:19:59 +02:00
Kasper Svendsen
785e0273f2
Merge pull request #19968 from kaspersv/kaspersv/overlay-java-getastrictancestor-caller
...
Overlay: Mark `RefType.getAStrictAncestor`` overlay[caller?]`
2025-07-04 09:38:02 +02:00
Nick Rolfe
a02aabe797
Java: add upgrade scripts for overlayChangedFiles dbscheme addition
2025-07-03 12:44:12 +01:00
Nick Rolfe
72b4e67477
Java/Ruby/Rust/QL: add overlayChangedFiles relation to dbscheme
2025-07-03 12:44:09 +01:00
Kasper Svendsen
dd8af3baf7
Overlay: Mark RefType.getAStrictAncestor overlay[caller?]
2025-07-03 12:23:20 +02:00
Kasper Svendsen
649091c0ed
Fix java/local-temp-file-or-directory-information-disclosure overlay compilation regression
2025-07-03 10:47:33 +02:00
Asger F
4a2d795076
Shared: Make approximate location filtering the default behaviour
2025-07-02 14:41:02 +02:00
Asger F
82d190f4bf
Java: use approximate related sink locations in polynomial redos
2025-07-02 14:40:56 +02:00
Kasper Svendsen
3d7343273e
Merge pull request #19813 from github/kaspersv/overlay-java-discarding
...
Overlay: Add manual Java overlay annotations & discard predicates
2025-06-30 11:17:31 +02:00
Kasper Svendsen
c7194a4012
Overlay: Add missing QLDoc
2025-06-30 08:40:46 +02:00
Nicolas Will
38fdf7eea0
Merge pull request #19880 from bdrodes/operation_step_refactor
...
Crypto: Refactor OpenSSL operation step data-flow logic
2025-06-27 17:19:11 +02:00
Kasper Svendsen
e02affd327
Merge pull request #19901 from github/kaspersv/overlay-guards-inline
...
Overlay: Add missing `overlay[caller?]` annotation
2025-06-27 15:13:09 +02:00
Nicolas Will
976364fcaa
Merge branch 'main' into operation_step_refactor
2025-06-27 12:05:14 +02:00
Kasper Svendsen
5096ce405f
Overlay: Add missing overlay[caller?] annotation
2025-06-27 10:50:28 +02:00
Jonas Jensen
b446fe74c2
Merge pull request #19846 from jbj/diff-informed-CleartextStorageCookie
...
Java: Diff-informed CleartextStorageCookie.ql
2025-06-27 08:45:11 +02:00
Kasper Svendsen
e6ef6a3326
Merge branch 'main' into kaspersv/overlay-java-discarding
2025-06-27 08:28:34 +02:00
Kasper Svendsen
da1b99b921
Merge pull request #19779 from github/kaspersv/overlay-java-annotations
...
Overlay: Add overlay annotations to Java & shared libraries
2025-06-27 08:26:33 +02:00
REDMOND\brodes
0aee4f76f9
Crypto: Minor change to force CI/CD checks to restart, prior ql check failures do not make sense.
2025-06-26 16:35:01 -04:00
REDMOND\brodes
dc8d22a468
Crypto: Fix JCA to account for new key gen instance API in model.qll.
2025-06-26 15:48:10 -04:00
Nicolas Will
c54e68c855
Merge branch 'main' into pr/19880
2025-06-26 16:47:38 +02:00
Nicolas Will
652e7ba15b
Merge branch 'main' into codescanning_fixes_cpp
2025-06-26 14:54:36 +02:00
Kasper Svendsen
9d2dd782d9
Merge remote-tracking branch 'github/main' into kaspersv/overlay-java-annotations
2025-06-26 13:18:25 +02:00
Anders Schack-Mulligen
321a4afd5c
Merge pull request #19883 from aschackmull/java/fix-assert-cfg
...
Java: Fix assert CFG by properly tagging the false successor.
2025-06-26 11:43:27 +02:00
Kasper Svendsen
64f27e2adf
Java: Add abstraction for discardable locatables
2025-06-26 11:35:37 +02:00
Anders Schack-Mulligen
c091fc585b
Java: Account for AssertionError possibly not being extracted.
2025-06-26 11:03:59 +02:00
Anders Schack-Mulligen
f07d9dda39
Guards: Refactor EqualityTest interface.
2025-06-26 10:26:40 +02:00
Anders Schack-Mulligen
1d4c8197ec
Java: Fix assert CFG by properly tagging the false successor.
2025-06-26 10:18:14 +02:00
Jonas Jensen
fc2b18ae8a
Java: Diff-informed CleartextStorageCookie.ql
...
This query shares implementation with several other queries about
cleartext storage, but it's the only one of them that's in the
code-scanning suite. The sharing mechanism remains the same as before,
but now each query has to override `getASelectedLocation` to become
diff-informed.
Two other data-flow configurations are used in this query, but they
can't easily be made diff-informed.
2025-06-26 09:31:11 +02:00
Anders Schack-Mulligen
73810a6d85
Java: Fix perf issue.
2025-06-26 07:17:35 +02:00
Anders Schack-Mulligen
d4c897f8e2
Java: Fix perf issue.
2025-06-26 07:17:35 +02:00
Anders Schack-Mulligen
5c0dcd980d
Java: Switch to the shared Guards library.
2025-06-26 07:17:34 +02:00
Anders Schack-Mulligen
cc13193cb6
Java: Replace some references to basicNullGuard.
2025-06-26 07:17:33 +02:00
Anders Schack-Mulligen
0607fefc57
Java: Refactor integerGuard.
2025-06-26 07:17:33 +02:00
Anders Schack-Mulligen
a2778eee75
Java: Refactor clearlyNotNullExpr into a base case that does not rely on SSA.
2025-06-26 07:17:32 +02:00
