Nicolas Will
cf31af77c9
Add Micronaut framework support for Java QL
...
Add CodeQL support for Micronaut: add MaD models for HTTP, HTTP client and multipart (sources, sinks and summary propagation), new framework QLL modules (Controller, WebSocket, Config, Data, Security). Add library tests and query tests exercising request inputs, file uploads, HttpClient sinks (SSRF), header sinks (response-splitting) and redirect sinks (open-redirect), plus expected results and extractor options. Include Micronaut 4.x stubs used by the tests.
2026-02-27 17:17:07 +01:00
Owen Mansel-Chan
cf73d96c9d
Update test results (remove SPURIOUS annotations)
2026-02-16 12:03:02 +00:00
Owen Mansel-Chan
9fc95f5171
Expand log injection sanitizers to annotation regex matches
2026-02-16 12:01:13 +00:00
Owen Mansel-Chan
146fc7a8c0
Add failing log injection test for @Pattern validation
2026-02-16 12:01:07 +00:00
Owen Mansel-Chan
8f8f4c2d52
Fix Matcher.matches edge case
2026-02-14 00:28:37 +00:00
Owen Mansel-Chan
90befa0c00
Add failing test for Matcher.matches() edge case
2026-02-14 00:28:34 +00:00
Owen Mansel-Chan
bfe26c1989
Add @Pattern as RegexExecution => SSRF sanitizer
2026-02-12 16:57:11 +00:00
Owen Mansel-Chan
d0999e3abd
Add failing test for @Pattern validation
2026-02-12 16:57:04 +00:00
Owen Mansel-Chan
a5d9cb179a
Merge pull request #20930 from owen-mc/java/spring-rest-template-request-forgery-sinks
...
Java: add more Spring RestTemplate request forgery sinks
2026-01-15 14:23:15 +00:00
Mauro Baluda
5cef0376a9
Update java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCouchBaseCredentials.java
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2026-01-14 11:50:52 +01:00
Mauro Baluda
9efefa6120
Fix test expectations
2026-01-13 22:46:42 +01:00
Mauro Baluda
d335f039ef
Improve model for CWE-089
2026-01-13 21:48:43 +01:00
Mauro Baluda
89f0e79ea1
Fix SqlTainted test
2026-01-13 13:55:14 +01:00
Mauro Baluda
dda042f7df
rename change notes
2026-01-13 13:07:14 +01:00
Mauro Baluda
15ee88ee24
SQLi test case
2025-12-24 20:30:21 +01:00
Mauro Baluda
b22077c371
Hardcoded credentials in CouchBase
2025-12-22 20:22:20 +01:00
Owen Mansel-Chan
a85d0ea8a3
Make tests pass
2025-12-02 17:08:16 +00:00
Owen Mansel-Chan
8fd8fc07b7
Add failing tests for more regex match methods
2025-12-02 17:06:34 +00:00
Owen Mansel-Chan
969b0cf439
Add SSRF sinks for uriVariables arguments of more methods on Spring RestTemplate
2025-11-27 23:44:35 +00:00
Owen Mansel-Chan
1a59839f3c
Range library recognises long literals now
2025-11-24 14:10:54 +00:00
Owen Mansel-Chan
ec381e4ec5
Use range analysis and improve tests
2025-11-21 10:31:50 +00:00
aegilops
e904520779
Fixed formatting
2025-11-20 17:34:42 +00:00
aegilops
62ee6d3a33
Made changes requested by reviewers - bounded() for range checking, style and better comments
2025-11-20 11:46:42 +00:00
aegilops
fa703e3e60
Test cases for sensitive logging sanitizer
2025-11-14 16:53:46 +00:00
Tom Hvitved
a4eab484ce
Address review comments
2025-10-24 13:32:39 +02:00
Tom Hvitved
7a9cb64e2e
Java: Treat x.matches(regexp) as a sanitizer for request forgery
2025-10-24 09:06:57 +02:00
Joe Farebrother
d8b37d0cde
Review suggestions - update comments and description
2025-10-14 16:03:40 +01:00
Joe Farebrother
9cb593b020
Update tests
2025-10-13 14:51:37 +01:00
Joe Farebrother
c799f93811
Update tests and add inline expectations
2025-10-13 14:51:04 +01:00
Jami
3675e4bb4f
Merge branch 'main' into jcogs33/java/insecure-spring-actuator-config-promotion
2025-08-26 08:02:17 -04:00
Jami Cogswell
c9692a6d10
Java: fix test failures cause by alert msg change
2025-07-19 13:27:09 -04:00
Jami Cogswell
7250265c1f
Java: consider all endpoints except for health and info as sensitive to align with Spring docs
2025-07-18 17:50:18 -04:00
Jami Cogswell
685f68d9d3
Java: support 'management.endpoints.web.expose' property
2025-07-18 17:50:17 -04:00
Jami Cogswell
70d51504a7
Java: rename to align with 'java/spring-boot-exposed-actuators' query
2025-07-18 17:50:12 -04:00
Jami Cogswell
ea35fbbe3b
Java: support version 3.x
2025-07-18 17:50:07 -04:00
Jami Cogswell
0d2a4222fd
Java: add related location to alert message
2025-07-17 19:22:18 -04:00
Jami Cogswell
2bfc4b4ee2
Java: fix test case for version 1.4
...
Need the existence of an ApplicationProperties File, not an ApplicationProperties ConfigPair
2025-07-17 19:22:15 -04:00
Jami Cogswell
3823186dc6
Java: split tests by versions
...
splitting is required to properly test each scenario
2025-07-17 19:22:13 -04:00
Jami Cogswell
ed8da5e151
Java: convert tests to inline expectations
2025-07-17 19:22:08 -04:00
Jami Cogswell
fc930d9184
Java: update tests for non-experimental directory
2025-07-17 19:22:06 -04:00
Jami Cogswell
a39cb40177
Java: copy out of experimental
2025-07-17 19:22:01 -04:00
Nora Dimitrijević
b33058c967
[TEST] Java: SensitiveCommunication: convert to qlref
2025-07-17 18:59:05 +02:00
Nora Dimitrijević
44bb5e7220
[TEST] Java: ConditionalBypass: convert to qlref
2025-07-17 18:59:03 +02:00
Nora Dimitrijević
6134518d60
[TEST] Java: SensitiveLogInfo: convert to qlref
2025-07-17 18:59:01 +02:00
Nora Dimitrijević
94386f0550
[TEST] Java: TrustBoundaryViolations: convert test to qlref
2025-07-17 18:58:59 +02:00
Nora Dimitrijević
49e03b4dfd
[TEST] Java: UnsafeCertTrust: convert test to qlref
2025-07-17 18:58:56 +02:00
Nora Dimitrijević
7aced48443
[TEST] Java: LogInjection: convert test to qlref
2025-07-17 18:58:54 +02:00
Nora Dimitrijević
5c2cf79785
[TEST] Java: CWE-020/ExternalAPI: new test based on qhelp
2025-07-17 18:58:52 +02:00
Owen Mansel-Chan
805e31fdb9
Update test expectations
2025-07-16 15:25:45 +01:00
Owen Mansel-Chan
fdd1e3fefe
Use MaD models for unsafe deserialization sinks when possible
...
Many of the unsafe deserialization sinks have to stay defined in QL
because they have custom logic that cannot be expressed in MaD models.
2025-07-16 14:42:07 +01:00
