Fredrik Dahlgren
a50a92673c
Updated Bouncy Castle signer unit tests
2025-07-04 10:20:02 +02:00
Fredrik Dahlgren
2098a64c2a
Fixed QL for QL recommendation
2025-07-04 10:18:57 +02:00
Fredrik Dahlgren
bcbd29b8e3
Updated unit tests to list graph nodes, edges, and properties
2025-07-02 16:36:53 +02:00
Fredrik Dahlgren
cdb8f91c86
Removed transient output artifact instances
2025-06-27 16:36:38 +02:00
Fredrik Dahlgren
357ae9206a
Updated Bouncy Castle algorithm instances
...
- Signature operations are now handled by a single algorithm instance
- All key generation operations except generic EC key generation
operations are now handled by a single algorithm instance
- Ed25519 and Ed448 key generation have the algorithm set to Ed25519 and
Ed448 respectively
- For generic EC key generation operations the algorithm is given by the
corresponding curve (since these could be used for either ECDSA or ECDH)
2025-06-19 10:27:51 +02:00
Fredrik Dahlgren
1e5bb5ff14
Updated tests to pass with new key generation modeling
2025-06-16 11:34:01 +02:00
Fredrik Dahlgren
80a29f91d3
Fixed QL for QL findings
2025-06-12 17:05:22 +02:00
Fredrik Dahlgren
7969bdf8ae
Added test cases for Bouncy Castle block cipher modes
...
This commit also reorganizes the Bouncy Castle test cases into separate
sub-directories for signature and cipher modes.
2025-06-12 13:44:57 +02:00
Fredrik Dahlgren
f97be14fe7
Fixed argument to block cipher mode method being tagged as input
2025-06-12 13:44:56 +02:00
Fredrik Dahlgren
192bb7f9a9
Added support for block cipher modes
2025-06-12 13:44:56 +02:00
Fredrik Dahlgren
99b4cb1b7d
Fixed QL for QL findings
2025-06-12 13:44:56 +02:00
Fredrik Dahlgren
3840e93445
Added support for HSS
2025-06-12 13:44:55 +02:00
Fredrik Dahlgren
b64fdc0418
Added BouncyCastle license file to stubs
2025-06-12 13:44:55 +02:00
Fredrik Dahlgren
eb89ee1a36
Updated BouncyCastle tests and corresponding stubs
2025-06-12 13:44:55 +02:00
Fredrik Dahlgren
8b06c3284e
Added support for EllipticCurveConsumingAlgorithm
2025-06-12 13:44:54 +02:00
Fredrik Dahlgren
f17bc7e995
Added EllipticCurveConsumingAlgorithmInstance to Model.qll
...
This commit adds EllipticCurveConsumingAlgorithmInstance to the shared
model, allowing us to model and graph elliptic curve algorithms.
2025-06-12 13:44:54 +02:00
Fredrik Dahlgren
4a34a5c176
Created additional stubs for ECDSA
2025-06-12 13:44:54 +02:00
Fredrik Dahlgren
b57bf9ad20
Updated signature operations test query
2025-06-12 13:44:54 +02:00
Fredrik Dahlgren
efd3266b1c
Added signature input nodes to signature verify operation nodes
2025-06-12 13:44:53 +02:00
Fredrik Dahlgren
fca90b3292
Added support for BouncyCast ECDSA
...
This commit adds support for ECDSA. This includes tracking the
instantiated curve parameters using data flow.
It also adds SignatureArtifactInstance and SignatureOperationInstance
types to the shared model.
2025-06-12 13:44:53 +02:00
Fredrik Dahlgren
d7f1c701b2
Added unit tests for BouncyCastle EdDSA signatures and key generators
2025-06-12 13:44:53 +02:00
Fredrik Dahlgren
4aecf8b667
Added stubs for BouncyCastle EdDSA signature algorithms and key generators
2025-06-12 13:44:53 +02:00
Fredrik Dahlgren
9c602f8e38
Updated returned key sizes to be integers
2025-06-12 13:44:53 +02:00
Fredrik Dahlgren
45416d28cb
Refactored algorithm instances
...
This commit also adds associated elliptic curves to the key generation
and key nodes.
2025-06-12 13:44:52 +02:00
Fredrik Dahlgren
d8cdd3c2d1
Added support for BouncyCastle key generation algorithms
...
This commit adds the `KeyGenerationOperationInstance` and
`KeyGenerationAlgorithmInstance` types to the BouncyCastle model.
It also adds data flow support from key pairs to the corresponding
public and private components.
2025-06-12 13:44:52 +02:00
Fredrik Dahlgren
e9c6c3350a
Multiple bug fixes in BouncyCastle signature model
2025-06-12 13:44:52 +02:00
Fredrik Dahlgren
c588d11297
Removed unused getIntermediateUse function
2025-06-12 13:44:52 +02:00
Fredrik Dahlgren
43e5e40823
Added initial support for BouncyCastle signers
2025-06-12 13:44:51 +02:00
Owen Mansel-Chan
538a5af1d1
Merge pull request #19738 from owen-mc/pr/felickz/19530
...
Set CWE-134 from 9.3 to 7.3 CVSS score for memory safe languages (#2 )
2025-06-12 10:27:28 +01:00
Ana Scolari
a07ce30d30
Update java-code-scanning.qls.expected
...
removing line once this query precision is changed to Medium
2025-06-11 15:27:20 -07:00
Chad Bentz
0135cf661f
Attempt to edit swift change notes for CI failure
2025-06-11 21:49:26 +01:00
Ana Scolari
b84f9d6c3c
Update java/ql/src/change-notes/2025-06-10-reduce-precision-for-building-cmdline-with-string-concatenation.md
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2025-06-11 08:55:45 -07:00
Ana Scolari
f915984b01
Update java/ql/src/change-notes/2025-06-10-reduce-precision-for-building-cmdline-with-string-concatenation.md
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-06-11 08:55:34 -07:00
Ana Scolari
510bbac0e4
Create 2025-06-10-reduce-precision-for-building-cmdline-with-string-concatenation.md
2025-06-10 16:17:32 -07:00
Ana Scolari
857b51be58
Update ExecUnescaped.ql - causing FPs with hard coded strings
...
This query is generating False positives with hard coded strings declared within the function - issue reported by customer. We had a discussion on code_scanning channel on 6/5/25 and the team agreed upon reducing its precision to Medium.
2025-06-10 16:06:22 -07:00
github-actions[bot]
21463a9653
Post-release preparation for codeql-cli-2.22.0
2025-06-09 18:50:20 +00:00
github-actions[bot]
88ba02edf8
Release preparation for version 2.22.0
2025-06-09 18:14:51 +00:00
Chad Bentz
371a50e6c4
Merge branch 'main' into cwe-134
2025-06-09 11:22:40 -04:00
Chuan-kai Lin
631502e129
Merge branch 'main' into cklin/rc-3.18-mergeback
2025-06-09 07:19:40 -07:00
Chad Bentz
53a6133e6f
Add change-notes for csharp/java/swift
2025-06-06 12:23:59 -04:00
Chad Bentz
77e49f1f90
Merge branch 'main' into cwe-134
2025-06-06 11:16:10 -04:00
Nicolas Will
5a822462ad
Merge branch 'main' into openssl_keyagreement_instances_and_consumers
2025-06-02 16:54:22 +02:00
REDMOND\brodes
f5d24c5a7b
Crypto: Fix UnknownKeyAgreementType to OthernKeyAgreementType for JCA.
2025-06-02 10:11:53 -04:00
github-actions[bot]
d2c6875eac
Post-release preparation for codeql-cli-2.21.4
2025-05-27 18:16:21 +00:00
github-actions[bot]
bfb91e95e3
Release preparation for version 2.21.4
2025-05-27 17:22:05 +00:00
Anders Schack-Mulligen
62000319fe
Rangeanalysis: Simplify Guards integration.
2025-05-23 13:39:53 +02:00
Anders Schack-Mulligen
1d30103559
SSA: Distinguish between has and controls branch edge.
2025-05-23 09:56:22 +02:00
Owen Mansel-Chan
663c83d8c6
Merge pull request #19556 from owen-mc/java/pr/19512
...
Java: Fix SpringRequestMappingMethod URL Extraction #2
2025-05-22 15:08:31 +01:00
Owen Mansel-Chan
79453cc103
Add test showing correct usage
2025-05-22 14:30:32 +01:00
Owen Mansel-Chan
476ada13db
Improve QLDoc for SpringRequestMappingMethod.getAValue
2025-05-22 14:22:28 +01:00
