Ed Minnix
00891fa455
Android Manifest Incomplete provider permissions initial commit
...
Initial work on checking provider elements in Android manifests for
complete permissions.
2022-09-19 10:31:02 -04:00
Marcono1234
e3c1b96830
Java: Fix incorrect annotation handling for SpringControllerRequestMappingGetMethod
2022-09-16 15:49:16 +01:00
Marcono1234
b96061aa7e
Java: Rename Annotation value predicates
2022-09-16 15:49:16 +01:00
Marcono1234
02c8fe9346
Java: Add convenience predicates for AnnotationType
2022-09-16 15:49:16 +01:00
Marcono1234
536f5c7f89
Java: Add Annotation value convenience predicates
2022-09-16 15:49:15 +01:00
github-actions[bot]
67ce442674
Post-release preparation for codeql-cli-2.10.5
2022-09-16 14:23:44 +00:00
Tony Torralba
e140f04881
Merge pull request #10393 from zbazztian/uri-constructor-flow
...
Java: Model taint flow for java.net.URI constructors in tainted path queries
2022-09-16 15:10:40 +02:00
Sebastian Bauersfeld
8c35803749
Add more details to change note.
2022-09-16 16:11:34 +07:00
Anders Schack-Mulligen
726772220c
Merge pull request #10191 from smowton/smowton/admin/java-implicit-this-type-tests
...
Java: Add test regarding the type of an implicit `this` expression
2022-09-16 10:58:48 +02:00
Tony Torralba
fdc8453a59
Introduce TaintedPathAdditionalTaintStep
...
Use separate configurations for tainted path and tainted path local again.
2022-09-16 10:42:15 +02:00
Sebastian Bauersfeld
95478f1af6
Address review comments.
2022-09-16 14:35:30 +07:00
Philip Ginsbach
c2bdb69476
remove upper-case variable name
2022-09-15 16:32:16 +01:00
Chris Smowton
88644b6e76
Add change note
2022-09-15 15:35:52 +01:00
Chris Smowton
5a56bb97fc
deprecated-call query: notice calls to methods of specialised generic classes
2022-09-15 12:49:12 +01:00
Sebastian Bauersfeld
20d78972f5
Address review comments.
2022-09-15 16:44:36 +07:00
Chris Smowton
b926bc9efa
Fix and add test for java/subtle-inherited-call involving inheritence from generic types
2022-09-14 22:17:19 +01:00
Chris Smowton
da04673cb0
Fix query java/internal-representation-exposure regarding generic callees, and add a test
2022-09-14 22:17:19 +01:00
Chris Smowton
c149754c6b
Fix java/iterator-remove-failure to handle calls to specialised generic functions
2022-09-14 22:17:19 +01:00
Chris Smowton
3bdccb38b6
Adapt inner-class-could-be-static query now that specialised methods are callable via an implicit this qualifier.
...
Previously such a call always targeted the unbound method, so we checked for an inherited method that could be a specialisation thereof; now we expect it should be directly inherited.
2022-09-14 22:17:19 +01:00
Anders Schack-Mulligen
d713910714
Merge pull request #10334 from aschackmull/java/uniontypeflow
...
Java: Implement union type flow and replace ad-hoc variable tracking in dispatch
2022-09-14 13:34:28 +02:00
Michael Nebel
c5949fad75
C#/Java: Rename to Typed based summary model generation.
2022-09-14 11:06:23 +02:00
Michael Nebel
2d57b7d56a
Java: Sync files.
2022-09-14 11:06:23 +02:00
Michael Nebel
13a802e260
Java: Sync files and make adjusting changes.
2022-09-14 11:06:23 +02:00
Tony Torralba
ac46a38b9d
Update java/ql/src/Security/CWE/CWE-079/XSS.java
2022-09-13 16:49:20 +02:00
Tony Torralba
2b027709e4
Update XSS qhelp
2022-09-13 16:39:48 +02:00
gx1
1c4488e7c8
Updated vulnerable XSS.java version
2022-09-13 15:58:25 +02:00
Anders Schack-Mulligen
c8b93e0910
Java: Replace uses of deprecated variableTrack.
2022-09-13 13:30:40 +02:00
Sebastian Bauersfeld
f95663cdfb
Java: Added change note.
2022-09-13 11:38:15 +07:00
Edward Minnix III
eadb8a3988
Merge pull request #10106 from egregius313/egregius313/android-backup-allowed
...
Java: Query to detect Android backup allowed
2022-09-12 11:14:03 -04:00
Tony Torralba
dd6257c757
Add security-severity
2022-09-12 11:59:01 +02:00
Edward Minnix III
08a17b355e
allowBackup documentation updates
...
Make error messages and descriptions clearer about application backups not being disabled, rather than focusing on `android:allowBackup` specifically.
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-09 09:30:49 -04:00
Edward Minnix III
83c8e22225
Apply suggestions from documentation review
...
Co-authored-by: Ben Ahmady <32935794+subatoi@users.noreply.github.com >
2022-09-08 15:55:00 -04:00
Tony Torralba
6413de6c20
Add change note
2022-09-08 17:38:26 +02:00
Tony Torralba
fb13e7f307
Docs changes
2022-09-08 17:38:25 +02:00
Tony Torralba
b68e6669b8
Refactor TemplateInjection libraries
2022-09-08 17:38:25 +02:00
github-actions[bot]
a9d80a5a48
Release preparation for version 2.10.5
2022-09-08 11:35:54 +00:00
Ed Minnix
c69a2be976
Moved allowBackup query logic to allowsBackup pred
2022-09-07 12:08:25 -04:00
Edward Minnix III
f6c8144eed
Update java/ql/src/Security/CWE/CWE-312/AllowBackupAttributeEnabled.ql
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-07 09:46:36 -04:00
Edward Minnix III
9ddfcf935b
Update java/ql/src/change-notes/2022-08-18-android-allowbackup-query.md
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-09-07 09:46:16 -04:00
Tony Torralba
cd61bd0606
Move files from experimental
2022-09-07 13:13:40 +02:00
Ed Minnix
dca4cd221a
Documentation cleanup for allowBackup query
2022-09-06 14:35:11 -04:00
Tony Torralba
c0dd9dd5d5
Merge pull request #10249 from atorralba/atorralba/regex-dot-bypass-docs
...
Java: Documentation fixes in the "Permissive dot regex" experimental query
2022-09-06 16:18:35 +02:00
Anders Schack-Mulligen
6ffaa6918a
Apply suggestions from code review
2022-09-06 14:11:48 +02:00
Tony Torralba
b94e0d3e69
Merge pull request #10251 from atorralba/atorralba/implicit-pendingintent-sinks
...
Java: Add new AlarmManager sinks to Use of implicit PendingIntents
2022-09-06 11:31:27 +02:00
Erik Krogh Kristensen
6cee635cb5
Merge pull request #10180 from erik-krogh/fixTags
...
Add missing security tags
2022-09-02 08:04:57 +02:00
Edoardo Pirovano
8f332714f4
Merge pull request #10260 from github/edoardo/3.7-mergeback
...
Merge `rc/3.7` into `main`
2022-09-01 15:44:17 +01:00
Tony Torralba
04c230b128
Docs fixes
2022-09-01 09:57:32 +02:00
Tony Torralba
5d9f366ac5
Add change note
2022-09-01 09:53:46 +02:00
Michael Nebel
1cb6d78d35
Merge pull request #10170 from michaelnebel/java/models-io
...
Java: Update models for commons-io and add negative models.
2022-08-31 11:05:09 +02:00
Tony Torralba
2ec53bf78c
Merge pull request #9873 from luchua-bc/java/permissive-dot-regex
...
Java: CWE-625 Query to detect regex dot bypass
2022-08-31 10:24:18 +02:00
