Kasper Svendsen
e02affd327
Merge pull request #19901 from github/kaspersv/overlay-guards-inline
...
Overlay: Add missing `overlay[caller?]` annotation
2025-06-27 15:13:09 +02:00
Kasper Svendsen
5096ce405f
Overlay: Add missing overlay[caller?] annotation
2025-06-27 10:50:28 +02:00
Nora Dimitrijević
f568d41264
Merge pull request #19888 from d10c/d10c/missing-diff-informed-tests
...
Java, Ruby: add missing .qlref tests
2025-06-27 09:28:41 +02:00
Jonas Jensen
b446fe74c2
Merge pull request #19846 from jbj/diff-informed-CleartextStorageCookie
...
Java: Diff-informed CleartextStorageCookie.ql
2025-06-27 08:45:11 +02:00
Kasper Svendsen
da1b99b921
Merge pull request #19779 from github/kaspersv/overlay-java-annotations
...
Overlay: Add overlay annotations to Java & shared libraries
2025-06-27 08:26:33 +02:00
Nicolas Will
652e7ba15b
Merge branch 'main' into codescanning_fixes_cpp
2025-06-26 14:54:36 +02:00
Nora Dimitrijević
e0b3a2c5f9
Java: convert ArbitraryApkInstallation test to .qlref
2025-06-26 13:22:05 +02:00
Kasper Svendsen
9d2dd782d9
Merge remote-tracking branch 'github/main' into kaspersv/overlay-java-annotations
2025-06-26 13:18:25 +02:00
Tamás Vajk
ae36f94d5e
Merge pull request #19844 from tamasvajk/tamasvajk/threadpoolexecutor
...
Java: Add `java/javautilconcurrentscheduledthreadpoolexecutor` query for zero thread pool size
2025-06-26 12:36:09 +02:00
Anders Schack-Mulligen
321a4afd5c
Merge pull request #19883 from aschackmull/java/fix-assert-cfg
...
Java: Fix assert CFG by properly tagging the false successor.
2025-06-26 11:43:27 +02:00
Tamas Vajk
1bd543a8a2
Improve readability of the ID
2025-06-26 11:36:32 +02:00
Tamás Vajk
1e0dd2a935
Apply suggestion from @michaelnebel
...
Co-authored-by: Michael Nebel <michaelnebel@github.com >
2025-06-26 11:34:43 +02:00
Anders Schack-Mulligen
c091fc585b
Java: Account for AssertionError possibly not being extracted.
2025-06-26 11:03:59 +02:00
Anders Schack-Mulligen
326f2b0498
Java: Accept qltest change showing FP removal.
2025-06-26 11:03:39 +02:00
Anders Schack-Mulligen
f07d9dda39
Guards: Refactor EqualityTest interface.
2025-06-26 10:26:40 +02:00
Anders Schack-Mulligen
1d4c8197ec
Java: Fix assert CFG by properly tagging the false successor.
2025-06-26 10:18:14 +02:00
Jonas Jensen
fc2b18ae8a
Java: Diff-informed CleartextStorageCookie.ql
...
This query shares implementation with several other queries about
cleartext storage, but it's the only one of them that's in the
code-scanning suite. The sharing mechanism remains the same as before,
but now each query has to override `getASelectedLocation` to become
diff-informed.
Two other data-flow configurations are used in this query, but they
can't easily be made diff-informed.
2025-06-26 09:31:11 +02:00
Anders Schack-Mulligen
5ddddaecdc
Java: Add change note.
2025-06-26 07:17:36 +02:00
Anders Schack-Mulligen
4645856f09
Java: document FP
2025-06-26 07:17:36 +02:00
Anders Schack-Mulligen
73810a6d85
Java: Fix perf issue.
2025-06-26 07:17:35 +02:00
Anders Schack-Mulligen
d4c897f8e2
Java: Fix perf issue.
2025-06-26 07:17:35 +02:00
Anders Schack-Mulligen
42b1b12aa1
Java: Fix qltests
2025-06-26 07:17:34 +02:00
Anders Schack-Mulligen
5c0dcd980d
Java: Switch to the shared Guards library.
2025-06-26 07:17:34 +02:00
Anders Schack-Mulligen
cc13193cb6
Java: Replace some references to basicNullGuard.
2025-06-26 07:17:33 +02:00
Anders Schack-Mulligen
0607fefc57
Java: Refactor integerGuard.
2025-06-26 07:17:33 +02:00
Anders Schack-Mulligen
a2778eee75
Java: Refactor clearlyNotNullExpr into a base case that does not rely on SSA.
2025-06-26 07:17:32 +02:00
Anders Schack-Mulligen
22d5dc999a
Shared: Bugfix for unique value implication.
2025-06-26 07:17:32 +02:00
Anders Schack-Mulligen
994c1f6427
Java: Add hasInputFromBlock predicate in BaseSSA.
2025-06-26 07:17:28 +02:00
Anders Schack-Mulligen
a0c849139c
Java: Add guards-logic qltest with inline expectation.
2025-06-26 07:17:28 +02:00
Nicolas Will
98479ff6c3
Crypto: Update queries to use new type names
2025-06-25 20:34:33 +02:00
Nicolas Will
8e6031df14
Crypto: Fix further acronym casing and remove unused field
2025-06-25 20:25:33 +02:00
Nicolas Will
14472bf744
Crypto: Refactor type name mapping and fix QL-for-QL alerts
2025-06-25 20:08:14 +02:00
Nicolas Will
710e08088f
Crypto: Refactor casing and documentation
2025-06-25 15:29:03 +02:00
Nora Dimitrijević
690446149a
Java: add CleartextStorageCookie test
...
Given that it's a non-path-problem dataflow query, the InlineExpectationsTest is not as useful.
2025-06-24 18:12:19 +02:00
Nora Dimitrijević
a49999dd5d
PolynomialReDoS: disable diff-informed support
...
This is because it was failing the diff-informed consistency check, and like other ReDoS queries (Python?) the query tries to be helpful by showing a substring of a regex, which has a `hasLocation(...)` (intensional) but no corresponding `getLocation()` (extensional). Until the location overrides get updated to support `hasLocation`-based locations, it's probably best to turn off diff-informed support.
2025-06-24 16:42:41 +02:00
Nora Dimitrijević
b2cb585bf2
UnsafeDeserialization: add missing getASelectedSinkLocation override
...
This fixes the failing diff-informed consistency check.
2025-06-24 16:42:39 +02:00
Nora Dimitrijević
e213e3fc37
Java: convert ImplicitPendingIntents test to .qlref
2025-06-24 16:42:37 +02:00
Nora Dimitrijević
e0311e26c6
Java: convert ImproperIntentVerification test to .qlref
...
It's a non-path query, so the InlineExpectationsTest postprocessor doesn't do anything.
2025-06-24 16:42:35 +02:00
Nora Dimitrijević
aac4f63e9a
Java: convert RequestForgery test to .qlref
2025-06-24 16:42:32 +02:00
Nora Dimitrijević
7f05b72e10
Java: convert OgnlInjection test to .qlref
2025-06-24 16:42:30 +02:00
Nora Dimitrijević
cadfd0dcaa
Java: convert RsaWithoutOaep test to .qlref
2025-06-24 16:42:28 +02:00
Nora Dimitrijević
b7e47e2cf3
Java: convert PolynomialReDoS and RegexInjection tests to .qlref
...
Leaves ReDoS.ql unmodified since it's not a dataflow query; just moves it to its own directory.
2025-06-24 16:42:26 +02:00
Nora Dimitrijević
f5c7ef6ab4
Java: convert XPathInjection test to .qlref
2025-06-24 16:42:23 +02:00
Nora Dimitrijević
162b1c51a9
Java: convert XXE test to .qlref
2025-06-24 16:42:21 +02:00
Nora Dimitrijević
7f33f57c9b
Java: convert UrlForward test to .qlref
2025-06-24 16:42:19 +02:00
Nora Dimitrijević
bf1a699982
Java: convert CWE-522 tests to .qlref
2025-06-24 16:42:17 +02:00
Nora Dimitrijević
4412335223
Java: convert UnsafeDeserialization test to .qlref
2025-06-24 16:42:14 +02:00
Nora Dimitrijević
c4b0955045
Java: convert WebviewDebuggingEnabled test to .qlref
2025-06-24 16:42:12 +02:00
Nora Dimitrijević
192f45ed2b
Java: convert FragmentInjection test to .qlref
2025-06-24 16:42:10 +02:00
Nora Dimitrijević
2b19cbcd7e
Java: convert UnsafeContentUriResolution test to .qlref
2025-06-24 16:42:08 +02:00
