Chris Smowton
413ac4e8f4
Merge pull request #6684 from owen-mc/java/model/apache-collections-subpackages
...
Java: model remaining subpackages of Apache Commons Collections
2021-09-28 12:28:48 +01:00
Tony Torralba
cec6cd0830
Merge pull request #6724 from atorralba/atorralba/android-contentprovider-sources
...
Java: Add sources for content providers in Android
2021-09-28 12:13:54 +02:00
Owen Mansel-Chan
bdd78d2bc7
Fix stub
2021-09-27 16:24:41 +01:00
Owen Mansel-Chan
29db42c3cd
Generate stubs
2021-09-27 16:24:40 +01:00
Anders Schack-Mulligen
cfa0d46b73
Merge pull request #6097 from atorralba/atorralba/promote-xslt-injection
...
Java: Promote XSLT Injection from experimental
2021-09-27 13:14:57 +02:00
Tony Torralba
c792567904
Move from experimental
2021-09-27 11:57:53 +02:00
Tony Torralba
569426b04e
Consider subtypes of Expression and ExpressionParser
...
Add parseRaw as additional taint step
2021-09-27 11:38:12 +02:00
Tony Torralba
99881db8bd
Add stubs
2021-09-21 12:10:05 +02:00
Joe Farebrother
3ef09da1df
Add models for more of methods; update stubs
2021-09-17 16:57:49 +01:00
Joe Farebrother
7bf55fbc49
Update stubs to not include package protected members
2021-09-16 15:23:02 +01:00
Joe Farebrother
b51ffadd27
Improve generated tests
2021-09-16 15:23:01 +01:00
Joe Farebrother
6ae11b5b2c
Generate stubs.
...
Some generated stubs were manually adjusted due to minor issues in the stub generator.
In particular, ambiguous references were resolved and references to private classes were removed.
2021-09-16 15:23:00 +01:00
Chris Smowton
367a53dd71
Add models for android.net.Uri[.Builder]
2021-09-14 16:37:07 +01:00
Chris Smowton
6cff0d0376
Merge pull request #6393 from luchua-bc/java/xss-jsf
...
Java: CWE-079 Query to detect XSS with JavaServer Faces (JSF)
2021-09-14 15:15:56 +01:00
Anders Schack-Mulligen
26eafcb55a
Merge pull request #6456 from smowton/smowton/admin/flexjson-unsafe-deserialization
...
Java: add unsafe-deserialization support for Flexjson
2021-09-14 14:33:22 +02:00
luchua-bc
24addd5c10
Query to detect XSS with JavaServer Faces (JSF)
2021-09-14 11:47:32 +01:00
Chris Smowton
f1c3a11103
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
Chris Smowton
9b488207eb
Add support for the Flexjson framework to the unsafe-deserialization query
2021-09-10 16:27:23 +01:00
Chris Smowton
2d03840fde
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
...
Originally authored by @haby0, squashed to clean up a tangled commit history.
2021-09-10 13:49:31 +01:00
Owen Mansel-Chan
714e126088
Merge pull request #6370 from owen-mc/java/model/apache-collections
...
Java: Model more of Apache Commons Collections
2021-08-19 15:09:06 +01:00
Joe Farebrother
9dc28eb9b5
Merge pull request #6387 from joefarebrother/guava-cache
...
Java: Model guava cache package
2021-08-19 10:53:48 +01:00
Chris Smowton
48818ebd6d
Merge pull request #6434 from smowton/smowton/admin/jodd-unsafe-deserialization
...
Java: Unsafe deserialization: add support for Jodd JSON library
2021-08-18 17:26:02 +01:00
Sauyon Lee
fd0ea15719
Add stubs for Spring web.util tests
2021-08-12 11:20:48 -07:00
Owen Mansel-Chan
51a7018afc
Add stubs
2021-08-06 07:06:16 +01:00
Chris Smowton
0b6c991ac4
Unsafe deserialization: add support for Jodd JSON library
2021-08-05 16:01:14 +01:00
Tony Torralba
0356ed7f9e
Merge pull request #5911 from atorralba/atorralba/promote-missing-jwt-signature-check
...
Java: Promote Missing JWT signature check query from experimental
2021-08-05 09:43:03 +02:00
Anders Schack-Mulligen
1932f604dc
Merge pull request #6419 from smowton/smowton/admin/unsafe-deserialization-jabsorb
...
Add unsafe-deserialization support for Jabsorb
2021-08-05 09:04:23 +02:00
Chris Smowton
69549e9ce3
Add unsafe-deserialization support for Jabsorb
...
This is partly extracted from https://github.com/github/codeql/pull/5954
2021-08-04 15:35:50 +01:00
Anders Schack-Mulligen
6a09a5667d
Merge pull request #5931 from atorralba/atorralba/promote-jndi-injection
...
Java: Promote JNDI Injection query from experimental
2021-08-04 15:48:44 +02:00
Anders Schack-Mulligen
7fb1e1578e
Merge pull request #5894 from atorralba/atorralba/promote-ognl-injection
...
Java: Promote OGNL Injection query from experimental
2021-08-03 15:31:40 +02:00
Anders Schack-Mulligen
c0d76da1a6
Merge pull request #5846 from atorralba/atorralba/promote-unsafe-android-webview-fetch
...
Java: Promote Unsafe resource loading in Android WebView from experimental
2021-08-03 14:24:34 +02:00
Tony Torralba
f5cbec4938
Fix tests affected by Jackson stubs changes
2021-08-03 14:22:55 +02:00
Anders Schack-Mulligen
fb9feabe64
Merge pull request #6062 from atorralba/atorralba/promote-groovy-injection
...
Java: Promote Groovy Code Injection from experimental
2021-08-03 14:19:15 +02:00
Chris Smowton
f83f950be6
Merge pull request #6325 from smowton/smowton/feature/org-json-models
...
Java: add models of JSON-java, aka `org.json`
2021-08-03 10:33:49 +01:00
Tony Torralba
084cda6daa
Merge branch 'main' into atorralba/promote-groovy-injection
2021-08-03 09:53:46 +02:00
Chris Smowton
fad1622730
Merge pull request #5435 from haby0/DynamicallyLoadedClasses
...
Java: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
2021-08-02 16:04:30 +01:00
Tony Torralba
08bdd1aa7a
Merge branch 'main' into atorralba/promote-ognl-injection
2021-08-02 16:05:38 +02:00
Anders Schack-Mulligen
53e6ddfeb6
Merge pull request #6001 from atorralba/atorralba/promote-mvel-injection
...
Java: Promote MVEL injection query from experimental
2021-08-02 14:40:26 +02:00
Tony Torralba
f4b78ef3bd
Fix stubs
2021-08-02 14:12:05 +02:00
Tony Torralba
9b384d84cc
Merge branch 'main' into atorralba/promote-ognl-injection
2021-08-02 14:06:45 +02:00
Tony Torralba
351a24558d
Add tests for JacksonSerializability
...
Upgraded jackson stubs to 2.12
2021-08-02 14:03:30 +02:00
Anders Schack-Mulligen
3b676d432f
Merge pull request #5900 from artem-smotrakov/unsafe-jackson-deserialization
...
Java: Unsafe deserialization with Jackson
2021-08-02 12:45:30 +02:00
Fosstars
a4b0041120
Better looksLikeResolveClassStep() predicate
2021-07-30 09:28:03 +02:00
Joe Farebrother
f1ca29a846
Add more stubs
2021-07-29 15:58:42 +01:00
Joe Farebrother
096509b9aa
Generate tests and stubs
2021-07-29 15:01:50 +01:00
Artem Smotrakov
7fec575df8
Simplify JsonTypeInfo stub
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-07-28 14:23:50 +02:00
haby0
2a50cf8244
Fix
2021-07-22 22:24:09 +08:00
haby0
d8f5f6987b
Fix
2021-07-22 21:53:41 +08:00
haby0
e160352b38
Fix
2021-07-22 21:48:46 +08:00
haby0
4ebf0ed7c5
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
2021-07-22 21:45:29 +08:00
