intrigus
5aa711a956
Accept test changes.
2021-06-25 17:04:36 +02:00
Anders Schack-Mulligen
a79356e316
Apply suggestions from code review
2021-06-25 16:47:26 +02:00
intrigus
5106aec319
Fix test location.
2021-06-25 16:47:25 +02:00
intrigus
36575bb26f
Move back to experimental.........
2021-06-25 16:47:25 +02:00
intrigus
fe923facc8
Java: Move comments to separate lines.
...
Move comments to separate lines to improve
the rendering in the finished query help.
2021-06-25 16:47:25 +02:00
intrigus-lgtm
f527df73d5
Apply suggestions from code review.
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-06-25 16:47:25 +02:00
intrigus
6bfdf8d148
Java: Fix qhelp errors.
2021-06-25 16:47:24 +02:00
intrigus
dc0b06a735
Java: Factor out SecurityFlag library.
2021-06-25 16:47:24 +02:00
intrigus-lgtm
51fdcf86c8
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-06-25 16:47:24 +02:00
intrigus
6f217d37da
Java: Apply suggestions from review.
2021-06-25 16:47:24 +02:00
intrigus
4a00670b68
Java: Reduce long comment.
2021-06-25 16:47:24 +02:00
intrigus
45cec3df1c
Java: Use this consistently in QL classes.
2021-06-25 16:47:24 +02:00
intrigus
0c1ce74135
Java: Switch from tabs to spaces.
2021-06-25 16:47:24 +02:00
intrigus
281e0859d1
Java: Accept test changes.
2021-06-25 16:47:23 +02:00
intrigus
6413af4fbe
Java: Expand tests.
2021-06-25 16:47:23 +02:00
intrigus
484533c659
Java: Flag "intentionally" unsafe methods in tests.
...
Previously intentionally unsafe methods such as `disableCertificate`
would be ignored by this query. But now they will also be flagged
as it is hard to guess intentions...
Adjust the tests to account for this change.
2021-06-25 16:47:23 +02:00
intrigus
7023793af4
Java: Fix compilation errors in test.
2021-06-25 16:47:23 +02:00
intrigus
6d09db6fd6
Java: Explicitly list custom flow steps.
2021-06-25 16:47:23 +02:00
intrigus
e4775e0fae
Java: Remove "intention-guessing" sanitizer & simplify.
...
This removes the sanitizer part that classified some results as FP
if the results were in methods with certain names, like
`disableVerification()`. I now think that it's a bad idea to filter
based on the method name.
The custom flow steps in `flagFlowStep` are now listed explicitly.
Simplified check whether a method throws an exception.
2021-06-25 16:47:23 +02:00
intrigus
8a7f6b72e9
Java: Apply suggestions for QHelp
2021-06-25 16:47:23 +02:00
intrigus
d37d922e8f
Java: Fix Typos
2021-06-25 16:47:22 +02:00
intrigus-lgtm
030c286902
Java: Use machine-in-the-middle consistently
2021-06-25 16:47:22 +02:00
intrigus-lgtm
f52e438f3e
Java: Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-06-25 16:47:22 +02:00
intrigus
592fd1e8ca
Java: Accept test changes
2021-06-25 16:47:22 +02:00
intrigus
1b96d0ac54
Java: Remove overlapping code
2021-06-25 16:47:22 +02:00
intrigus
87554a78d4
Java: Add insecure trust manager query.
2021-06-25 16:47:22 +02:00
Timo Mueller
b969b9b5e7
Merge branch 'insecureJmxRmiServerEnvironment' of github.com:mogwailabs/codeql into insecureJmxRmiServerEnvironment
2021-06-25 16:11:47 +02:00
Timo Mueller
72ef4983db
Fixed wrong match for symbolic constant
2021-06-25 16:11:37 +02:00
Timo Müller
328b69f46c
Update java/ql/src/experimental/Security/CWE/CWE-665/InsecureRmiJmxEnvironmentConfiguration.ql
2021-06-25 16:10:20 +02:00
Owen Mansel-Chan
bad32716e8
Import Apache Collections models in ExternalFlow
2021-06-25 14:51:09 +01:00
Timo Mueller
5aeeb3a801
Fixed and validated qhelp
2021-06-25 15:37:47 +02:00
Owen Mansel-Chan
044ecc51e5
Manually improve tests #2
2021-06-25 13:51:18 +01:00
Owen Mansel-Chan
2fd4c9f1b9
Manually improve tests
2021-06-25 11:17:11 +01:00
Owen Mansel-Chan
eb469c0811
Duplicate models for old package name
...
The package name was org.apache.commons.collection until release 4.0.
2021-06-25 11:17:09 +01:00
Owen Mansel-Chan
2e670c4050
Manually update automatically generated stubs
2021-06-25 11:17:08 +01:00
Owen Mansel-Chan
acc43fcaca
Add options file
2021-06-25 11:17:07 +01:00
Owen Mansel-Chan
5feee9cc17
Add automatically-generated stubs
2021-06-25 11:17:06 +01:00
Owen Mansel-Chan
7004c87ec0
Manually edit tests so they pass
2021-06-25 11:17:05 +01:00
Owen Mansel-Chan
4388f19ddf
Add automatically-generated tests
2021-06-25 11:17:04 +01:00
Owen Mansel-Chan
224fd343f3
Fix models (addressing PR review comments)
2021-06-25 11:17:03 +01:00
Owen Mansel-Chan
e78d56e7e9
Model MapUtils class and keyvalue package
2021-06-25 11:17:02 +01:00
Owen Mansel-Chan
213f5d6a37
Model and use isEmpty from Apache Collections
2021-06-25 11:17:01 +01:00
Owen Mansel-Chan
492f6ebc7c
Model isNotEmpty from Apache Commons Collections
2021-06-25 11:17:00 +01:00
Anders Schack-Mulligen
2d24387e9e
Merge pull request #6149 from edoardopirovano/fix-java-regression
...
Performance: Fix bad join order in Java dataflow library
2021-06-25 10:42:05 +02:00
Timo Müller
d0478eac95
XML validation and spelling/ordering changes
...
* XML validation and summary changes in qhelp file
;
* Encode entities within <code> snippet
* Updated minor descriptions and examples
* Implemented spelling review
2021-06-25 09:45:46 +02:00
Chris Smowton
2acb4de2cb
Merge pull request #5955 from haby0/java/JShellCodeInjection
...
Java: JShell Injection
2021-06-24 17:03:30 +01:00
Anders Schack-Mulligen
95ad8b55fe
Merge pull request #6107 from aschackmull/dataflow/implicit-reads
...
Dataflow: Add support for implicit reads
2021-06-24 15:38:35 +02:00
Anders Schack-Mulligen
cd0efbe7ce
Dataflow: Sync.
2021-06-24 14:19:17 +02:00
Anders Schack-Mulligen
1c1d11a4a4
DataFlow: Address review comments.
2021-06-24 14:18:45 +02:00
haby0
3cf71c50b8
Mobile stubs
2021-06-24 19:24:38 +08:00
