Chris Smowton
8a78075d3d
Remove redundant method taint flow specifications
2021-08-02 14:30:31 +01:00
Mathias Vorreiter Pedersen
bbbbeda7c3
Merge pull request #6385 from MathiasVP/more-FieldConfiguration-sources
...
C++: Fix missing local flow in AST dataflow
2021-08-02 15:22:07 +02:00
Anders Schack-Mulligen
53e6ddfeb6
Merge pull request #6001 from atorralba/atorralba/promote-mvel-injection
...
Java: Promote MVEL injection query from experimental
2021-08-02 14:40:26 +02:00
Tony Torralba
f4b78ef3bd
Fix stubs
2021-08-02 14:12:05 +02:00
Tony Torralba
9b384d84cc
Merge branch 'main' into atorralba/promote-ognl-injection
2021-08-02 14:06:45 +02:00
Tony Torralba
351a24558d
Add tests for JacksonSerializability
...
Upgraded jackson stubs to 2.12
2021-08-02 14:03:30 +02:00
Tony Torralba
632ae747c7
Fix JacksonModel duplicate row
2021-08-02 12:53:30 +02:00
Anders Schack-Mulligen
3b676d432f
Merge pull request #5900 from artem-smotrakov/unsafe-jackson-deserialization
...
Java: Unsafe deserialization with Jackson
2021-08-02 12:45:30 +02:00
Anders Schack-Mulligen
0a1c754de8
Merge pull request #6395 from github/bmuskalla/fixTypoInVariables
...
Fix typo in variables documentation
2021-08-02 12:30:14 +02:00
Benjamin Muskalla
d678cdc815
Update variables.rst
2021-08-02 12:07:09 +02:00
Pavel Avgustinov
2be9f3e41e
C#: Guard against virtual dispatch branching too much.
...
We have observed databases where dispatch to highly overridden
virtual methots (like Enumerable.GetEnumerator) ends up branching
to many thousands of overrides, if there is not sufficient type
context to prune. This causes performance problems for analyses
that use dataflow.
As an immediate fix, this commit prevents branching to virtual
method overrides if this would result in branching to 1,000 or
more methods.
2021-08-02 09:40:16 +01:00
Tom Hvitved
7a475eb0a2
C#: Fix CSV overrides logic
2021-08-02 10:35:21 +02:00
Tom Hvitved
df29538840
C#: Add test that exhibits bug in CSV overrides logic
2021-08-02 10:35:21 +02:00
Anders Schack-Mulligen
6c973b59ac
Update java/ql/src/semmle/code/java/frameworks/Jackson.qll
2021-08-02 10:16:42 +02:00
Anders Schack-Mulligen
26881ec220
Merge pull request #6389 from github/yo-h-patch-1
...
Java: update `frameworks.rst` with Jackson
2021-08-02 10:07:02 +02:00
Tony Torralba
9fadb26325
Fix qhelp sample
2021-08-02 10:00:59 +02:00
Tony Torralba
4435853c8a
Apply suggestions from code review
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-08-02 09:56:40 +02:00
ihsinme
375a60194b
Update OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.ql
2021-08-01 16:44:54 +03:00
ihsinme
14b4e08ce9
Update OperatorPrecedenceLogicErrorWhenUseBitwiseOrLogicalOperations.expected
2021-08-01 16:43:56 +03:00
ihsinme
36131ee16a
Update test.cpp
2021-08-01 16:43:05 +03:00
ihsinme
098773dd10
Update FindIncorrectlyUsedSwitch.ql
2021-08-01 15:04:30 +03:00
ihsinme
80eb4907c0
Update FindIncorrectlyUsedSwitch.expected
2021-08-01 15:03:30 +03:00
ihsinme
5c71a7c024
Update test.c
2021-08-01 15:02:41 +03:00
Fosstars
bd7e7b1371
Better qldoc for timing attacks
2021-08-01 10:18:37 +02:00
Fosstars
44e52517ad
Removed unsafeMacCheckWithArraysDeepEquals() test
2021-08-01 10:12:38 +02:00
Fosstars
0fc487fb04
Better qhelp for timing attacks
2021-08-01 09:57:14 +02:00
Artem Smotrakov
9b953cf0fc
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-08-01 09:47:07 +02:00
Fosstars
ad54c9d937
Two queries for timing attacks
2021-08-01 09:47:07 +02:00
Artem Smotrakov
e3b6ceade5
Renamed NonConstantTimeCryptoComparison.ql to NonConstantTimeCheckOnSignature.ql
2021-08-01 09:47:06 +02:00
Artem Smotrakov
8b557765b3
Narrow NonConstantTimeCryptoComparison.ql to timing attack on signatures and MACs only
2021-08-01 09:47:06 +02:00
Artem Smotrakov
c359852608
Consider only Cipher.ENCRYPT_MODE in NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:06 +02:00
Artem Smotrakov
1f2a9cdda7
Added taint propagation steps for hashes in NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:06 +02:00
Artem Smotrakov
c96d939cf5
Covered custom fast-fail checks in NonConstantTimeCryptoComparison.ql
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-08-01 09:47:06 +02:00
Artem Smotrakov
6500a1bbbb
More references in NonConstantTimeCryptoComparison.qhelp
2021-08-01 09:47:05 +02:00
Artem Smotrakov
860e8f379e
Better signatures in java/non-constant-time-crypto-comparison
2021-08-01 09:47:05 +02:00
Artem Smotrakov
622c7ee957
Added a change note for new steps for ByteBuffer and InputStream
2021-08-01 09:47:05 +02:00
Artem Smotrakov
1b4ee05b80
Better docs for java/non-constant-time-crypto-comparison
2021-08-01 09:47:05 +02:00
Artem Smotrakov
8c4da16459
More test cases for java/non-constant-time-crypto-comparison
2021-08-01 09:47:04 +02:00
Artem Smotrakov
295fd686ce
Make java/non-constant-time-crypto-comparison a warning
2021-08-01 09:47:04 +02:00
Artem Smotrakov
c977fd09cb
Better constant check in java/non-constant-time-crypto-comparison
2021-08-01 09:47:04 +02:00
Artem Smotrakov
d01dc35011
Less duplicate code in java/non-constant-time-crypto-comparison
2021-08-01 09:47:04 +02:00
Artem Smotrakov
40e513ba52
Added more taint propagation steps for InputStream and ByteBuffer
2021-08-01 09:47:04 +02:00
Artem Smotrakov
a4f3a5a88e
Take into account remote user input in java/non-constant-time-crypto-comparison
2021-08-01 09:47:03 +02:00
Artem Smotrakov
8e6d227dc0
More sinks for java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:03 +02:00
Artem Smotrakov
dfa3b523d0
Renamed files
2021-08-01 09:47:03 +02:00
Artem Smotrakov
75f67959f3
Covered Arrays.deepEquals() in NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:02 +02:00
Artem Smotrakov
5dbcf1d611
Covered Object.deepEquals() in NotConstantTimeCryptoComparison.ql
2021-08-01 09:47:02 +02:00
Artem Smotrakov
5c474f689d
Better comments and descriptions
2021-08-01 09:47:02 +02:00
Artem Smotrakov
f245dc3ac8
Removed hashes from NotConstantTimeCryptoComparison.ql
2021-08-01 09:47:02 +02:00
Artem Smotrakov
8a69b7b3ac
Added NotConstantTimeCryptoComparison.qhelp and examples
2021-08-01 09:47:01 +02:00
