hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-17 17:23:36 +01:00
Code Issues Packages Projects Releases Wiki Activity
21,517 Commits 1,671 Branches 157 Tags
sauyon/java-spring-stringutils
Commit Graph

1740 Commits

Author SHA1 Message Date
Tamas Vajk
5cdbde2686 Java: migrate 'qualifier to return' taint steps to CSV 2021-03-16 12:10:28 +01:00
Tamas Vajk
40126563ef Java: migrate 'qualifier to arg' taint steps to CSV 2021-03-16 12:10:28 +01:00
Anders Schack-Mulligen
2d8d967060 Dataflow: Address review comment. 2021-03-16 11:07:33 +01:00
Chris Smowton
6d108c0fa7 Improve docstring for composedValueAndTaintModelStep 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2021-03-16 09:00:35 +00:00
Chris Smowton
915a19fb9d Improve naming; eliminate some harmless extra results 
Adding `src != valueSource` should have no effect as the introduced edge would already exist, but could reduce workload downstream.
 2021-03-16 08:57:14 +00:00
Chris Smowton
516122aa74 Add taint-preserving edges where a call also has a value-preserving edge 
For example, for a fluent method that returns `this`, we take a tainting edge from argX to either `this` or the return value to also taint the other.
 2021-03-16 08:45:24 +00:00
Anders Schack-Mulligen
45c9428668 Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources 
Java: Add support for Commons-Lang's RandomUtils
 2021-03-15 16:21:01 +01:00
Anders Schack-Mulligen
662e17ff85 Java: Bugfix dispatch to lambda in call context. 2021-03-15 15:09:03 +01:00
Anders Schack-Mulligen
5aa9c2bd19 Dataflow: One more pragma. 2021-03-12 15:59:19 +01:00
Chris Smowton
92d61354d4 Remove abstract class RandomNumberGenerator 2021-03-12 13:04:31 +00:00
Anders Schack-Mulligen
a8b84e430f Merge pull request #5390 from Marcono1234/patch-2 
Java: Fix documentation mistake in Modules.qll
 2021-03-12 12:51:24 +01:00
Anders Schack-Mulligen
c9786df760 Merge pull request #5344 from smowton/smowton/feature/commons-object-utils 
Java: Add models for flow- and taint-preserving functions in Commons ObjectUtils
 2021-03-12 12:46:31 +01:00
Anders Schack-Mulligen
1d3ad0cb52 Java: Remove value steps from taint steps. 2021-03-12 11:09:53 +01:00
Marcono1234
edeb08480e Java: Fix documentation mistake in Modules.qll 2021-03-11 23:45:59 +01:00
luchua-bc
57953c523c Update qldoc 2021-03-11 17:16:36 +00:00
Chris Smowton
b5268def16 Add models for CONST_BYTE and CONST_SHORT 2021-03-11 16:22:56 +00:00
Chris Smowton
1c1ca70027 Add models for flow- and taint-preserving functions in Commons ObjectUtils. 
These should all be value-preserving, but we don't support value-preserving varargs methods yet.
 2021-03-11 16:22:54 +00:00
Artem Smotrakov
4b7c57c077 Added a comment for getBeanIdentifier() 
Co-authored-by: Chris Smowton <smowton@github.com>
 2021-03-11 11:52:07 +01:00
Anders Schack-Mulligen
87e4dec86a Merge pull request #5300 from tamasvajk/feature/external-remote-flow-sources 
Java: Convert remote flow sources to use new CSV format
 2021-03-11 10:44:17 +01:00
Artem Smotrakov
0a5d58ed8a Cover more configurations in UnsafeSpringExporterInConfigurationClass.ql 2021-03-10 21:15:19 +03:00
Anders Schack-Mulligen
674886a17d Dataflow: Sync. 2021-03-10 16:53:51 +01:00
Anders Schack-Mulligen
667dab28d4 Dataflow: Switch from unbind to pragma[only_bind_into]. 2021-03-10 16:52:45 +01:00
Tom Hvitved
fc5158c41c Merge pull request #5338 from hvitved/dataflow/performance-tweaks 
Data flow: Performance tweaks
 2021-03-10 13:56:57 +01:00
Anders Schack-Mulligen
4941d9b7bf Java: Add query for CSV framework coverage. 2021-03-10 12:03:44 +01:00
Chris Smowton
410f21cd55 Fix comment describing two-arg nextInt/nextLong 
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>
 2021-03-10 08:43:37 +00:00
Artem Smotrakov
df60268023 Split qhelp files 2021-03-10 10:49:47 +03:00
Chris Smowton
fa51af5be1 NBSP -> original-flavour space 2021-03-09 15:40:45 +00:00
Chris Smowton
9163893879 Add models for Commons-Lang's RegExUtils class 2021-03-09 15:11:13 +00:00
Tom Hvitved
fe6efde449 Address review comments 2021-03-09 14:30:12 +01:00
Tamas Vajk
5480a31b68 Java: Remove MultipartFile.getSize/isEmpty from remote flow sources 2021-03-09 12:23:47 +01:00
Tamas Vajk
0d405c293a Java: Convert PlayRequestGetMethod to CSV based flow source 2021-03-09 12:20:35 +01:00
Joe Farebrother
7a4ce83169 Merge pull request #5310 from joefarebrother/guava-io 
Java: Add modelling for Guava IO utilities
 2021-03-09 11:19:44 +00:00
Joe Farebrother
bd4a414abd Remove CSV data from query 
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2021-03-09 10:50:15 +00:00
Tamas Vajk
e0b1a86038 Java: Convert WebSocketMessageParameterSource to CSV based flow source 2021-03-09 11:49:59 +01:00
Tamas Vajk
193458eb3d Java: Convert SpringRestTemplateResponseEntityMethod to CSV based flow source 2021-03-09 11:49:59 +01:00
Tamas Vajk
e0c51b510f Java: Convert WebViewGetUrlMethod to CSV based flow source 2021-03-09 11:42:40 +01:00
Tamas Vajk
8ba820cae1 Java: Convert android XML get* methods to CSV based flow source 2021-03-09 11:42:13 +01:00
Tamas Vajk
09b0d824b4 Java: Convert org.apache.http.Http*.get* methods to CSV based flow source 2021-03-09 11:41:33 +01:00
Tamas Vajk
3c8ac5c789 Java: Convert Cookie.get* methods to CSV based flow source 2021-03-09 11:41:33 +01:00
Tamas Vajk
86cf143029 Java: Convert ServletRequestGetBodyMethod to CSV based flow source 2021-03-09 11:41:32 +01:00
Tamas Vajk
b05a9043b5 Java: Convert SpringWebRequestGetMethod to CSV based flow source 2021-03-09 11:41:32 +01:00
Tamas Vajk
09bcf878f7 Java: Convert HttpServletRequest.get* methods to CSV based flow source 2021-03-09 11:40:59 +01:00
Tamas Vajk
f2448cc921 Java: Convert SpringMultipartFileSource to CSV based flow source 2021-03-09 11:40:18 +01:00
Tamas Vajk
80b4d63d4b Java: Convert SpringMultipartRequestSource to CSV based flow source 2021-03-09 11:39:47 +01:00
Tamas Vajk
06fdd64dab Java: Remove already modelled BeanValidationSource 2021-03-09 11:35:42 +01:00
Tamas Vajk
3dfc236bbe Java: Remove already modelled RemoteTaintedMethods 2021-03-09 11:35:42 +01:00
Artem Smotrakov
a78f2115f2 Split SpringExporterUnsafeDeserialization.ql 2021-03-09 00:06:38 +03:00
Joe Farebrother
ed228cbcef Add sinks for URL Open Stream query 2021-03-08 14:07:53 +00:00
Chris Smowton
790fb7829a Improve comment and change-note accuracy 2021-03-08 11:00:05 +00:00
Chris Smowton
4a4f4b01a1 Add support for java.util.concurrent.ThreadLocalRandom 2021-03-08 10:59:53 +00:00