Tony Torralba
5deb996b33
Merge branch 'main' into atorralba/android_slice_models
2021-10-18 08:41:48 +02:00
Chris Smowton
8816aa1431
Improve Android stub fidelity to the point that all relevant tests work
...
Note these still aren't entirely mechanically generated stubs matching the real Android 9.
2021-10-12 12:35:05 +01:00
Chris Smowton
205b6fe6d7
Fix bad merge on Uri.java
2021-10-12 12:35:05 +01:00
Chris Smowton
1dffbcd0bd
Fix tests disrupted by re-modelling and stubbing Android 9:
...
* Account for changed dataflow graph shape using external flow
* Account for BaseBundle only existing as of Android 5
* Properly implement Parcelable, which we previously got away with due to a partial stub
* Restore an Android 11 function that had been added to the Android 9 Context class (I won't get into enforcing the difference in this PR)
2021-10-12 12:35:05 +01:00
Chris Smowton
fc0b18cf61
Add tests for Android flow steps
2021-10-12 12:35:05 +01:00
Chris Smowton
cd2c9e9ca3
Add Gson support to unsafe deserialization query
2021-10-12 12:35:04 +01:00
Tony Torralba
588dedc265
Add stubs
2021-10-07 17:03:05 +02:00
Tony Torralba
1a04ad98bc
Add Android Slice models
2021-10-07 17:01:16 +02:00
luchua-bc
0621e65827
Query to detect exposure of sensitive information from android file intent
2021-10-06 12:16:04 +01:00
Anders Schack-Mulligen
d0b307ecfb
Merge pull request #6103 from atorralba/atorralba/promote-insecure-javamail
...
Java: Promote Insecure JavaMail SSL Configuration from experimental
2021-10-06 09:24:11 +02:00
Chris Smowton
5b13232a9d
Merge pull request #6739 from joefarebrother/android-intent-extra
...
Java: Model Android Bundle and Intent extras methods
2021-10-05 15:39:42 +01:00
Tony Torralba
baffb0ed89
Consider Jakarta Mail
2021-10-05 09:18:47 +02:00
f1v3
168fc4170d
Apply suggestions from code review
2021-09-30 14:26:14 +01:00
f1v3
f3bde56de9
detects a hard-coded cipher key for shiro
2021-09-30 14:22:48 +01:00
Chris Smowton
60a023d064
Merge pull request #5852 from luchua-bc/java/hardcoded-azure-credential
...
Java: CWE-798 Query to detect hard-coded Azure credentials
2021-09-30 14:11:29 +01:00
Joe Farebrother
3ae5f13c3d
Generate tests and stubs
2021-09-29 15:44:21 +01:00
Chris Smowton
413ac4e8f4
Merge pull request #6684 from owen-mc/java/model/apache-collections-subpackages
...
Java: model remaining subpackages of Apache Commons Collections
2021-09-28 12:28:48 +01:00
Tony Torralba
cec6cd0830
Merge pull request #6724 from atorralba/atorralba/android-contentprovider-sources
...
Java: Add sources for content providers in Android
2021-09-28 12:13:54 +02:00
Owen Mansel-Chan
bdd78d2bc7
Fix stub
2021-09-27 16:24:41 +01:00
Owen Mansel-Chan
29db42c3cd
Generate stubs
2021-09-27 16:24:40 +01:00
Anders Schack-Mulligen
cfa0d46b73
Merge pull request #6097 from atorralba/atorralba/promote-xslt-injection
...
Java: Promote XSLT Injection from experimental
2021-09-27 13:14:57 +02:00
Tony Torralba
c792567904
Move from experimental
2021-09-27 11:57:53 +02:00
Tony Torralba
569426b04e
Consider subtypes of Expression and ExpressionParser
...
Add parseRaw as additional taint step
2021-09-27 11:38:12 +02:00
Tony Torralba
99881db8bd
Add stubs
2021-09-21 12:10:05 +02:00
Joe Farebrother
3ef09da1df
Add models for more of methods; update stubs
2021-09-17 16:57:49 +01:00
Joe Farebrother
7bf55fbc49
Update stubs to not include package protected members
2021-09-16 15:23:02 +01:00
Joe Farebrother
b51ffadd27
Improve generated tests
2021-09-16 15:23:01 +01:00
Joe Farebrother
6ae11b5b2c
Generate stubs.
...
Some generated stubs were manually adjusted due to minor issues in the stub generator.
In particular, ambiguous references were resolved and references to private classes were removed.
2021-09-16 15:23:00 +01:00
Chris Smowton
367a53dd71
Add models for android.net.Uri[.Builder]
2021-09-14 16:37:07 +01:00
Chris Smowton
6cff0d0376
Merge pull request #6393 from luchua-bc/java/xss-jsf
...
Java: CWE-079 Query to detect XSS with JavaServer Faces (JSF)
2021-09-14 15:15:56 +01:00
Anders Schack-Mulligen
26eafcb55a
Merge pull request #6456 from smowton/smowton/admin/flexjson-unsafe-deserialization
...
Java: add unsafe-deserialization support for Flexjson
2021-09-14 14:33:22 +02:00
luchua-bc
24addd5c10
Query to detect XSS with JavaServer Faces (JSF)
2021-09-14 11:47:32 +01:00
Chris Smowton
f1c3a11103
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
Chris Smowton
9b488207eb
Add support for the Flexjson framework to the unsafe-deserialization query
2021-09-10 16:27:23 +01:00
Chris Smowton
2d03840fde
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
...
Originally authored by @haby0, squashed to clean up a tangled commit history.
2021-09-10 13:49:31 +01:00
Owen Mansel-Chan
714e126088
Merge pull request #6370 from owen-mc/java/model/apache-collections
...
Java: Model more of Apache Commons Collections
2021-08-19 15:09:06 +01:00
Joe Farebrother
9dc28eb9b5
Merge pull request #6387 from joefarebrother/guava-cache
...
Java: Model guava cache package
2021-08-19 10:53:48 +01:00
Chris Smowton
48818ebd6d
Merge pull request #6434 from smowton/smowton/admin/jodd-unsafe-deserialization
...
Java: Unsafe deserialization: add support for Jodd JSON library
2021-08-18 17:26:02 +01:00
Sauyon Lee
fd0ea15719
Add stubs for Spring web.util tests
2021-08-12 11:20:48 -07:00
Owen Mansel-Chan
51a7018afc
Add stubs
2021-08-06 07:06:16 +01:00
Chris Smowton
0b6c991ac4
Unsafe deserialization: add support for Jodd JSON library
2021-08-05 16:01:14 +01:00
Tony Torralba
0356ed7f9e
Merge pull request #5911 from atorralba/atorralba/promote-missing-jwt-signature-check
...
Java: Promote Missing JWT signature check query from experimental
2021-08-05 09:43:03 +02:00
Anders Schack-Mulligen
1932f604dc
Merge pull request #6419 from smowton/smowton/admin/unsafe-deserialization-jabsorb
...
Add unsafe-deserialization support for Jabsorb
2021-08-05 09:04:23 +02:00
Chris Smowton
69549e9ce3
Add unsafe-deserialization support for Jabsorb
...
This is partly extracted from https://github.com/github/codeql/pull/5954
2021-08-04 15:35:50 +01:00
Anders Schack-Mulligen
6a09a5667d
Merge pull request #5931 from atorralba/atorralba/promote-jndi-injection
...
Java: Promote JNDI Injection query from experimental
2021-08-04 15:48:44 +02:00
Anders Schack-Mulligen
7fb1e1578e
Merge pull request #5894 from atorralba/atorralba/promote-ognl-injection
...
Java: Promote OGNL Injection query from experimental
2021-08-03 15:31:40 +02:00
Anders Schack-Mulligen
c0d76da1a6
Merge pull request #5846 from atorralba/atorralba/promote-unsafe-android-webview-fetch
...
Java: Promote Unsafe resource loading in Android WebView from experimental
2021-08-03 14:24:34 +02:00
Tony Torralba
f5cbec4938
Fix tests affected by Jackson stubs changes
2021-08-03 14:22:55 +02:00
Anders Schack-Mulligen
fb9feabe64
Merge pull request #6062 from atorralba/atorralba/promote-groovy-injection
...
Java: Promote Groovy Code Injection from experimental
2021-08-03 14:19:15 +02:00
Chris Smowton
f83f950be6
Merge pull request #6325 from smowton/smowton/feature/org-json-models
...
Java: add models of JSON-java, aka `org.json`
2021-08-03 10:33:49 +01:00
