3153 Commits

Author	SHA1	Message	Date
Tony Torralba	c35fbf9abc	Add more sanitizers	2022-08-22 13:20:02 +02:00
Tony Torralba	72c204063d	Merge pull request #10115 from atorralba/atorralba/fragment-fix ... Java: Add support for androidx.fragment.app.Fragment	2022-08-22 12:53:19 +02:00
Chris Smowton	f3ef8510d3	Merge pull request #10093 from smowton/smowton/feature/java-singular-locations ... Java: pick an arbitrary representative location when an entity has many candidate locations.	2022-08-22 09:32:43 +01:00
erik-krogh	049af68bc2	restrict suffix-construction to relevant regexps	2022-08-21 20:35:39 +02:00
erik-krogh	bcf4c57060	Merge branch 'main' into redosPrefix	2022-08-19 19:22:49 +02:00
erik-krogh	d052b1e3c9	also support regular expressions without repetitions	2022-08-19 19:21:44 +02:00
Tony Torralba	3c6c09b0f8	No longer require a mode in Cipher.init	2022-08-19 16:40:59 +02:00
Tony Torralba	794fd976a9	Add androidx Fragment support	2022-08-19 16:32:06 +02:00
Tamas Vajk	1c08ac1d7a	Kotlin: Identify data classes during extraction	2022-08-19 14:51:36 +02:00
Sebastian Bauersfeld	354a7fd252	Make taint flow through java.lang.String.(replace|replaceFirst|replaceAll) more permissive.	2022-08-19 17:33:35 +07:00
Sebastian Bauersfeld	5cf320d553	Add corresponding taint steps.	2022-08-19 17:33:35 +07:00
Erik Krogh Kristensen	4f93f2b9ba	Merge pull request #10076 from erik-krogh/ql-for-ql-fixes ... various QL-for-QL fixes	2022-08-18 15:46:48 +02:00
Chris Smowton	17dd1f64ec	Java: pick an arbitrary representative location when an entity has many candidate locations.	2022-08-18 14:29:16 +01:00
erik-krogh	9e7c0c6ab9	revert changing imports in java/	2022-08-18 10:19:12 +02:00
erik-krogh	473bc92e2d	move the PrefixConstruction module out of the ReDoSPruning module	2022-08-18 10:07:48 +02:00
erik-krogh	4bc10f9b5c	explicitly import required frameworks that were previously implicitly imported	2022-08-18 08:40:46 +02:00
Anders Schack-Mulligen	c3ba632a32	Java: Add some type-based sanitizers to SensitiveInfoLog.ql.	2022-08-17 14:54:28 +02:00
Anders Schack-Mulligen	6e495ba6e5	Merge pull request #10068 from aschackmull/java/summarizedcallable-split ... Java: Make synthesized method bodies disjoint from source code.	2022-08-17 14:13:56 +02:00
erik-krogh	14d83ab1b5	make the framework imports in FlowSources.qll private	2022-08-17 13:50:08 +02:00
erik-krogh	b7b80fe176	reintroduce redundant cast in synced file	2022-08-17 13:34:22 +02:00
erik-krogh	ffb65d054e	delete redundant inline casts	2022-08-17 13:34:22 +02:00
erik-krogh	2e44fba67d	add explicit this	2022-08-17 13:33:31 +02:00
Anders Schack-Mulligen	27f76330be	Java: Fix models.	2022-08-17 12:46:09 +02:00
Joe Farebrother	de69827711	Use a full dataflow config rather than local flow	2022-08-17 10:35:48 +01:00
Joe Farebrother	fe5a61bdde	Fix typos in docs and comments	2022-08-17 10:35:48 +01:00
Joe Farebrother	c77b17574a	Use CryptoAlgoSpec rather than hadcoding Cipher.getInstance	2022-08-17 10:35:47 +01:00
Joe Farebrother	41bdd6d4cc	Add RSA without OEAP query and qhelp	2022-08-17 10:35:46 +01:00
Joe Farebrother	7989ba3391	Replace a tainttracking instance with local flow	2022-08-17 10:35:16 +01:00
Joe Farebrother	bf32b5a8fd	Reiview suggestions - add doc comment, reword description, simplify a part	2022-08-17 10:35:15 +01:00
Joe Farebrother	4d0957711b	Reduce FPs from empty arrays	2022-08-17 10:35:14 +01:00
Joe Farebrother	c0a1300955	Improve initializedWthConstants to no longer need a workaround	2022-08-17 10:35:13 +01:00
Joe Farebrother	f8f21c7ee6	Move static init vector query and tests from experimental to main	2022-08-17 10:35:13 +01:00
Jami	dd23d48ad2	Merge pull request #9939 from jcogs33/android-debug-query-inline-tests ... Java: query to detect android:debuggable attribute enabled	2022-08-16 10:07:13 -04:00
Anders Schack-Mulligen	df40ccd129	Java: Make synthesized method bodies disjoint from source code.	2022-08-16 13:36:39 +02:00
erik-krogh	8e6a36256c	import the non-deprecated NfaUtils in the overly-large-range query	2022-08-16 11:21:43 +02:00
Anders Schack-Mulligen	28e4224ab1	Merge pull request #10023 from aschackmull/java/numbertype-perf ... Java: Minor perf improvement.	2022-08-16 09:52:55 +02:00
Erik Krogh Kristensen	f106e064fa	Merge pull request #9422 from erik-krogh/refacReDoS ... Refactorizations of the ReDoS libraries	2022-08-16 09:32:08 +02:00
Jami Cogswell	4986cc8458	update isDebuggable predicate	2022-08-15 15:50:00 -04:00
Jami Cogswell	c010f92811	simplified predicates, removed overridden getFile predicate	2022-08-15 15:50:00 -04:00
Jami Cogswell	6e10fcf519	added predicates in the AndroidManifest library and adjusted tests	2022-08-15 15:50:00 -04:00
Chris Smowton	774e379eb1	Merge pull request #9742 from smehta23/feat/SM/java_partial_path_traversal_vulnerability ... [JAVA] Partial Path Traversal Vuln Query	2022-08-15 12:56:16 +01:00
Erik Krogh Kristensen	0adb588fe8	Merge pull request #9712 from erik-krogh/badRange ... JS/RB/PY/Java: add suspicious range query	2022-08-15 13:55:44 +02:00
Chris Smowton	e27d62b0b4	Fix qldoc wording	2022-08-15 12:08:14 +01:00
Anders Schack-Mulligen	a3fb54c9de	Merge pull request #10007 from aschackmull/dataflow/source-node-identity ... Dataflow: Fix identification of source PathNodes in the presence of source-to-source flow	2022-08-15 10:39:17 +02:00
Chris Smowton	ca4ef6578d	Spelling	2022-08-13 14:37:08 +01:00
Chris Smowton	8bea2a5f6c	Add missing qldoc	2022-08-13 14:20:48 +01:00
Chris Smowton	b62e9dc92c	Convert tests to inline expectations and fix one bug revealed doing so ... Specifically Apache sshd defines its sensitive api calls on an inherited interface, and they need to be described that way for us to pick them up.	2022-08-13 14:02:05 +01:00
Chris Smowton	ddb0846e06	Split up hardcoded creds queries, ready for conversion to inline expectations	2022-08-13 12:39:16 +01:00
erik-krogh	3a4a3437b5	fix some QL-for-QL warnings	2022-08-12 20:38:50 +02:00
erik-krogh	b54f037424	Merge branch 'main' into refacReDoS	2022-08-12 20:28:30 +02:00