Tony Torralba
ed5619498c
WIP: XPath Injection promotion
2021-05-06 09:18:48 +02:00
Jonathan Leitschuh
67e9f06304
[Java] Fix Kryo FP & Kryo 5 Support
...
Closes #4992
2021-05-05 17:38:34 -04:00
Tony Torralba
458b89bf5f
Added Android stubs
2021-05-05 11:57:01 +02:00
luchua-bc
703fbf139a
Add more methods and update the library name
2021-05-04 02:54:49 +00:00
Jonathan Leitschuh
dfad1fc740
[Java] Add support for com.google.common.base.MoreObjects#firstNonNull
2021-05-03 12:58:00 -04:00
Tony Torralba
38e052482c
More csv sinks and sources
2021-05-03 12:44:53 +02:00
luchua-bc
4709e8139d
JPython code injection
2021-05-03 01:43:56 +00:00
haby0
5be9fbbc5a
Remove LogOperationSink and PrintSink
2021-04-27 14:12:33 +08:00
Chris Smowton
6589460357
Add models for Commons ToStringBuilder
...
These don't include support for reflectionToString yet, which is coming up in a subsequent PR.
2021-04-21 15:47:19 +01:00
haby0
8296abcea8
Fix Modify the ql query (the qhelp part is not modified).
2021-04-19 20:59:47 +08:00
haby0
23b508c5e7
Merge remote-tracking branch 'upstream/main' into UseOfLessTrustedSource
2021-04-19 20:05:49 +08:00
Anders Schack-Mulligen
06514159be
Java: Add XXE tests.
2021-04-19 10:58:21 +02:00
Anders Schack-Mulligen
605f28f741
Merge pull request #5686 from smowton/haby0/JsonHijacking
...
Java: JSONP Injection w/cleanups
2021-04-16 11:09:17 +02:00
Chris Smowton
254de76078
Remove unnecessary stubs
2021-04-15 16:20:27 +01:00
Chris Smowton
fa36ba901a
Merge pull request #5471 from artem-smotrakov/el-injection
...
Java: Query for detecting Jakarta Expression Language injections
2021-04-15 12:39:34 +01:00
haby0
216f204438
delete FilterClass
2021-04-15 19:28:25 +08:00
haby0
583d0889e2
delete tomcat-embed-core stub, update the ServletGetMethod class
2021-04-15 17:40:51 +08:00
haby0
b3bdf89fc2
rm VerificationMethodFlowConfig, use springframework-5.2.3 stub
2021-04-15 10:25:40 +08:00
Chris Smowton
58d198261e
Merge pull request #5663 from smowton/luchua/java/sensitive-cookie-not-httponly
...
Java: CWE-1004 Query to check sensitive cookies without the HttpOnly flag set w/minor corrections
2021-04-13 12:08:53 +01:00
Chris Smowton
f22b11881e
Minimise stubs
...
By removing all business logic from the stubs, we better test that our analysis treats them as opaque and does not rely on their internal structure
2021-04-13 10:36:28 +01:00
luchua-bc
d7f26dfc18
Update stub classes and qldoc
2021-04-12 16:19:23 +00:00
Artem Smotrakov
b39a3ab12c
Added setVariable() sink
2021-04-08 20:41:43 +03:00
haby0
86ef2588f1
Restore @Component annotation
2021-04-08 17:55:29 +08:00
haby0
3f0a3266aa
[Java] CWE-348: Use of less trusted source
2021-04-08 17:14:03 +08:00
Chris Smowton
7fb5bd0cab
Add tests for and slightly expand models of Commons Lang's ArrayUtils class
2021-03-25 15:11:51 +00:00
Anders Schack-Mulligen
a1ccbcdaf1
Merge pull request #5260 from artem-smotrakov/spring-http-invoker
...
Java: Query for detecting unsafe deserialization with Spring exporters
2021-03-24 13:57:17 +01:00
haby0
3df23eecb6
Merge remote-tracking branch 'upstream/main' into JsonHijacking
2021-03-24 15:52:01 +08:00
Anders Schack-Mulligen
27408fefe2
Merge pull request #5008 from torque59/cwe-346
...
Java: Queries to detect remote source flow origins to CORS header.
2021-03-23 13:54:00 +01:00
haby0
fe046ec71e
Merge remote-tracking branch 'upstream/main' into main
2021-03-22 17:25:37 +08:00
Artem Smotrakov
adb1ed380a
Added tests for Jakarta expression injection
2021-03-21 21:19:39 +03:00
haby0
c516d69b98
Merge remote-tracking branch 'upstream/main' into main
2021-03-17 16:42:48 +08:00
haby0
98204a15a6
Fix the problem
2021-03-17 15:28:04 +08:00
Joe Farebrother
1e3c4d0eb1
Add stubs to fix broken test case
2021-03-16 14:24:49 +00:00
Anders Schack-Mulligen
45c9428668
Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources
...
Java: Add support for Commons-Lang's RandomUtils
2021-03-15 16:21:01 +01:00
luchua-bc
0a35feef76
Exclude CSRF cookies to reduce FPs
2021-03-11 17:28:07 +00:00
Chris Smowton
1c1ca70027
Add models for flow- and taint-preserving functions in Commons ObjectUtils.
...
These should all be value-preserving, but we don't support value-preserving varargs methods yet.
2021-03-11 16:22:54 +00:00
Artem Smotrakov
0a5d58ed8a
Cover more configurations in UnsafeSpringExporterInConfigurationClass.ql
2021-03-10 21:15:19 +03:00
Chris Smowton
9163893879
Add models for Commons-Lang's RegExUtils class
2021-03-09 15:11:13 +00:00
Joe Farebrother
7a4ce83169
Merge pull request #5310 from joefarebrother/guava-io
...
Java: Add modelling for Guava IO utilities
2021-03-09 11:19:44 +00:00
p0wn4j
6841f5f7c4
Java: Add NashornScriptEngine detection in ScriptEngine query
...
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
2021-03-06 16:19:07 +04:00
Chris Smowton
e3cf5c235e
Add support for Commons-Lang's RandomUtils
...
This is realised by somewhat generalising our interfaces for modelling RNGs. We also add tests for randomness-related queries that didn't have any, and addtest cases checking the Apache random-number generators are interchangeable with the stdlib ones.
2021-03-05 12:09:33 +00:00
Joe Farebrother
d30d1a2ab2
Add unit tests and fix issues
2021-03-05 11:19:52 +00:00
Joe Farebrother
c12f8035c4
Add stubs for unit tests
2021-03-05 11:19:25 +00:00
Anders Schack-Mulligen
00983c8967
Merge pull request #4965 from artem-smotrakov/jexl-injection
...
Java: Query for detecting JEXL injections
2021-03-05 10:52:36 +01:00
Anders Schack-Mulligen
20ccb52912
Merge pull request #4299 from torque59/play-framework
...
Initial support for Java - Play Framework > 2.6.x
2021-03-05 10:51:53 +01:00
luchua-bc
a93aabab40
Add the toString() method
2021-03-05 03:05:49 +00:00
haby0
c5577cb09a
Fix the problem
2021-03-04 19:54:49 +08:00
Chris Smowton
b0ba0585a7
Add models for Apache Commons Lang and Text's Str[ing]Substitutor
2021-03-04 11:11:55 +00:00
Chris Smowton
f749c31136
Add models for commons lang/text's Str[ing]Lookup class
2021-03-04 11:11:55 +00:00
Chris Smowton
1580d23b2b
Add models for WordUtils and StrTokenizer
...
Both of these have commons-text and commons-lang variants.
2021-03-04 11:11:55 +00:00
