luchua-bc
a83f9ced96
Change the query to only catch the common exception rethrown case
2020-11-09 12:07:43 +00:00
luchua-bc
fa54c23a83
Handle the edge case that an exception is rethrown in a catch clause
2020-11-03 16:31:12 +00:00
luchua-bc
6a8ce37428
Add query for initCause and addSuppressed
2020-11-02 11:59:14 +00:00
luchua-bc
78d7fe2fbb
Detect rethrowing unprocessed exceptions in catch clause
2020-11-01 02:13:50 +00:00
luchua-bc
756db4c03a
Simplify the query and add more test cases
2020-10-31 01:33:24 +00:00
luchua-bc
67af9b0f3e
Add comments and update JavaDocs of GenericServlet using the source JAR
2020-10-30 17:05:53 +00:00
luchua-bc
93d1393ded
Add error-page check
2020-10-30 16:45:56 +00:00
luchua-bc
1d0232b464
Add more servlet methods and fix formatting errors
2020-07-02 03:07:19 +00:00
luchua-bc
ede9cec4a9
Uncaught Servlet Exception
2020-06-29 20:07:53 +00:00
Anders Schack-Mulligen
791f31fa65
Merge pull request #3595 from luchua-bc/j2ee-server-directory-listing
...
Java: Add check for J2EE server directory listing
2020-06-24 16:45:34 +02:00
Anders Schack-Mulligen
4b3ca13f25
Merge pull request #3491 from luchua-bc/java-insecure-smtp-ssl
...
Java: CWE-297 insecure JavaMail SSL configuration
2020-06-10 11:02:50 +02:00
luchua-bc
1fd9c7fdec
Add all dependent class stubs
2020-06-09 20:12:05 +00:00
luchua-bc
5acfc52087
Add dependent stub classes for the test case
2020-06-08 16:17:40 +00:00
luchua-bc
cba81eeb97
Fix string/type match and add a test case
2020-06-06 03:56:12 +00:00
luchua-bc
3d4a5a337d
Add check for J2EE server directory listing
2020-05-30 10:58:16 +00:00
Anders Schack-Mulligen
0d75c6a5f1
Merge pull request #3506 from ggolawski/spring-actuators-fix
...
Fixes FPs in SpringBootActuators query
2020-05-25 13:09:56 +02:00
Anders Schack-Mulligen
c36e6213f1
Merge pull request #3288 from ggolawski/jndi-injection
...
CodeQL query to detect JNDI injections
2020-05-19 11:03:29 +02:00
Grzegorz Golawski
ac329e81f8
Fixes FPs in SpringBootActuators query
...
No evidence that Spring Actuators are being used, e.g. `http.authorizeRequests().anyRequest().permitAll()`
Only safe Actuators are enabled, e.g. `EndpointRequest.to("health", "info")`
2020-05-18 22:55:33 +02:00
Grzegorz Golawski
afea9330b7
Fix the case where user-controlled input is passed as URL to env Hashtable
2020-05-08 00:44:22 +02:00
Grzegorz Golawski
df9921f870
Update according to the review comments
2020-05-07 23:19:13 +02:00
Grzegorz Golawski
f893954ea3
Add Spring LDAP and JMXServiceURL related sinks
2020-05-03 20:51:50 +02:00
Grzegorz Golawski
0c75330e42
Remove qlpack.yml as these are not needed
2020-04-27 23:31:10 +02:00
Grzegorz Golawski
639aa826ea
Remove qlpack.yml as these are not needed
2020-04-27 23:26:59 +02:00
Grzegorz Golawski
af48bc3e57
CodeQL query to detect JNDI injections
2020-04-17 21:45:42 +02:00
Grzegorz Golawski
1d8da905ac
Make the test runnable via codeql test run
2020-04-03 21:44:13 +02:00
Grzegorz Golawski
f05b2af69d
Move to experimental
2020-04-03 00:27:51 +02:00
