Anders Schack-Mulligen
64dd8b9488
Merge branch 'main' into java/refactor-dataflow-queries-1
2023-03-10 12:38:06 +01:00
Anders Schack-Mulligen
730eae9521
Java: Autoformat
2023-03-10 09:39:41 +01:00
Anders Schack-Mulligen
2288eab0fd
Java: Refactor BrokenCryptoAlgorithm, MaybeBrokenCryptoAlgorithm
2023-03-07 13:53:36 +01:00
Anders Schack-Mulligen
50935899fa
Java: Refactor XSS.ql
2023-03-07 13:33:00 +01:00
Anders Schack-Mulligen
d839b4038e
Java: Refactor TaintedPath.ql
2023-03-07 11:53:03 +01:00
Anders Schack-Mulligen
cc75a1a97e
Java: Refactor RequestForgery.ql
2023-03-07 11:39:03 +01:00
Anders Schack-Mulligen
35beadc3bb
Java: Refactor SensitiveInfoLog.ql
2023-03-07 11:31:49 +01:00
Anders Schack-Mulligen
4408482699
Java: Refactor NumericCastTainted, NumericCastTaintedLocal
2023-03-07 10:42:00 +01:00
Anders Schack-Mulligen
d4e6e77200
Java: Refactor StackTraceExposure, XSS.qll
2023-03-07 10:38:00 +01:00
Anders Schack-Mulligen
c4cf2febfb
Java: Refactor ResponseSplitting, ResponseSplittingLocal
2023-03-07 10:37:45 +01:00
Jami
029e1d47fe
Merge pull request #12081 from jcogs33/jcogs33/update-some-Files-sinks
...
Java: update `createTempDirectory` and `copy` "create-file" sinks
2023-02-14 10:53:17 -05:00
Tony Torralba
4fad01a739
Further refactoring
...
Avoid having two taint tracking configurations in the same file
2023-02-13 09:18:05 +01:00
Tony Torralba
5555b5cd19
Add local version of the XXE query
2023-02-13 09:18:05 +01:00
Jami Cogswell
ce1c814daa
Java: update path-injection query to use new 'read-file' sink kind
2023-02-11 17:10:58 -05:00
Joe Farebrother
97b2e852c9
Merge pull request #11713 from joefarebrother/sensitive-result-receiver
...
Java: Add query for leaking sensitive data through a ResultReceiver
2023-02-01 16:34:17 +00:00
Tony Torralba
834fc51a3a
Update java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.ql
2023-02-01 15:26:26 +01:00
Joe Farebrother
74dba953ca
Apply suggestions from docs review
...
Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com >
2023-02-01 12:54:19 +00:00
Edward Minnix III
4c018759c8
Merge pull request #11283 from egregius313/egregius313/webview-setAllowContentAccess
...
Java: Android WebView Content Access Query
2023-01-17 11:02:47 -05:00
Antoine Taillefer
660e6d7085
Fix partial path traversal Java example
...
The Java recommendation example for the "Partial path traversal vulnerability from remote" query doesn't seem right to me. Indeed, the following statement doesn't compile, since `dir.getCanonicalPath()` returns a String:
```
dir.getCanonicalPath().toPath()
```
Maybe the author wanted to state `dir.getCanonicalFile().toPath()`, which would compile, but is useless compared to `dir.getCanonicalPath()`.
Moreover, `parent.getCanonicalFile().toPath()` or `parent.getCanonicalPath()` will **not** be slash-terminated, contrary to what the description says.
From what I can see (and test), the correct fix is to concatenate `File.separator` to the parent canonical path.
2023-01-16 21:14:29 +01:00
Tony Torralba
cca6a13fbb
Update java/ql/src/Security/CWE/CWE-927/SensitiveResultReceiver.qhelp
2023-01-16 14:21:03 +01:00
jelaiw
cf7189bb28
Fix small typo in good/bad code sample.
2023-01-13 19:16:11 -06:00
Michael Nebel
5c466f3319
Java: Sync files and update other relavant files related to the new naming of shift.
2023-01-12 19:06:29 +01:00
Chris Smowton
09d8a50494
Spelling
2023-01-12 17:46:00 +00:00
Joe Farebrother
b565f997a0
Improve qhelp
2023-01-12 11:44:39 +00:00
Joe Farebrother
639c42c9e9
Fix qhelp errors and ql-for-ql errors
2023-01-12 11:44:39 +00:00
Joe Farebrother
f52db7f9a3
Add qhelp
2023-01-12 11:44:39 +00:00
Joe Farebrother
b96edb9c64
Add Sensitive Result Receiver query
2023-01-12 11:44:39 +00:00
Florin Coada
4c1c12dd70
suggestions in list format
2023-01-10 11:18:56 -05:00
Jonathan Leitschuh
1d7881e03f
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2023-01-10 11:18:56 -05:00
Tony Torralba
b7364f5428
Update UnsafeDeserialization.qhelp
...
Move the table under <recommendation>, minor fixes.
2023-01-10 11:18:56 -05:00
Jonathan Leitschuh
3fa11c21c3
[Java] Document fixes for deserialization vulnerabilities by framework
...
Related https://github.com/github/codeql/issues/11603
2023-01-10 11:18:56 -05:00
Ed Minnix
909b1d70d9
Rename files to say "Allow" instead of "Permit"
2023-01-09 10:11:03 -05:00
Ed Minnix
f626d4794a
Change wording from "permit" to "allow" in id and name
2023-01-09 10:03:12 -05:00
Ed Minnix
64668883a4
Add good example to documentation
2023-01-09 09:59:38 -05:00
Ed Minnix
2ec73c50f9
Mention WebView in alert message
2023-01-09 09:55:09 -05:00
Chris Smowton
ef27f9fe96
Replace one more mention of escaping
2023-01-09 10:56:13 +00:00
Chris Smowton
45c732a6f9
Java: improve naming and description of SqlUnescaped.ql
...
Since the main thing it's objecting to is concatenation not lack of escaping (in particular it doesn't look for escaping sanitizers), rename and re-describe it accordingly.
2023-01-09 10:56:13 +00:00
Ed Minnix
28ad9d00fb
Merge both setAllowContentAccess queries into one query
...
Previously, the query to detect whether or not access to `content://`
links was done using two queries.
Now they can be merged into one query
2023-01-03 15:17:07 -05:00
Ed Minnix
35de551f6b
Formatting
2022-12-31 17:19:49 -05:00
Ed Minnix
df1a4d2ed1
Documentation fix: Add state1 and state2 to documentation
2022-12-31 15:25:37 -05:00
Ed Minnix
02f70f3536
Add @security-severity tag
2022-12-31 15:00:28 -05:00
Edward Minnix III
1d345c6101
Refactoring and simplification
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-12-31 15:00:28 -05:00
Ed Minnix
5265cb4b03
Merge two dataflow configurations into one taint tracking
2022-12-31 15:00:28 -05:00
Ed Minnix
973f649e76
Break dataflow into two steps in order to capture flow from WebView to settings call
2022-12-31 15:00:28 -05:00
Ed Minnix
0e15dd9fa9
Query metadata
2022-12-31 15:00:28 -05:00
Edward Minnix III
778749184b
Change id to use android/ instead of prepending android-
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-12-31 15:00:28 -05:00
Ed Minnix
da25c586e6
Dataflow query for detecting paths that disable content access
...
Since the default value is `true`, we need to determine whether or not
the `setAllowContentAccess` method is ever called using dataflow.
2022-12-31 15:00:28 -05:00
Ed Minnix
8a763015e6
Reduce precision rating to medium
...
This query won't always be a security problem, so it should have a lower
precision rating than `high`.
2022-12-31 15:00:28 -05:00
Ed Minnix
e4e13d38b7
Java: query for Android WebView setAllowContentAccess
2022-12-31 15:00:28 -05:00
Tony Torralba
345c383acc
Fix new Android queries' IDs
2022-12-21 09:36:57 +01:00
