Chris Smowton
171dc26531
Fix test reference and expectations
2021-08-09 13:56:55 +01:00
Fosstars
b913928294
Renamed queries and merged qhelp files
2021-08-04 17:54:16 +02:00
Fosstars
bd7e7b1371
Better qldoc for timing attacks
2021-08-01 10:18:37 +02:00
Fosstars
44e52517ad
Removed unsafeMacCheckWithArraysDeepEquals() test
2021-08-01 10:12:38 +02:00
Fosstars
0fc487fb04
Better qhelp for timing attacks
2021-08-01 09:57:14 +02:00
Artem Smotrakov
9b953cf0fc
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-08-01 09:47:07 +02:00
Fosstars
ad54c9d937
Two queries for timing attacks
2021-08-01 09:47:07 +02:00
Artem Smotrakov
e3b6ceade5
Renamed NonConstantTimeCryptoComparison.ql to NonConstantTimeCheckOnSignature.ql
2021-08-01 09:47:06 +02:00
Artem Smotrakov
8b557765b3
Narrow NonConstantTimeCryptoComparison.ql to timing attack on signatures and MACs only
2021-08-01 09:47:06 +02:00
Artem Smotrakov
c359852608
Consider only Cipher.ENCRYPT_MODE in NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:06 +02:00
Artem Smotrakov
1f2a9cdda7
Added taint propagation steps for hashes in NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:06 +02:00
Artem Smotrakov
c96d939cf5
Covered custom fast-fail checks in NonConstantTimeCryptoComparison.ql
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-08-01 09:47:06 +02:00
Artem Smotrakov
6500a1bbbb
More references in NonConstantTimeCryptoComparison.qhelp
2021-08-01 09:47:05 +02:00
Artem Smotrakov
860e8f379e
Better signatures in java/non-constant-time-crypto-comparison
2021-08-01 09:47:05 +02:00
Artem Smotrakov
622c7ee957
Added a change note for new steps for ByteBuffer and InputStream
2021-08-01 09:47:05 +02:00
Artem Smotrakov
1b4ee05b80
Better docs for java/non-constant-time-crypto-comparison
2021-08-01 09:47:05 +02:00
Artem Smotrakov
8c4da16459
More test cases for java/non-constant-time-crypto-comparison
2021-08-01 09:47:04 +02:00
Artem Smotrakov
295fd686ce
Make java/non-constant-time-crypto-comparison a warning
2021-08-01 09:47:04 +02:00
Artem Smotrakov
c977fd09cb
Better constant check in java/non-constant-time-crypto-comparison
2021-08-01 09:47:04 +02:00
Artem Smotrakov
d01dc35011
Less duplicate code in java/non-constant-time-crypto-comparison
2021-08-01 09:47:04 +02:00
Artem Smotrakov
40e513ba52
Added more taint propagation steps for InputStream and ByteBuffer
2021-08-01 09:47:04 +02:00
Artem Smotrakov
a4f3a5a88e
Take into account remote user input in java/non-constant-time-crypto-comparison
2021-08-01 09:47:03 +02:00
Artem Smotrakov
8e6d227dc0
More sinks for java/ql/src/experimental/Security/CWE/CWE-208/NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:03 +02:00
Artem Smotrakov
dfa3b523d0
Renamed files
2021-08-01 09:47:03 +02:00
Artem Smotrakov
75f67959f3
Covered Arrays.deepEquals() in NonConstantTimeCryptoComparison.ql
2021-08-01 09:47:02 +02:00
Artem Smotrakov
5dbcf1d611
Covered Object.deepEquals() in NotConstantTimeCryptoComparison.ql
2021-08-01 09:47:02 +02:00
Artem Smotrakov
5c474f689d
Better comments and descriptions
2021-08-01 09:47:02 +02:00
Artem Smotrakov
f245dc3ac8
Removed hashes from NotConstantTimeCryptoComparison.ql
2021-08-01 09:47:02 +02:00
Artem Smotrakov
8a69b7b3ac
Added NotConstantTimeCryptoComparison.qhelp and examples
2021-08-01 09:47:01 +02:00
Artem Smotrakov
67579dd1d8
Added tests for NotConstantTimeCryptoComparison.ql
2021-08-01 09:47:01 +02:00
Artem Smotrakov
c2c85d32da
Java: Added a query for timing attacks
2021-08-01 09:47:01 +02:00
Joe Farebrother
f7099f459f
Java: Test generator: use getComponentType
2021-07-29 10:08:45 +01:00
Joe Farebrother
d900fcaf42
Merge pull request #6374 from joefarebrother/test-gen-improvements
...
Java: Add support for synthetic fields to the test generator
2021-07-28 16:02:47 +01:00
Joe Farebrother
9ddae3e9f6
Fix spelling
...
Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com >
2021-07-28 10:12:17 +01:00
Joe Farebrother
2d862ef119
Support synthetic fields
2021-07-27 17:28:53 +01:00
Joe Farebrother
a8cca4ba0e
Merge pull request #6373 from joefarebrother/test-gen-improvements
...
Java: Test generator improvements
2021-07-27 15:44:56 +01:00
Joe Farebrother
309f0e7c26
Fix handling of arrays
2021-07-27 15:05:57 +01:00
Joe Farebrother
9ffcfbcd33
Add --force option
2021-07-27 15:05:57 +01:00
Joe Farebrother
8ab0fd54b4
Improvements to the test generator:
...
- Only reference public methods
- Report rows for which test cases could not be generated
- Add a blanket `throws Exception` clause to the generated method
2021-07-27 15:05:55 +01:00
Joe Farebrother
2036aa1e4a
Format test generator
2021-07-27 15:04:19 +01:00
Chris Smowton
97d603cafb
Add test-case generator check for non-parseable rows
2021-07-27 14:26:22 +01:00
Anders Schack-Mulligen
a5f0a4ea71
Merge pull request #6087 from smowton/smowton/admin/rest-xss-tests
...
Java: Add Spring XSS tests
2021-07-27 14:09:34 +02:00
Anders Schack-Mulligen
aa8fa26a2a
Merge pull request #6355 from intrigus-lgtm/patch-6
...
Update broken link
2021-07-27 09:05:02 +02:00
intrigus-lgtm
434b36c648
Update broken link
2021-07-26 15:48:47 +02:00
Anders Schack-Mulligen
6c666b49f5
Merge pull request #6366 from smowton/smowton/fiix/junit-nested-classes
...
Prevent class-could-be-static alerts regarding JUnit Nested tests
2021-07-26 12:45:23 +02:00
Anders Schack-Mulligen
5d3e8d2add
Merge pull request #6365 from Marcono1234/marcono1234/InstanceOfExpr-getCheckedType
...
Java: Add `InstanceOfExpr.getCheckedType()`
2021-07-26 11:20:48 +02:00
Anders Schack-Mulligen
ee13520836
Merge pull request #6364 from Marcono1234/marcono1234/TypeLiteral-getReferencedType
...
Java: Add `TypeLiteral.getReferencedType()`
2021-07-26 11:15:06 +02:00
Chris Smowton
aca905fa36
Prevent class-could-be-static alerts regarding JUnit Nested tests
2021-07-26 09:35:26 +01:00
github-actions[bot]
d51eafbfd5
Add changed framework coverage reports
2021-07-26 00:08:31 +00:00
Marcono1234
606173012a
Java: Add InstanceOfExpr.getCheckedType()
...
Additionally change `EqualsUsesInstanceOf.ql` to check for all RefTypes
instead of only Class.
2021-07-26 00:50:11 +02:00
