intrigus
1901f6bf55
Java: Make @id @name of query more similar.
2021-01-12 15:36:55 +01:00
intrigus
85286f362c
Java: Replace global flow by local flow
2021-01-11 19:02:07 +01:00
intrigus-lgtm
722bd4dafa
Java: Revise qhelp
2021-01-11 18:57:24 +01:00
intrigus-lgtm
4cfdb10ddc
Java: Improve QLDoc & simplify code
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2021-01-11 18:50:43 +01:00
intrigus
5c1e746c96
Java: Rename to EnvReadMethod
2021-01-11 13:42:08 +01:00
intrigus
1eb2b75389
Java: Further reduce FPs, simply Flag2Guard flow
2021-01-11 13:42:08 +01:00
intrigus
b4692734b2
Java: Add QLDoc improve query message
2021-01-11 13:42:08 +01:00
intrigus-lgtm
f4b912cd8a
Apply suggestions from doc review
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-01-11 13:42:08 +01:00
intrigus
e11304a1ca
Java: Autoformat
2021-01-11 13:42:08 +01:00
intrigus-lgtm
b8f3e64a0f
Apply suggestions from code review
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-01-11 13:42:08 +01:00
intrigus
502e4c39f5
Java: Fix Qhelp
2021-01-11 13:42:08 +01:00
intrigus-lgtm
355cb6eeec
Fix Qhelp format
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-01-11 13:42:07 +01:00
intrigus-lgtm
10fc2cf9f8
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-01-11 13:42:07 +01:00
intrigus
9e2ef9bd74
Java: Filter results by feature flags.
...
This ignores results that are guarded by a feature flag
that suggests an intentionally insecure feature.
Inspired by Go's `InsecureFeatureFlag.qll` and
`DisabledCertificateCheck.ql`.
2021-01-11 13:42:07 +01:00
intrigus
a62a2e58dd
Java: Improve QL-Doc
2021-01-11 13:42:07 +01:00
intrigus
d98b171998
Java: Make EnvTaintedMethod public + QL-Doc
2021-01-11 13:42:07 +01:00
intrigus
e021158b5f
Java: Tighter model of HostnameVerifier#verify
...
This more tightly models `HostnameVerifier#verify` previously it
was possible to accidentally match other methods called `verify`.
2021-01-11 13:42:07 +01:00
intrigus
0a9df07df7
Apply suggestions from review.
2021-01-11 13:42:07 +01:00
intrigus
70b0703952
Java: Remove overlapping code
2021-01-11 13:42:07 +01:00
intrigus
3da1cb0879
Java: Add unsafe hostname verification query
2021-01-11 13:42:07 +01:00
intrigus
8df5d77398
Java: Model HostnameVerifier method
...
Model `HostnameVerifier#setDefaultHostnameVerifier`
2021-01-11 13:42:06 +01:00
Joe Farebrother
24dc631a8f
Java: Fix false positive in XXE query
2020-12-08 16:38:42 +00:00
yo-h
54d7cac46d
Merge pull request #4718 from aschackmull/java/cleanup-deprecated
...
Java: Remove some deprecated classes.
2020-12-04 11:17:14 -05:00
yo-h
a5393b4661
Merge pull request #4746 from aschackmull/java/ssa-perf
...
Java: Improve performance of SSA.
2020-12-04 11:16:39 -05:00
Anders Schack-Mulligen
0cc324b715
Merge pull request #3839 from luchua-bc/uncaught-servlet-exception
...
Java: Uncaught servlet exception
2020-12-02 15:12:59 +01:00
Anders Schack-Mulligen
0175a596ef
Update java/ql/src/experimental/Security/CWE/CWE-600/UncaughtServletException.ql
2020-12-02 13:33:59 +01:00
Anders Schack-Mulligen
8f2094f0bf
Autoformat.
2020-11-30 14:42:38 +01:00
Anders Schack-Mulligen
88e0759365
Java: Change RemoteUserInput to private instead of removing.
2020-11-30 13:40:53 +01:00
Anders Schack-Mulligen
5a66d6ab93
Java: Improve performance of SSA.
2020-11-30 11:26:03 +01:00
Anders Schack-Mulligen
931322e4c5
Merge pull request #4668 from aschackmull/dataflow/refactor-pruning
...
Dataflow: Refactor pruning stages.
2020-11-30 09:37:04 +01:00
Anders Schack-Mulligen
028a72bcdd
Merge pull request #4610 from luchua-bc/java-nfe-local-android-dos
...
Java: Query to detect Local Android DoS caused by NFE
2020-11-27 14:20:23 +01:00
Anders Schack-Mulligen
fec9758252
Dataflow: Sync.
2020-11-27 12:16:43 +01:00
Anders Schack-Mulligen
8f4fce185b
Dataflow: Review fixes.
2020-11-27 12:16:28 +01:00
Jonas Jensen
ad4b2beafa
Merge pull request #4727 from criemen/remove-abstract-classes
...
C++/C#/JS/Python/Java XML.qll: Remove abstract from class hierarchy.
2020-11-27 08:17:21 +01:00
Anders Schack-Mulligen
2234d665ce
Add manual magic
2020-11-26 13:55:20 -05:00
yo-h
9bb949a8b1
Java: make some SMAP predicates private and add QLDoc
2020-11-26 13:55:19 -05:00
yo-h
f9e78085ac
Java: add dbscheme stats for SMAP relations
2020-11-26 13:55:18 -05:00
yo-h
edb41655b4
Java: incorporate SMAP locations into Top.hasLocationInfo
2020-11-26 13:55:17 -05:00
yo-h
e2419e8fed
Java: add SMAP relations to dbscheme
2020-11-26 13:55:17 -05:00
Anders Schack-Mulligen
f70072a2db
Merge pull request #3454 from porcupineyhairs/javaSSRf
...
Java : add request forgery query
2020-11-26 08:52:15 +01:00
Cornelius Riemenschneider
3bfb398516
Autoformat XML.qll.
2020-11-25 18:20:50 +01:00
Cornelius Riemenschneider
7eec988fb5
XML.qll: Remove abstract from class hierarchy.
2020-11-25 17:22:03 +01:00
Anders Schack-Mulligen
b192f6dfe0
Java: Remove some deprecated classes.
2020-11-24 14:04:01 +01:00
Anders Schack-Mulligen
3f04099c25
Update java/ql/src/experimental/CWE-918/RequestForgery.ql
...
Co-authored-by: Chris Smowton <smowton@github.com >
2020-11-24 13:18:58 +01:00
Anders Schack-Mulligen
0450489022
Java: Review fixes.
2020-11-24 11:31:44 +01:00
Anders Schack-Mulligen
2cf10a7658
Merge pull request #4427 from aschackmull/java/fastjson
...
Java: Add support for FastJson in unsafe deserialization.
2020-11-23 14:40:14 +01:00
Porcupiney Hairs
ebc6c49555
include suggestions from review.
2020-11-19 03:37:00 +05:30
Aditya Sharad
b9b6a35564
Merge pull request #4629 from pwntester/improve_bean_validation_query
...
Java: add some improvements to the bean validation query
2020-11-17 08:35:49 -08:00
Anders Schack-Mulligen
f74fc0ff26
Dataflow: Fix bad join-orders.
2020-11-17 14:28:25 +01:00
Anders Schack-Mulligen
4be731d2ab
Java: Adjust reference to static method and add test.
2020-11-16 11:47:58 +01:00
