Anders Schack-Mulligen
8e6dd51f50
Merge pull request #5868 from Marcono1234/marcono1234/ignore-not-closing-char-array-closeable
...
Java: Ignore char array based closeables for CloseReader.ql and CloseWriter.ql
2021-06-02 15:00:59 +02:00
Chris Smowton
7382b349c2
Merge pull request #5987 from aschackmull/java/query-metadata
...
Java: Add missing metadata.
2021-06-02 12:40:34 +01:00
Anders Schack-Mulligen
8a20395857
Merge pull request #5940 from pwntester/main
...
Remove XSS sink for Java
2021-06-02 12:30:20 +02:00
Anders Schack-Mulligen
c0e562de21
Merge pull request #5979 from hvitved/java/shared-external-summaries
...
Java: Move some CSV flow summary code into shared library
2021-06-02 12:28:45 +02:00
Alvaro Muñoz
a3a215afea
HTTP -> Http
2021-06-02 11:12:39 +02:00
Anders Schack-Mulligen
5e96e28792
Java: Add missing metadata.
2021-06-02 10:24:46 +02:00
Alvaro Muñoz
9aba92397d
lift XssSink check to InformationLeakSink
2021-06-01 17:16:41 +02:00
Alvaro Muñoz
0fb692400c
fix failing test
2021-06-01 13:57:13 +02:00
Tom Hvitved
14f9a5c280
Java: Move some CSV flow summary code into shared library
2021-06-01 13:22:14 +02:00
Anders Schack-Mulligen
ce509eb7e1
Merge pull request #5927 from aschackmull/dataflow/flowthrough-dispatch-perf
...
Dataflow: Improve performance in flow-through pruning
2021-06-01 11:46:22 +02:00
Anders Schack-Mulligen
a4661e1aca
Merge pull request #5704 from edvraa/regexj
...
Java: Regex injection
2021-06-01 11:45:59 +02:00
Anders Schack-Mulligen
5d21c64247
Dataflow: qldoc fix.
2021-06-01 10:49:47 +02:00
Anders Schack-Mulligen
4f9a6c151b
Dataflow: Code review fixes.
2021-06-01 10:29:17 +02:00
Anders Schack-Mulligen
683f853fa5
Dataflow: Fix another bad join order.
2021-05-31 15:14:13 +02:00
Alvaro Muñoz
41d034d5a0
Attempt to use information-leak sink category
2021-05-30 00:22:40 +02:00
Alvaro Muñoz
735e4e4b7b
update failing tests
2021-05-28 15:13:18 +02:00
Alvaro Muñoz
706874491b
Remove XSS sink for Java
2021-05-28 15:13:18 +02:00
Erik Krogh Kristensen
79989cc3f4
CPP/Java: Fix getAPrimaryQlClass implementations
2021-05-27 21:36:27 +02:00
Anders Schack-Mulligen
d05f524759
Merge pull request #5941 from aschackmull/java/virt-disp-perf
...
Java: Improve performance of virtual dispatch calculation.
2021-05-25 14:44:51 +02:00
Anders Schack-Mulligen
4884da363f
Java: Bugfix.
2021-05-25 11:48:35 +02:00
Anders Schack-Mulligen
017bf68906
Dataflow: Fix bad join order.
2021-05-25 11:40:53 +02:00
Anders Schack-Mulligen
d00618f4f4
Java: Improve performance of virtual dispatch calculation.
2021-05-21 15:04:08 +02:00
Sebastian Bauersfeld
28f597440f
Add method invocations of Spring's SavedRequest as a remote sources.
2021-05-20 20:00:14 +07:00
Anders Schack-Mulligen
4406b8e339
Dataflow: Sync.
2021-05-19 19:22:36 +02:00
Anders Schack-Mulligen
bb258813a1
Dataflow: Improve performance for dispatch-join in flow-through.
2021-05-19 19:20:57 +02:00
luchua-bc
02aa9c6fc7
Optimize the sink and update qldoc
2021-05-18 16:12:23 +00:00
luchua-bc
d4323a4a54
Update qldoc
2021-05-18 16:12:23 +00:00
luchua-bc
9d392263a5
Refactor inconsistent method names
2021-05-18 16:12:23 +00:00
luchua-bc
2fa249a8eb
Update method name and qldoc
2021-05-18 16:12:23 +00:00
luchua-bc
2c1374bdcf
Use inline implementation for ScriptEngineFactory
2021-05-18 16:12:23 +00:00
luchua-bc
0ac8453398
Allow all arguments of methods in ScriptEngineFactory
2021-05-18 16:12:23 +00:00
luchua-bc
e4699f7fa9
Optimize the query
2021-05-18 16:12:22 +00:00
luchua-bc
d664aa6d6a
Include more scenarios and update qldoc
2021-05-18 16:12:22 +00:00
luchua-bc
852bcfb5c7
Refactor the ScriptEngine query and the Rhino code injection query into one
2021-05-18 16:12:22 +00:00
luchua-bc
b0b5338359
Rhino code injection
2021-05-18 16:12:22 +00:00
Chris Smowton
4230869ee2
Merge pull request #5819 from luchua-bc/java/jpython-injection
...
Java: CWE-094 Jython code injection
2021-05-18 16:38:40 +01:00
Chris Smowton
71f540a755
Merge pull request #5844 from haby0/SpringRedirects
...
[Java] CWE-601 Spring url redirection detect
2021-05-18 16:37:40 +01:00
luchua-bc
2a0721b2ae
Optimize the sink and update method name
2021-05-18 12:18:14 +00:00
haby0
e46de44473
Solve errors caused by private ownership
2021-05-18 19:56:32 +08:00
haby0
caf5f4d605
modified comment
2021-05-18 19:10:03 +08:00
Anders Schack-Mulligen
9b0e3b1950
Merge pull request #5814 from JLLeitschuh/feat/JLL/jackson_as_taint_step
...
[Java] Add taint tracking through Jackson deserialization
2021-05-18 09:31:16 +02:00
haby0
a0cd551bae
Add filtering of String.format
2021-05-18 11:05:10 +08:00
luchua-bc
e652d8771c
Update method name and qldoc
2021-05-17 20:36:15 +00:00
Anders Schack-Mulligen
77c93dcf26
Make private
2021-05-17 10:35:04 +02:00
Marcono1234
73c7e15580
Java: Add back StringInputStream to CloseReader.ql
2021-05-14 22:25:00 +02:00
luchua-bc
1497fba6f2
Remove the isAdditionalTaintStep predicate
2021-05-14 11:43:49 +00:00
Robin Neatherway
f378513ea3
Add lines-of-code tags
...
This is a proposed method for advertising which queries are measuring
the lines of code in a project in a more robust manner than inspecting
the rule id.
Note that the python "LinesOfUserCode" query should _not_ have this
property, as otherwise the results of the two queries will be summed.
2021-05-14 11:20:43 +01:00
haby0
498c99e26c
Add left value, Add return expression tracing flow
2021-05-14 16:31:59 +08:00
haby0
02e415045f
Delete RedirectBuilderFlowConfig
2021-05-13 15:48:15 +08:00
haby0
effa2b162a
Add spring url redirection detect
2021-05-13 09:55:37 +08:00
