hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 20:56:33 +01:00
Code Issues Packages Projects Releases Wiki Activity
9,782 Commits 1,673 Branches 157 Tags
287af2bdecf1aca3ef0c37c6fdf79124463b6dfd
Commit Graph

530 Commits

Author SHA1 Message Date
Chris Gavin
484333b192 Java: Update help and description of java/suspicious-date-format. 2020-01-27 11:57:59 +00:00
Chris Gavin
0e8d435ca1 Java: Add a test for java/suspicious-date-format. 2020-01-27 11:57:59 +00:00
Chris Gavin
88146295f9 Java: Add a query for suspicious date format patterns. 2020-01-27 11:57:18 +00:00
Anders Schack-Mulligen
816a8d1f9e Merge pull request #2586 from ggolawski/spring_disable_csrf 
Add check for disabled CSRF protection in Spring
 2020-01-27 11:32:39 +01:00
Esben Sparre Andreasen
8deefd60a7 java: fixup whitespace/tabs in test 2020-01-24 11:01:38 +01:00
Esben Sparre Andreasen
57b3a55b48 java: sharpen java/maven/non-https-url to allow localhost URLs 2020-01-24 08:51:54 +01:00
Esben Sparre Andreasen
a5558809f4 java: add more tests for java/maven/non-https-url 2020-01-24 08:49:59 +01:00
yo-h
eb6f8da080 Merge pull request #2679 from aschackmull/java/remove-depr-flow-fwd-back 
Java/C++/C#: Remove the deprecated hasFlowForward/hasFlowBackward.
 2020-01-23 14:10:28 -05:00
yo-h
50320c7828 Merge pull request #2628 from aschackmull/java/no-adhoc-testclass 
Java: Replace ad-hoc TestClass detection.
 2020-01-23 14:09:11 -05:00
Anders Schack-Mulligen
e7f7c7370a Java/C++/C#: Remove the deprecated hasFlowForward/hasFlowBackward. 2020-01-23 14:05:18 +01:00
yo-h
9d70358ec4 Merge pull request #2640 from aschackmull/java/nullness-fp-tests 
Java: Document two FPs with unit tests.
 2020-01-22 16:28:30 -05:00
yo-h
9a939534c7 Merge pull request #2670 from aschackmull/java/remove-parityanalysis 
Java: Remove the deprecated ParityAnalysis.
 2020-01-22 16:22:34 -05:00
Grzegorz Golawski
5596944926 Add check for disabled CSRF protection in Spring 
Fix help and correct formatting.
 2020-01-22 21:27:34 +01:00
Anders Schack-Mulligen
cf004ac9d8 Java: Remove the deprecated ParityAnalysis. 2020-01-22 11:45:18 +01:00
Grzegorz Golawski
c5a974788b Add check for disabled CSRF protection in Spring 
Fix the help according to review comments.
 2020-01-21 21:54:36 +01:00
Anders Schack-Mulligen
9cc0d3d1f4 Java/C++/C#: Remove DataFlowLocation as it's no longer needed. 2020-01-21 15:08:39 +01:00
Anders Schack-Mulligen
2dca188288 Java: Document two FPs with unit tests. 2020-01-17 09:57:11 +01:00
Tom Hvitved
f7278d36e1 Merge pull request #2498 from aschackmull/java/taint-getter 
Java/C++/C#: Add support for taint-getter/setter summaries in data flow.
 2020-01-15 09:55:19 +01:00
Anders Schack-Mulligen
a6526c60cb Java: Replace ad-hoc TestClass detection. 2020-01-14 14:26:22 +01:00
Anders Schack-Mulligen
241b8a05e4 Java/C++/C#: Address review comment. 2020-01-14 11:59:55 +01:00
Anders Schack-Mulligen
041bcc5812 Java/C++/C#: Small perf improvement and simplification. 2020-01-13 17:00:56 +01:00
Anders Schack-Mulligen
ad92d6fe0f Merge pull request #2607 from yo-h/java-alert-suppression-block-comment 
Java: allow single-line `/* ... */` comments for alert suppression
 2020-01-10 11:05:23 +01:00
yo-h
7ffa517803 Merge pull request #2584 from aschackmull/java/nonnull-final-field 
Java: Include non-null final fields in clearlyNotNull.
 2020-01-09 18:48:45 -05:00
yo-h
1078424f79 Java: allow single-line /* ... */ comments for alert suppression 2020-01-08 09:19:25 -05:00
Anders Schack-Mulligen
d918cb1f6f Merge pull request #2550 from JLLeitschuh/task/JLL/improve_netty_response_splitting_detection 
Add io.netty.handler.codec.http.DefaultHttpResponse to Netty Response Splitting Detection
 2020-01-07 14:28:01 +01:00
Anders Schack-Mulligen
9ba169b346 Java: Fix bad join-order. 2020-01-06 16:52:06 +01:00
Grzegorz Golawski
4ce25c045d Simplify the query 2020-01-05 22:05:00 +01:00
Grzegorz Golawski
ab49397bb8 Add check for disabled CSRF protection in Spring 2020-01-03 21:52:50 +01:00
Anders Schack-Mulligen
e74aa33f9d Java: Include non-null final fields in clearlyNotNull. 2020-01-03 16:24:54 +01:00
Jonathan Leitschuh
0e2c5db7b1 Netty Response Splitting use CompileTimeConstantExpr 
Co-Authored-By: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2020-01-03 07:51:55 -05:00
Anders Schack-Mulligen
7e987c570f Merge pull request #2413 from JLLeitschuh/feature/JLL/maven_insecure_artifact_resolution 
Java: Use of HTTP/FTP to download/upload Maven artifacts
 2020-01-02 14:47:30 +01:00
Tom Hvitved
29cd6a9e30 Sync XML.qll 2019-12-19 10:29:30 +01:00
Jonathan Leitschuh
75939afe9c Update java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.qhelp 
Co-Authored-By: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>
 2019-12-18 09:53:36 -05:00
Jonathan Leitschuh
b218374772 Add io.netty.handler.codec.http.DefaultHttpResponse to Netty Response Splitting Detection 
Related: #2185
Related: https://github.com/github/security-lab/issues/22
 2019-12-17 12:12:04 -05:00
Anders Schack-Mulligen
ca08097b56 Java/C++/C#: Fix Java Content.getType and getContainerType to match C# and fix C# tests. 2019-12-17 11:51:58 +01:00
Max Schaefer
09ee106333 Java/JavaScript: Add two deprecated predicates to XML.qll. 
This makes XML.qll identical across C++, Java, JavaScript and Python.
 2019-12-17 10:15:43 +00:00
Max Schaefer
923e36ba4f C++/Java/JavaScript/Python: Make qldoc consistent. 2019-12-17 10:15:43 +00:00
Max Schaefer
a2fe678464 C++/Java/JavaScript/Python: Unify imports in XML.qll. 2019-12-17 10:15:43 +00:00
yo-h
69a2632806 Merge pull request #2341 from aschackmull/java/cached-tostring-perf-fixes 
Java: Fix a number of performance issues when toString is cached.
 2019-12-16 22:01:35 -05:00
Anders Schack-Mulligen
a97e7bd3b2 Java/C++/C#: Some review fixes. 2019-12-16 16:17:19 +01:00
Anders Schack-Mulligen
a1a875e3e1 Java/C++/C#: Fix autoformat. 2019-12-16 16:15:48 +01:00
Anders Schack-Mulligen
02068ecdcd Java/C++/C#: Sync. 2019-12-16 16:15:48 +01:00
Anders Schack-Mulligen
bca79cd4d6 Java/C++/C#: Add support for taint-getter/setter summaries. 2019-12-16 16:15:48 +01:00
Anders Schack-Mulligen
13f12c5332 Java: Fix characteristic predicate of XMLParent. 2019-12-13 15:20:52 +01:00
Anders Schack-Mulligen
f88623ccb4 Java: Add .expected file to qltest. 2019-12-13 14:34:29 +01:00
Jonathan Leitschuh
0c2da8af40 Update java/ql/src/Security/CWE/CWE-829/InsecureDependencyResolution.ql 2019-12-12 14:10:11 -05:00
Jonathan Leitschuh
229622459c Update InsecureDependencyResolution with code review comments 2019-12-09 20:37:53 -05:00
Jonathan Leitschuh
f341234edb Apply suggestions from code review 
Co-Authored-By: Felicity Chapman <felicitymay@github.com>
Co-Authored-By: yo-h <55373593+yo-h@users.noreply.github.com>
 2019-12-09 19:17:23 -05:00
Henning Makholm
baacc6f66b Java tests: add queries.xml 
The `queries.xml` file defines which extractor the `codeql test` runner will use
to extract databases for the tests. In the future one will be able to write this
information in `qlpack.yml`, but we can't do that immediately because the
_existing_ CodeQL tooling would  refuse to parse  a `qlpack.yml` that has
the new field in it.
 2019-12-07 02:38:02 +01:00
yo-h
ed97be459f Merge pull request #2454 from aschackmull/java/explicit-mul-zero 
Java: Allow explicit zero multiplication in java/evaluation-to-constant.
 2019-12-06 18:13:43 -05:00