Sebastian Bauersfeld
28f597440f
Add method invocations of Spring's SavedRequest as a remote sources.
2021-05-20 20:00:14 +07:00
haby0
effa2b162a
Add spring url redirection detect
2021-05-13 09:55:37 +08:00
haby0
5be9fbbc5a
Remove LogOperationSink and PrintSink
2021-04-27 14:12:33 +08:00
haby0
8296abcea8
Fix Modify the ql query (the qhelp part is not modified).
2021-04-19 20:59:47 +08:00
haby0
23b508c5e7
Merge remote-tracking branch 'upstream/main' into UseOfLessTrustedSource
2021-04-19 20:05:49 +08:00
Anders Schack-Mulligen
605f28f741
Merge pull request #5686 from smowton/haby0/JsonHijacking
...
Java: JSONP Injection w/cleanups
2021-04-16 11:09:17 +02:00
Chris Smowton
254de76078
Remove unnecessary stubs
2021-04-15 16:20:27 +01:00
haby0
b3bdf89fc2
rm VerificationMethodFlowConfig, use springframework-5.2.3 stub
2021-04-15 10:25:40 +08:00
Chris Smowton
58d198261e
Merge pull request #5663 from smowton/luchua/java/sensitive-cookie-not-httponly
...
Java: CWE-1004 Query to check sensitive cookies without the HttpOnly flag set w/minor corrections
2021-04-13 12:08:53 +01:00
haby0
86ef2588f1
Restore @Component annotation
2021-04-08 17:55:29 +08:00
haby0
3f0a3266aa
[Java] CWE-348: Use of less trusted source
2021-04-08 17:14:03 +08:00
Anders Schack-Mulligen
a1ccbcdaf1
Merge pull request #5260 from artem-smotrakov/spring-http-invoker
...
Java: Query for detecting unsafe deserialization with Spring exporters
2021-03-24 13:57:17 +01:00
luchua-bc
0a35feef76
Exclude CSRF cookies to reduce FPs
2021-03-11 17:28:07 +00:00
Artem Smotrakov
0a5d58ed8a
Cover more configurations in UnsafeSpringExporterInConfigurationClass.ql
2021-03-10 21:15:19 +03:00
Artem Smotrakov
15a43ffe36
Simplified returnsRemoteInvocationSerializingExporter()
2021-02-27 13:41:20 +01:00
Artem Smotrakov
aac0c27dcd
Added tests for SpringHttpInvokerUnsafeDeserialization.ql
2021-02-24 22:35:20 +01:00
Artem Smotrakov
7d2d27394b
Java: Added a source and a taint step for JexlInjectionConfig
...
- Added TaintedSpringRequestBody source
- Added returningTaintedDataFromBean() taint step
- Added tests
2021-01-17 22:28:42 +01:00
Porcupiney Hairs
38de9b6433
add request forgery query
2020-11-10 01:19:35 +05:30
Anders Schack-Mulligen
581d496167
Java: Fix LdapInjection qltest
2020-07-08 14:04:01 +02:00
Anders Schack-Mulligen
40b9d34ab9
Java: Consolidate springframework-5.2.3 stubs
2020-07-08 09:57:48 +02:00
Artem Smotrakov
df3adeec36
Java: Add a query for SpEL injections
...
- Added experimental/Security/CWE/CWE-094/SpelInjection.ql
and a couple of libraries
- Added a qhelp file with a few examples
- Added tests and stubs for Spring
2020-05-31 20:52:45 +03:00
Arthur Baars
ae2bab7e9c
Add test case
2020-04-28 16:57:03 +02:00
Anders Schack-Mulligen
9391058363
Java: Add unit test for ldap injection.
2020-01-29 11:37:33 +01:00
