10 Commits

Author	SHA1	Message	Date
luchua-bc	4e3791dc0d	Remove LoadCredentialsConfiguration and update qldoc	2021-04-09 19:36:35 +00:00
luchua-bc	1349bf7b0b	Create a .qll file to reuse the code and add check of Spring properties	2021-03-30 11:25:29 +00:00
Porcuiney Hairs	84c9137152	Include suggestions from review	2021-03-18 16:12:00 +05:30
porcupineyhairs	f27d2bdf6d	Update java/ql/src/experimental/semmle/code/java/Logging.qll ... Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com>	2021-03-18 16:12:00 +05:30
Porcuiney Hairs	d0c82d3756	Add flogger and android logging support	2021-03-18 16:12:00 +05:30
Porcuiney Hairs	17d7ba8049	Add Log Injection Vulnerability	2021-03-18 16:12:00 +05:30
Porcuiney Hairs	5151a528ac	Include suggestions from review	2021-03-01 22:59:30 +05:30
Porcupiney Hairs	42a84a18b0	JAVA : Add query to detect Apache Structs enabled DEvmode ... This query detects cases where the development mode is enabled for a struts configuration. I can't find a CVE per se but, at present, [Github's fuzzy search](https://github.com/search?q=%3Cconstant+name%3D%22struts.devMode%22+value%3D%22true%22+%2F%3E+language%3Axml&type=Code) returns more than 44000 results. Some of them look like they are classroom projects, so they may be ineligible for a CVE. But we should be flagging them anyways as setting the development on in a production system is a very bad practice and can often lead to remote code execution. So these should be fixed anyways.	2021-02-26 16:30:04 +05:30
Grzegorz Golawski	df9921f870	Update according to the review comments	2020-05-07 23:19:13 +02:00
Grzegorz Golawski	af48bc3e57	CodeQL query to detect JNDI injections	2020-04-17 21:45:42 +02:00