intrigus
4a00670b68
Java: Reduce long comment.
2021-06-25 16:47:24 +02:00
intrigus
45cec3df1c
Java: Use this consistently in QL classes.
2021-06-25 16:47:24 +02:00
intrigus
0c1ce74135
Java: Switch from tabs to spaces.
2021-06-25 16:47:24 +02:00
intrigus
6d09db6fd6
Java: Explicitly list custom flow steps.
2021-06-25 16:47:23 +02:00
intrigus
e4775e0fae
Java: Remove "intention-guessing" sanitizer & simplify.
...
This removes the sanitizer part that classified some results as FP
if the results were in methods with certain names, like
`disableVerification()`. I now think that it's a bad idea to filter
based on the method name.
The custom flow steps in `flagFlowStep` are now listed explicitly.
Simplified check whether a method throws an exception.
2021-06-25 16:47:23 +02:00
intrigus
8a7f6b72e9
Java: Apply suggestions for QHelp
2021-06-25 16:47:23 +02:00
intrigus
d37d922e8f
Java: Fix Typos
2021-06-25 16:47:22 +02:00
intrigus-lgtm
030c286902
Java: Use machine-in-the-middle consistently
2021-06-25 16:47:22 +02:00
intrigus-lgtm
f52e438f3e
Java: Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2021-06-25 16:47:22 +02:00
intrigus
87554a78d4
Java: Add insecure trust manager query.
2021-06-25 16:47:22 +02:00
Calum Grant
32f6a465b0
Merge pull request #6080 from github/calumgrant/security-severities
...
Update security-severity scores
2021-06-18 09:40:40 +01:00
Chris Smowton
b66dcbe5b6
Factor request-forgery config so it can be used in an inline-expectations test
2021-06-17 11:43:32 +01:00
Chris Smowton
a665d5d111
Improve RequestForgery.qhelp recommendation
2021-06-17 11:41:05 +01:00
Chris Smowton
fb2989c16b
Copyedit comments and function names
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-06-17 11:41:04 +01:00
Chris Smowton
575198a0e4
Java SSRF query: Server Side -> Server-Side everywhere.
2021-06-17 11:41:04 +01:00
Chris Smowton
7899e17f3a
Java SSRF query: move RequestForgery qll file into semmle/code hierarchy
...
This makes it importable by people wishing to extend the query.
2021-06-17 11:41:04 +01:00
Chris Smowton
532a10bfdf
Java SSRF query: Provide hook for custom taint-propagating steps; make all default sinks/sanitizers/steps private.
2021-06-17 11:41:04 +01:00
Chris Smowton
e8613367e8
Java SSRF query: copyedit qhelp
2021-06-17 11:41:04 +01:00
Chris Smowton
3333e7d186
Java SSRF query: sanitize primitives
...
Even 'char' isn't a realistic vector for an exploit, unless somebody is copying out a string char by char.
2021-06-17 11:41:04 +01:00
Chris Smowton
6933d06a46
Add exactly the string '/' as a sanitizing prefix.
...
Usually this is ignored for suspicion that it could be taken for a protocol specifier, but on balance the context `(something) + "/" + tainted()` is more likely to be taken for a user-controlled location within a host the user does not control.
2021-06-17 11:41:03 +01:00
Chris Smowton
bc43b6d760
Fix typo
2021-06-17 11:41:03 +01:00
Chris Smowton
e6249eed79
Add doc comments
2021-06-17 11:41:03 +01:00
Chris Smowton
26e10f3ad5
SSRF: don't consider results of fetches we initiated to be untrustworthy
2021-06-17 11:41:03 +01:00
Chris Smowton
c63d5986cf
Sanitize StringBuilder appends that follow directly from a constructor.
...
Note that some of this logic ought to be incorporated into StringBuilderVar once that code can be reviewed.
2021-06-17 11:41:03 +01:00
Chris Smowton
b5a450b881
SSRF query: add sanitizer looking for a variety of ways of prepending a sanitizing prefix, such as one that restricts the hostname a URI will refer to.
2021-06-17 11:41:03 +01:00
Chris Smowton
487c1db6ed
Promote SSRF query to main query set
2021-06-17 11:41:01 +01:00
haby0
c1ada6d85b
Merge branch 'main' into java/UnsafeDeserialization
2021-06-16 16:37:03 +08:00
Calum Grant
771e686946
Update security-severity scores
2021-06-15 13:25:17 +01:00
Calum Grant
a594afb828
Add security-severity metadata
2021-06-10 20:11:08 +01:00
Tony Torralba
56a429a5f9
Merge branch 'main' into promote-jexl-injection
2021-06-03 11:10:56 +02:00
Alvaro Muñoz
a3a215afea
HTTP -> Http
2021-06-02 11:12:39 +02:00
Alvaro Muñoz
9aba92397d
lift XssSink check to InformationLeakSink
2021-06-01 17:16:41 +02:00
Alvaro Muñoz
0fb692400c
fix failing test
2021-06-01 13:57:13 +02:00
haby0
d6782767b7
Fix typos
2021-05-31 11:12:22 +08:00
Alvaro Muñoz
41d034d5a0
Attempt to use information-leak sink category
2021-05-30 00:22:40 +02:00
haby0
58d774ae85
add change notes
2021-05-17 14:52:05 +08:00
haby0
60fc607449
Modify ql
2021-05-14 18:17:05 +08:00
haby0
12f47bcf24
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
Tony Torralba
e78e5b9ee4
Merge branch 'main' into promote-jexl-injection
2021-05-07 12:36:49 +02:00
Tony Torralba
b37b15cea4
Re-structure imports, add some new comments to tests
2021-05-07 12:33:51 +02:00
Tony Torralba
b69be30b88
Fix imports as suggested in code review
2021-05-07 11:07:06 +02:00
Tony Torralba
f16605b3c1
Apply suggestions from code review
...
Co-authored-by: Felicity Chapman <felicitymay@github.com >
2021-05-06 15:17:55 +02:00
Tony Torralba
76468559ba
Add safe example for dom4j
2021-05-06 10:17:25 +02:00
Tony Torralba
26c3ff2cee
Move from experimental to standard
2021-05-06 09:18:49 +02:00
Tony Torralba
f79d2e06f9
Fix failing checks
2021-05-04 11:29:09 +02:00
Tony Torralba
745a6f6fb4
Getters called on parameters propagate taint
2021-05-03 17:43:33 +02:00
Tony Torralba
4d5ec87de9
Use InlineTest
2021-05-03 13:27:24 +02:00
Tony Torralba
4bfd34b1fe
Moved from experimental
2021-05-03 13:15:24 +02:00
Tamás Vajk
4cc88662e2
Merge pull request #5557 from tamasvajk/feature/java-sinks-csv
...
Java: convert sinks to CSV
2021-04-27 15:58:09 +02:00
Tamas Vajk
5b79094f34
Fix naming in HTTPS URL check
2021-04-27 14:59:52 +02:00
