Nicolas Will
61ec2aaa08
Autoformat QL files
2026-02-23 00:32:57 +01:00
Nicolas Will
9176564c81
Add ECMQV, PSS, MFG1 logic, fix tests
2026-02-23 00:23:47 +01:00
Nicolas Will
4c23111ceb
Update JCA.qll to fix overly specific barrier
...
Fix generic creation/init/use flow barrier logic: the barrier was previously cipher-specific inside a generic module, and other instances would therefore get no re-init barrier.
2026-02-22 17:53:28 +01:00
Nicolas Will
e0ff863b85
Support additional JCA algorithms and tests
...
Extend the experimental JCA model to recognize additional symmetric ciphers and padding/mode types (ARIA, Camellia, Twofish, SEED, Salsa20, LRW, PKCS1Padding, PSS) and fix DES/DESEDE classification ordering. Add test coverage with AdditionalSymmetricAlgorithms.java and expand existing tests: EllipticCurve1 (Ed448 and NIST P-256/P-384/P-521 key generation) and SymmetricModesTest (3DES ECB, DES CFB/OFB). Update standardization logic and test expectations (node_edges, node_properties, nodes) to reflect the new algorithm mappings.
2026-02-22 17:51:09 +01:00
Owen Mansel-Chan
94e3d86f6a
Merge pull request #21319 from owen-mc/java/javax-jakarta
...
Java: Always use both "javax" and "jakarta" at the beginning of Jave EE packages
2026-02-17 08:31:52 +00:00
github-actions[bot]
b5898c5a30
Post-release preparation for codeql-cli-2.24.2
2026-02-16 17:07:45 +00:00
github-actions[bot]
ef04f927fb
Release preparation for version 2.24.2
2026-02-16 13:29:25 +00:00
Owen Mansel-Chan
597be6a1c0
Add change note
2026-02-16 12:01:15 +00:00
Owen Mansel-Chan
94f1d94a2b
Rename MethodCall ma to mc
2026-02-16 12:01:14 +00:00
Owen Mansel-Chan
9fc95f5171
Expand log injection sanitizers to annotation regex matches
2026-02-16 12:01:13 +00:00
Owen Mansel-Chan
924bb92d91
Expand log injection sanitizer guards to non-annotation regex matches
2026-02-16 12:01:11 +00:00
Owen Mansel-Chan
60e58f8219
Refactor logInjectionGuard part 2
2026-02-16 12:01:10 +00:00
Owen Mansel-Chan
6c0c1d558e
Refactor logInjectionGuard part 1
2026-02-16 12:01:08 +00:00
Owen Mansel-Chan
91c731f68d
Fix new usage that was introduced
2026-02-16 11:03:27 +00:00
Owen Mansel-Chan
c4192b670b
More copilot suggestions
2026-02-16 11:02:21 +00:00
Owen Mansel-Chan
53b8f2abb1
Apply copilot's fixes
2026-02-16 11:02:20 +00:00
Owen Mansel-Chan
178fbf9600
Add missing QLDoc
2026-02-16 11:02:19 +00:00
Owen Mansel-Chan
6da3a4557e
Add change note
2026-02-16 11:02:17 +00:00
Owen Mansel-Chan
31840902cd
Fix places which already dealt with both javax and jakarta
2026-02-16 11:02:16 +00:00
Owen Mansel-Chan
4b240ebf8a
Define new predicate javaxOrJakarta()
2026-02-16 11:02:14 +00:00
Owen Mansel-Chan
a5e6f6daf9
Replace "javax" with javaxOrJakarta()
...
This is just a find-replace of `"javax` with `javaxOrJakarta() + "`.
2026-02-16 11:02:12 +00:00
Owen Mansel-Chan
47a9f87d9b
Merge pull request #21310 from owen-mc/java/regex-execution
...
Java: Add RegexMatch concept and recognise `@Pattern` annotation as sanitizer
2026-02-16 09:11:47 +00:00
Owen Mansel-Chan
16ddb5658f
Small refactor for stylistic consistency
2026-02-15 14:39:23 +00:00
Owen Mansel-Chan
d6b71a346e
Extend RegexMatch framework to allow for MatcherMatchesCall edge case
2026-02-15 14:39:21 +00:00
Owen Mansel-Chan
8f8f4c2d52
Fix Matcher.matches edge case
2026-02-14 00:28:37 +00:00
Owen Mansel-Chan
2e0f244376
Improve QLDoc on RegexMatch.getName()
2026-02-13 22:55:01 +00:00
Owen Mansel-Chan
c7099584b4
Put imports implementing abstract classes in private module
2026-02-13 22:51:53 +00:00
Owen Mansel-Chan
3c161f9c93
Make contract of RegexMatch clear
2026-02-13 22:47:44 +00:00
Owen Mansel-Chan
1fefa989d7
Rename RegexMatch and only include expressions
2026-02-13 22:45:48 +00:00
Owen Mansel-Chan
953ff9f0d0
PatternAnnotation.getString() should only be field reads
2026-02-13 22:41:20 +00:00
Owen Mansel-Chan
106254b220
Improve QLDocs
2026-02-13 22:40:36 +00:00
Owen Mansel-Chan
5bdf550317
Fix QLDocs
2026-02-12 16:57:14 +00:00
Owen Mansel-Chan
c539c2f4fd
Add change note
2026-02-12 16:57:12 +00:00
Owen Mansel-Chan
bfe26c1989
Add @Pattern as RegexExecution => SSRF sanitizer
2026-02-12 16:57:11 +00:00
Anders Schack-Mulligen
5c53677051
Java: Deprecate UnreachableBlocks.
2026-02-12 11:06:34 +01:00
Owen Mansel-Chan
6a8204d28c
"dataflow" -> "data flow" in QLDoc
2026-02-11 13:41:14 +00:00
Owen Mansel-Chan
1ee5728311
Add missing QLDoc
2026-02-11 13:40:20 +00:00
Owen Mansel-Chan
a22fd39230
Use RegexExecution in sanitizer definitions (expands scope)
2026-02-11 13:09:48 +00:00
Owen Mansel-Chan
fa3fba4a00
Use new regex-related classes (no functional change)
2026-02-11 13:09:46 +00:00
Owen Mansel-Chan
44eeee5757
Add and improve classes for regex-related methods
2026-02-11 13:09:45 +00:00
Owen Mansel-Chan
e6dbd525c3
Add RegexExecution in Concepts.qll
2026-02-11 13:09:42 +00:00
Anders Schack-Mulligen
5116b0c1e5
Java: Add delayed deprecation annotation.
2026-02-10 14:02:48 +01:00
Anders Fugmann
c5179e40c6
Kotlin: Add change note for supporting 2.3.10
2026-02-06 14:59:34 +01:00
Anders Schack-Mulligen
29e01748b7
Merge pull request #21267 from aschackmull/java/rename-misc
...
Java: Rename several AST predicates.
2026-02-05 11:15:29 +01:00
Anders Schack-Mulligen
11003e685d
Java: Fix qldoc
2026-02-05 10:37:19 +01:00
Anders Schack-Mulligen
32fe12a6dd
Java: Delay deprecation a bit.
2026-02-05 08:51:27 +01:00
Anders Schack-Mulligen
2d02908e7f
Java: Add change note.
2026-02-04 14:43:32 +01:00
Anders Schack-Mulligen
4fcf3fbff8
Java: Make loop classes extend LoopStmt and use getBody instead of getStmt.
2026-02-04 14:43:31 +01:00
Anders Schack-Mulligen
6f40ac15b4
Java: Rename ReturnStmt.getResult to getExpr.
2026-02-04 14:43:31 +01:00
Anders Schack-Mulligen
36fa0a22f9
Java: Rename getTrueExpr/getFalseExpr on ConditionalExpr to getThen/getElse.
2026-02-04 13:38:11 +01:00
