885 Commits

Author	SHA1	Message	Date
Anders Schack-Mulligen	74d35f4f37	Java: Add support for value-preserving steps.	2021-02-18 11:26:15 +01:00
Anders Schack-Mulligen	04eeeda2c9	Java: Add documentation for the final column.	2021-02-18 11:23:49 +01:00
Anders Schack-Mulligen	6f583baa90	Java: More documentation and support for field writes.	2021-02-18 11:18:31 +01:00
Anders Schack-Mulligen	e9bfbb677d	Java: Connect the external sources and steps to the defaults.	2021-02-10 17:06:21 +01:00
Anders Schack-Mulligen	5a391ab6c0	Java: Add qldoc.	2021-02-10 16:54:48 +01:00
Anders Schack-Mulligen	3a6fa9d99b	Java: Add support for framework modelling through csv data.	2021-02-10 13:25:03 +01:00
Anders Schack-Mulligen	35e620a19c	Merge pull request #4854 from luchua-bc/java/insecure-ldap-auth ... Java: Insecure LDAP authentication	2021-02-04 14:56:38 +01:00
Anders Schack-Mulligen	40d02e7e32	Merge pull request #4926 from luchua-bc/java/insufficient-key-size ... Java: Query to detect weak encryption: insufficient key size	2021-02-03 15:16:10 +01:00
Anders Schack-Mulligen	0df7e9fa4e	Merge pull request #4989 from lcartey/lcartey/spring-inheritence-improvements ... Java: Track taint through Spring Java bean getters on super types	2021-02-03 15:06:03 +01:00
luchua-bc	3151aeff48	Enhance the query	2021-02-02 18:26:29 +00:00
luchua-bc	50be54385a	Update qldoc	2021-02-02 14:49:50 +00:00
Luke Cartey	76c9b6466e	Reformat TaintTrackingUtil.qll with more recent CodeQL CLI	2021-01-29 11:27:30 +00:00
luchua-bc	cbaee937d0	Optimize the query	2021-01-28 04:06:27 +00:00
luchua-bc	cfc950f803	Query for weak encryption: Insufficient key size	2021-01-28 03:25:15 +00:00
Joe Farebrother	d69ecde5c1	Java: Add additional flow steps for guava collection methods and more unit tests	2021-01-25 16:37:40 +00:00
Joe Farebrother	7e11d8ed07	Java: Add modelling for guava Sets	2021-01-25 16:37:40 +00:00
Joe Farebrother	d1427fcd93	Java: Add modelling for Guava's collection classes	2021-01-25 16:37:40 +00:00
Luke Cartey	5c6f5b7b33	Java: Track taint through Spring Java bean getters on super types	2021-01-20 16:53:03 +00:00
Anders Schack-Mulligen	dde8d320f3	Apply suggestions from code review ... Minor qldoc fixes.	2021-01-19 08:24:24 +01:00
Marcono1234	703336a77f	Add ArrayInit.getSize(), improve documentation	2021-01-18 16:44:53 +01:00
Anders Schack-Mulligen	29935e1388	Merge pull request #4771 from intrigus-lgtm/split-cwe-295 ... Java: Add unsafe hostname verification query and remove existing overlapping query	2021-01-13 11:31:38 +01:00
intrigus-lgtm	4cfdb10ddc	Java: Improve QLDoc & simplify code ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2021-01-11 18:50:43 +01:00
intrigus	5c1e746c96	Java: Rename to EnvReadMethod	2021-01-11 13:42:08 +01:00
intrigus	b4692734b2	Java: Add QLDoc improve query message	2021-01-11 13:42:08 +01:00
intrigus	d98b171998	Java: Make EnvTaintedMethod public + QL-Doc	2021-01-11 13:42:07 +01:00
intrigus	e021158b5f	Java: Tighter model of HostnameVerifier#verify ... This more tightly models `HostnameVerifier#verify` previously it was possible to accidentally match other methods called `verify`.	2021-01-11 13:42:07 +01:00
intrigus	8df5d77398	Java: Model HostnameVerifier method ... Model `HostnameVerifier#setDefaultHostnameVerifier`	2021-01-11 13:42:06 +01:00
Anders Schack-Mulligen	3a2dd8f1ed	Merge pull request #4867 from RasmusWL/java-externalapis-taint-step ... Java: Fix taint-step handling for untrusted-data-external-api	2021-01-11 13:36:59 +01:00
Rasmus Wriedt Larsen	00c253a710	Java: Don't ignore local taint steps (fixup)	2021-01-08 15:29:01 +01:00
Anders Schack-Mulligen	e5b4975450	Merge pull request #4675 from luchua-bc/cleartext-storage-shared-prefs ... Java: Query to detect cleartext storage of sensitive information using Android SharedPreferences	2021-01-08 12:41:34 +01:00
luchua-bc	606d0946fc	Update qldoc	2021-01-07 14:05:12 +00:00
luchua-bc	b54e5b1c49	Revamp the library module	2021-01-07 12:44:59 +00:00
luchua-bc	f13b8814f5	Update class/method names in the module	2021-01-06 16:49:35 +00:00
luchua-bc	5690bf49f4	Optimize the query	2021-01-06 16:21:26 +00:00
Jonathan Leitschuh	ba4a562c9a	Update PrintAst.actual with new test output	2021-01-04 23:37:58 -05:00
Jonathan Leitschuh	028e4756bb	Apply suggestions from code review ... Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com>	2021-01-04 10:13:52 -05:00
luchua-bc	c069a5b4c6	Factor private host regex into the networking library and enhance the query	2021-01-04 14:51:32 +00:00
Jonathan Leitschuh	54950c2f42	Add MethodAccessSystemGetProperty predicate	2021-01-01 20:07:45 -05:00
Rasmus Wriedt Larsen	874af7637f	Java: Fix taint-step handling for untrusted-data-external-api ... The previous implementation would not handle any `AdditionalTaintStep` subclasses.	2020-12-22 11:02:50 +01:00
luchua-bc	bed8a68d28	Exclude broken algorithms from the list of secure algorithms	2020-12-17 00:41:23 +00:00
luchua-bc	6b77922a25	Fix typo and update qldoc	2020-12-16 14:04:45 +00:00
luchua-bc	d7facb42d6	Add missing broken crypto algorithms	2020-12-16 04:32:11 +00:00
Joe Farebrother	24dc631a8f	Java: Fix false positive in XXE query	2020-12-08 16:38:42 +00:00
yo-h	54d7cac46d	Merge pull request #4718 from aschackmull/java/cleanup-deprecated ... Java: Remove some deprecated classes.	2020-12-04 11:17:14 -05:00
yo-h	a5393b4661	Merge pull request #4746 from aschackmull/java/ssa-perf ... Java: Improve performance of SSA.	2020-12-04 11:16:39 -05:00
Anders Schack-Mulligen	0cc324b715	Merge pull request #3839 from luchua-bc/uncaught-servlet-exception ... Java: Uncaught servlet exception	2020-12-02 15:12:59 +01:00
Anders Schack-Mulligen	8f2094f0bf	Autoformat.	2020-11-30 14:42:38 +01:00
Anders Schack-Mulligen	88e0759365	Java: Change RemoteUserInput to private instead of removing.	2020-11-30 13:40:53 +01:00
Anders Schack-Mulligen	5a66d6ab93	Java: Improve performance of SSA.	2020-11-30 11:26:03 +01:00
Anders Schack-Mulligen	931322e4c5	Merge pull request #4668 from aschackmull/dataflow/refactor-pruning ... Dataflow: Refactor pruning stages.	2020-11-30 09:37:04 +01:00