500 Commits

Author	SHA1	Message	Date
Chris Smowton	76838809bb	Merge pull request #5818 from artem-smotrakov/rmi-deserialization ... Java: Unsafe RMI deserialization	2021-06-11 13:43:07 +01:00
Tony Torralba	56a429a5f9	Merge branch 'main' into promote-jexl-injection	2021-06-03 11:10:56 +02:00
Anders Schack-Mulligen	5e96e28792	Java: Add missing metadata.	2021-06-02 10:24:46 +02:00
Anders Schack-Mulligen	a4661e1aca	Merge pull request #5704 from edvraa/regexj ... Java: Regex injection	2021-06-01 11:45:59 +02:00
Artem Smotrakov	8dc1451d42	Better recommendation in UnsafeDeserializationRmi.qhelp ... Co-authored-by: Chris Smowton <smowton@github.com>	2021-06-01 12:16:09 +03:00
Artem Smotrakov	b28d639166	Fixed errors in UnsafeDeserializationRmi.qhelp	2021-05-29 09:32:08 +02:00
Artem Smotrakov	62c6bee5f8	Simplified UnsafeDeserializationRmi.ql	2021-05-29 09:21:20 +02:00
Artem Smotrakov	1b51dd47ec	Added an example with deserialization filter to UnsafeDeserializationRmi.qhelp	2021-05-23 13:24:42 +02:00
Artem Smotrakov	c837605c85	Added test cases with sanitizers for UnsafeDeserializationRmi.ql	2021-05-23 13:01:22 +02:00
Artem Smotrakov	d2e29fc72c	Renamed RmiUnsafeDeserialization.ql -> UnsafeDeserializationRmi.ql	2021-05-23 10:21:05 +02:00
Artem Smotrakov	2d93eeae33	Covered deserialization filters in RmiUnsafeDeserialization.ql	2021-05-23 10:21:05 +02:00
Artem Smotrakov	e28f919f3d	Look for remote callable method only in RmiUnsafeDeserialization.ql	2021-05-23 10:21:05 +02:00
Artem Smotrakov	0182dfe1c0	Added RmiUnsafeDeserialization.qhelp	2021-05-23 10:21:04 +02:00
Artem Smotrakov	efa4b4f414	Cover Registry in RmiUnsafeDeserialization.ql	2021-05-23 10:21:04 +02:00
Artem Smotrakov	8b96ff9601	First draft of RmiUnsafeDeserialization.ql	2021-05-23 10:21:04 +02:00
luchua-bc	02aa9c6fc7	Optimize the sink and update qldoc	2021-05-18 16:12:23 +00:00
luchua-bc	d4323a4a54	Update qldoc	2021-05-18 16:12:23 +00:00
luchua-bc	9d392263a5	Refactor inconsistent method names	2021-05-18 16:12:23 +00:00
luchua-bc	2fa249a8eb	Update method name and qldoc	2021-05-18 16:12:23 +00:00
luchua-bc	2c1374bdcf	Use inline implementation for ScriptEngineFactory	2021-05-18 16:12:23 +00:00
luchua-bc	0ac8453398	Allow all arguments of methods in ScriptEngineFactory	2021-05-18 16:12:23 +00:00
luchua-bc	e4699f7fa9	Optimize the query	2021-05-18 16:12:22 +00:00
luchua-bc	d664aa6d6a	Include more scenarios and update qldoc	2021-05-18 16:12:22 +00:00
luchua-bc	852bcfb5c7	Refactor the ScriptEngine query and the Rhino code injection query into one	2021-05-18 16:12:22 +00:00
luchua-bc	b0b5338359	Rhino code injection	2021-05-18 16:12:22 +00:00
Chris Smowton	4230869ee2	Merge pull request #5819 from luchua-bc/java/jpython-injection ... Java: CWE-094 Jython code injection	2021-05-18 16:38:40 +01:00
Chris Smowton	71f540a755	Merge pull request #5844 from haby0/SpringRedirects ... [Java] CWE-601 Spring url redirection detect	2021-05-18 16:37:40 +01:00
luchua-bc	2a0721b2ae	Optimize the sink and update method name	2021-05-18 12:18:14 +00:00
haby0	e46de44473	Solve errors caused by private ownership	2021-05-18 19:56:32 +08:00
haby0	caf5f4d605	modified comment	2021-05-18 19:10:03 +08:00
haby0	a0cd551bae	Add filtering of String.format	2021-05-18 11:05:10 +08:00
luchua-bc	e652d8771c	Update method name and qldoc	2021-05-17 20:36:15 +00:00
luchua-bc	1497fba6f2	Remove the isAdditionalTaintStep predicate	2021-05-14 11:43:49 +00:00
haby0	498c99e26c	Add left value, Add return expression tracing flow	2021-05-14 16:31:59 +08:00
haby0	02e415045f	Delete RedirectBuilderFlowConfig	2021-05-13 15:48:15 +08:00
haby0	effa2b162a	Add spring url redirection detect	2021-05-13 09:55:37 +08:00
luchua-bc	e7cd6c9972	Optimize the query	2021-05-11 16:56:12 +00:00
Chris Smowton	0afe22d60c	Merge pull request #5710 from p0wn4j/jsch-os-injection ... [Java] CWE-078: Add JSch lib OS Command Injection sink	2021-05-10 16:12:00 +01:00
Hayk Andriasyan	fd88b72101	Delete JSchOSInjection.qhelp	2021-05-08 12:51:15 +04:00
Tony Torralba	e78e5b9ee4	Merge branch 'main' into promote-jexl-injection	2021-05-07 12:36:49 +02:00
Tony Torralba	26c3ff2cee	Move from experimental to standard	2021-05-06 09:18:49 +02:00
Tony Torralba	215118c7ea	Fixes in QLDocs and imports	2021-05-06 09:18:49 +02:00
Tony Torralba	d739a8cac2	Moved configuration from XPath.qll back to XPath Injection query	2021-05-06 09:18:48 +02:00
Tony Torralba	ed5619498c	WIP: XPath Injection promotion	2021-05-06 09:18:48 +02:00
Felicity Chapman	8b2009cfb1	Minor updates to qhelp file	2021-05-05 12:36:29 +01:00
Tony Torralba	f79d2e06f9	Fix failing checks	2021-05-04 11:29:09 +02:00
luchua-bc	703fbf139a	Add more methods and update the library name	2021-05-04 02:54:49 +00:00
Jaroslav Lobačevski	38bce39baa	Update UncaughtServletException.qhelp ... There is no single word in https://cwe.mitre.org/data/definitions/600.html about possible DoS or unexpected state.	2021-05-03 15:06:57 +03:00
Tony Torralba	4bfd34b1fe	Moved from experimental	2021-05-03 13:15:24 +02:00
Tony Torralba	38e052482c	More csv sinks and sources	2021-05-03 12:44:53 +02:00