Owen Mansel-Chan
|
a5d9cb179a
|
Merge pull request #20930 from owen-mc/java/spring-rest-template-request-forgery-sinks
Java: add more Spring RestTemplate request forgery sinks
|
2026-01-15 14:23:15 +00:00 |
|
Mauro Baluda
|
5cef0376a9
|
Update java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCouchBaseCredentials.java
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
|
2026-01-14 11:50:52 +01:00 |
|
Mauro Baluda
|
9efefa6120
|
Fix test expectations
|
2026-01-13 22:46:42 +01:00 |
|
Mauro Baluda
|
d335f039ef
|
Improve model for CWE-089
|
2026-01-13 21:48:43 +01:00 |
|
Mauro Baluda
|
89f0e79ea1
|
Fix SqlTainted test
|
2026-01-13 13:55:14 +01:00 |
|
Mauro Baluda
|
dda042f7df
|
rename change notes
|
2026-01-13 13:07:14 +01:00 |
|
Mauro Baluda
|
15ee88ee24
|
SQLi test case
|
2025-12-24 20:30:21 +01:00 |
|
Mauro Baluda
|
b22077c371
|
Hardcoded credentials in CouchBase
|
2025-12-22 20:22:20 +01:00 |
|
Owen Mansel-Chan
|
a85d0ea8a3
|
Make tests pass
|
2025-12-02 17:08:16 +00:00 |
|
Owen Mansel-Chan
|
8fd8fc07b7
|
Add failing tests for more regex match methods
|
2025-12-02 17:06:34 +00:00 |
|
Owen Mansel-Chan
|
969b0cf439
|
Add SSRF sinks for uriVariables arguments of more methods on Spring RestTemplate
|
2025-11-27 23:44:35 +00:00 |
|
Owen Mansel-Chan
|
1a59839f3c
|
Range library recognises long literals now
|
2025-11-24 14:10:54 +00:00 |
|
Owen Mansel-Chan
|
ec381e4ec5
|
Use range analysis and improve tests
|
2025-11-21 10:31:50 +00:00 |
|
aegilops
|
e904520779
|
Fixed formatting
|
2025-11-20 17:34:42 +00:00 |
|
aegilops
|
62ee6d3a33
|
Made changes requested by reviewers - bounded() for range checking, style and better comments
|
2025-11-20 11:46:42 +00:00 |
|
aegilops
|
fa703e3e60
|
Test cases for sensitive logging sanitizer
|
2025-11-14 16:53:46 +00:00 |
|
Tom Hvitved
|
a4eab484ce
|
Address review comments
|
2025-10-24 13:32:39 +02:00 |
|
Tom Hvitved
|
7a9cb64e2e
|
Java: Treat x.matches(regexp) as a sanitizer for request forgery
|
2025-10-24 09:06:57 +02:00 |
|
Joe Farebrother
|
d8b37d0cde
|
Review suggestions - update comments and description
|
2025-10-14 16:03:40 +01:00 |
|
Joe Farebrother
|
9cb593b020
|
Update tests
|
2025-10-13 14:51:37 +01:00 |
|
Joe Farebrother
|
c799f93811
|
Update tests and add inline expectations
|
2025-10-13 14:51:04 +01:00 |
|
Jami
|
3675e4bb4f
|
Merge branch 'main' into jcogs33/java/insecure-spring-actuator-config-promotion
|
2025-08-26 08:02:17 -04:00 |
|
Jami Cogswell
|
c9692a6d10
|
Java: fix test failures cause by alert msg change
|
2025-07-19 13:27:09 -04:00 |
|
Jami Cogswell
|
7250265c1f
|
Java: consider all endpoints except for health and info as sensitive to align with Spring docs
|
2025-07-18 17:50:18 -04:00 |
|
Jami Cogswell
|
685f68d9d3
|
Java: support 'management.endpoints.web.expose' property
|
2025-07-18 17:50:17 -04:00 |
|
Jami Cogswell
|
70d51504a7
|
Java: rename to align with 'java/spring-boot-exposed-actuators' query
|
2025-07-18 17:50:12 -04:00 |
|
Jami Cogswell
|
ea35fbbe3b
|
Java: support version 3.x
|
2025-07-18 17:50:07 -04:00 |
|
Jami Cogswell
|
0d2a4222fd
|
Java: add related location to alert message
|
2025-07-17 19:22:18 -04:00 |
|
Jami Cogswell
|
2bfc4b4ee2
|
Java: fix test case for version 1.4
Need the existence of an ApplicationProperties File, not an ApplicationProperties ConfigPair
|
2025-07-17 19:22:15 -04:00 |
|
Jami Cogswell
|
3823186dc6
|
Java: split tests by versions
splitting is required to properly test each scenario
|
2025-07-17 19:22:13 -04:00 |
|
Jami Cogswell
|
ed8da5e151
|
Java: convert tests to inline expectations
|
2025-07-17 19:22:08 -04:00 |
|
Jami Cogswell
|
fc930d9184
|
Java: update tests for non-experimental directory
|
2025-07-17 19:22:06 -04:00 |
|
Jami Cogswell
|
a39cb40177
|
Java: copy out of experimental
|
2025-07-17 19:22:01 -04:00 |
|
Nora Dimitrijević
|
b33058c967
|
[TEST] Java: SensitiveCommunication: convert to qlref
|
2025-07-17 18:59:05 +02:00 |
|
Nora Dimitrijević
|
44bb5e7220
|
[TEST] Java: ConditionalBypass: convert to qlref
|
2025-07-17 18:59:03 +02:00 |
|
Nora Dimitrijević
|
6134518d60
|
[TEST] Java: SensitiveLogInfo: convert to qlref
|
2025-07-17 18:59:01 +02:00 |
|
Nora Dimitrijević
|
94386f0550
|
[TEST] Java: TrustBoundaryViolations: convert test to qlref
|
2025-07-17 18:58:59 +02:00 |
|
Nora Dimitrijević
|
49e03b4dfd
|
[TEST] Java: UnsafeCertTrust: convert test to qlref
|
2025-07-17 18:58:56 +02:00 |
|
Nora Dimitrijević
|
7aced48443
|
[TEST] Java: LogInjection: convert test to qlref
|
2025-07-17 18:58:54 +02:00 |
|
Nora Dimitrijević
|
5c2cf79785
|
[TEST] Java: CWE-020/ExternalAPI: new test based on qhelp
|
2025-07-17 18:58:52 +02:00 |
|
Owen Mansel-Chan
|
805e31fdb9
|
Update test expectations
|
2025-07-16 15:25:45 +01:00 |
|
Owen Mansel-Chan
|
fdd1e3fefe
|
Use MaD models for unsafe deserialization sinks when possible
Many of the unsafe deserialization sinks have to stay defined in QL
because they have custom logic that cannot be expressed in MaD models.
|
2025-07-16 14:42:07 +01:00 |
|
Owen Mansel-Chan
|
8e4bd1a102
|
Add sink for ObjectInput.readObject to make test pass
|
2025-07-11 11:05:38 +01:00 |
|
Owen Mansel-Chan
|
34fae324a0
|
Add test for ObjectInput.readObject
|
2025-07-11 11:03:47 +01:00 |
|
Tom Hvitved
|
6fdec47e83
|
Java: Use MaD in log injection test
|
2025-07-08 10:25:58 +02:00 |
|
Nora Dimitrijević
|
e0b3a2c5f9
|
Java: convert ArbitraryApkInstallation test to .qlref
|
2025-06-26 13:22:05 +02:00 |
|
Nora Dimitrijević
|
690446149a
|
Java: add CleartextStorageCookie test
Given that it's a non-path-problem dataflow query, the InlineExpectationsTest is not as useful.
|
2025-06-24 18:12:19 +02:00 |
|
Nora Dimitrijević
|
e213e3fc37
|
Java: convert ImplicitPendingIntents test to .qlref
|
2025-06-24 16:42:37 +02:00 |
|
Nora Dimitrijević
|
e0311e26c6
|
Java: convert ImproperIntentVerification test to .qlref
It's a non-path query, so the InlineExpectationsTest postprocessor doesn't do anything.
|
2025-06-24 16:42:35 +02:00 |
|
Nora Dimitrijević
|
aac4f63e9a
|
Java: convert RequestForgery test to .qlref
|
2025-06-24 16:42:32 +02:00 |
|