Owen Mansel-Chan
|
e96ba4806b
|
Merge pull request #21415 from owen-mc/java/validate-constructor-summary-models
Java: validate constructor summary models
|
2026-03-06 09:09:18 +00:00 |
|
Owen Mansel-Chan
|
92a719092a
|
Update models in test output
|
2026-03-05 13:32:52 +00:00 |
|
Anders Schack-Mulligen
|
8ef4be49aa
|
Merge pull request #21412 from aschackmull/java/binary-assignment
Java: Make Assignment extend BinaryExpr.
|
2026-03-05 13:19:45 +01:00 |
|
Anders Schack-Mulligen
|
ec1d034ee0
|
Java: Make Assignment extend BinaryExpr.
|
2026-03-05 11:31:59 +01:00 |
|
Owen Mansel-Chan
|
2b3111441d
|
Add space before $ in xml test file
|
2026-03-04 15:03:24 +00:00 |
|
Owen Mansel-Chan
|
f41c30e335
|
java: Inline expectation should have space before $
|
2026-03-04 13:11:33 +00:00 |
|
Owen Mansel-Chan
|
ef345a3279
|
Java: Inline expectation should have space after $
This was a regex-find-replace from `// \$(?! )` (using a negative lookahead) to `// $ `.
|
2026-03-04 12:44:54 +00:00 |
|
Anders Schack-Mulligen
|
2b8e719034
|
Java: Add nullness test covering known FP.
|
2026-02-23 15:10:03 +01:00 |
|
Anders Schack-Mulligen
|
d84e0e262d
|
Java: Accept removal of spurious reason (the alert stays).
|
2026-02-23 15:09:59 +01:00 |
|
Anders Schack-Mulligen
|
8b0dd7b866
|
Java: Accept new TP in NullMaybe.
|
2026-02-23 15:09:58 +01:00 |
|
Owen Mansel-Chan
|
cf73d96c9d
|
Update test results (remove SPURIOUS annotations)
|
2026-02-16 12:03:02 +00:00 |
|
Owen Mansel-Chan
|
9fc95f5171
|
Expand log injection sanitizers to annotation regex matches
|
2026-02-16 12:01:13 +00:00 |
|
Owen Mansel-Chan
|
146fc7a8c0
|
Add failing log injection test for @Pattern validation
|
2026-02-16 12:01:07 +00:00 |
|
Owen Mansel-Chan
|
8f8f4c2d52
|
Fix Matcher.matches edge case
|
2026-02-14 00:28:37 +00:00 |
|
Owen Mansel-Chan
|
90befa0c00
|
Add failing test for Matcher.matches() edge case
|
2026-02-14 00:28:34 +00:00 |
|
Owen Mansel-Chan
|
bfe26c1989
|
Add @Pattern as RegexExecution => SSRF sanitizer
|
2026-02-12 16:57:11 +00:00 |
|
Owen Mansel-Chan
|
d0999e3abd
|
Add failing test for @Pattern validation
|
2026-02-12 16:57:04 +00:00 |
|
Anders Schack-Mulligen
|
6f40ac15b4
|
Java: Rename ReturnStmt.getResult to getExpr.
|
2026-02-04 14:43:31 +01:00 |
|
Owen Mansel-Chan
|
516b84b59a
|
Add test for *Pool exclusion
|
2026-01-27 15:38:29 +00:00 |
|
Owen Mansel-Chan
|
a5d9cb179a
|
Merge pull request #20930 from owen-mc/java/spring-rest-template-request-forgery-sinks
Java: add more Spring RestTemplate request forgery sinks
|
2026-01-15 14:23:15 +00:00 |
|
Mauro Baluda
|
5cef0376a9
|
Update java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCouchBaseCredentials.java
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
|
2026-01-14 11:50:52 +01:00 |
|
Mauro Baluda
|
9efefa6120
|
Fix test expectations
|
2026-01-13 22:46:42 +01:00 |
|
Mauro Baluda
|
d335f039ef
|
Improve model for CWE-089
|
2026-01-13 21:48:43 +01:00 |
|
Mauro Baluda
|
89f0e79ea1
|
Fix SqlTainted test
|
2026-01-13 13:55:14 +01:00 |
|
Mauro Baluda
|
dda042f7df
|
rename change notes
|
2026-01-13 13:07:14 +01:00 |
|
Mauro Baluda
|
4c8058d97b
|
Merge branch 'github:main' into couchdb
|
2026-01-09 17:20:40 +01:00 |
|
Mauro Baluda
|
15ee88ee24
|
SQLi test case
|
2025-12-24 20:30:21 +01:00 |
|
Mauro Baluda
|
b22077c371
|
Hardcoded credentials in CouchBase
|
2025-12-22 20:22:20 +01:00 |
|
yoff
|
c6240e5a99
|
java: understand more initializers
Whne a fiels is assigned a safe type in a constructor,
that field is not exposed.
|
2025-12-16 10:11:05 +01:00 |
|
yoff
|
a65d385297
|
java: add tests for thread safe initialisation
Co-authored-by: Raúl Pardo <raul.pardo@protonmail.com>
|
2025-12-16 10:11:05 +01:00 |
|
Owen Mansel-Chan
|
a85d0ea8a3
|
Make tests pass
|
2025-12-02 17:08:16 +00:00 |
|
Owen Mansel-Chan
|
8fd8fc07b7
|
Add failing tests for more regex match methods
|
2025-12-02 17:06:34 +00:00 |
|
Owen Mansel-Chan
|
969b0cf439
|
Add SSRF sinks for uriVariables arguments of more methods on Spring RestTemplate
|
2025-11-27 23:44:35 +00:00 |
|
Owen Mansel-Chan
|
1a59839f3c
|
Range library recognises long literals now
|
2025-11-24 14:10:54 +00:00 |
|
Owen Mansel-Chan
|
ec381e4ec5
|
Use range analysis and improve tests
|
2025-11-21 10:31:50 +00:00 |
|
aegilops
|
e904520779
|
Fixed formatting
|
2025-11-20 17:34:42 +00:00 |
|
aegilops
|
1e67907516
|
Merge commit
|
2025-11-20 12:22:39 +00:00 |
|
aegilops
|
62ee6d3a33
|
Made changes requested by reviewers - bounded() for range checking, style and better comments
|
2025-11-20 11:46:42 +00:00 |
|
Paul Hodgkinson
|
7b25e22a37
|
Merge branch 'main' into java-kotlin-sensitive-logging-substring-barriers
|
2025-11-17 11:03:39 +00:00 |
|
aegilops
|
fa703e3e60
|
Test cases for sensitive logging sanitizer
|
2025-11-14 16:53:46 +00:00 |
|
Anders Schack-Mulligen
|
d6800394fa
|
Guards: Support disjunctive implications.
|
2025-11-12 14:14:32 +01:00 |
|
Anders Schack-Mulligen
|
2192d75286
|
Java: Add test for a known FP.
|
2025-11-12 14:08:18 +01:00 |
|
yoff
|
4461be180a
|
Merge pull request #19539 from yoff/java/conflicting-access
|
2025-10-28 20:37:44 +01:00 |
|
yoff
|
406e48b3bb
|
java: fix aliasing FP
reorganise code, adding `LockField`
|
2025-10-27 14:30:25 +01:00 |
|
yoff
|
531b994819
|
java: add test for aliasing
found by triage
|
2025-10-27 14:27:32 +01:00 |
|
Tom Hvitved
|
a4eab484ce
|
Address review comments
|
2025-10-24 13:32:39 +02:00 |
|
Tom Hvitved
|
7a9cb64e2e
|
Java: Treat x.matches(regexp) as a sanitizer for request forgery
|
2025-10-24 09:06:57 +02:00 |
|
yoff
|
9e77e5b046
|
java: add test with deeper paths
also format test files
|
2025-10-21 14:02:36 +02:00 |
|
yoff
|
f183a7223f
|
java: add test for notFullyMonitored
|
2025-10-21 13:40:29 +02:00 |
|
yoff
|
de05bfbce3
|
java: address review comments
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
|
2025-10-21 13:25:26 +02:00 |
|