Anders Schack-Mulligen
|
7fb1e1578e
|
Merge pull request #5894 from atorralba/atorralba/promote-ognl-injection
Java: Promote OGNL Injection query from experimental
|
2021-08-03 15:31:40 +02:00 |
|
Anders Schack-Mulligen
|
c0d76da1a6
|
Merge pull request #5846 from atorralba/atorralba/promote-unsafe-android-webview-fetch
Java: Promote Unsafe resource loading in Android WebView from experimental
|
2021-08-03 14:24:34 +02:00 |
|
Tony Torralba
|
a33e0bce9d
|
Fix tests affected by Jackson stubs changes
|
2021-08-03 13:15:45 +02:00 |
|
Tony Torralba
|
084cda6daa
|
Merge branch 'main' into atorralba/promote-groovy-injection
|
2021-08-03 09:53:46 +02:00 |
|
Tony Torralba
|
36565802dc
|
Delete unnecesary file
RequestForgery.expected in experimental was an artifact from a merge that wasn't adequately removed
|
2021-08-03 09:48:04 +02:00 |
|
Chris Smowton
|
fad1622730
|
Merge pull request #5435 from haby0/DynamicallyLoadedClasses
Java: CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
|
2021-08-02 16:04:30 +01:00 |
|
Tony Torralba
|
08bdd1aa7a
|
Merge branch 'main' into atorralba/promote-ognl-injection
|
2021-08-02 16:05:38 +02:00 |
|
Anders Schack-Mulligen
|
53e6ddfeb6
|
Merge pull request #6001 from atorralba/atorralba/promote-mvel-injection
Java: Promote MVEL injection query from experimental
|
2021-08-02 14:40:26 +02:00 |
|
Tony Torralba
|
9b384d84cc
|
Merge branch 'main' into atorralba/promote-ognl-injection
|
2021-08-02 14:06:45 +02:00 |
|
Tony Torralba
|
351a24558d
|
Add tests for JacksonSerializability
Upgraded jackson stubs to 2.12
|
2021-08-02 14:03:30 +02:00 |
|
haby0
|
eda3d864f5
|
Model written using smowton
|
2021-07-28 15:55:47 +08:00 |
|
haby0
|
00f13e1e6e
|
Modify isAdditionalTaintStep
|
2021-07-27 10:59:38 +08:00 |
|
haby0
|
291ca3830a
|
Modify according to suggestions
|
2021-07-23 09:28:55 +08:00 |
|
haby0
|
2a50cf8244
|
Fix
|
2021-07-22 22:24:09 +08:00 |
|
haby0
|
e160352b38
|
Fix
|
2021-07-22 21:48:46 +08:00 |
|
haby0
|
4ebf0ed7c5
|
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
|
2021-07-22 21:45:29 +08:00 |
|
p0wn4j
|
f0d5520976
|
Add Spring URL Redirect ResponseEntity sink
Copyedit qhelp
|
2021-07-21 03:16:16 +04:00 |
|
Tony Torralba
|
99e66cffa2
|
Merge branch 'main' into atorralba/promote-unsafe-android-webview-fetch
|
2021-07-20 17:30:56 +02:00 |
|
Tony Torralba
|
b6904a7992
|
Merge branch 'main' into atorralba/promote-ognl-injection
|
2021-07-20 17:17:17 +02:00 |
|
Tony Torralba
|
45a72ff6eb
|
Fix InsecureBasicAuth test expectations
|
2021-07-19 13:56:31 +02:00 |
|
Tony Torralba
|
46faf68d64
|
Decouple MvelInjection.qll to reuse the taint tracking configuration
|
2021-07-19 13:50:03 +02:00 |
|
Tony Torralba
|
5ca8b380e9
|
Merge branch 'main' into atorralba/promote-mvel-injection
|
2021-07-19 13:45:10 +02:00 |
|
Tony Torralba
|
b08f417a1e
|
Merge branch 'main' into atorralba/promote-groovy-injection
|
2021-07-19 12:44:03 +02:00 |
|
Sauyon Lee
|
60db9e1851
|
Rename springframework-5.2.3 to 5.3.8
|
2021-06-28 08:26:39 -07:00 |
|
Chris Smowton
|
8aa9cd52b5
|
Merge pull request #5811 from mogwailabs/insecureJmxRmiServerEnvironment
Java: Add query - insecure environment configuration during JMX/RMI server init
|
2021-06-25 22:09:20 +01:00 |
|
intrigus
|
5aa711a956
|
Accept test changes.
|
2021-06-25 17:04:36 +02:00 |
|
intrigus
|
5106aec319
|
Fix test location.
|
2021-06-25 16:47:25 +02:00 |
|
intrigus
|
36575bb26f
|
Move back to experimental.........
|
2021-06-25 16:47:25 +02:00 |
|
intrigus
|
592fd1e8ca
|
Java: Accept test changes
|
2021-06-25 16:47:22 +02:00 |
|
intrigus
|
1b96d0ac54
|
Java: Remove overlapping code
|
2021-06-25 16:47:22 +02:00 |
|
Chris Smowton
|
2acb4de2cb
|
Merge pull request #5955 from haby0/java/JShellCodeInjection
Java: JShell Injection
|
2021-06-24 17:03:30 +01:00 |
|
Anders Schack-Mulligen
|
95ad8b55fe
|
Merge pull request #6107 from aschackmull/dataflow/implicit-reads
Dataflow: Add support for implicit reads
|
2021-06-24 15:38:35 +02:00 |
|
haby0
|
3cf71c50b8
|
Mobile stubs
|
2021-06-24 19:24:38 +08:00 |
|
Artem Smotrakov
|
14e724bce6
|
Added sinks for RmiBasedExporter and HessianExporter
|
2021-06-23 09:53:47 +02:00 |
|
Anders Schack-Mulligen
|
27c973e157
|
Java: Fix some qltests.
|
2021-06-21 16:08:52 +02:00 |
|
haby0
|
1750efad2a
|
fix
|
2021-06-18 21:46:48 +08:00 |
|
haby0
|
dca737190b
|
Modify JShellInjection.expected
|
2021-06-18 21:36:45 +08:00 |
|
haby0
|
ed0aabef46
|
add isAdditionalTaintStep
|
2021-06-18 21:36:44 +08:00 |
|
haby0
|
921b8e80a2
|
Jshell Injection
|
2021-06-18 21:36:44 +08:00 |
|
haby0
|
a73cb3f04a
|
Fix error
|
2021-06-18 17:22:26 +08:00 |
|
haby0
|
0d18e4ff9c
|
BeanShell Injection
|
2021-06-18 15:54:13 +08:00 |
|
Tony Torralba
|
0c71393171
|
Merge branch 'main' into atorralba/promote-unsafe-android-webview-fetch
|
2021-06-17 14:54:25 +02:00 |
|
Chris Smowton
|
7509e36382
|
Remove no-longer-needed BasicRequestLine model from InsecureBasicAuth.ql; adjust test expectations accordingly
|
2021-06-17 11:43:33 +01:00 |
|
Chris Smowton
|
487c1db6ed
|
Promote SSRF query to main query set
|
2021-06-17 11:41:01 +01:00 |
|
Anders Schack-Mulligen
|
8fe2f4a554
|
Merge pull request #6034 from owen-mc/java/jax-rs
Improve JAX-WS and JAX-RS models
|
2021-06-17 12:35:34 +02:00 |
|
Tony Torralba
|
47fffb04a6
|
Merge branch 'main' into atorralba/promote-ognl-injection
|
2021-06-16 15:46:33 +02:00 |
|
Tony Torralba
|
dab33b21fb
|
Merge branch 'main' into atorralba/promote-mvel-injection
|
2021-06-16 15:44:43 +02:00 |
|
Tony Torralba
|
66d49aa4e8
|
Fix InsecureBasicAuth tests affected by the new URL summary
|
2021-06-16 13:01:40 +02:00 |
|
Tony Torralba
|
357b0e1a90
|
Fix SSRF tests affected by the new URL summary
|
2021-06-16 13:01:40 +02:00 |
|
Tony Torralba
|
356601ce15
|
Moved from experimental
|
2021-06-16 13:01:38 +02:00 |
|