1101 Commits

Author	SHA1	Message	Date
Edward Minnix III	8d88af1af0	Apply docs review suggestions ... Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com>	2023-08-17 13:05:38 -04:00
Ed Minnix	b305962c9a	Use more appropriate description	2023-08-17 13:05:37 -04:00
Edward Minnix III	929090a847	Typos and style fixes ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-08-17 13:05:37 -04:00
Ed Minnix	172b8a6967	Documentation fixes	2023-08-17 13:05:37 -04:00
Ed Minnix	b567ec875a	Documentation	2023-08-17 13:05:37 -04:00
Ed Minnix	f58590c6a9	Trust Boundary Work	2023-08-17 13:05:37 -04:00
Ed Minnix	3e7444cd66	Style fixes	2023-08-17 13:05:36 -04:00
Ed Minnix	15370506b8	Add missing security severity	2023-08-17 13:05:36 -04:00
Ed Minnix	a8b7e70d01	Convert trust boundary models to MaD	2023-08-17 13:05:36 -04:00
Ed Minnix	76438f13b6	Trust Boundary Query	2023-08-17 13:05:36 -04:00
Anders Schack-Mulligen	91de43f918	C#/Java/Ruby: Remove superfluous module members.	2023-07-13 11:38:35 +02:00
Tony Torralba	a7c2a25cac	Merge pull request #12879 from atorralba/atorralba/java/command-injection-mad-sinks ... Java: Convert all command injection sinks to MaD format	2023-06-27 14:06:45 +02:00
Tony Torralba	8f6d2ed2f9	Adjust ZipSlip query description according to review suggestions.	2023-06-19 10:27:41 +02:00
Tony Torralba	3c4d938cf1	Apply code review suggestions. ... Co-authored-by: Asger F <asgerf@github.com>	2023-06-19 10:20:19 +02:00
Tony Torralba	3e96fe60c5	Go/Java/JS/Python/Ruby: Update the description and qhelp of the ZipSlip query ... All filesystem operations, not just writes, with paths built from untrusted archive entry names are dangerous	2023-06-16 08:52:44 +02:00
Tony Torralba	ffe67689ec	Merge branch 'main' into atorralba/java/command-injection-mad-sinks	2023-06-13 09:27:33 +02:00
Tony Torralba	527fe523a8	Add PathCreation.qll sinks to models-as-data ... The old PathCreation sinks can't be removed because doing so would cause alert wobble in the path injection queries. See their getReportingNode predicates.	2023-06-02 09:14:35 +02:00
Tony Torralba	c3b1ef2cdf	Merge branch 'main' into atorralba/java/command-injection-mad-sinks	2023-06-02 08:57:24 +02:00
erik-krogh	9f5bf8fb22	also fix the first code-block	2023-05-25 13:56:29 +02:00
erik-krogh	765076bcba	fix whitespace in the samples in ReDoS.qhelp	2023-05-25 13:28:39 +02:00
Tony Torralba	a276cc3094	Convert all command injection sinks to MaD format	2023-05-25 11:41:32 +02:00
erik-krogh	710b309142	apply suggestions from doc review	2023-05-21 22:18:48 +02:00
erik-krogh	480e71fd69	avoid contractions	2023-05-17 08:42:45 +02:00
erik-krogh	83ca1495e0	trim the whitespace in the poly-redos examples	2023-05-15 16:47:24 +02:00
erik-krogh	d989359656	add another example to the qhelp in poly-redos, showing how to just limit the length of the input	2023-05-15 16:47:02 +02:00
Ed Minnix	5f3c8fef3f	Privacy markers and fixed imports	2023-05-04 10:25:17 -04:00
Ed Minnix	74fc6382a6	Add improper validation of array size query libraries	2023-05-04 10:25:17 -04:00
Ed Minnix	c319ee4c0d	Add TempDirLocalInformationDisclosureQuery	2023-05-04 10:25:16 -04:00
Ed Minnix	b087cf9a0a	Add Arithmetic query libraries	2023-05-04 10:25:16 -04:00
Ed Minnix	b6361cdd3d	Move CWE-190/ArithmeticCommon.qll to semmle.code.java.security	2023-05-04 10:25:16 -04:00
Ed Minnix	24b00bac11	Add UnsafeHostnameVerificationQuery	2023-05-04 10:25:16 -04:00
Ed Minnix	f4a6f555b4	Add NumericCastTaintedQuery	2023-05-04 10:25:13 -04:00
Ed Minnix	e65a54b85f	Add BrokenCryptoAlgorithmQuery	2023-05-04 10:19:12 -04:00
Ed Minnix	4b76564911	Add MaybeBrokenCryptoAlgorithmQuery	2023-05-04 10:15:00 -04:00
Ed Minnix	e4f47ece43	Add ResponseSplittingLocalQuery	2023-05-04 10:15:00 -04:00
Ed Minnix	91b3533035	Add SqlTaintedLocalQuery	2023-05-04 10:14:59 -04:00
Ed Minnix	a0f7575b34	Add StackTraceExposureQuery	2023-05-04 10:14:59 -04:00
Ed Minnix	aff299eafd	Add ExecTaintedLocal	2023-05-04 10:14:59 -04:00
Ed Minnix	b39d5088de	Add InsecureCookieQuery	2023-05-04 10:14:59 -04:00
Ed Minnix	be24b29e7a	Add UrlRedirectLocalQuery.qll	2023-05-04 10:14:59 -04:00
Ed Minnix	0249187282	Add ExternallyControlledFormatStringLocalQuery.qll	2023-05-04 10:14:59 -04:00
Ed Minnix	5834e4ac52	Add UrlRedirectQuery.qll	2023-05-04 10:14:59 -04:00
Ed Minnix	cc22a7d4b4	Add XssLocalQuery	2023-05-04 10:14:59 -04:00
Ed Minnix	c2b6a3f4e0	Add XPathInjectionQuery	2023-05-04 10:14:59 -04:00
Ed Minnix	c15ce27957	Add SqlConcatenatedQuery	2023-05-04 10:14:59 -04:00
Ed Minnix	1af6d5f7b3	Add TaintedPermissionsCheckQuery	2023-05-04 10:14:59 -04:00
Kasper Svendsen	081085e128	Java: Make implicit this receivers explicit	2023-05-03 13:37:35 +02:00
Ed Minnix	ea54ea47b1	Deprecate sensitiveResultReceiver	2023-04-13 23:06:16 -04:00
Ed Minnix	cd661f1d9f	Refactor SensitiveResultReceiver	2023-04-13 23:06:16 -04:00
Ed Minnix	735a7383c6	Refactor HardcodedCredentialsSourceCall	2023-04-13 23:06:16 -04:00