Anders Schack-Mulligen
add960bc4d
Merge pull request #4880 from luchua-bc/java/sensitive-query-with-get
...
Java: Sensitive GET Query
2021-02-24 11:08:47 +01:00
yo-h
1d654febfd
Merge pull request #5195 from aschackmull/java/cwe-548-test
...
Java: Add empty file to test.
2021-02-23 21:12:40 -05:00
Anders Schack-Mulligen
b1bed2731d
Merge pull request #5172 from smowton/smowton/feature/commons-strbuilder
...
Java: Add support for commons-lang's StrBuilder class
2021-02-23 14:39:11 +01:00
yo-h
6213c20bc3
Merge pull request #5136 from aschackmull/java/csv-models
...
Java: Add support for framework modelling through csv data.
2021-02-22 19:00:41 -05:00
Chris Smowton
321df82851
Apply review feedback: comment style, bracketing, and use proper MISSING test annotations
2021-02-18 14:56:52 +00:00
Anders Schack-Mulligen
954e0b9496
Java: Add empty file to test.
2021-02-18 13:10:29 +01:00
Anders Schack-Mulligen
6f583baa90
Java: More documentation and support for field writes.
2021-02-18 11:18:31 +01:00
Anders Schack-Mulligen
862c41632e
Java: Add empty file to test.
2021-02-17 13:23:18 +01:00
Chris Smowton
c700d004e0
Commons Lang/Text StrBuilder: propagate taint from constructors
2021-02-17 09:51:28 +00:00
Chris Smowton
10112c50ab
Add support for StrBuilder and TextStringBuilder in commons-text
...
These are identical to the current deprecated StrBuilder in commons-lang3.
2021-02-17 09:36:28 +00:00
Chris Smowton
a63f18e49d
Add models for Commons-Lang's StrBuilder class. These exclude its fluent methods for the time being, which will be added in a forthcoming PR.
2021-02-17 09:36:20 +00:00
Chris Smowton
a2eeffa9c0
Add support for Apache Commons Lang StringUtils
2021-02-16 14:48:39 +00:00
Chris Smowton
bf03c0f419
Port InlineExpectationsTest for the Java analysis
2021-02-16 14:48:39 +00:00
Anders Schack-Mulligen
6eafa9d396
Merge pull request #5133 from pwntester/fix_SnakeYaml
...
Remove sanitizing condition which does not prevent vulnerability.
2021-02-16 12:58:47 +01:00
luchua-bc
2f17943abc
Update qldoc
2021-02-15 16:58:09 +00:00
Alvaro Muñoz
00a0b12dad
update expected results
2021-02-15 11:23:40 +01:00
Alvaro Muñoz
c7072aef16
update A.java test
2021-02-15 10:34:20 +01:00
Anders Schack-Mulligen
161e756c4b
Merge pull request #5141 from github/yo-h/java-flow-check-fix
...
Java: prepare to enforce additional compiler checks in test code
2021-02-15 09:41:03 +01:00
yo-h
1d007b6e72
Java: delete two test cases as per code review
2021-02-14 21:42:58 -05:00
Chris Smowton
97df60f9d6
Move misplaced experimental query into the conventional directory
2021-02-12 12:12:16 +00:00
Anders Schack-Mulligen
b74911204a
Merge pull request #4945 from intrigus-lgtm/java/insecure-jxbrowser
...
Java: Insecure JXBrowser
2021-02-10 15:48:17 +01:00
Anders Schack-Mulligen
3a6fa9d99b
Java: Add support for framework modelling through csv data.
2021-02-10 13:25:03 +01:00
yo-h
e5331a4735
Java: accept changes in expected output
2021-02-09 09:17:35 -05:00
yo-h
e194411cfa
Java: fix javac errors in test code
2021-02-09 09:16:57 -05:00
luchua-bc
cb01613aa6
Exclude FP token patterns
2021-02-09 13:53:23 +00:00
intrigus
2e30f2d9ce
Java: Fix QHelp & accept test output
...
Accept test output for changed alert message.
2021-02-08 00:05:02 +01:00
Anders Schack-Mulligen
35e620a19c
Merge pull request #4854 from luchua-bc/java/insecure-ldap-auth
...
Java: Insecure LDAP authentication
2021-02-04 14:56:38 +01:00
Anders Schack-Mulligen
40d02e7e32
Merge pull request #4926 from luchua-bc/java/insufficient-key-size
...
Java: Query to detect weak encryption: insufficient key size
2021-02-03 15:16:10 +01:00
luchua-bc
2ace10fcdf
Use PostUpdateNode for wrapper method calls
2021-02-03 12:21:31 +00:00
Anders Schack-Mulligen
bbdd7c9b57
Merge pull request #4963 from joefarebrother/guava-collections
...
Java: Add flow steps for Guava collection utilities
2021-01-28 11:01:03 +01:00
luchua-bc
ab7d257569
Add more cases and change EC to 256 bits
2021-01-28 04:06:27 +00:00
luchua-bc
058f3af4b2
Refactor the hasShortSymmetricKey method
2021-01-28 04:06:27 +00:00
luchua-bc
cbaee937d0
Optimize the query
2021-01-28 04:06:27 +00:00
luchua-bc
cfc950f803
Query for weak encryption: Insufficient key size
2021-01-28 03:25:15 +00:00
Henning Makholm
54f00de3e0
Add "tests" fields to test qlpacks
...
This will allow `codeql resolve tests --ignore-dubious-cases`
(and thus the VSCode extension) to recognize all `.ql` files in those
packs as test cases, even if they don't have accompanying `.expected`
files.
CLI versions prior to 2.1.0 will choke on this, but it's almost 10
months since that came out.
2021-01-26 18:15:22 +01:00
luchua-bc
fee0b94cd4
Use isRequestGetParamMethod as the source
2021-01-26 04:41:44 +00:00
Joe Farebrother
d69ecde5c1
Java: Add additional flow steps for guava collection methods and more unit tests
2021-01-25 16:37:40 +00:00
intrigus
a4cbd7037b
Java: Add tests for different versions.
...
Adds a test for version 6.24, because that version is not vulnerable.
The other test is for versions < 6.24, because these versions are
vulnerable.
2021-01-15 17:20:57 +01:00
luchua-bc
e5a703e49c
Revamp the query
2021-01-15 04:05:11 +00:00
Anders Schack-Mulligen
29935e1388
Merge pull request #4771 from intrigus-lgtm/split-cwe-295
...
Java: Add unsafe hostname verification query and remove existing overlapping query
2021-01-13 11:31:38 +01:00
luchua-bc
babe744a30
Add SECURITY_PROTOCOL check
2021-01-13 03:49:08 +00:00
intrigus
5b3086a93a
Java: Fix capitalization of JxBrowser
2021-01-12 22:43:41 +01:00
intrigus
4fa8f5eab2
Java: Accept test changes
2021-01-12 15:29:03 +01:00
intrigus
b30872806d
Java: Add tests and test stubs.
2021-01-12 14:49:12 +01:00
intrigus
e11304a1ca
Java: Autoformat
2021-01-11 13:42:08 +01:00
intrigus
c88f07dde4
Java: Accept test output
2021-01-11 13:42:07 +01:00
intrigus
33b0ff28d8
Java: Update test
2021-01-11 13:42:07 +01:00
intrigus
70b0703952
Java: Remove overlapping code
2021-01-11 13:42:07 +01:00
intrigus
3da1cb0879
Java: Add unsafe hostname verification query
2021-01-11 13:42:07 +01:00
Anders Schack-Mulligen
e5b4975450
Merge pull request #4675 from luchua-bc/cleartext-storage-shared-prefs
...
Java: Query to detect cleartext storage of sensitive information using Android SharedPreferences
2021-01-08 12:41:34 +01:00
