Ed Minnix
0990a370c7
Convert QL classes for Lastaflute to MaD
2024-07-18 17:41:06 -04:00
Ed Minnix
9713551448
Missing QLDoc
2024-07-18 17:41:05 -04:00
Ed Minnix
3bd330423d
Add some models for the org.lastaflute.web library
...
Methods annotated `@Execute` are handlers for URLs. Therefore, the
parameters of the methods annotated with the
`org.lastaflute.web.Execute` annotation are likely either URL parameters
or forms.
2024-07-18 17:41:00 -04:00
Owen Mansel-Chan
e2356d9820
Merge pull request #16914 from owen-mc/java/android-app-detection
...
Java: Improve Android app detection
2024-07-16 21:52:43 +01:00
Owen Mansel-Chan
db6cd1877c
Accept suggested QLDoc fix
...
Co-authored-by: Chris Smowton <smowton@github.com >
2024-07-16 12:24:42 +01:00
Anders Schack-Mulligen
938f46b888
Java: Remove superfluous clone models.
2024-07-16 11:11:53 +02:00
Anders Schack-Mulligen
12d6875cc4
Java: Replace the MaD Object.clone() models with a non-aliasing value step.
2024-07-16 11:11:50 +02:00
Anders Schack-Mulligen
da5abc8321
Dataflow: Replace MakeSets with QlBuiltins::InternSets.
2024-07-15 13:35:57 +02:00
Owen Mansel-Chan
b7a5252cb0
Refactor inAndroidApplication
2024-07-13 07:35:02 +01:00
Owen Mansel-Chan
5347770608
Update Android app detection
2024-07-07 00:24:25 +01:00
Owen Mansel-Chan
9c82966022
Move detection of Android app to one place
2024-07-05 23:47:56 +01:00
Tom Hvitved
4ae8720930
SSA: Add BasicBlock.{getNode/1,length/0} to the input signature
2024-07-03 11:32:35 +02:00
Anders Schack-Mulligen
8c23e21073
Dataflow: Cache compatibleTypes.
2024-06-24 13:35:48 +02:00
Michael Nebel
cd9d58fdc8
Merge pull request #16772 from michaelnebel/java/taintedpermissionthreatmodel
...
Java: Opt-in `java/tainted-permissions-check` to threat models.
2024-06-18 10:54:28 +02:00
Michael Nebel
197cdab43d
Merge pull request #16752 from michaelnebel/shared/sourcesinkcallables
...
C#/Java: Add some (shared) helper classes for Neutrals, Sources and Sink
2024-06-17 14:58:27 +02:00
Anders Schack-Mulligen
96b6ddefe0
Merge pull request #16751 from aschackmull/java/sndlevelscope-fix
...
Java: Calculate 2nd level scopes for implicit instance accesses.
2024-06-17 13:10:46 +02:00
Michael Nebel
833b4f90bf
Java: Make source and sink callable adapters.
2024-06-17 12:53:08 +02:00
Michael Nebel
327dab69d0
Java: Opt-in the tainted permissions check query to threat models.
2024-06-17 11:02:08 +02:00
Owen Mansel-Chan
7a13c31021
Exclude loopback address from reverse DNS source
2024-06-14 14:05:01 +01:00
Anders Schack-Mulligen
b47831af14
Java: Calculate 2nd level scopes for implicit instance accesses.
2024-06-13 13:57:18 +02:00
Tony Torralba
7336dd1ae5
Merge pull request #16482 from grakshith/rakshith/tune-java-crypto
...
Java: Add RSA/ECB/OEAP ciphers to the list of secure algorithms
2024-06-10 17:27:35 +02:00
Anders Schack-Mulligen
4ec4da4c8c
Dataflow/Java: Add support for pretty-printed provenace in tests. Convert one test.
2024-06-07 11:45:13 +02:00
Rakshith Gopalakrishna
65af2556ed
fix: remove rsa/ecb/* from getASecureAlgorithmName
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2024-06-04 11:20:05 -07:00
Rakshith Gopala krishna
97f9a882c6
fix: address PR comments
2024-06-04 11:20:05 -07:00
Rakshith Gopala krishna
80bf7cdb52
fix: remove the pkcs1 scheme
2024-06-04 11:20:05 -07:00
Rakshith Gopala krishna
dd223ed704
feat: add rsa/ecb/... variants to the list of secure algorithms
2024-06-04 11:20:05 -07:00
Owen Mansel-Chan
3fb5ad2a0d
Cover all params in QLDoc of modelCoverage
2024-06-04 17:06:00 +01:00
Anders Schack-Mulligen
06ce40c687
Merge pull request #16561 from aschackmull/java/typeflow-effectively-private
...
Java: Improve dispatch through TypeFlow of effectively private calls.
2024-05-31 15:11:18 +02:00
Mauro Baluda
bbe888c2b3
Update SpringCsrfProtection.qll
2024-05-30 23:13:08 +02:00
Mauro Baluda
e2479a7ce2
Disable csrf for ServerHttpSecurity
2024-05-30 23:08:57 +02:00
Anders Schack-Mulligen
5a259843bb
Dataflow: Switch call context to a set representation.
2024-05-27 11:01:52 +02:00
Anders Schack-Mulligen
bc8ca1af86
Dataflow: Introduce NodeRegions for use in isUnreachableInCall.
2024-05-27 11:01:51 +02:00
Anders Schack-Mulligen
5a7174dcbb
Merge pull request #16500 from aschackmull/java/static-field-side-effect
...
Java: Add support for flow through side-effects on static fields.
2024-05-24 09:19:31 +02:00
Anders Schack-Mulligen
4905612905
Merge pull request #16573 from aschackmull/java/dispatch-joinorder
...
Java: Fix join-order in viableImplInCallContext.
2024-05-23 14:48:25 +02:00
Anders Schack-Mulligen
bf3dbc24de
Java: Add support for flow through side-effects on static fields.
2024-05-23 12:57:57 +02:00
Anders Schack-Mulligen
4b3e35ed52
Java: Fix join-order in viableImplInCallContext.
2024-05-23 12:49:57 +02:00
Anders Schack-Mulligen
527dafa346
Java: Improve dispatch through TypeFlow of effectively private calls.
2024-05-23 10:50:16 +02:00
Anders Schack-Mulligen
f353065d26
Java: Allow overloading for exact model matches.
2024-05-23 10:50:01 +02:00
Anders Schack-Mulligen
0f864081cb
Java: Remove source dispatch when there's an exact match from a manual model.
2024-05-23 10:50:00 +02:00
Anders Schack-Mulligen
d82acf5866
Java: Add simple type sanitization to java/zipslip.
2024-05-22 10:23:30 +02:00
Michael Nebel
b1329fd806
Merge pull request #16362 from michaelnebel/java/removelocalqueries
...
Java: Remove local query variants.
2024-05-16 14:34:04 +02:00
Anders Schack-Mulligen
76e740bc1d
Java: Clean up some instances of getQualifiedName.
2024-05-13 13:06:44 +02:00
Michael Nebel
95ff5bae65
Merge pull request #16297 from michaelnebel/java/improveapitelemetry
...
Java: Identify more APIs as supported in the telemetry queries.
2024-05-03 12:34:19 +02:00
Michael Nebel
c07bf65eb6
Update java/ql/lib/semmle/code/java/dataflow/FlowSources.qll
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2024-05-03 11:13:05 +02:00
Michael Nebel
8def1c2c13
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
Michael Nebel
58bbfe694f
Java: Deprecate the content of ExecTaintedLocalQuery as this is unused.
2024-05-01 13:07:21 +02:00
Michael Nebel
d9c7401ea2
Java: Deprecate the local content of UrlRedirectLocalQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
Michael Nebel
ed7538d0b9
Java: Deprecate the local content of TaintedPathQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
Michael Nebel
5b89bd23c7
Java: Deprecate the content of SqlTaintedLocalQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
Michael Nebel
b68abab12a
Java: Deprecate the content of ResponseSplittingLocalQuery and remove local query variant.
2024-05-01 13:07:21 +02:00
