Anders Schack-Mulligen
da579c27fc
Merge pull request #18934 from aschackmull/ssa/refactor5
...
SSA: Replace the Guards interface in the SSA data flow integration.
2025-03-06 15:11:52 +01:00
Lukas Abfalterer
32e1589745
Update java/ql/src/change-notes/2025-03-03-fix-improper-intent-verification-query.md
...
Co-authored-by: Edward Minnix III <egregius313@github.com >
2025-03-06 09:57:16 +01:00
Owen Mansel-Chan
f2947f7066
Fix indentation
2025-03-05 14:13:53 +00:00
Lukas Abfalterer
b4c75d832c
Merge branch 'main' into cwe-925
2025-03-05 14:15:07 +01:00
Anders Schack-Mulligen
c6761db2fc
SSA: Replace the Guards interface in the SSA data flow integration.
2025-03-05 13:29:31 +01:00
Lukas Abfalterer
41e9a837e5
Fix naming
...
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com >
2025-03-05 12:50:54 +01:00
Anders Schack-Mulligen
709d36b502
Merge pull request #18869 from aschackmull/ssa/refactor3
...
Ssa: Update qltests including consistency checks
2025-03-05 11:40:27 +01:00
Lukas Abfalterer
c9b75afc2a
Fix QLL and add change notes with tests
2025-03-05 10:23:35 +01:00
Anders Schack-Mulligen
9e03b12ba0
C#/Java/Ruby/Rust/SSA: Replace DefinitionExt with SourceVariable in data flow integration predicates.
2025-03-04 12:24:21 +01:00
Lukas Abfalterer
a3749530d6
The query should only report cases when the method is not empty.
2025-03-03 10:20:46 +01:00
Jami Cogswell
b0b95965f6
Java: add change note
2025-03-02 17:13:37 -05:00
Jami Cogswell
fbf7513f37
Java: handle lock state check stored in variable
2025-03-02 17:01:18 -05:00
Chris Smowton
79e581f555
Change note
2025-02-28 11:23:10 +00:00
Chris Smowton
1577b40b45
Accept test changes
2025-02-28 11:23:07 +00:00
Chris Smowton
178e90c2f1
Update test expectations for JDK24 upgrade
2025-02-28 11:23:06 +00:00
Alex Eyers-Taylor
5e3ccc0cca
Java: Simplify interpretOutput
2025-02-26 18:20:46 +00:00
Anders Schack-Mulligen
994a8eea39
Merge pull request #18857 from aschackmull/ssa/refactor-df-integr
...
Ssa: Refactor the data flow integration module
2025-02-25 15:04:11 +01:00
Anders Schack-Mulligen
2c3b48946d
Merge pull request #18824 from aschackmull/java/basessa
...
Java: Switch BaseSSA to use shared SSA lib.
2025-02-25 14:23:46 +01:00
Jonas Jensen
2edc9af1e0
Merge pull request #18848 from jbj/StaticInitializationVector-postprocess
...
Java: StaticInitializationVector with postprocess
2025-02-25 12:44:16 +01:00
Owen Mansel-Chan
74a249597a
Merge pull request #18607 from owen-mc/java/xss-content-type-sanitizer
...
Java: Add XSS Sanitizer for `HttpServletResponse.setContentType` with safe values
2025-02-24 23:39:18 +00:00
Anders Schack-Mulligen
db7ec4a781
Java: Remove getDefinitionExt reference
2025-02-24 13:50:08 +01:00
Jonas Jensen
11a0a9f8af
Java: StaticInitializationVector with postprocess
...
Use the new `postprocess` feature for the test of
`StaticInitializationVector.ql`. This makes it easier to modify and test
this query for diff-informed operation.
2025-02-24 13:33:02 +01:00
Chris Smowton
32e4c741cc
Merge pull request #18554 from smowton/smowton/admin/test-gbk-xml-extraction
...
Java: Add tests for XML and Java extraction with GBK charset
2025-02-21 17:27:32 +00:00
Anders Schack-Mulligen
6932e000c6
Java: Switch BaseSSA to use shared SSA lib.
2025-02-21 08:57:23 +01:00
Anders Schack-Mulligen
1c616d10d4
Merge pull request #18819 from aschackmull/ssa/refactor-phiread3
...
Ssa: Refactor shared SSA in preparation for eliminating phi-read definitions
2025-02-21 08:56:38 +01:00
Chris Smowton
9162ce7d73
Add test for extraction of a Java file with a non-UTF-8 charset
2025-02-20 12:31:36 +00:00
Chris Smowton
be6162edc0
Add test for XML extraction with GBK charset
2025-02-20 12:31:36 +00:00
Jami
485ee5c5ed
Merge pull request #18692 from jcogs33/jcogs33/spring-csrf-qhelp-update
...
Java: update `java/spring-disabled-csrf-protection` QHelp
2025-02-19 11:39:11 -05:00
Anders Schack-Mulligen
291ea6f6eb
Java: Move SSA data flow test and extend it to cover phi-read input edges.
2025-02-19 16:17:22 +01:00
Anders Schack-Mulligen
5379506464
Java: Use firstUse and adjacentUseUse predicates.
2025-02-19 16:17:22 +01:00
github-actions[bot]
ce234bb2c6
Add changed framework coverage reports
2025-02-19 14:09:10 +00:00
Remco Vermeulen
2d991fc387
Updata Java CCR suite
2025-02-18 20:25:22 +00:00
Anders Schack-Mulligen
194afbb7f8
Java: Simplify SSA for variable capture.
2025-02-18 14:01:20 +01:00
Jami
d94dc5aa40
Merge pull request #18504 from jcogs33/jcogs33/java/file-constructor-path-sanitizer
...
Java: `File` constructor path sanitizer
2025-02-18 08:00:32 -05:00
Jami Cogswell
9bb5fe837d
Java: address review comments
2025-02-17 15:47:45 -05:00
github-actions[bot]
ad24f94a77
Post-release preparation for codeql-cli-2.20.5
2025-02-17 17:58:24 +00:00
github-actions[bot]
6f4562f3bd
Release preparation for version 2.20.5
2025-02-17 16:55:54 +00:00
Jami Cogswell
61a184c1d7
Java: update more tests
2025-02-14 16:08:06 -05:00
Jami Cogswell
2bb6a3914b
Java: update tests
2025-02-14 15:16:08 -05:00
Jami Cogswell
c0ebeb9c7b
Java: use AdditionalTaintStep
2025-02-14 13:52:43 -05:00
Owen Mansel-Chan
dd102c4cea
Merge pull request #18645 from fabienpe/main
...
Added missing "GOOD" and "BAD" to some examples
2025-02-13 10:37:39 +00:00
Jami
2a8cc00284
Merge pull request #18288 from jcogs33/jcogs33/csrf-unprotected-request-type
...
Java: add CSRF query
2025-02-11 15:32:56 -05:00
Jonas Jensen
76440120d1
Merge pull request #18737 from jbj/NumericCastTaintedQuery-selectedLocation
...
Java: precise diff-informed NumericCastTainted
2025-02-11 15:33:28 +01:00
Jonas Jensen
71c078dbdd
Java: precise diff-informed NumericCastTainted
...
It was discovered by the upcoming support for exact locations matching
in diff-informed testing that this data-flow configuration did not
correspond exactly to the query.
2025-02-11 13:49:15 +01:00
Tom Hvitved
e5e88435bc
Java: Remove ExitBasicBlock from SsaInput
2025-02-11 10:07:18 +01:00
Tom Hvitved
6fbb1e2571
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2025-02-11 10:06:50 +01:00
Anders Schack-Mulligen
e955f58eb1
Java: Bugfix for samevar in useReaches.
2025-02-11 10:06:49 +01:00
Anders Schack-Mulligen
ed284353ef
Java: Bugfix for qualifier-of-qualifier update in hasExplicitQualifierUpdate.
2025-02-11 10:06:47 +01:00
Anders Schack-Mulligen
284e48cfbe
Java: Fixup private
2025-02-11 10:06:45 +01:00
Tom Hvitved
75137a0f4c
Java: Adopt shared SSA library
2025-02-11 10:06:43 +01:00
