REDMOND\brodes
|
d68f3cff8b
|
Crypto: InsecureIVorNonceSource now ignored null to avoid being too noisy.
|
2025-10-10 14:51:16 -04:00 |
|
REDMOND\brodes
|
ffd191d0e1
|
Crypto: missing new endpoint to get the creating operation for a key if known.
|
2025-10-10 14:50:50 -04:00 |
|
REDMOND\brodes
|
36673659ad
|
Crypto: Weak asymmetric key gen size fixes and test.
|
2025-10-10 14:49:35 -04:00 |
|
REDMOND\brodes
|
758759a304
|
Crypto: Reused nonce query updates and test updates to address false positives.
|
2025-10-10 12:25:31 -04:00 |
|
REDMOND\brodes
|
fba80870a6
|
Crypto: Example query reorg - moving queries of this PR into 'examples' subdirectories.
|
2025-10-09 09:03:00 -04:00 |
|
REDMOND\brodes
|
deb43735be
|
Crypto: Minor fixes to WeakSymmetricCipher, change to a singular name for consistency.
|
2025-10-09 08:39:39 -04:00 |
|
REDMOND\brodes
|
3dedda4233
|
Merge branch 'santander-java-crypto-check' of https://github.com/bdrodes/codeql into santander-java-crypto-check
|
2025-10-09 08:18:04 -04:00 |
|
REDMOND\brodes
|
c6cc4fff51
|
Crypto: Minor fixes to WeakBlockModes, WeakHash to consider SHA3 ok, Added unknown hash.
|
2025-10-09 08:16:28 -04:00 |
|
Nicolas Will
|
fdba3acc4b
|
Crypto: Fix QL-for-QL alert and auto-format
|
2025-10-09 13:59:51 +02:00 |
|
REDMOND\brodes
|
f524de4afc
|
Crypto: Updating insecure iv/nonce to consider if an operation is known for it, and if so do not alert on non-secure random if it is tied to decryption
|
2025-10-08 16:27:18 -04:00 |
|
REDMOND\brodes
|
7a57496c54
|
Crypto: Missing test update.
|
2025-10-08 14:16:47 -04:00 |
|
REDMOND\brodes
|
11e81395b5
|
Crypto: Updated default flows to use taint tracking (this is needed to fix false positives in the unknown IV/Nonce query). Add the unknown IV/Nonce query and associated test cases. Fix unknown IV/Nonce query to focus on cases where the oepration isn't known or the operation subtype is not encrypt or wrap.
|
2025-10-08 14:14:17 -04:00 |
|
REDMOND\brodes
|
75b5a9fda8
|
Crypto: Update general regression test results to account for removal of JCA random source.
|
2025-10-08 12:55:11 -04:00 |
|
REDMOND\brodes
|
8e10e1937d
|
Crypto: Adding query for unknown IV initialization.
|
2025-10-08 12:49:54 -04:00 |
|
REDMOND\brodes
|
83ff70bcd8
|
Crypto: Adding tests for insecure iv or nonce. Updating generic literal sources to include array literals.
|
2025-10-08 12:47:58 -04:00 |
|
REDMOND\brodes
|
bd34b6ce02
|
Crypto: Removing JCA model of random, need to reassess this as this impacts the insecure IV/Nonce query. Updated name of the Insecure nonce query to be InsecureIVorNonce
|
2025-10-08 11:41:21 -04:00 |
|
REDMOND\brodes
|
143be8cc35
|
Crypto: Remove redundant queries.
|
2025-10-08 10:26:05 -04:00 |
|
REDMOND\brodes
|
1b1b333e8b
|
Crypto: Modify suggested queries per misc. side conversations on standards. Remove redundant query. Fix QL-for-QL issues.
|
2025-10-08 10:21:06 -04:00 |
|
REDMOND\brodes
|
cf88e3f52d
|
Crypto: Standardize naming where use of "family" and "type" have been used. Prefer 'type'.
|
2025-10-08 09:54:53 -04:00 |
|
REDMOND\brodes
|
bba541c016
|
Merge remote-tracking branch 'upstream/java-crypto-check' into santander-java-crypto-check
|
2025-10-08 09:30:26 -04:00 |
|
Geoffrey White
|
d39c8d155c
|
Merge pull request #20574 from geoffw0/rustga3
Rust: Docs updates
|
2025-10-08 11:04:29 +01:00 |
|
Anders Schack-Mulligen
|
2d9b249367
|
Merge pull request #20600 from aschackmull/java/constant-exp-fix
Java: Fix bug in ConstantExpAppearsNonConstant.
|
2025-10-08 11:40:50 +02:00 |
|
Michael Nebel
|
4cc6a07620
|
Merge pull request #20593 from michaelnebel/csharp/reducetypeparameterandtuplelocations
C#: Reduce Type Parameter- and Tuple type location extraction.
|
2025-10-08 11:36:32 +02:00 |
|
Anders Schack-Mulligen
|
99f5dcaaa4
|
Java: Fix bug in ConstantExpAppearsNonConstant.
|
2025-10-08 10:32:51 +02:00 |
|
Michael Nebel
|
cdfa58645a
|
C#: Add change-note.
|
2025-10-08 10:14:51 +02:00 |
|
Idriss Riouak
|
28fe20e3e4
|
Merge pull request #20595 from github/idrissrio/java-lambda
Java: Add integration test for buildless lambda recovery
|
2025-10-08 09:53:29 +02:00 |
|
Paolo Tranquilli
|
75a7507017
|
Merge pull request #20590 from github/redsun82/rust-test-compatibility
Rust: test with the 1.90 toolchain
|
2025-10-08 09:00:30 +02:00 |
|
Asger F
|
10c9b747a5
|
Merge pull request #20586 from asgerf/js/api-graphs-block-this
JS: Restrict receiver-flow in API graphs
|
2025-10-08 08:41:56 +02:00 |
|
Ian Lynagh
|
2918d30697
|
Merge pull request #20597 from github/igfoo/bmn-ga
C++: Add a changenote for C/C++ BMN GA
|
2025-10-07 22:57:32 +01:00 |
|
Alexander Eyers-Taylor
|
825d3709d8
|
Merge pull request #20386 from github/alexet/overlay-informed-dataflow
Dataflow: Overlay informed dataflow.
|
2025-10-07 20:22:57 +01:00 |
|
Alex Eyers-Taylor
|
193cd46a76
|
DataFlow: Adress comments on overlay informed dataflow
|
2025-10-07 17:52:12 +01:00 |
|
Alex Eyers-Taylor
|
7a8d2392ee
|
Daatflow: Fix bug
|
2025-10-07 17:52:12 +01:00 |
|
Alex Eyers-Taylor
|
542bdf0792
|
Java: Use Overlay dataflow in java.
|
2025-10-07 17:52:12 +01:00 |
|
Alex Eyers-Taylor
|
3c110f2eb8
|
DataFlow: Add code for merging base with overlay.
|
2025-10-07 17:52:12 +01:00 |
|
Alex Eyers-Taylor
|
c49e2ab2da
|
DataFlow: Add code to do overlay informed dataflow.
|
2025-10-07 17:52:12 +01:00 |
|
Alex Eyers-Taylor
|
82e4fc9f0f
|
AlertFiltering: Expose filtering further.
|
2025-10-07 17:52:12 +01:00 |
|
Alex Eyers-Taylor
|
8c02130bcf
|
DataFlow: Rearrange files to group the parts that can be shared with overlay aware.
|
2025-10-07 17:52:12 +01:00 |
|
Ian Lynagh
|
791a92b146
|
C++: Add a changenote for C/C++ BMN GA
|
2025-10-07 17:32:36 +01:00 |
|
idrissrio
|
f69e5f5ffc
|
Java: Accept new test results after extractor changes
|
2025-10-07 16:55:53 +02:00 |
|
idrissrio
|
55b15a261a
|
Java: Add integration test for buildless lambda recovery
|
2025-10-07 16:55:52 +02:00 |
|
Michael Nebel
|
eb84b1441a
|
C#: Add some locations tests for type parameters and tuple types.
|
2025-10-07 15:26:33 +02:00 |
|
Michael Nebel
|
f0842e430d
|
C#: Respect the context when extracting locations for type parameters and tuple typles.
|
2025-10-07 15:26:31 +02:00 |
|
Anders Schack-Mulligen
|
18e33b193e
|
Merge pull request #20589 from aschackmull/java/array-entrypoint-read-taint
Java: Allow taint-read-steps for array sources.
|
2025-10-07 15:04:03 +02:00 |
|
Michael Nebel
|
ea4d4751f3
|
Merge pull request #20581 from michaelnebel/csharp/reducetyplocationtuples
C#: Reduce location tuple extraction for named types.
|
2025-10-07 14:50:36 +02:00 |
|
Paolo Tranquilli
|
122b7ebba8
|
Rust: accept test changes
|
2025-10-07 14:49:08 +02:00 |
|
Michael Nebel
|
584d8c5377
|
C#: Add change-note.
|
2025-10-07 14:24:21 +02:00 |
|
Anders Schack-Mulligen
|
7dadbc43fb
|
Java: Add change note.
|
2025-10-07 13:51:49 +02:00 |
|
Owen Mansel-Chan
|
b0c8fcda35
|
Merge pull request #20591 from owen-mc/shared/update-inline-expectations-qldoc
Shared: Correct comment about empty `.expected` file
|
2025-10-07 12:47:11 +01:00 |
|
Anders Schack-Mulligen
|
f0bfd7053e
|
Java: Add test case.
|
2025-10-07 13:40:44 +02:00 |
|
Kasper Svendsen
|
0396756cd9
|
Merge pull request #20184 from Marcono1234/patch-1
Doc: Fix link to `warnOnImplicitThis` GitHub docs
|
2025-10-07 13:08:32 +02:00 |
|