Joe Farebrother
55e78e3e25
Minor doc fixes + making directFileRead private
2022-06-28 10:10:28 +02:00
Joe Farebrother
a41f28ebe5
Use more file openning methods
2022-06-28 10:10:28 +02:00
Tamas Vajk
579bfc22f3
Fix performance change in SecurityFlag
2022-06-23 08:46:33 +02:00
Anders Schack-Mulligen
df6d68b215
Merge pull request #9618 from aschackmull/dataflow/deprecate-barrierguard-class
...
Dataflow: Deprecate BarrierGuard class
2022-06-22 10:44:08 +02:00
Michael Nebel
0d4321666a
Java: Update fragment injection sinkmodels.
2022-06-20 16:20:02 +02:00
Michael Nebel
2e46e93f36
Java: Update java models with provenance column information.
2022-06-20 16:20:02 +02:00
Anders Schack-Mulligen
33deff9bae
Java: Deprecate BarrierGuard class.
2022-06-16 11:25:28 +02:00
Anders Schack-Mulligen
e016feeb5c
ReDoS: Improve performance in ExponentialBackTracking.qll.
2022-05-31 11:04:03 +02:00
Erik Krogh Kristensen
215a6a72cc
Merge branch 'main' into useStringComp
2022-05-18 10:55:31 +02:00
Erik Krogh Kristensen
7245591468
Merge pull request #7763 from erik-krogh/unused-field
...
QL: add unused-field query
2022-05-18 09:15:16 +02:00
Erik Krogh Kristensen
86e97c32d6
fix all ql/use-string-compare
2022-05-17 14:11:05 +02:00
Nick Rolfe
c518150b49
Merge pull request #9132 from github/nickrolfe/misspelling
...
QL for QL: generalise non-US spelling query
2022-05-16 16:03:36 +01:00
Tony Torralba
616b12d011
Merge pull request #8956 from atorralba/atorralba/intent-redirection-sanitizer-fix
...
Java: Fix Intent Redirection sanitizer
2022-05-16 09:21:04 +02:00
Tony Torralba
168a184602
Merge pull request #9127 from atorralba/atorralba/sensitive-info-log-improvs
...
Java: Sensitive Info Log query improvements
2022-05-13 16:57:32 +02:00
Tony Torralba
b9f3b3bd37
Apply code review suggestion
2022-05-13 15:09:06 +02:00
Nick Rolfe
6c52831143
Java: sync spelling correction in shared qll
2022-05-12 16:11:29 +01:00
Nick Rolfe
1115227f9d
Merge remote-tracking branch 'origin/main' into nickrolfe/misspelling
2022-05-12 16:10:27 +01:00
Nick Rolfe
128fac4414
Java: fix typos in comments
2022-05-12 14:28:49 +01:00
Joe Farebrother
59e400d2e0
Merge pull request #7723 from joefarebrother/redos
...
Java: Add ReDoS queries
2022-05-12 13:50:38 +01:00
Tony Torralba
f0a0ac100b
Add live literals as sanitizers for sensitive logging
2022-05-12 11:57:44 +02:00
Tony Torralba
5db8306fef
Stop considering usernames sensitive info
...
Require variables to be static to be considered constants
2022-05-12 11:46:52 +02:00
Chris Smowton
7dec3f4835
Use EqualityTest for either value or ref comparions, and ReferenceEqualityTest for strictly ref comparison.
2022-05-10 19:51:17 +01:00
Chris Smowton
f95effcf82
Always extract ValueEQ/NEExpr for Kotlin ==/!=
...
I introduce AnyEqualsExpr for either reference or value equality and AnyEqualityTest for the same concept including not-equals operators, and use them wherever the written QL clearly doesn't care about the difference between reference and value comparison, typically because it is concerned with testing against null or against a primitive constant.
2022-05-10 19:51:17 +01:00
Ian Lynagh
6566f7b69f
Kotlin: Add types for the different kinds of casts that Kotlin has
...
We might want to unify some of these in future, but doing that
correctly is easier than splitting them up correctly, so I've given each
one its own QL class for now.
I am not familiar with many of the libraries/queries that use CastExpr.
I've briefly looked at them and updated them in a way that looks
superficially reasonable, but some of the uses will probably want to be
refined later.
2022-05-10 19:51:13 +01:00
Tony Torralba
ca2959cf37
Merge pull request #8537 from atorralba/atorralba/unsafe_android_access_improvs
...
Java: Improvements to UnsafeAndroidAccess
2022-05-05 16:46:54 +02:00
Joe Farebrother
c7d30087d1
Fix issue with named backrefs; add needed import
2022-05-04 15:41:42 +01:00
Joe Farebrother
9078e13f1c
Apply reveiw suggestions
...
- make java imports private
- qdoc fixes
- reorder predicates
- simplifications
2022-05-04 15:41:41 +01:00
Joe Farebrother
2a80540157
Sync shared files
2022-05-04 15:41:40 +01:00
Joe Farebrother
0f606d987d
Remove redundant super call.
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-05-04 15:41:39 +01:00
Joe Farebrother
522a8aff6f
Fix filename case
2022-05-04 15:41:39 +01:00
Joe Farebrother
3d65a9cafc
Update shared files
2022-05-04 15:41:39 +01:00
Joe Farebrother
1605d36ddf
Refine polynomial redos sources to exclude length limited methods
2022-05-04 15:41:39 +01:00
Joe Farebrother
6794268a3c
Split PolynomialRedos definition into a library to avoid duplication in the tests
2022-05-04 15:41:38 +01:00
Joe Farebrother
5555985ad6
Distingush between whether or not a regex is matched against a full string
...
Also some fixes and additional tests
2022-05-04 15:41:38 +01:00
Joe Farebrother
bb562643c6
Support possessive quantifiers, which cannot backtrack.
...
They are approximated by limiting them to up to one repetition (effectively making *+ like ? and ++ like a no-op).
2022-05-04 15:41:37 +01:00
Joe Farebrother
57ba8a4d1b
Improve handling of hex escapes; and support some named character classes
2022-05-04 15:41:36 +01:00
Joe Farebrother
91887ab229
Sync shared files
2022-05-04 15:41:36 +01:00
Joe Farebrother
aa1337db86
Apply style suggestions from code review
2022-05-04 15:41:34 +01:00
Joe Farebrother
f9f7a01f57
Add Java ReDoS libraries to identical-files.json
2022-05-04 15:41:33 +01:00
Joe Farebrother
a8f7a4459e
Port redos libraries from Python
2022-05-04 15:40:56 +01:00
Tony Torralba
8601137602
Fix bad join order by moving WebViewRef::getAnAccess from callsites into predicates
2022-05-04 11:58:47 +02:00
Tony Torralba
3b1210eacb
Update java/ql/lib/semmle/code/java/security/UnsafeAndroidAccess.qll
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-05-04 10:53:31 +02:00
Tony Torralba
dce11f3984
Removed unnecessary imports
2022-05-04 10:53:30 +02:00
Tony Torralba
f5e72e6e33
Remove getUnderlyingExpr
2022-05-04 10:53:30 +02:00
Tony Torralba
b678467e9d
Move things around
2022-05-04 10:53:30 +02:00
Tony Torralba
d68311e26d
Consider implicit this accesses in WebViewRef
2022-05-04 10:53:30 +02:00
Tony Torralba
51dfebf4c9
Apply suggestions from code review
...
Co-authored-by: Chris Smowton <smowton@github.com >
2022-05-04 10:53:29 +02:00
Tony Torralba
91bdb4299f
Improvements to UnsafeAndroidAccess
2022-05-04 10:53:29 +02:00
Tony Torralba
02822c6284
Merge pull request #9013 from atorralba/atorralba/private-externalflow-imports
...
Java: Make more ExternalFlow imports private
2022-05-03 16:02:09 +02:00
Tony Torralba
9c92454fa7
Merge pull request #8872 from atorralba/atorralba/android-widget-flowstep
...
Java: Add Editable.toString flow step
2022-05-03 15:27:52 +02:00
