hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-31 03:21:23 +02:00
Code Issues Packages Projects Releases Wiki Activity
87,669 Commits 1,763 Branches 168 Tags
e40a7124d4fcffb2cbac86403e84f932a4ff74ae
Commit Graph

622 Commits

Author SHA1 Message Date
BazookaMusic
e40a7124d4 oops 2026-05-28 10:31:12 +02:00
BazookaMusic
7b5cceadf5 models for axis2 2026-05-28 10:15:41 +02:00
Jack Nørskov Jørgensen
3119ef6c1a Add MaDs for Apache Avro 2026-05-19 09:27:32 +02:00
Owen Mansel-Chan
33035dbfc8 Fix yaml formatting 2026-05-07 11:06:43 +01:00
MarkLee131
49e5886a06 Update java/ql/lib/ext/org.apache.commons.io.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-04 12:56:11 +08:00
MarkLee131
c10a05f26a Update java/ql/lib/ext/org.apache.commons.io.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:14:48 +08:00
MarkLee131
8710e63011 Update java/ql/lib/ext/javax.servlet.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:14:15 +08:00
MarkLee131
dbc9d0de4a Update java/ql/lib/ext/org.apache.commons.io.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:14:07 +08:00
MarkLee131
9194cdad9c Update java/ql/lib/ext/java.nio.file.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:08:31 +08:00
MarkLee131
7050241a54 Update java/ql/lib/ext/java.nio.file.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:08:21 +08:00
MarkLee131
62a0a3e384 Update java/ql/lib/ext/java.nio.file.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:08:12 +08:00
MarkLee131
3ad2d8ca3d Update java/ql/lib/ext/java.nio.file.model.yml 
Co-authored-by: Owen Mansel-Chan <62447351+owen-mc@users.noreply.github.com>
 2026-05-03 14:04:35 +08:00
MarkLee131
119994b59f Java: move File inspection methods to path-injection[read] 
Per review feedback on #21741: File.canRead/canWrite/canExecute,
exists/isDirectory/isFile/isHidden only inspect a path, so move them
under the path-injection[read] sub-kind. Update TaintedPath.expected
and the experimental CWE-073 expected to match.
 2026-05-01 16:04:29 +08:00
MarkLee131
90741b15e2 Merge branch 'main' into fix/path-injection-read-subkind 2026-04-30 18:37:12 +08:00
Jack Nørskov Jørgensen
6ec250951a Move generated MaDs for Java into modelgenerator/ 2026-04-24 13:24:31 +02:00
copilot-swe-agent[bot]
25d232b815 Model additional Hibernate query sinks 
Agent-Logs-Url: https://github.com/github/codeql/sessions/fc2c7f71-3493-4bf7-9136-34571a1d4b47

Co-authored-by: owen-mc <62447351+owen-mc@users.noreply.github.com>
 2026-04-23 13:41:03 +00:00
MarkLee131
c336a1595d Java: split read-only path sinks into path-injection[read] 
Introduce a new Models-as-Data sink sub-kind path-injection[read] for
models that only read from or inspect a path. The general
java/path-injection query and its PathInjectionSanitizer barrier
continue to consider both path-injection and path-injection[read]
sinks, so no alerts are lost. The java/zipslip query deliberately
selects only path-injection sinks, since read-only accesses such as
ClassLoader.getResource or FileInputStream are outside the archive
extraction threat model.

Addresses https://github.com/github/codeql/issues/21606 along the lines
proposed on the issue thread: prefer path-injection[read] over a
[create] sub-kind so that miscategorizing a sink causes a false
positive (easy to spot) rather than a false negative.

- shared/mad/codeql/mad/ModelValidation.qll: allow path-injection[...]
  as a valid sink kind.
- java/ql/lib/ext/*.model.yml: relabel the models that PR #12916
  migrated from the historical read-file kind (plus the newer
  ClassLoader resource-lookup variants that share the same read-only
  semantics).
- java/ql/lib/semmle/code/java/security/TaintedPathQuery.qll and
  PathSanitizer.qll: select both path-injection and
  path-injection[read] sinks/barriers.
- java/ql/lib/semmle/code/java/security/ZipSlipQuery.qll: keep only
  path-injection, with a comment explaining why path-injection[read]
  is excluded.
- java/ql/test/query-tests/security/CWE-022/semmle/tests/ZipTest.java:
  add m7 regression covering the Dubbo-style classpath lookup from
  issue #21606 and assert no alert is produced.
- Update TaintedPath.expected for the renamed kinds in the models list.
- Add change-notes under java/ql/lib/change-notes and
  java/ql/src/change-notes.
 2026-04-21 09:17:36 +10:00
Owen Mansel-Chan
579c871b69 Fix incorrect constructor summary models 2026-03-05 12:03:21 +00:00
Tom Hvitved
7024b07dd2 Java: Adapt to changes in FlowSummaryImpl 
Missing manual models were added using the following code added to `FlowSummaryImpl.qll`:

```ql
    private predicate testsummaryElement(
      Input::SummarizedCallableBase c, string namespace, string type, boolean subtypes, string name,
      string signature, string ext, string originalInput, string originalOutput, string kind,
      string provenance, string model, boolean isExact
    ) {
      exists(string input, string output, Callable baseCallable |
        summaryModel(namespace, type, subtypes, name, signature, ext, originalInput, originalOutput,
          kind, provenance, model) and
        baseCallable = interpretElement(namespace, type, subtypes, name, signature, ext, isExact) and
        (
          c.asCallable() = baseCallable and input = originalInput and output = originalOutput
          or
          correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalInput,
            input) and
          correspondingKotlinParameterDefaultsArgSpec(baseCallable, c.asCallable(), originalOutput,
            output)
        )
      )
    }

    private predicate testsummaryElement2(
      string namespace, string type, boolean subtypes, string name, string signature, string ext,
      string originalInput, string originalOutput, string kind, string provenance, string model,
      string namespace2, string type2
    ) {
      exists(Input::SummarizedCallableBase c |
        testsummaryElement(c, namespace2, type2, _, _, _, ext, originalInput, originalOutput, kind,
          provenance, model, false) and
        testsummaryElement(c, namespace, type, subtypes, name, _, _, _, _, _, provenance, _, true) and
        signature = paramsString(c.asCallable()) and
        not testsummaryElement(c, _, _, _, _, _, _, originalInput, originalOutput, kind, provenance,
          _, true)
      )
    }

    private string getAMissingManualModel(string namespace2, string type2) {
      exists(
        string namespace, string type, boolean subtypes, string name, string signature, string ext,
        string originalInput, string originalOutput, string kind, string provenance, string model
      |
        testsummaryElement2(namespace, type, subtypes, name, signature, ext, originalInput,
          originalOutput, kind, provenance, model, namespace2, type2) and
        result =
          "- [\"" + namespace + "\", \"" + type + "\", True, \"" + name + "\", \"" + signature +
            "\", \"\", \"" + originalInput + "\", \"" + originalOutput + "\", \"" + kind + "\", \"" +
            provenance + "\"]"
      )
    }
```
 2026-01-26 12:40:15 +01:00
Mauro Baluda
f71b6c1bfd Improved models for Supplier arguments 2026-01-14 12:32:42 +01:00
Mauro Baluda
d335f039ef Improve model for CWE-089 2026-01-13 21:48:43 +01:00
Mauro Baluda
dda042f7df rename change notes 2026-01-13 13:07:14 +01:00
Mauro Baluda
4c8058d97b Merge branch 'github:main' into couchdb 2026-01-09 17:20:40 +01:00
Owen Mansel-Chan
8a80158959 Merge pull request #17590 from Kwstubbs/java-mad-test 
Java: FileUpload Support MaD
 2026-01-08 13:33:55 +00:00
Owen Mansel-Chan
6a3c74c989 Merge pull request #20999 from joefarebrother/java-spring-websocket 
Java: Add models for spring WebSocketHandler
 2026-01-07 13:29:19 +00:00
Owen Mansel-Chan
6c291e1e7f Add model for handlePongMessage and update test 2026-01-07 11:09:59 +00:00
Mauro Baluda
1e1fb43534 Update JsonObject put method signatures in YAML 
Use erased type
 2026-01-02 11:55:40 +01:00
Owen Mansel-Chan
bf79b8a792 Merge branch 'main' into java-mad-test 2026-01-01 23:34:45 +00:00
Mauro Baluda
15ee88ee24 SQLi test case 2025-12-24 20:30:21 +01:00
Mauro Baluda
fd78c949d3 Merge branch 'github:main' into couchdb 2025-12-22 20:25:41 +01:00
Mauro Baluda
b22077c371 Hardcoded credentials in CouchBase 2025-12-22 20:22:20 +01:00
Owen Mansel-Chan
87f58fe51a Convert regex injection barrier to MaD 2025-12-11 16:24:29 +01:00
Owen Mansel-Chan
44295e4c7d Convert XSS barrier to MaD 2025-12-11 16:24:28 +01:00
Owen Mansel-Chan
7e562f3150 Convert request forgery barrier guard to MaD 2025-12-11 16:24:28 +01:00
Owen Mansel-Chan
f6e3c77145 Convert path injection barrier to MaD 2025-12-11 16:24:27 +01:00
Owen Mansel-Chan
f6e40bd49d Convert trust boundary violation barrier and barrier guard to MaD 2025-12-11 16:24:26 +01:00
Anders Schack-Mulligen
dcf6041dca Java: Add empty extensible data. 2025-12-11 16:24:26 +01:00
Joe Farebrother
d98e660803 Test fixes + more tests 2025-12-09 14:13:28 +00:00
Joe Farebrother
41b94e7031 Add spring websocket handler models 2025-12-09 14:12:39 +00:00
Owen Mansel-Chan
7b533db4fb Sort models and tests alphabetically 2025-11-12 15:10:29 +00:00
Owen Mansel-Chan
f598027cbd Apply suggestions from code review 2025-11-12 15:02:42 +00:00
Kevin Stubbings
88f9f90236 Fix merge problems 2025-10-06 22:41:16 -07:00
Kevin Stubbings
0d3b65a35b Resolved merge conflicts and completed merge 2025-10-06 22:37:28 -07:00
Idriss Riouak
b89b68dfdb Merge pull request #20339 from github/idrissrio/scoped-values 
Java: Add MaDs for `java.lang.ScopedValue`
 2025-09-10 11:21:34 +02:00
idrissrio
728a4aff22 Java: Add model for thenExpand and accept new results 2025-09-08 13:17:53 +02:00
idrissrio
55ff71b760 Java: Address review comment. Fix dataflow model 2025-09-08 13:17:51 +02:00
idrissrio
f52a427295 Java: Add MaDs for java.crypto.KDF 2025-09-08 13:17:48 +02:00
idrissrio
117c41bd55 Java: Address review comment. Fix dataflow model 2025-09-08 12:55:19 +02:00
idrissrio
9f1e60ca6d Java: Add MaDs for java.lang.scoped 2025-09-08 12:55:14 +02:00
Sid Gawri
a8889ff056 add extensions for remote sources 2025-08-14 16:10:49 -04:00