Chris Smowton
2e26fb1171
Merge pull request #11819 from smowton/smowton/admin/port-java-autobuilder-tests
...
Add Java autobuilder integration tests
2023-01-09 12:17:39 +00:00
Chris Smowton
efe23c1da7
Note that alerts should not be re-raised
2023-01-09 10:56:13 +00:00
Chris Smowton
994a46289f
Add change note
2023-01-09 10:56:13 +00:00
Chris Smowton
ef27f9fe96
Replace one more mention of escaping
2023-01-09 10:56:13 +00:00
Chris Smowton
45c732a6f9
Java: improve naming and description of SqlUnescaped.ql
...
Since the main thing it's objecting to is concatenation not lack of escaping (in particular it doesn't look for escaping sanitizers), rename and re-describe it accordingly.
2023-01-09 10:56:13 +00:00
Jami Cogswell
a3c7b2c3a2
Java: move java.lang.Math.min to the correct file
2023-01-06 14:35:09 -05:00
Jami
f5e5f6dfd1
Merge pull request #11821 from jcogs33/jcogs33/fix-mad-typos
...
Java: fix typos in MaD row `name` columns for `MappingSqlQuery` and `MappingSqlQueryWithParameters`
2023-01-06 07:59:30 -05:00
github-actions[bot]
cdb8f67601
Post-release preparation for codeql-cli-2.12.0
2023-01-06 10:36:34 +00:00
Nick Rolfe
6e07076151
tweak wording in 2.12 release notes
2023-01-05 16:46:44 +00:00
github-actions[bot]
b6a8193785
Release preparation for version 2.12.0
2023-01-05 16:32:14 +00:00
Jami Cogswell
f03f687d61
Java: add change note
2023-01-05 09:08:04 -05:00
Jami Cogswell
0640bd9d8b
Java: fix typos in the MaD row name columns for MappingSqlQuery and MappingSqlQueryWithParameters
2023-01-05 08:32:22 -05:00
Chris Smowton
52297c0b23
Add Java autobuilder integration tests
2023-01-05 12:19:25 +00:00
Rasmus Lerchedahl Petersen
c3b3c05cf3
Revert "Merge pull request #37 from erik-krogh/shared/inline-tests"
...
This reverts commit 65fe9abcfe08e9d3391f
2023-01-05 09:19:43 +01:00
Rasmus Lerchedahl Petersen
2e46919e10
java: nicer code as suggested by review
2023-01-04 19:50:29 +01:00
Jami Cogswell
abe501c1af
Java: add change note
2023-01-03 17:15:50 -05:00
Aditya Sharad
9988c19a42
Merge branch 'main' into tutorial/library-pack
2023-01-03 14:08:37 -08:00
Jami Cogswell
5d92792e40
Java: update test case affected by Function.apply model
2023-01-03 16:14:08 -05:00
Jami Cogswell
feaae16f7c
Java: adjust comments
2023-01-03 16:08:14 -05:00
Ed Minnix
0be8648a9d
Add changenote
2023-01-03 15:55:53 -05:00
Ed Minnix
28f555c2b2
Add simple test case for @JavascriptInterface parameter flow
2023-01-03 15:31:40 -05:00
Ed Minnix
ab7ca1d642
Java: Add parameters of @JavascriptInterface methods as a remote flow sources
2023-01-03 15:31:40 -05:00
Ed Minnix
f9b8200009
Add stub for android.webkit.JavascriptInterface annoation
2023-01-03 15:31:40 -05:00
Ed Minnix
81df89f93e
Use proper @id in changenote
2023-01-03 15:19:26 -05:00
Ed Minnix
28ad9d00fb
Merge both setAllowContentAccess queries into one query
...
Previously, the query to detect whether or not access to `content://`
links was done using two queries.
Now they can be merged into one query
2023-01-03 15:17:07 -05:00
Jami Cogswell
29221ae426
Java: add summary model for System.getProperty, adjust comments
2023-01-03 15:11:21 -05:00
Jami Cogswell
21a018e5c5
Java: add summary model and test for File.getName
2023-01-03 13:12:24 -05:00
Ed Minnix
35de551f6b
Formatting
2022-12-31 17:19:49 -05:00
Ed Minnix
515fa21aad
Change notes
2022-12-31 17:18:37 -05:00
Ed Minnix
df1a4d2ed1
Documentation fix: Add state1 and state2 to documentation
2022-12-31 15:25:37 -05:00
Ed Minnix
68392aa8d8
Fix test expectations
2022-12-31 15:25:25 -05:00
Ed Minnix
02f70f3536
Add @security-severity tag
2022-12-31 15:00:28 -05:00
Edward Minnix III
1d345c6101
Refactoring and simplification
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-12-31 15:00:28 -05:00
Ed Minnix
9ef319f659
Java: setAllowContentAccess query tests
2022-12-31 15:00:28 -05:00
Ed Minnix
5265cb4b03
Merge two dataflow configurations into one taint tracking
2022-12-31 15:00:28 -05:00
Ed Minnix
973f649e76
Break dataflow into two steps in order to capture flow from WebView to settings call
2022-12-31 15:00:28 -05:00
Ed Minnix
0e15dd9fa9
Query metadata
2022-12-31 15:00:28 -05:00
Edward Minnix III
778749184b
Change id to use android/ instead of prepending android-
...
Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com >
2022-12-31 15:00:28 -05:00
Ed Minnix
da25c586e6
Dataflow query for detecting paths that disable content access
...
Since the default value is `true`, we need to determine whether or not
the `setAllowContentAccess` method is ever called using dataflow.
2022-12-31 15:00:28 -05:00
Ed Minnix
8a763015e6
Reduce precision rating to medium
...
This query won't always be a security problem, so it should have a lower
precision rating than `high`.
2022-12-31 15:00:28 -05:00
Ed Minnix
7cc53126f3
Java: WebView setAllowContentAccess query test cases
2022-12-31 15:00:28 -05:00
Ed Minnix
a023726c03
Java: add Android stubs to options file for CWE-200 tests
2022-12-31 15:00:28 -05:00
Ed Minnix
e4e13d38b7
Java: query for Android WebView setAllowContentAccess
2022-12-31 15:00:28 -05:00
Ed Minnix
e259ef5d1d
Java: Add class for android.webkit.WebSettings.setAllowContentAccess
2022-12-31 15:00:28 -05:00
Jami Cogswell
939279af38
Java: add comments
2022-12-22 16:25:12 -05:00
Jami Cogswell
673d37cc3d
Java: update Math.min test case
2022-12-22 14:36:06 -05:00
Jami Cogswell
a81c54b58c
Java: updates to order alphabetically
2022-12-22 13:22:12 -05:00
Jami Cogswell
e6331dc2e6
Java: update test case affected by Long.parseLong summary model
2022-12-22 12:57:37 -05:00
Jami Cogswell
997219a280
Java: update test case affected by Class.isAssignableFrom neutral model
2022-12-22 12:54:02 -05:00
Jami Cogswell
6007827dd3
Java: update test cases
2022-12-22 12:29:57 -05:00
