MarkLee131
e6adfbca77
Address review: update QLDoc comment and fix expected test output
...
- Clarify that arithmeticUsedInBoundsCheck applies to if-condition
comparisons, not all comparisons
- Update expected test line numbers to reflect added test calls
2026-03-29 11:53:06 +08:00
Kaixuan Li
938039d82c
Merge branch 'main' into fix/tainted-arithmetic-bounds-check-barrier
2026-03-29 10:25:39 +08:00
MarkLee131
0c5e89a68e
Exclude bounds-check arithmetic from tainted-arithmetic sinks
...
The java/tainted-arithmetic query now recognizes when an arithmetic
expression appears directly as an operand of a comparison (e.g.,
`if (off + len > array.length)`). Such expressions are bounds checks,
not vulnerable computations, and are excluded via the existing
overflowIrrelevant predicate.
Add test cases for bounds-checking patterns that should not be flagged.
2026-03-28 17:39:40 +08:00
MarkLee131
da4a2238bc
Address PR review: add Signature.getInstance sink, HMAC/PBKDF2 whitelist, fix test APIs
...
- Model Signature.getInstance() as CryptoAlgoSpec sink (previously only
Signature constructor was modeled)
- Add HMAC-based algorithms (HMACSHA1/256/384/512, HmacSHA1/256/384/512)
and PBKDF2 to the secure algorithm whitelist
- Fix XDH/X25519/X448 tests to use KeyAgreement.getInstance() instead of
KeyPairGenerator.getInstance() to match their key agreement semantics
- Add test cases for SHA384withECDSA, HMACSHA*, and PBKDF2WithHmacSHA1
from user-reported false positives
- Update change note to document all additions
2026-03-28 16:53:46 +08:00
MarkLee131
a9449cc991
Add EC to secure algorithm whitelist for Java CWE-327 query
2026-03-28 16:48:58 +08:00
Anders Schack-Mulligen
6a6bb5ebf9
Merge pull request #21441 from aschackmull/cfg/switch-sharing
...
Cfg: Share more code for switch statements.
2026-03-10 13:50:21 +01:00
Anders Schack-Mulligen
77d4f5a2dc
Cfg: Update fallsThrough default.
2026-03-10 11:10:24 +01:00
Anders Schack-Mulligen
edf88b34da
Cfg: Move Case.getBodyElement to shared code.
2026-03-10 11:02:58 +01:00
Anders Schack-Mulligen
35ac66d3aa
Cfg: Move getCaseControlFlowOrder to shared code.
2026-03-10 10:39:32 +01:00
Owen Mansel-Chan
d8007a85e6
Java: Make corresponding predicate private
2026-03-09 13:44:50 +00:00
Owen Mansel-Chan
e96ba4806b
Merge pull request #21415 from owen-mc/java/validate-constructor-summary-models
...
Java: validate constructor summary models
2026-03-06 09:09:18 +00:00
Owen Mansel-Chan
63c71b418c
Add model validation for constructor summary models
2026-03-05 12:02:37 +00:00
Anders Schack-Mulligen
ec1d034ee0
Java: Make Assignment extend BinaryExpr.
2026-03-05 11:31:59 +01:00
Anders Schack-Mulligen
3c129fcd23
Java: Align BinaryExpr.getOp() with AssignOp.getOp().
2026-03-04 13:46:04 +01:00
Anders Schack-Mulligen
ab94524328
Cfg: Address review comments.
2026-02-27 16:35:25 +01:00
Anders Schack-Mulligen
bdbbd45909
Java: Handle missing throws clauses.
2026-02-23 15:10:02 +01:00
Anders Schack-Mulligen
b798bc2c8f
Java: Fix enhancedForEarlyExit implementation.
2026-02-23 15:09:58 +01:00
Anders Schack-Mulligen
fc8b7c04cf
Java: Exclude ExprStmt consistent with SwitchCase.getRuleExpression().
2026-02-23 15:09:55 +01:00
Anders Schack-Mulligen
ccd28ff66a
Java: Fix instanceof-disjunction.
2026-02-23 15:09:55 +01:00
Anders Schack-Mulligen
7871cd74f6
Java: Fix switchcase guards.
2026-02-23 15:09:52 +01:00
Anders Schack-Mulligen
1e9dcea88b
Java: Fix RangeAnalysis/ModulusAnalysis.
2026-02-23 15:09:51 +01:00
Anders Schack-Mulligen
6fbdb2c52b
Java: Fix Cyclomatic complexity calculation.
2026-02-23 15:09:51 +01:00
Anders Schack-Mulligen
48e3724299
Java/Cfg: Introduce new shared CFG library and replace the Java CFG.
2026-02-23 15:09:50 +01:00
Anders Schack-Mulligen
4a97a449fc
Java: Replace ControlFlowNode.asCall with Call.getControlFlowNode.
2026-02-23 15:09:49 +01:00
Anders Schack-Mulligen
2e987343dd
Java: Preparatory tweaks.
2026-02-23 15:09:48 +01:00
Owen Mansel-Chan
94e3d86f6a
Merge pull request #21319 from owen-mc/java/javax-jakarta
...
Java: Always use both "javax" and "jakarta" at the beginning of Jave EE packages
2026-02-17 08:31:52 +00:00
Owen Mansel-Chan
94f1d94a2b
Rename MethodCall ma to mc
2026-02-16 12:01:14 +00:00
Owen Mansel-Chan
9fc95f5171
Expand log injection sanitizers to annotation regex matches
2026-02-16 12:01:13 +00:00
Owen Mansel-Chan
924bb92d91
Expand log injection sanitizer guards to non-annotation regex matches
2026-02-16 12:01:11 +00:00
Owen Mansel-Chan
60e58f8219
Refactor logInjectionGuard part 2
2026-02-16 12:01:10 +00:00
Owen Mansel-Chan
6c0c1d558e
Refactor logInjectionGuard part 1
2026-02-16 12:01:08 +00:00
Owen Mansel-Chan
91c731f68d
Fix new usage that was introduced
2026-02-16 11:03:27 +00:00
Owen Mansel-Chan
c4192b670b
More copilot suggestions
2026-02-16 11:02:21 +00:00
Owen Mansel-Chan
53b8f2abb1
Apply copilot's fixes
2026-02-16 11:02:20 +00:00
Owen Mansel-Chan
178fbf9600
Add missing QLDoc
2026-02-16 11:02:19 +00:00
Owen Mansel-Chan
31840902cd
Fix places which already dealt with both javax and jakarta
2026-02-16 11:02:16 +00:00
Owen Mansel-Chan
4b240ebf8a
Define new predicate javaxOrJakarta()
2026-02-16 11:02:14 +00:00
Owen Mansel-Chan
a5e6f6daf9
Replace "javax" with javaxOrJakarta()
...
This is just a find-replace of `"javax` with `javaxOrJakarta() + "`.
2026-02-16 11:02:12 +00:00
Owen Mansel-Chan
47a9f87d9b
Merge pull request #21310 from owen-mc/java/regex-execution
...
Java: Add RegexMatch concept and recognise `@Pattern` annotation as sanitizer
2026-02-16 09:11:47 +00:00
Owen Mansel-Chan
16ddb5658f
Small refactor for stylistic consistency
2026-02-15 14:39:23 +00:00
Owen Mansel-Chan
d6b71a346e
Extend RegexMatch framework to allow for MatcherMatchesCall edge case
2026-02-15 14:39:21 +00:00
Owen Mansel-Chan
8f8f4c2d52
Fix Matcher.matches edge case
2026-02-14 00:28:37 +00:00
Owen Mansel-Chan
2e0f244376
Improve QLDoc on RegexMatch.getName()
2026-02-13 22:55:01 +00:00
Owen Mansel-Chan
c7099584b4
Put imports implementing abstract classes in private module
2026-02-13 22:51:53 +00:00
Owen Mansel-Chan
3c161f9c93
Make contract of RegexMatch clear
2026-02-13 22:47:44 +00:00
Owen Mansel-Chan
1fefa989d7
Rename RegexMatch and only include expressions
2026-02-13 22:45:48 +00:00
Owen Mansel-Chan
953ff9f0d0
PatternAnnotation.getString() should only be field reads
2026-02-13 22:41:20 +00:00
Owen Mansel-Chan
106254b220
Improve QLDocs
2026-02-13 22:40:36 +00:00
Owen Mansel-Chan
5bdf550317
Fix QLDocs
2026-02-12 16:57:14 +00:00
Owen Mansel-Chan
bfe26c1989
Add @Pattern as RegexExecution => SSRF sanitizer
2026-02-12 16:57:11 +00:00
