Tony Torralba
32471d326e
Java: Remove omittable exists variables
2023-01-10 13:37:19 +01:00
Chris Smowton
45c732a6f9
Java: improve naming and description of SqlUnescaped.ql
...
Since the main thing it's objecting to is concatenation not lack of escaping (in particular it doesn't look for escaping sanitizers), rename and re-describe it accordingly.
2023-01-09 10:56:13 +00:00
Tony Torralba
ab73d13d8b
Small simplification
2022-12-21 09:58:13 +01:00
Jami
c9258effb6
Merge pull request #11572 from jcogs33/jcogs33/model-top-jdk-apis
...
Java: model top 100 JDK APIs
2022-12-20 09:13:53 -05:00
Tony Torralba
149cae9603
Merge pull request #10971 from joefarebrother/android-certificate-pinning
...
Java: Add Android missing certificate pinning query (CWE-295)
2022-12-20 11:03:16 +01:00
Tony Torralba
3e7a819fe7
Simplification
2022-12-20 09:42:25 +01:00
Edward Minnix III
39a7c7bb12
Merge pull request #11282 from egregius313/egregiu313/webview-addjavascriptinterface
...
Java: Query for detecting addJavascriptInterface method calls
2022-12-19 11:28:45 -05:00
Jami Cogswell
f3fc68352e
Java: update tests affected by Integer.parseInt model
2022-12-18 19:43:32 -05:00
Edward Minnix III
0ebfee8b11
Merge pull request #11241 from egregius313/egregius313/webview-file-access
...
Java: Query to detect Android Webview file access
2022-12-12 11:12:26 -05:00
Joe Farebrother
a14ebb7c03
Fixes
2022-12-09 13:41:18 +00:00
Joe Farebrother
0d6a376a36
Add test cases for TrustManager case
2022-12-09 13:41:18 +00:00
Joe Farebrother
4afecf575e
Generate more stubs for okhttp and fix tests.
...
Some generated stubs needed to be manually corrected.
2022-12-09 13:41:17 +00:00
Joe Farebrother
bb402c497b
Fix typo in dir name
2022-12-09 13:41:17 +00:00
Joe Farebrother
53c4ada883
Add okhttp tests
2022-12-09 13:41:17 +00:00
Joe Farebrother
ea3db5d429
Add test cases
2022-12-09 13:41:17 +00:00
Edward Minnix III
170c9af9e8
Merge pull request #11238 from egregius313/egregius313/webview-setjavascriptenabled
...
Java: Query for detecting enabling Javascript in Android WebSettings
2022-12-07 09:31:58 -05:00
Mauro Baluda
04f1fe523a
Update Test.java
2022-12-02 18:01:10 +01:00
Tony Torralba
43f4dd8bc4
Consider taint through bitwise operations on PendingIntent flags
2022-11-22 11:39:30 +01:00
Jami
8a73675483
Merge pull request #11070 from jcogs33/java-regex-injection
...
Java: Promote regex injection query from experimental
2022-11-21 15:04:26 -05:00
Tony Torralba
2809c3a77c
Handle disabled Maven repositories
2022-11-21 10:11:57 +01:00
Joe Farebrother
d6c5132f39
Merge pull request #10684 from joefarebrother/android-keyboard-cache
...
Java: Add query for Sensitive Keyboard Cache
2022-11-16 15:27:44 +00:00
Joe Farebrother
dd4e1d0ac3
Add tests and fix issues
2022-11-16 10:54:14 +00:00
Joe Farebrother
359d703ded
More precise layout xml handling
2022-11-16 10:54:13 +00:00
Joe Farebrother
706858e211
Add test cases; fix the regex used
2022-11-16 10:54:13 +00:00
Ed Minnix
eb8ef72e47
Java: addJavascriptInterface query test case
2022-11-15 23:28:18 -05:00
Ed Minnix
3b96fefc71
Java: Add Android stubs to options file for CWE-079 test cases
2022-11-15 23:26:49 -05:00
Ed Minnix
10875568ec
Java: add negative test cases for WebView file access query
2022-11-15 13:50:31 -05:00
erik-krogh
c029048306
port the Java regex/redos queries to use the shared pack
2022-11-14 21:29:41 +01:00
Ed Minnix
7a0544d80e
Java: test files for WebView file access query
2022-11-14 15:11:15 -05:00
Ed Minnix
1132572620
Java: add test cases for setJavaScriptEnabled query
2022-11-14 14:33:12 -05:00
Jami
cfbaf5e53b
Merge pull request #10785 from jcogs33/insuff-key-size-globalflow-keysize
...
Java: Promote insufficient key size query from experimental
2022-11-08 18:05:01 -05:00
Jami Cogswell
bada986433
apply review comments
2022-11-08 15:29:33 -05:00
Jami Cogswell
b99a1d2cd9
update sink and tests
2022-11-08 15:29:33 -05:00
Jami Cogswell
0e93e71127
update tests
2022-11-08 15:29:33 -05:00
Jami Cogswell
5402001362
remove original sanitizer
2022-11-08 15:29:33 -05:00
Jami Cogswell
5dcd3b2c0f
clean up files
2022-11-08 15:29:33 -05:00
Jami Cogswell
5b089bbb9c
split sanitizer into three
2022-11-08 15:29:33 -05:00
Jami Cogswell
91491d9a7b
refactor into more classes; add more test cases; add LITERAL sanitizer
2022-11-08 15:29:33 -05:00
Jami Cogswell
6545cff0ef
add Pattern.quote sanitizer
2022-11-08 15:29:33 -05:00
Jami Cogswell
833c5edf06
move to .qll file and switch to InlineExpectations tests
2022-11-08 15:29:32 -05:00
Jami Cogswell
25436fe555
update options and qlref files
2022-11-08 15:29:32 -05:00
Jami Cogswell
32b140045e
move files out of experimental
2022-11-08 15:29:32 -05:00
Jami Cogswell
f40eefce57
use CompileTimeConstantExpr instead of StringLiteral
2022-10-27 17:11:07 -04:00
Jami Cogswell
e5982f19fa
minor updates
2022-10-19 11:05:40 -04:00
Jami Cogswell
961e5c72a3
minor updates
2022-10-19 08:44:35 -04:00
Tony Torralba
fd8f8cb930
Merge pull request #10223 from atorralba/atorralba/unsafe-content-resolver
...
Java: New Android query to detect unsafe content URI resolution
2022-10-19 11:22:04 +02:00
Jami Cogswell
4df0fbcce1
update tests
2022-10-19 01:17:57 -04:00
Jami Cogswell
2714c7fdcf
update tests
2022-10-14 16:45:13 -04:00
Jami Cogswell
2daa3457d7
combine three configs into one
2022-10-13 17:57:56 -04:00
Jami Cogswell
bfbb6db436
clean up code
2022-10-12 16:58:34 -04:00
