Joe Farebrother
1e3c4d0eb1
Add stubs to fix broken test case
2021-03-16 14:24:49 +00:00
Anders Schack-Mulligen
45c9428668
Merge pull request #5337 from smowton/smowton/feature/commons-lang-random-sources
...
Java: Add support for Commons-Lang's RandomUtils
2021-03-15 16:21:01 +01:00
Chris Smowton
1c1ca70027
Add models for flow- and taint-preserving functions in Commons ObjectUtils.
...
These should all be value-preserving, but we don't support value-preserving varargs methods yet.
2021-03-11 16:22:54 +00:00
Chris Smowton
9163893879
Add models for Commons-Lang's RegExUtils class
2021-03-09 15:11:13 +00:00
Joe Farebrother
7a4ce83169
Merge pull request #5310 from joefarebrother/guava-io
...
Java: Add modelling for Guava IO utilities
2021-03-09 11:19:44 +00:00
p0wn4j
6841f5f7c4
Java: Add NashornScriptEngine detection in ScriptEngine query
...
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
Java: Add NashornScriptEngine detection in ScriptEngine query
2021-03-06 16:19:07 +04:00
Chris Smowton
e3cf5c235e
Add support for Commons-Lang's RandomUtils
...
This is realised by somewhat generalising our interfaces for modelling RNGs. We also add tests for randomness-related queries that didn't have any, and addtest cases checking the Apache random-number generators are interchangeable with the stdlib ones.
2021-03-05 12:09:33 +00:00
Joe Farebrother
d30d1a2ab2
Add unit tests and fix issues
2021-03-05 11:19:52 +00:00
Joe Farebrother
c12f8035c4
Add stubs for unit tests
2021-03-05 11:19:25 +00:00
Anders Schack-Mulligen
00983c8967
Merge pull request #4965 from artem-smotrakov/jexl-injection
...
Java: Query for detecting JEXL injections
2021-03-05 10:52:36 +01:00
Anders Schack-Mulligen
20ccb52912
Merge pull request #4299 from torque59/play-framework
...
Initial support for Java - Play Framework > 2.6.x
2021-03-05 10:51:53 +01:00
Chris Smowton
b0ba0585a7
Add models for Apache Commons Lang and Text's Str[ing]Substitutor
2021-03-04 11:11:55 +00:00
Chris Smowton
f749c31136
Add models for commons lang/text's Str[ing]Lookup class
2021-03-04 11:11:55 +00:00
Chris Smowton
1580d23b2b
Add models for WordUtils and StrTokenizer
...
Both of these have commons-text and commons-lang variants.
2021-03-04 11:11:55 +00:00
Anders Schack-Mulligen
3400c121d6
Merge pull request #5202 from joefarebrother/apache-http
...
Java: Add modelling for Apache HTTP Components
2021-03-03 13:41:41 +01:00
Francis Alexander
173c4b7f2f
More Play stubs improvements
2021-03-02 20:39:25 +05:30
Francis Alexander
4384f78595
Play stubs improvements, cleanup and return values
2021-03-02 16:50:16 +05:30
Tamás Vajk
505d04b13e
Merge pull request #5102 from luchua-bc/java/main-method-in-servlet
...
Java: CWE-489 Query to detect main() method in servlets
2021-02-25 16:05:06 +01:00
Artem Smotrakov
34b6ed0a05
Removed commented code from JexlUberspect
2021-02-24 22:31:03 +01:00
Joe Farebrother
e13c779f0f
Add additional unit tests
2021-02-23 16:17:13 +00:00
Joe Farebrother
7b5961769a
Add unit tests for version 5.x
2021-02-23 14:26:12 +00:00
Joe Farebrother
cf58a90d74
Add unit tests for utility methods
2021-02-23 14:26:12 +00:00
Joe Farebrother
5bba7f6df7
Add unit tests
2021-02-23 14:26:11 +00:00
luchua-bc
3d9ac0d094
Add query for enterprise beans
2021-02-20 02:00:42 +00:00
Chris Smowton
10112c50ab
Add support for StrBuilder and TextStringBuilder in commons-text
...
These are identical to the current deprecated StrBuilder in commons-lang3.
2021-02-17 09:36:28 +00:00
Chris Smowton
a63f18e49d
Add models for Commons-Lang's StrBuilder class. These exclude its fluent methods for the time being, which will be added in a forthcoming PR.
2021-02-17 09:36:20 +00:00
Chris Smowton
a2eeffa9c0
Add support for Apache Commons Lang StringUtils
2021-02-16 14:48:39 +00:00
Artem Smotrakov
042c0b005e
Covered sandboxes for JEXL 2
...
- Updated SandboxedJexlFlowConfig to cover JEXL 2
- Added SandboxedJexl2 test
2021-02-11 22:57:26 +01:00
Artem Smotrakov
af0f361ac8
Updated JexlInjection.ql to check for sandboxes
...
- Added a dataflow config to track setting a sandbox
on JexlBuilder
- Added SandboxedJexl3.java test
2021-02-10 22:19:45 +01:00
yo-h
e194411cfa
Java: fix javac errors in test code
2021-02-09 09:16:57 -05:00
luchua-bc
a183b00166
Query to detect main method in servlets
2021-02-05 03:53:01 +00:00
Francis Alexander
683233333c
test case return statements and feedback
2021-02-04 22:28:10 +05:30
Joe Farebrother
d69ecde5c1
Java: Add additional flow steps for guava collection methods and more unit tests
2021-01-25 16:37:40 +00:00
Artem Smotrakov
7d2d27394b
Java: Added a source and a taint step for JexlInjectionConfig
...
- Added TaintedSpringRequestBody source
- Added returningTaintedDataFromBean() taint step
- Added tests
2021-01-17 22:28:42 +01:00
Artem Smotrakov
99401f6e84
Java: Query for detecting JEXL injections
2021-01-17 14:19:26 +01:00
Anders Schack-Mulligen
e5b4975450
Merge pull request #4675 from luchua-bc/cleartext-storage-shared-prefs
...
Java: Query to detect cleartext storage of sensitive information using Android SharedPreferences
2021-01-08 12:41:34 +01:00
Francis Alexander
1f5a466e46
Playframework test cases & review fixes
2021-01-06 22:57:14 +05:30
Anders Schack-Mulligen
0cc324b715
Merge pull request #3839 from luchua-bc/uncaught-servlet-exception
...
Java: Uncaught servlet exception
2020-12-02 15:12:59 +01:00
Anders Schack-Mulligen
f70072a2db
Merge pull request #3454 from porcupineyhairs/javaSSRf
...
Java : add request forgery query
2020-11-26 08:52:15 +01:00
luchua-bc
0bd6255c41
Query for cleartext storage using Android SharedPreferences
2020-11-16 17:23:01 +00:00
Anders Schack-Mulligen
4be731d2ab
Java: Adjust reference to static method and add test.
2020-11-16 11:47:58 +01:00
Porcupiney Hairs
38de9b6433
add request forgery query
2020-11-10 01:19:35 +05:30
Anders Schack-Mulligen
89361a3b75
Merge pull request #3812 from luchua-bc/java-android-remote-source
...
Java: Add remote source of Android intent extra
2020-11-03 09:35:40 +01:00
luchua-bc
864411b4b9
Updates to Android stub classes
2020-11-02 14:06:44 +00:00
luchua-bc
67af9b0f3e
Add comments and update JavaDocs of GenericServlet using the source JAR
2020-10-30 17:05:53 +00:00
Anders Schack-Mulligen
f3e2bd0fd9
Merge pull request #3141 from pwntester/InsecureBeanValidation
...
Insecure Bean Validation query
2020-10-28 12:04:12 +01:00
Alvaro Muñoz
3378dd526e
remove compiled classes from stubs
2020-10-27 15:56:26 +01:00
Alvaro Muñoz
671ea2f6c6
add test and stubs
2020-10-27 15:47:54 +01:00
Joe Farebrother
2050f82553
Merge pull request #4383 from joefarebrother/guava-strings
...
Java: Add modelling for Guava
2020-10-26 10:16:55 +00:00
Francis Alexander
ddc544aa07
Initial support for Play Framework > 2.6.x
2020-10-22 20:20:49 +05:30
