2600 Commits

Author	SHA1	Message	Date
Tom Hvitved	c9cf2a899c	Merge pull request #15260 from hvitved/dataflow/may-benefit-from-cctx-simplify ... Data flow: Remove column from `mayBenefitFromCallContext`	2024-01-10 11:43:15 +01:00
Tom Hvitved	f90201eb56	Data flow: Remove column from mayBenefitFromCallContext	2024-01-09 11:34:43 +01:00
Ed Minnix	a528db8958	Use MapMutation instead of MethodCall	2024-01-08 09:39:05 -05:00
Ed Minnix	709649e9df	Model replace and putIfAbsent	2024-01-08 09:39:03 -05:00
Ed Minnix	1544330f3f	Minor fixes for code review	2024-01-08 09:38:53 -05:00
Edward Minnix III	1f37e70d83	Fix typos ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2024-01-08 09:38:51 -05:00
Ed Minnix	6eff72f99a	Include other map mutations	2024-01-08 09:38:49 -05:00
Ed Minnix	f1f0f50c92	TaintedEnvironmentVariableQuery docs	2024-01-08 09:38:47 -05:00
Ed Minnix	d4e2b84348	Cleanup helper dataflow configuration	2024-01-08 09:38:45 -05:00
Ed Minnix	8ed3f3c865	Move to library	2024-01-08 09:38:44 -05:00
Tony Torralba	7e6f2d1fc5	Merge pull request #14681 from atorralba/atorralba/java/weak-randomness-cve-coverage ... Java: Add more sinks to the Insecure Randomness query	2024-01-08 15:33:03 +01:00
Tony Torralba	8ad787f3b8	Java: Generelize MaybeBrokenCryptoAlgorithmQuery.qll	2023-12-22 10:15:40 +01:00
Ed Minnix	7f9dff2dc7	Fix minor error in Weak Hashing	2023-12-21 22:48:07 -05:00
Ed Minnix	ce130c6ed5	Add replace to MapMutator	2023-12-19 10:23:06 -05:00
Edward Minnix III	56921a6e21	Merge pull request #14040 from egregius313/egregius313/weak-hashing-properties ... Java: Add support for algorithm names specified in `.properties` files to `java/potentially-weak-cryptographic-algorithm`	2023-12-18 09:38:58 -05:00
Tony Torralba	9446249e94	Merge pull request #15012 from atorralba/atorralba/java/fix-missing-pinning-fp ... Java: Fix FPs in Missing certificate pinning	2023-12-18 09:37:18 +01:00
Ed Minnix	09a0730491	QLdoc fix	2023-12-15 11:13:09 -05:00
Ed Minnix	02581a3850	Move class for getProperty method call to Properties.qll	2023-12-15 11:09:08 -05:00
Ed Minnix	1c3993e632	QLDocs	2023-12-15 11:09:07 -05:00
Ed Minnix	83c6ece405	Move weak hashing into MaybeBrokenCryptoAlgorithm	2023-12-15 11:09:07 -05:00
Ed Minnix	fbc2a33597	Replace MethodAccess with MethodCall	2023-12-15 11:09:07 -05:00
Ed Minnix	25fa8d5ae7	Move some logic to class	2023-12-15 11:09:07 -05:00
Ed Minnix	93cf5b8eb9	Weak Hashing Property initial query	2023-12-15 11:09:07 -05:00
Anders Schack-Mulligen	337e5e458c	Update java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-12-15 08:48:50 +01:00
Anders Schack-Mulligen	7623432c76	Java: Remove/deprecate FlowStateString-based extension points.	2023-12-14 15:15:58 +01:00
Anders Schack-Mulligen	a1068ce2f9	Dataflow: deprecate references	2023-12-14 15:05:33 +01:00
Tom Hvitved	c8b4a215bc	Merge pull request #14573 from hvitved/flow-summary-impl-param ... Move `FlowSummaryImpl.qll` to `dataflow` pack	2023-12-14 12:24:15 +01:00
Tom Hvitved	098afb935b	Address more review comments	2023-12-14 09:48:45 +01:00
Tony Torralba	d955dce72a	Improve source of randomness detection ... Also sanitize flow out of sinks to avoid overlapping paths	2023-12-13 11:15:27 +01:00
Tony Torralba	3a5d711711	Add cookie sinks	2023-12-13 11:15:27 +01:00
Tony Torralba	435d1f97a3	Add sink for OpenSAML's RequestType.setID	2023-12-13 11:15:27 +01:00
Tony Torralba	bd8f35bef7	Java: Fix FPs in Missing certificate pinning ... Local URIs should never require pinning	2023-12-12 18:02:12 +01:00
Ed Minnix	3ca039bc8f	Rename to InsecureRandomness	2023-12-11 11:18:40 -05:00
Ed Minnix	6e70e6c85a	Use pre-exisiting type for SecureRandom	2023-12-11 11:18:39 -05:00
Ed Minnix	bbf99375c7	Alter cookie sinks to instead focus on creation of a cookie	2023-12-11 11:18:39 -05:00
Ed Minnix	b9d2a26e6e	Move ESAPI models into the Weak Randomness query ... These models don't need to apply to all queries. So instead they are better suited to be within the weak randomness query itself.	2023-12-11 11:18:39 -05:00
Ed Minnix	7241e0920c	Replace convertBytesToString with models	2023-12-11 11:18:39 -05:00
Ed Minnix	e9ca4a25d4	Update to new MethodCall name	2023-12-11 11:18:39 -05:00
Ed Minnix	a1e9564cc5	Add more sources	2023-12-11 11:18:39 -05:00
Ed Minnix	b8b2de2f3c	Remove use of crypto-parameter sink kind	2023-12-11 11:18:39 -05:00
Ed Minnix	646254c9b2	Add credentials sinks from SensitiveApi	2023-12-11 11:18:39 -05:00
Ed Minnix	057a74d914	Remove unnused class	2023-12-11 11:18:39 -05:00
Ed Minnix	ba3c38c226	Restrict addCookie to specific interface	2023-12-11 11:18:38 -05:00
Ed Minnix	dc3e4cd928	Refactored method accesses to the RandomDataSource library	2023-12-11 11:18:38 -05:00
Ed Minnix	ce7690b53f	Make imports private	2023-12-11 11:18:38 -05:00
Edward Minnix III	bc0655573f	Simplifications ... Co-authored-by: Tony Torralba <atorralba@users.noreply.github.com>	2023-12-11 11:18:38 -05:00
Ed Minnix	0313f39229	Cryptographic sinks	2023-12-11 11:18:38 -05:00
Ed Minnix	b713efb711	Add ThreadLocalRandom.current as another source	2023-12-11 11:18:38 -05:00
Ed Minnix	bf0123d6ae	Add org.apache.commons.lang.RandomStringUtils as a source	2023-12-11 11:18:38 -05:00
Ed Minnix	e69ff7b601	Move to library and add docs	2023-12-11 11:18:38 -05:00