Anders Schack-Mulligen
fe07630e40
Merge pull request #5219 from smowton/smowton/feature/backward-dataflow-for-fluent-methods
...
Java: Add backward dataflow edges through fluent function invocations.
2021-03-04 11:13:32 +01:00
Anders Schack-Mulligen
3400c121d6
Merge pull request #5202 from joefarebrother/apache-http
...
Java: Add modelling for Apache HTTP Components
2021-03-03 13:41:41 +01:00
Joe Farebrother
81ff76814f
Remove incorrect expectaton
2021-03-02 16:35:34 +00:00
Chris Smowton
aab9deceef
Remove package from test Java file
2021-03-01 10:32:44 +00:00
Chris Smowton
54caf501e7
Switch fluent-methods test to use a plain DataFlow::Configuration
...
No taint edges are involved, so TaintTracking was unnecessary.
2021-03-01 10:16:02 +00:00
Chris Smowton
fadbb32bd6
Add backward dataflow edges through fluent function invocations.
...
This means that much as obj.getA().setB(...) already has a side-effect on `obj`, all three setters in obj.setA(...).setB(...).setC(...) will have a side-effect on `obj`.
2021-03-01 10:11:28 +00:00
Tamás Vajk
505d04b13e
Merge pull request #5102 from luchua-bc/java/main-method-in-servlet
...
Java: CWE-489 Query to detect main() method in servlets
2021-02-25 16:05:06 +01:00
Anders Schack-Mulligen
f0d3841369
Merge pull request #5105 from JLLeitschuh/feat/JLL/depricated_bintray_usage
...
CWE-1104: Maven POM dependence upon Bintray/JCenter
2021-02-25 09:08:31 +01:00
Anders Schack-Mulligen
add960bc4d
Merge pull request #4880 from luchua-bc/java/sensitive-query-with-get
...
Java: Sensitive GET Query
2021-02-24 11:08:47 +01:00
yo-h
1d654febfd
Merge pull request #5195 from aschackmull/java/cwe-548-test
...
Java: Add empty file to test.
2021-02-23 21:12:40 -05:00
Joe Farebrother
e13c779f0f
Add additional unit tests
2021-02-23 16:17:13 +00:00
Joe Farebrother
a3b8d4ab2d
Switch to inline test expectations; fix failing test outputs
2021-02-23 14:26:12 +00:00
Joe Farebrother
7b5961769a
Add unit tests for version 5.x
2021-02-23 14:26:12 +00:00
Joe Farebrother
cf58a90d74
Add unit tests for utility methods
2021-02-23 14:26:12 +00:00
Joe Farebrother
5bba7f6df7
Add unit tests
2021-02-23 14:26:11 +00:00
Anders Schack-Mulligen
b1bed2731d
Merge pull request #5172 from smowton/smowton/feature/commons-strbuilder
...
Java: Add support for commons-lang's StrBuilder class
2021-02-23 14:39:11 +01:00
yo-h
6213c20bc3
Merge pull request #5136 from aschackmull/java/csv-models
...
Java: Add support for framework modelling through csv data.
2021-02-22 19:00:41 -05:00
Jonathan Leitschuh
ad99aa2d76
Fix typo in test output
2021-02-22 13:26:51 -05:00
luchua-bc
40df01d2cd
Update qldoc and method name
2021-02-22 14:15:41 +00:00
luchua-bc
3d9ac0d094
Add query for enterprise beans
2021-02-20 02:00:42 +00:00
Chris Smowton
321df82851
Apply review feedback: comment style, bracketing, and use proper MISSING test annotations
2021-02-18 14:56:52 +00:00
Anders Schack-Mulligen
954e0b9496
Java: Add empty file to test.
2021-02-18 13:10:29 +01:00
Anders Schack-Mulligen
6f583baa90
Java: More documentation and support for field writes.
2021-02-18 11:18:31 +01:00
Anders Schack-Mulligen
862c41632e
Java: Add empty file to test.
2021-02-17 13:23:18 +01:00
Chris Smowton
c700d004e0
Commons Lang/Text StrBuilder: propagate taint from constructors
2021-02-17 09:51:28 +00:00
Chris Smowton
10112c50ab
Add support for StrBuilder and TextStringBuilder in commons-text
...
These are identical to the current deprecated StrBuilder in commons-lang3.
2021-02-17 09:36:28 +00:00
Chris Smowton
a63f18e49d
Add models for Commons-Lang's StrBuilder class. These exclude its fluent methods for the time being, which will be added in a forthcoming PR.
2021-02-17 09:36:20 +00:00
Chris Smowton
a2eeffa9c0
Add support for Apache Commons Lang StringUtils
2021-02-16 14:48:39 +00:00
Chris Smowton
bf03c0f419
Port InlineExpectationsTest for the Java analysis
2021-02-16 14:48:39 +00:00
Anders Schack-Mulligen
6eafa9d396
Merge pull request #5133 from pwntester/fix_SnakeYaml
...
Remove sanitizing condition which does not prevent vulnerability.
2021-02-16 12:58:47 +01:00
luchua-bc
2f17943abc
Update qldoc
2021-02-15 16:58:09 +00:00
Jonathan Leitschuh
d82e8216ed
Merge branch 'main' into feat/JLL/depricated_bintray_usage
2021-02-15 10:48:28 -05:00
Alvaro Muñoz
00a0b12dad
update expected results
2021-02-15 11:23:40 +01:00
Alvaro Muñoz
c7072aef16
update A.java test
2021-02-15 10:34:20 +01:00
Anders Schack-Mulligen
161e756c4b
Merge pull request #5141 from github/yo-h/java-flow-check-fix
...
Java: prepare to enforce additional compiler checks in test code
2021-02-15 09:41:03 +01:00
yo-h
1d007b6e72
Java: delete two test cases as per code review
2021-02-14 21:42:58 -05:00
Chris Smowton
97df60f9d6
Move misplaced experimental query into the conventional directory
2021-02-12 12:12:16 +00:00
Anders Schack-Mulligen
b74911204a
Merge pull request #4945 from intrigus-lgtm/java/insecure-jxbrowser
...
Java: Insecure JXBrowser
2021-02-10 15:48:17 +01:00
Anders Schack-Mulligen
3a6fa9d99b
Java: Add support for framework modelling through csv data.
2021-02-10 13:25:03 +01:00
yo-h
e5331a4735
Java: accept changes in expected output
2021-02-09 09:17:35 -05:00
yo-h
e194411cfa
Java: fix javac errors in test code
2021-02-09 09:16:57 -05:00
luchua-bc
cb01613aa6
Exclude FP token patterns
2021-02-09 13:53:23 +00:00
intrigus
2e30f2d9ce
Java: Fix QHelp & accept test output
...
Accept test output for changed alert message.
2021-02-08 00:05:02 +01:00
Jonathan Leitschuh
bfa9324266
CWE-1104: Maven POM dependence upon Bintray/JCenter
2021-02-05 13:05:51 -05:00
luchua-bc
a183b00166
Query to detect main method in servlets
2021-02-05 03:53:01 +00:00
Anders Schack-Mulligen
35e620a19c
Merge pull request #4854 from luchua-bc/java/insecure-ldap-auth
...
Java: Insecure LDAP authentication
2021-02-04 14:56:38 +01:00
Anders Schack-Mulligen
40d02e7e32
Merge pull request #4926 from luchua-bc/java/insufficient-key-size
...
Java: Query to detect weak encryption: insufficient key size
2021-02-03 15:16:10 +01:00
luchua-bc
2ace10fcdf
Use PostUpdateNode for wrapper method calls
2021-02-03 12:21:31 +00:00
Anders Schack-Mulligen
bbdd7c9b57
Merge pull request #4963 from joefarebrother/guava-collections
...
Java: Add flow steps for Guava collection utilities
2021-01-28 11:01:03 +01:00
luchua-bc
ab7d257569
Add more cases and change EC to 256 bits
2021-01-28 04:06:27 +00:00
