yoff
de05bfbce3
java: address review comments
...
- do not use `getQualifiedName`
- use camelCase
- rework alert predicates
2025-10-21 13:25:26 +02:00
Michael Nebel
def522d122
C#: Make sure that the file exists before attempting to get version info.
2025-10-21 13:12:21 +02:00
Michael Nebel
af5622a60e
C#: Address review comments.
2025-10-21 13:03:53 +02:00
Geoffrey White
d691c3215f
Rust: Add expressions with unknown type metric (expected by DCA).
2025-10-21 12:00:25 +01:00
yoff
715acefacc
Apply suggestions from code review
...
Co-authored-by: Anders Schack-Mulligen <aschackmull@users.noreply.github.com >
2025-10-21 12:52:59 +02:00
Anders Schack-Mulligen
414e5ecbce
Merge pull request #20646 from aschackmull/ssa/ssa-sig
...
SSA: Add a shared signature for SSA and a module to implement it.
2025-10-21 12:14:08 +02:00
Paolo Tranquilli
316225bb88
Csharp: rename predicate
2025-10-21 11:47:54 +02:00
Paolo Tranquilli
6f8b1f6f4c
Csharp: address review
2025-10-21 11:43:58 +02:00
Michael Nebel
6bc15bcedc
C#: Add change-note.
2025-10-21 11:42:19 +02:00
Michael Nebel
e560ac197f
C#: Tracer support for invoking csc directly.
2025-10-21 11:16:55 +02:00
Paolo Tranquilli
c728503517
Merge branch 'main' into redsun82/csharp-fix-xframe-options-in-location
2025-10-21 11:15:46 +02:00
Anders Schack-Mulligen
242f12d4be
SSA: Remove variable capture reference from shared class.
2025-10-21 10:52:49 +02:00
Simon Friis Vindum
0badcfd663
C++: Address review comments
2025-10-21 09:47:58 +02:00
REDMOND\brodes
22c0f9fa91
Crypto: Adding a proof of concept bad mac ordering predicate that takes in an ArtifactNode to be used for graph generation to intercept nodes with known mac ordering issues, in order to format the node and output error messages in the graph.
2025-10-20 16:24:31 -04:00
REDMOND\brodes
eff94ef91f
Crypto: To allow for graph generation to have properties informed by assessments, altering a few queries weak/vuln/bad crypto to have qll files that can be accessed for other purposes, like graph generation. Also altering weak symmetric cipher to look for non-aes algorithms to be more comprehensive.
2025-10-20 15:51:07 -04:00
REDMOND\brodes
cc436e897d
Merge branch 'santander-java-crypto-check' of https://github.com/bdrodes/codeql into santander-java-crypto-check
2025-10-20 15:24:40 -04:00
REDMOND\brodes
354effe829
Crypto: Missing hash algorithms for HMAC operations in jca.
2025-10-20 15:24:18 -04:00
Taus
9efa20dfc7
Merge pull request #20654 from github/tausbn/add-query-history-patcher
...
Misc: Add script for patching the query history
2025-10-20 17:46:39 +02:00
Florin Coada
2c31090cf6
Update codeql-cli-2.23.3.rst
2025-10-20 14:20:17 +01:00
Florin Coada
aeee30b0c6
Add changelog entry for CodeQL CLI version 2.23.3
2025-10-20 14:17:40 +01:00
Geoffrey White
e4e7b1c528
Merge branch 'main' into mysql2
2025-10-20 14:06:48 +01:00
Anders Schack-Mulligen
be626bf0ce
SSA: Address some review comments.
2025-10-20 14:02:56 +02:00
Geoffrey White
1047c3e014
Merge pull request #20652 from geoffw0/gen1
...
Rust: Generalize some models
2025-10-20 12:37:53 +01:00
Asger F
d7cf5ef645
Merge pull request #20647 from asgerf/js/type-resolution-cache
...
JS: Avoid magic and improve a join in type resolution
2025-10-20 11:50:23 +02:00
Geoffrey White
7b32cd4868
Merge pull request #20649 from geoffw0/mv1
...
Rust: Move rust/weak-sensitive-data-hashing
2025-10-20 10:17:40 +01:00
Tom Hvitved
85abcddd0e
Merge pull request #20614 from hvitved/dataflow/debug-predicates
...
Data flow: Add various debug predicates
2025-10-20 11:01:41 +02:00
Michael B. Gale
4441303623
Merge pull request #20625 from github/mbg/csharp/proxy-log-messages
2025-10-20 10:00:58 +01:00
Tom Hvitved
f71cfac40a
Data flow: Add various debug predicates
2025-10-20 09:59:40 +02:00
Ben Rodes
2b683c210f
Merge branch 'main' into santander-java-crypto-check
2025-10-18 17:56:43 -04:00
REDMOND\brodes
c01c060476
Crypto: more ID renaming to include "examples", fix singleton issues with ql-for-ql, use formatted test for WeakAsymmetricKeyGenSize (add post processing in the qlref), misc expected files updated (test passed locally but on rerun vscode reports failures, known bug with vscode unit tests).
2025-10-17 14:13:53 -04:00
REDMOND\brodes
540daa6df2
Crypto: weak symmetric cipher tests.
2025-10-17 13:40:15 -04:00
REDMOND\brodes
b06e05362b
Crypto: altering all query IDs in examples to have "examples" in the ID, to make clear the query is not intended for production.
2025-10-17 13:39:50 -04:00
REDMOND\brodes
1b205d8673
Removing WeakRSA, this is redundant with weak asymmetric key size.
2025-10-17 13:39:05 -04:00
REDMOND\brodes
b4ecb91c83
Crypto: Add missing cipher algorithms to JCA. Update node tests to account for missing cipher algorithms.
2025-10-17 13:38:47 -04:00
REDMOND\brodes
f480d90a68
Crypto: Add missing block mode JCA Models, add block mode unit tests
2025-10-17 13:13:14 -04:00
REDMOND\brodes
e12734162f
Crypto: WeakKDFKeySize tests.
2025-10-17 12:32:24 -04:00
REDMOND\brodes
628bab92fc
Crypto: Modify BadMacOrderMacOnEncryptPlaintext to be a path query that traces through any intermediate encrypt or mac to the final encrypt or mac.
2025-10-17 12:06:34 -04:00
REDMOND\brodes
ff7840dc9f
Crypto: removing precision tags on experimental queries.
2025-10-17 10:52:32 -04:00
Paolo Tranquilli
4b04b49ca9
Merge branch 'main' into redsun82/rust-file-semantics-predicates
2025-10-17 15:10:55 +02:00
Paolo Tranquilli
6a6015e0eb
Rust: accept test changes
2025-10-17 15:10:49 +02:00
Owen Mansel-Chan
66f95bcbcd
Merge pull request #20603 from owen-mc/update-broken-algo-qhelp
...
Many languages: Update broken algo qhelp
2025-10-17 12:30:43 +01:00
Paolo Tranquilli
0c719af33c
Csharp: add change note
2025-10-17 12:05:52 +02:00
Paolo Tranquilli
c3fd06c8a4
Csharp: fix cs/web/missing-x-frame-options to also consider location elements
...
As explained in
https://learn.microsoft.com/en-us/previous-versions/aspnet/ms178692(v=vs.100) ,
it is possible to add `system.webServer` elements nested inside
`location` elements in `Web.config`.
2025-10-17 11:27:31 +02:00
Simon Friis Vindum
979b05cc1a
C++: Apply suggested fixes from review
2025-10-17 09:50:36 +02:00
yoff
3a0a8999d5
java: fix ql alerts
2025-10-17 01:52:23 +02:00
yoff
61a3e9630f
java: rewrite conflict detection
...
- favour unary predicates over binary ones
(the natural "conflicting access" is binary)
- switch to a dual solution to trade recursion through forall for simple existentials.
Co-authored-by: Anders Schack-Mulligen <aschackmull@github.com >
2025-10-17 01:43:04 +02:00
REDMOND\brodes
ef6f0222f2
Crypto: Addressing FPs in BadMacOrderMacOnEncryptPlaintext
2025-10-16 16:11:42 -04:00
REDMOND\brodes
5923e5cbb0
Crypto: Bad expected files in last push.
2025-10-16 15:45:27 -04:00
REDMOND\brodes
700f34e53a
Crypto: Bad Mac use tests, and fix for BadMacOrderMacOnEncryptPlaintext (barriers were blocking flow through an encrypt to a subsequent mac on the same plaintext)
2025-10-16 15:44:57 -04:00
REDMOND\brodes
b9b0037e07
Crypto: Comment todo for observed missing modeled case. Tests for weak and unknown KDF iteration count.
2025-10-16 14:07:45 -04:00
