hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 10:23:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
codeql-cli-2.20.3
codeql/java/ql/lib/semmle/code/java/security
History
Owen Mansel-Chan 883301938b Merge pull request #18161 from owen-mc/java/weak-crypto-algo-more-informative 
Java: Make `java/weak-cryptographic-algorithm` give  a reason why the algo is insecure
2025-01-13 23:43:04 +00:00
..
internal
Java: Fix bad join
2024-08-06 13:30:19 +02:00
regexp
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
AndroidCertificatePinningQuery.qll
Update Android app detection
2024-07-07 00:24:25 +01:00
AndroidIntentRedirection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
AndroidIntentRedirectionQuery.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
AndroidLocalAuthQuery.qll
Add unit tests
2024-02-12 13:49:45 +00:00
AndroidSensitiveCommunicationQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
AndroidWebViewCertificateValidationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ArbitraryApkInstallation.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
ArbitraryApkInstallationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ArithmeticCommon.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
ArithmeticTaintedLocalQuery.qll
Java: Deprecate the content of ArithmeticTaintedLocalQuery and remove the arithmetic tainted local query variant.
2024-05-01 08:59:51 +02:00
ArithmeticTaintedQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
ArithmeticUncontrolledQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ArithmeticWithExtremeValuesQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
BrokenCryptoAlgorithmQuery.qll
fix: address PR comments
2024-06-04 11:20:05 -07:00
CleartextStorageAndroidDatabaseQuery.qll
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
CleartextStorageAndroidFilesystemQuery.qll
Update Android app detection
2024-07-07 00:24:25 +01:00
CleartextStorageClassQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
CleartextStorageCookieQuery.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
CleartextStoragePropertiesQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
CleartextStorageQuery.qll
Deprecate or remove imports of dataflow library copies
2023-12-08 10:42:10 -05:00
CleartextStorageSharedPrefsQuery.qll
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
CommandArguments.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
CommandLineQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
ConditionalBypassQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
ControlledString.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
Cookies.qll
Add cookie sinks
2023-12-13 11:15:27 +01:00
Encryption.qll
Only recommend GCM, and tighten wording
2025-01-07 16:55:10 +00:00
ExecTaintedLocalQuery.qll
Java: Deprecate the content of ExecTaintedLocalQuery as this is unused.
2024-05-01 13:07:21 +02:00
ExternalAPIs.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
ExternallyControlledFormatStringLocalQuery.qll
Java: Deprecate the content of ExternallyControlledFormatStringLocalQuery and remove the externally controlled format string local query variant.
2024-05-01 13:07:21 +02:00
ExternallyControlledFormatStringQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ExternalProcess.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
FileReadWrite.qll
Autoformat
2023-10-24 11:06:19 +01:00
FileWritable.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
FragmentInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
FragmentInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
GroovyInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
GroovyInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
HardcodedCredentials.qll
Rename class to CredentialsSinkNode to better align with naming convention
2023-10-25 14:31:54 -04:00
HardcodedCredentialsApiCallQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
HardcodedCredentialsComparison.qll
Autoformat
2023-10-24 11:06:19 +01:00
HardcodedCredentialsSourceCallQuery.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
HardcodedPasswordField.qll
Add java imports
2022-08-23 09:41:00 +01:00
HttpsUrls.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
HttpsUrlsQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
ImplicitlyExportedAndroidComponent.qll
adjusted comments and precision level
2022-08-22 12:41:22 -04:00
ImplicitPendingIntents.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
ImplicitPendingIntentsQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
ImproperIntentVerificationQuery.qll
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionLocalQuery.qll
Java: Deprecate the content of ImproperValidationOrArray and remove local query variants.
2024-05-01 13:07:21 +02:00
ImproperValidationOfArrayConstructionQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexLocalQuery.qll
Java: Deprecate the content of ImproperValidationOrArray and remove local query variants.
2024-05-01 13:07:21 +02:00
ImproperValidationOfArrayIndexQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
InformationLeak.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
InsecureBasicAuth.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
InsecureBasicAuthQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
InsecureBeanValidationQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
InsecureCookieQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureLdapAuth.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
InsecureLdapAuthQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
InsecureRandomnessQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
InsecureTrustManager.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
InsecureTrustManagerQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
InsufficientKeySize.qll
Update java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll
2023-12-15 08:48:50 +01:00
InsufficientKeySizeQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
IntentUriPermissionManipulation.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
IntentUriPermissionManipulationQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
JexlInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
JndiInjection.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
JndiInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
JWT.qll
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
LdapInjection.qll
Java: Remove superfluous clone models.
2024-07-16 11:11:53 +02:00
LdapInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ListOfConstantsSanitizer.qll
Java: Address review comment, include addFirst,addLast.
2024-11-26 13:25:43 +01:00
LogInjection.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
LogInjectionQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
Mail.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
MaybeBrokenCryptoAlgorithmQuery.qll
Java: weak crypto: do not report weak hash algorithms
2024-11-03 18:22:06 -05:00
MissingJWTSignatureCheckQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
MvelInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
MvelInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
NumericCastTaintedQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
OgnlInjection.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
OgnlInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
PartialPathTraversal.qll
Autoformat
2023-10-24 11:06:19 +01:00
PartialPathTraversalQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
PathSanitizer.qll
Merge pull request #18214 from jcogs33/jcogs33/java/file-getname-path-sanitizer
2024-12-11 10:18:02 -05:00
QueryInjection.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
RandomDataSource.qll
Improve source of randomness detection
2023-12-13 11:15:27 +01:00
RandomQuery.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
RelativePaths.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
RequestForgery.qll
Add QLDoc for HostnameSanitizingPrefix
2024-11-29 09:46:44 +00:00
RequestForgeryConfig.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ResponseSplitting.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ResponseSplittingLocalQuery.qll
Java: Deprecate the content of ResponseSplittingLocalQuery and remove local query variant.
2024-05-01 13:07:21 +02:00
ResponseSplittingQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
RsaWithoutOaepQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
Sanitizers.qll
Java: Add more type-based sanitizers.
2024-09-25 10:38:17 +02:00
SecurityFlag.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SecurityTests.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
SensitiveActions.qll
Add "tokenizer" to sensitive variable name FPs
2024-07-30 15:38:32 +01:00
SensitiveApi.qll
Refactor to using MethodCall instead of MethodAccess
2023-10-25 14:31:56 -04:00
SensitiveDataExposureThroughErrorMessageQuery.qll
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
2024-07-25 18:12:45 +02:00
SensitiveKeyboardCacheQuery.qll
Implement checks for calls that may safely mask information
2024-01-29 16:25:37 +00:00
SensitiveLoggingQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
SensitiveResultReceiverQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
SensitiveUiQuery.qll
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
SpelInjection.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
SpelInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
SpringCsrfProtection.qll
Update SpringCsrfProtection.qll
2024-05-30 23:13:08 +02:00
SqlConcatenatedLib.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SqlConcatenatedQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
SqlInjectionQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
SqlTaintedLocalQuery.qll
Java: Deprecate the content of SqlTaintedLocalQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
StackTraceExposureQuery.qll
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
2024-07-25 18:12:45 +02:00
StaticInitializationVectorQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
TaintedEnvironmentVariableQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
TaintedPathQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
TaintedPermissionsCheckQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
TempDirLocalInformationDisclosureQuery.qll
Java: Address review comments and some other code quality improvements.
2024-05-03 11:11:52 +02:00
TempDirUtils.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
TemplateInjection.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
TemplateInjectionQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
TrustBoundaryViolationQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
UnsafeAndroidAccess.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
UnsafeAndroidAccessQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
UnsafeCertTrust.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
UnsafeCertTrustQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
UnsafeContentUriResolution.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
UnsafeContentUriResolutionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
UnsafeDeserializationQuery.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
UnsafeHostnameVerificationQuery.qll
Java: update set-hostname-verifier sink kind to hostname-verification
2023-05-31 15:49:07 -04:00
UrlForwardQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
UrlRedirect.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
UrlRedirectLocalQuery.qll
Java: Deprecate the local content of UrlRedirectLocalQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
UrlRedirectQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
Validation.qll
Java: IPA the CFG
2024-12-10 15:26:11 +00:00
WebviewDebuggingEnabledQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
XmlParsers.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
XPath.qll
Java: Improve the Api sources and sinks implementation.
2024-04-26 14:12:41 +02:00
XPathInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
XsltInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
XsltInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
XSS.qll
Java: Clean up some instances of getQualifiedName.
2024-05-13 13:06:44 +02:00
XssLocalQuery.qll
Java: Deprecate the content of XssLocalQuery and remove the Xss local query variant.
2024-05-01 08:59:50 +02:00
XssQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
Xxe.qll
Fix import locations
2023-02-13 17:13:01 +01:00
XxeLocalQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
XxeQuery.qll
Refactor XxeQuery
2023-03-29 22:33:09 -04:00
XxeRemoteQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ZipSlipQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00