Owen Mansel-Chan 9fbe447428 Merge pull request #21749 from github/copilot/add-hibernate-sql-injection-tests ...

Add Hibernate SQL injection sink models and coverage

2026-04-24 09:36:46 +01:00

..

CWE-020

[TEST] Java: CWE-020/ExternalAPI: new test based on qhelp

2025-07-17 18:58:52 +02:00

CWE-022/semmle/tests

Java: recognize Path.toRealPath() as path normalization sanitizer

2026-04-04 20:59:45 +08:00

CWE-023/semmle/tests

Fix bug so += File.separator is recognized

2026-04-19 07:18:42 +01:00

CWE-074

Java: convert XsltInjection test to .qlref

2025-06-24 16:41:43 +02:00

CWE-078

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-079/semmle/tests

Java: convert XSS test to .qlref

2025-06-24 16:41:46 +02:00

CWE-089/semmle/examples

Model additional Hibernate query sinks

2026-04-23 13:41:03 +00:00

CWE-090

Java: rename springframework stubs directory from 5.3.8 to 5.8.x

2025-03-11 15:20:58 -04:00

CWE-094

Java: convert ArbitraryApkInstallation test to .qlref

2025-06-26 13:22:05 +02:00

CWE-113/semmle/tests

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-117

Update test results (remove SPURIOUS annotations)

2026-02-16 12:03:02 +00:00

CWE-129/semmle/tests

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-134/semmle/tests

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-190/semmle/tests

Address review: update QLDoc comment and fix expected test output

2026-03-29 11:53:06 +08:00

CWE-200/semmle/tests

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-209/semmle/tests

Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.

2024-07-25 18:12:45 +02:00

CWE-266

Java: convert IntentUriPermissionManipulation test to .qlref

2025-06-24 16:41:58 +02:00

CWE-273

[TEST] Java: UnsafeCertTrust: convert test to qlref

2025-07-17 18:58:56 +02:00

CWE-287

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-295

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-297

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-311

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-312

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-326

Java: convert InsufficientKeySize test to .qlref

2025-06-24 16:42:02 +02:00

CWE-327/semmle/tests

Address PR review: add Signature.getInstance sink, HMAC/PBKDF2 whitelist, fix test APIs

2026-03-28 16:53:46 +08:00

CWE-330

Java: convert InsecureRandomness test to .qlref

2025-06-24 16:42:04 +02:00

CWE-335/semmle/tests

Migrate Java code to separate QL repo.

2018-08-30 10:48:05 +01:00

CWE-338/semmle/tests

Update JHipster CodeQL query from code review

2020-10-01 15:38:56 -04:00

CWE-347

Java: convert MissingJWTSignatureCheck test to .qlref

2025-06-24 16:42:06 +02:00

CWE-352

Java: rename springframework stubs directory from 5.3.8 to 5.8.x

2025-03-11 15:20:58 -04:00

CWE-367/semmle/tests

Fix test output

2025-03-14 11:44:00 +00:00

CWE-421/semmle

Java: fix javac errors in test code

2021-02-09 09:16:57 -05:00

CWE-441

Java: convert UnsafeContentUriResolution test to .qlref

2025-06-24 16:42:08 +02:00

CWE-470

Java: convert FragmentInjection test to .qlref

2025-06-24 16:42:10 +02:00

CWE-489

Java: convert WebviewDebuggingEnabled test to .qlref

2025-06-24 16:42:12 +02:00

CWE-501

[TEST] Java: TrustBoundaryViolations: convert test to qlref

2025-07-17 18:58:59 +02:00

CWE-502

Use MaD models for unsafe deserialization sinks when possible

2025-07-16 14:42:07 +01:00

CWE-522

Java: convert CWE-522 tests to .qlref

2025-06-24 16:42:17 +02:00

CWE-524

Add space before $ in xml test file

2026-03-04 15:03:24 +00:00

CWE-532

Remove secretQuestion from FP exclusion list

2026-04-04 21:58:32 +08:00

CWE-552

Java: convert UrlForward test to .qlref

2025-06-24 16:42:19 +02:00

CWE-601/semmle/tests

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-611

Java: Add XXE sink model for Woodstox WstxInputFactory

2026-04-17 18:46:51 +04:00

CWE-643

Java: convert XPathInjection test to .qlref

2025-06-24 16:42:23 +02:00

CWE-676/semmle/tests

Java: Pin CWE-676 test to --release 25

2026-04-07 09:28:22 +02:00

CWE-681/semmle/tests

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-730

Java: convert PolynomialReDoS and RegexInjection tests to .qlref

2025-06-24 16:42:26 +02:00

CWE-732/semmle/tests

update alert-messsages of java queries

2022-09-26 12:15:25 +02:00

CWE-749

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-780

Java: convert RsaWithoutOaep test to .qlref

2025-06-24 16:42:28 +02:00

CWE-798/semmle/tests

Update java/ql/test/query-tests/security/CWE-798/semmle/tests/HardcodedCouchBaseCredentials.java

2026-01-14 11:50:52 +01:00

CWE-807/semmle/tests

[TEST] Java: ConditionalBypass: convert to qlref

2025-07-17 18:59:03 +02:00

CWE-829/semmle/tests

Handle disabled Maven repositories

2022-11-21 10:11:57 +01:00

CWE-833/semmle/tests

Java: accept changes in expected output

2021-02-09 09:17:35 -05:00

CWE-835/semmle/tests

Java: Adjust toString() for statements

2021-06-03 16:27:36 +02:00

CWE-917

Java: convert OgnlInjection test to .qlref

2025-06-24 16:42:30 +02:00

CWE-918

Update models in test output

2026-03-05 13:32:52 +00:00

CWE-925

Java: convert ImproperIntentVerification test to .qlref

2025-06-24 16:42:35 +02:00

CWE-926

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-927

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-940

Java: Update all test util paths to point to the new location.

2024-12-12 13:21:25 +01:00

CWE-1004

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00

CWE-1104/semmle/tests

Fix typo in test output

2021-02-22 13:26:51 -05:00

CWE-1204

Java: Inline expectation should have space after $

2026-03-04 12:44:54 +00:00