hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-26 12:52:57 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
14d1e08051ba3c47e7fc87f82887e657ae340345
codeql/java/ql/lib/semmle/code/java/security
History
Ed Minnix 43966ebaeb Change regex used in HostnameSanitizingPrefix
2023-05-22 15:57:15 -04:00
..
internal
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
performance
add deprecated aliases in the old locations, and use the Query.qll pattern for js/polynomial-redos
2022-06-23 14:36:25 +02:00
regexp
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
AndroidCertificatePinningQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
AndroidIntentRedirection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
AndroidIntentRedirectionQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
AndroidSensitiveCommunicationQuery.qll
Documentation for AndroidSensitiveCommunicationQuery
2023-03-29 22:33:10 -04:00
AndroidWebViewCertificateValidationQuery.qll
Use more precise control flow logic
2022-08-05 12:56:21 +01:00
ArbitraryApkInstallation.qll
Split ArbitraryApkInstallation file into 3 files
2023-03-08 12:12:11 -05:00
ArbitraryApkInstallationQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
ArithmeticCommon.qll
Move CWE-190/ArithmeticCommon.qll to semmle.code.java.security
2023-05-04 10:25:16 -04:00
ArithmeticTaintedLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ArithmeticTaintedQuery.qll
Add Arithmetic query libraries
2023-05-04 10:25:16 -04:00
ArithmeticUncontrolledQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ArithmeticWithExtremeValuesQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
BrokenCryptoAlgorithmQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
CleartextStorageAndroidDatabaseQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageAndroidFilesystemQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageClassQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageCookieQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStoragePropertiesQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageQuery.qll
Replace flow(_, sink) with flowTo(sink)
2023-03-29 22:33:09 -04:00
CleartextStorageSharedPrefsQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CommandArguments.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
CommandLineQuery.qll
Make LocalUserInputToArgumentToExecFlowConfig and LocalUserInputToArgumentToExecFlow importable
2023-03-30 10:24:23 +02:00
ConditionalBypassQuery.qll
Documentation for ConditionalBypassQuery
2023-03-29 22:33:10 -04:00
ControlledString.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
Encryption.qll
Merge pull request #10971 from joefarebrother/android-certificate-pinning
2022-12-20 11:03:16 +01:00
ExecTaintedLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ExternalAPIs.qll
Documentation for ExternalAPIs
2023-03-29 22:33:10 -04:00
ExternallyControlledFormatStringLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ExternallyControlledFormatStringQuery.qll
Updates to imports
2023-03-30 11:03:48 -04:00
ExternalProcess.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
FileReadWrite.qll
Java: Remove omittable exists variables
2023-01-10 13:37:19 +01:00
FileWritable.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
FragmentInjection.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
FragmentInjectionQuery.qll
Documentation additions
2023-03-29 22:33:09 -04:00
GroovyInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
GroovyInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
HardcodedCredentials.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
HardcodedCredentialsApiCallQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
HardcodedCredentialsComparison.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
HardcodedCredentialsSourceCallQuery.qll
Refactor HardcodedCredentialsSourceCall
2023-04-13 23:06:16 -04:00
HardcodedPasswordField.qll
Add java imports
2022-08-23 09:41:00 +01:00
HttpsUrls.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
HttpsUrlsQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
ImplicitlyExportedAndroidComponent.qll
adjusted comments and precision level
2022-08-22 12:41:22 -04:00
ImplicitPendingIntents.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
ImplicitPendingIntentsQuery.qll
Refactor ImplicitPendingIntents
2023-03-29 22:33:09 -04:00
ImproperIntentVerificationQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
InformationLeak.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
InsecureBasicAuth.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
InsecureBasicAuthQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
InsecureBeanValidationQuery.qll
Remove private marker
2023-03-30 11:08:41 -04:00
InsecureCookieQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
InsecureLdapAuth.qll
Move public classes/predicates to top of library file
2023-03-27 12:16:44 -04:00
InsecureLdapAuthQuery.qll
Make configuration public
2023-03-28 10:28:15 -04:00
InsecureTrustManager.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
InsecureTrustManagerQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
InsufficientKeySize.qll
change matches to equality
2022-12-01 11:56:44 -05:00
InsufficientKeySizeQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
IntentUriPermissionManipulation.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
IntentUriPermissionManipulationQuery.qll
Documentation for IntentUriPermissionManipulationQuery
2023-03-29 22:33:10 -04:00
JexlInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
JndiInjection.qll
Move JndiInjectionSanitizer to importable file
2023-03-23 17:05:53 +01:00
JndiInjectionQuery.qll
Fix miscopied isBarrier in JndiInjectionQuery
2023-03-29 07:23:13 -04:00
JWT.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
LdapInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
LdapInjectionQuery.qll
Move LdapInjectionLib to LdapInjectionQuery.qll
2023-03-29 17:59:33 -04:00
LogInjection.qll
Address review comment
2023-04-17 09:33:44 +02:00
LogInjectionQuery.qll
Documentation additions
2023-03-29 22:33:09 -04:00
Mail.qll
Apply suggestions from code review
2021-10-05 09:40:22 +02:00
MaybeBrokenCryptoAlgorithmQuery.qll
Add MaybeBrokenCryptoAlgorithmQuery
2023-05-04 10:15:00 -04:00
MissingJWTSignatureCheckQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
MvelInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
MvelInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
NumericCastTaintedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
OgnlInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
OgnlInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
OverlyLargeRangeQuery.qll
port the Java regex/redos queries to use the shared pack
2022-11-14 21:29:41 +01:00
PartialPathTraversal.qll
Autoformat ql
2022-08-11 09:55:46 +01:00
PartialPathTraversalQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
PathCreation.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
PathSanitizer.qll
Adjust getExtensionReceiverParameterIndex predicate name and change note
2022-12-09 10:29:52 +01:00
QueryInjection.qll
Kotlin: Add types for the different kinds of casts that Kotlin has
2022-05-10 19:51:13 +01:00
RandomDataSource.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
RandomQuery.qll
Refactor RandomQuery.qll
2023-03-29 22:33:09 -04:00
RelativePaths.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
RequestForgery.qll
Change regex used in HostnameSanitizingPrefix
2023-05-22 15:57:15 -04:00
RequestForgeryConfig.qll
Remove unnecessary private markers (CommandLine and Request forgery)
2023-03-29 11:45:09 -04:00
ResponseSplitting.qll
Java/C#/GO: Use instanceof in more places
2022-12-11 18:32:19 +01:00
ResponseSplittingLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ResponseSplittingQuery.qll
Updates to imports
2023-03-30 11:03:48 -04:00
RsaWithoutOaepQuery.qll
Documentation for RsaWithoutOaepQuery
2023-03-29 22:33:10 -04:00
SecurityFlag.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
SecurityTests.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
SensitiveActions.qll
Fix getCommonSensitiveInfoRegex
2023-04-13 10:33:03 +02:00
SensitiveApi.qll
Add byte[] signatures
2023-02-27 12:16:14 +01:00
SensitiveKeyboardCacheQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
SensitiveLoggingQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
SensitiveResultReceiverQuery.qll
SensitiveResultReceiverFlow needs to be public
2023-04-14 09:04:56 +02:00
SpelInjection.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
SpelInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
SqlConcatenatedLib.qll
Java: improve naming and description of SqlUnescaped.ql
2023-01-09 10:56:13 +00:00
SqlConcatenatedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
SqlInjectionQuery.qll
Deprecate old predicate
2023-03-24 10:07:40 -04:00
SqlTaintedLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
StackTraceExposureQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
StaticInitializationVectorQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
TaintedPathQuery.qll
Typos and rewording
2023-03-30 10:59:12 -04:00
TaintedPermissionsCheckQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
TempDirLocalInformationDisclosureQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
TempDirUtils.qll
Add TempDirLocalInformationDisclosureQuery
2023-05-04 10:25:16 -04:00
TemplateInjection.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
TemplateInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
UnsafeAndroidAccess.qll
Add Expr::getUnderlyingExpr predicate
2022-05-25 10:56:18 +02:00
UnsafeAndroidAccessQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
UnsafeCertTrust.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
UnsafeCertTrustQuery.qll
Documentation for UnsafeCertTrustQuery
2023-03-29 22:33:09 -04:00
UnsafeContentUriResolution.qll
Revert "Decouple from #10177"
2022-10-06 16:30:23 +02:00
UnsafeContentUriResolutionQuery.qll
Documentation for UnsafeContentUriResolutionQuery
2023-03-29 22:33:10 -04:00
UnsafeDeserializationQuery.qll
More replacing of single-predicate classes to predicate
2023-03-31 10:55:17 -04:00
UnsafeHostnameVerificationQuery.qll
Add UnsafeHostnameVerificationQuery
2023-05-04 10:25:16 -04:00
UrlRedirect.qll
Make more ExternalFlow imports private
2022-05-03 10:31:29 +02:00
UrlRedirectLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
UrlRedirectQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
Validation.qll
Java: Fix join-order.
2022-04-26 13:43:41 +02:00
WebviewDebuggingEnabledQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
WebviewDubuggingEnabledQuery.qll
Apply suggestions from code review
2023-03-24 09:47:50 -04:00
XmlParsers.qll
Merge branch 'main' into atorralba/java/promote-xxe-experimental-sinks
2023-05-16 09:49:34 +02:00
XPath.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
XPathInjectionQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
XsltInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
XsltInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
XSS.qll
Java: Rename references.
2023-03-23 13:06:19 +01:00
XssLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
XssQuery.qll
Move XssConfig to XssQuery.qll
2023-03-29 17:59:33 -04:00
Xxe.qll
Fix import locations
2023-02-13 17:13:01 +01:00
XxeLocalQuery.qll
Java: Rename references.
2023-03-23 13:06:19 +01:00
XxeQuery.qll
Refactor XxeQuery
2023-03-29 22:33:09 -04:00
XxeRemoteQuery.qll
Java: Rename references.
2023-03-23 13:06:19 +01:00
ZipSlipQuery.qll
Updates to imports
2023-03-30 11:03:48 -04:00