MarkLee131 345b842edc Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers ...

The trust-boundary-violation query only recognized OWASP ESAPI validators
as sanitizers. ESAPI is rarely used in modern Java projects, while regex
validation via String.matches() and @javax.validation.constraints.Pattern
is the standard approach in Spring/Jakarta applications.

RegexpCheckBarrier already exists in Sanitizers.qll and is used by other
queries (e.g., RequestForgery). This wires it into TrustBoundaryConfig,
so patterns like input.matches("[a-zA-Z0-9]+") and @Pattern annotations
are recognized as sanitizers, consistent with the existing ESAPI treatment.

2026-04-04 21:36:37 +08:00

..

change-notes

Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers

2026-04-04 21:36:37 +08:00

config

Java: Update dbscheme to make @assignment a @binaryexpr.

2026-03-03 15:15:35 +01:00

experimental/quantum

Replace "javax" with javaxOrJakarta()

2026-02-16 11:02:12 +00:00

ext

Fix incorrect constructor summary models

2026-03-05 12:03:21 +00:00

external

Overlay: Add overlay annotations to Java & shared libraries

2025-06-24 10:25:06 +02:00

semmle

Java: add RegexpCheckBarrier to trust-boundary-violation sanitizers

2026-04-04 21:36:37 +08:00

upgrades

Java: Update dbscheme to make @assignment a @binaryexpr.

2026-03-03 15:15:35 +01:00

utils/test

Java: Accept revised CFG.

2026-02-23 15:10:00 +01:00

CHANGELOG.md

Release preparation for version 2.25.1

2026-03-25 23:43:06 +00:00

codeql-pack.release.yml

Release preparation for version 2.25.1

2026-03-25 23:43:06 +00:00

Customizations.qll

Overlay: Add overlay annotations to Java & shared libraries

2025-06-24 10:25:06 +02:00

default.qll

Overlay: Add overlay annotations to Java & shared libraries

2025-06-24 10:25:06 +02:00

definitions.qll

Overlay: Add overlay annotations to Java & shared libraries

2025-06-24 10:25:06 +02:00

IDEContextual.qll

Overlay: Add overlay annotations to Java & shared libraries

2025-06-24 10:25:06 +02:00

java.qll

Add RegexExecution in Concepts.qll

2026-02-11 13:09:42 +00:00

localDefinitions.ql

Move contextual queries from src to lib

2022-06-29 07:51:26 -07:00

localReferences.ql

Move contextual queries from src to lib

2022-06-29 07:51:26 -07:00

printAst.ql

Java: Fix some Ql4Ql violations.

2025-09-01 15:04:08 +02:00

printCfg.ql

Java/Cfg: Introduce new shared CFG library and replace the Java CFG.

2026-02-23 15:09:50 +01:00

qlpack.lock.yml

…

qlpack.yml

Post-release preparation for codeql-cli-2.25.1

2026-03-30 08:43:48 +00:00