hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-14 15:04:56 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
359e49044fb5f550fdfcdc5456783d4492a1a50e
codeql/java/ql/lib/semmle/code/java/security
History
erik-krogh 8262fbbfb5 Java/C#/GO: Use instanceof in more places
2022-12-11 18:32:19 +01:00
..
internal
split rsa/dsa/dh
2022-12-01 11:56:44 -05:00
performance
add deprecated aliases in the old locations, and use the Query.qll pattern for js/polynomial-redos
2022-06-23 14:36:25 +02:00
regexp
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
AndroidIntentRedirection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
AndroidIntentRedirectionQuery.qll
Generally define lower-numbered data-flow configs in terms of higher-numbered ones
2022-04-15 09:25:40 +01:00
AndroidSensitiveCommunicationQuery.qll
Java: Implement ContentSet
2022-04-04 13:51:44 +02:00
AndroidWebViewCertificateValidationQuery.qll
Use more precise control flow logic
2022-08-05 12:56:21 +01:00
CleartextStorageAndroidDatabaseQuery.qll
Add Editable.toString flow step
2022-04-26 13:34:16 +02:00
CleartextStorageAndroidFilesystemQuery.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
CleartextStorageClassQuery.qll
rename more acronyms
2022-08-25 20:52:27 +02:00
CleartextStorageCookieQuery.qll
Apply code review comments
2021-09-23 15:48:15 +02:00
CleartextStoragePropertiesQuery.qll
Refactored cleartext storage libraries
2021-09-23 10:42:30 +02:00
CleartextStorageQuery.qll
Add Editable.toString flow step
2022-04-26 13:34:16 +02:00
CleartextStorageSharedPrefsQuery.qll
Add Expr::getUnderlyingExpr predicate
2022-05-25 10:56:18 +02:00
CommandArguments.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
CommandLineQuery.qll
Add QLDocs
2022-04-06 12:00:41 +02:00
ConditionalBypassQuery.qll
Fix conditionControlsMethod predicate
2021-09-15 17:51:51 +02:00
ControlledString.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
Encryption.qll
Java/C#/GO: Use instanceof in more places
2022-12-11 18:32:19 +01:00
ExternalAPIs.qll
Java: Format QL
2022-09-14 11:56:13 +01:00
ExternalProcess.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
FileReadWrite.qll
Minor doc fixes + making directFileRead private
2022-06-28 10:10:28 +02:00
FileWritable.qll
Merge pull request #8241 from igfoo/igfoo/stats4
2022-02-28 12:58:06 +00:00
FragmentInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
FragmentInjectionQuery.qll
Apply suggestions from code review
2021-12-15 16:53:47 +01:00
GroovyInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
GroovyInjectionQuery.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
HardcodedCredentials.qll
Add missing qldoc
2022-08-13 14:20:48 +01:00
HardcodedCredentialsApiCallQuery.qll
Fix qldoc wording
2022-08-15 12:08:14 +01:00
HardcodedCredentialsComparison.qll
Add java imports
2022-08-23 09:41:00 +01:00
HardcodedCredentialsSourceCallQuery.qll
Convert tests to inline expectations and fix one bug revealed doing so
2022-08-13 14:02:05 +01:00
HardcodedPasswordField.qll
Add java imports
2022-08-23 09:41:00 +01:00
HttpsUrls.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
HttpsUrlsQuery.qll
Refactored HttpsUrls.ql
2021-09-15 17:20:28 +02:00
ImplicitlyExportedAndroidComponent.qll
adjusted comments and precision level
2022-08-22 12:41:22 -04:00
ImplicitPendingIntents.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
ImplicitPendingIntentsQuery.qll
Java: Implement ContentSet
2022-04-04 13:51:44 +02:00
ImproperIntentVerificationQuery.qll
Remove checks for dynamically registered recievers
2022-06-14 14:56:24 +01:00
InformationLeak.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
InsecureBasicAuth.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
InsecureBasicAuthQuery.qll
Adapt InsecureBasicAuth to the previous commit
2021-09-15 17:20:28 +02:00
InsecureTrustManager.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
InsecureTrustManagerQuery.qll
Java: Implement ContentSet
2022-04-04 13:51:44 +02:00
InsufficientKeySize.qll
change matches to equality
2022-12-01 11:56:44 -05:00
InsufficientKeySizeQuery.qll
clean up code
2022-10-14 13:03:34 -04:00
IntentUriPermissionManipulation.qll
Java: Deprecate BarrierGuard class.
2022-06-16 11:25:28 +02:00
IntentUriPermissionManipulationQuery.qll
Java: Deprecate BarrierGuard class.
2022-06-16 11:25:28 +02:00
JexlInjectionQuery.qll
Java: fix typos in comments
2022-05-12 14:28:49 +01:00
JndiInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
JndiInjectionQuery.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
JWT.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
LdapInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
LogInjection.qll
Make more ExternalFlow imports private
2022-05-03 10:31:29 +02:00
LogInjectionQuery.qll
Minor corrections in QLDoc, qhelp and example code
2021-11-04 08:46:23 +01:00
Mail.qll
Apply suggestions from code review
2021-10-05 09:40:22 +02:00
MissingJWTSignatureCheckQuery.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
MvelInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
MvelInjectionQuery.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
OgnlInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
OgnlInjectionQuery.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
OverlyLargeRangeQuery.qll
port the Java regex/redos queries to use the shared pack
2022-11-14 21:29:41 +01:00
PartialPathTraversal.qll
Autoformat ql
2022-08-11 09:55:46 +01:00
PartialPathTraversalQuery.qll
Java: Remove unneeded imports of ExternalFlow.qll.
2022-12-05 09:49:38 +01:00
PathCreation.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
PathSanitizer.qll
Adjust getExtensionReceiverParameterIndex predicate name and change note
2022-12-09 10:29:52 +01:00
QueryInjection.qll
Kotlin: Add types for the different kinds of casts that Kotlin has
2022-05-10 19:51:13 +01:00
RandomDataSource.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
RandomQuery.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
RelativePaths.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
RequestForgery.qll
Autoformat
2022-03-14 12:44:40 +00:00
RequestForgeryConfig.qll
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
ResponseSplitting.qll
Java/C#/GO: Use instanceof in more places
2022-12-11 18:32:19 +01:00
RsaWithoutOaepQuery.qll
Use a full dataflow config rather than local flow
2022-08-17 10:35:48 +01:00
SecurityFlag.qll
Fix performance change in SecurityFlag
2022-06-23 08:46:33 +02:00
SecurityTests.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
SensitiveActions.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
SensitiveApi.qll
Spelling
2022-08-13 14:37:08 +01:00
SensitiveKeyboardCacheQuery.qll
Invert the xml logic to be consistent with the dataflow logic
2022-11-16 10:54:14 +00:00
SensitiveLoggingQuery.qll
run the implicit-this patch
2022-08-22 21:23:31 +02:00
SpelInjection.qll
Java: Remove unneeded imports of ExternalFlow.qll.
2022-12-05 09:49:38 +01:00
SpelInjectionQuery.qll
add explicit this qualifier on all of java
2021-10-15 15:27:37 +02:00
SqlInjectionQuery.qll
Add QLDocs
2022-04-06 12:00:41 +02:00
SqlUnescapedLib.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
StaticInitializationVectorQuery.qll
Java: Improve performance of StaticInitializationVector.
2022-09-23 14:39:32 +02:00
TemplateInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
TemplateInjectionQuery.qll
Address review comments re: flow states
2022-09-16 14:48:30 +02:00
UnsafeAndroidAccess.qll
Add Expr::getUnderlyingExpr predicate
2022-05-25 10:56:18 +02:00
UnsafeAndroidAccessQuery.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
UnsafeCertTrust.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
UnsafeCertTrustQuery.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
UnsafeContentUriResolution.qll
Revert "Decouple from #10177"
2022-10-06 16:30:23 +02:00
UnsafeContentUriResolutionQuery.qll
Java: Remove unneeded imports of ExternalFlow.qll.
2022-12-05 09:49:38 +01:00
UnsafeDeserializationQuery.qll
patch upper-case acronyms to be PascalCase
2022-03-11 11:10:33 +01:00
UrlRedirect.qll
Make more ExternalFlow imports private
2022-05-03 10:31:29 +02:00
Validation.qll
Java: Fix join-order.
2022-04-26 13:43:41 +02:00
WebviewDubuggingEnabledQuery.qll
Remove type check from the barrier predicate
2022-09-21 13:57:32 +01:00
XmlParsers.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
XPath.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
XsltInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
XsltInjectionQuery.qll
Move to lib
2021-09-27 12:04:14 +02:00
XSS.qll
Make more ExternalFlow imports private
2022-05-03 10:31:29 +02:00