hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-07-21 11:18:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
46eec3c8eb44ec8e9d70bdfd36adc18574e7ba9a
codeql/java/ql/test/stubs
History
Joe Farebrother 6ae11b5b2c Generate stubs. 
Some generated stubs were manually adjusted due to minor issues in the stub generator.
In particular, ambiguous references were resolved and references to private classes were removed.
2021-09-16 15:23:00 +01:00
..
akka-2.6.x/akka/util
Initial support for Play Framework > 2.6.x
2020-10-22 20:20:49 +05:30
amazon-aws-sdk-1.11.700
Hardcoded AWS credentials
2020-06-17 02:46:02 +00:00
android
Reuse previous tests from experimental
2021-05-10 11:17:20 +02:00
apache-commons-codec-1.14
Add test case
2020-04-28 11:26:43 +02:00
apache-commons-collections4-4.4/org
Add stubs
2021-08-06 07:06:16 +01:00
apache-commons-digester3-3.2/org/apache/commons/digester3
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
2021-09-10 13:49:31 +01:00
apache-commons-email-1.6.0
Add all dependent class stubs
2020-06-09 20:12:05 +00:00
apache-commons-io-2.6
Java: Add LICENSE.txt
2020-02-05 09:38:16 +01:00
apache-commons-jexl-2.1.1/org/apache/commons/jexl2
More csv sinks and sources
2021-05-03 12:44:53 +02:00
apache-commons-jexl-3.1/org/apache/commons/jexl3
Removed commented code from JexlUberspect
2021-02-24 22:31:03 +01:00
apache-commons-lang3-3.7
Add models for Apache Commons Lang's Mutable container
2021-07-15 14:58:25 +01:00
apache-commons-logging-1.2/org/apache/commons/logging
More csv sinks and sources
2021-05-03 12:44:53 +02:00
apache-commons-text-1.9/org/apache/commons/text
Add models for Apache Commons Lang and Text's Str[ing]Substitutor
2021-03-04 11:11:55 +00:00
apache-http-4.4.13/org/apache/http
Convert request forgery tests to inline expectations; add missing models revealed by this process.
2021-06-17 11:43:32 +01:00
apache-http-5/org/apache/hc/core5
Add additional unit tests
2021-02-23 16:17:13 +00:00
apache-ldap-1.0.2/org/apache/directory
Java: Adjust stubs and unit test.
2020-01-30 11:27:33 +01:00
bsh-2.0b5/bsh
BeanShell Injection
2021-06-18 15:54:13 +08:00
castor-1.4.1/org/exolab/castor
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
commons-exec-1.3/org/apache/commons/exec
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
dom4j-2.1.1/org/dom4j
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
2021-09-10 13:49:31 +01:00
ejb-3.2/javax
Add query for enterprise beans
2021-02-20 02:00:42 +00:00
esapi-2.0.1/org/owasp/esapi
Java: Adjust stubs and unit test.
2020-01-30 11:27:33 +01:00
fastjson-1.2.74/com/alibaba/fastjson
*)add JsonHijacking ql query
2021-02-18 18:11:10 +08:00
flexjson-2.1/flexjson
Add support for the Flexjson framework to the unsafe-deserialization query
2021-09-10 16:27:23 +01:00
google-android-9.0.0
Add models for android.net.Uri[.Builder]
2021-09-14 16:37:07 +01:00
groovy-all-3.0.7
Add tests for CompilationUnit's subtypes
2021-06-16 13:01:40 +02:00
gson-2.8.6/com/google/gson
Fix the problem
2021-03-04 19:54:49 +08:00
guava-30.0
Generate stubs.
2021-09-16 15:23:00 +01:00
guice-4.2.2/com/google/inject
Java: add test for Guice framework support
2019-02-15 20:01:08 -05:00
guice-servlet-4.2.2/com/google/inject/servlet
Java: add test for Guice framework support
2019-02-15 20:01:08 -05:00
hamcrest-2.2
Java: Respect Hamcrest assertThat(X, notNullValue())
2019-10-29 17:52:13 +00:00
hessian-4.0.38/com/caucho
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
j2objc
Add j2objc license
2019-08-17 16:31:18 +01:00
jabsorb-1.3.2/org/jabsorb
Add unsafe-deserialization support for Jabsorb
2021-08-04 15:35:50 +01:00
jackson-core-2.12/com/fasterxml/jackson/core
Add tests for JacksonSerializability
2021-08-02 14:03:30 +02:00
jackson-databind-2.12
Fix tests affected by Jackson stubs changes
2021-08-03 14:22:55 +02:00
jakarta-json-2.0.1/jakarta/json
Also cover jakarta version of javax.json, and some missed methods
2021-06-30 15:04:15 +01:00
java-ee-el/javax/el
Added setVariable() sink
2021-04-08 20:41:43 +03:00
javamail-api-1.6.2
Add all dependent class stubs
2020-06-09 20:12:05 +00:00
javax-faces-2.3/javax/faces
Query to detect XSS with JavaServer Faces (JSF)
2021-09-14 11:47:32 +01:00
javax-json-api-1.1.4/javax/json
Also cover jakarta version of javax.json, and some missed methods
2021-06-30 15:04:15 +01:00
javax-servlet-2.5/javax/servlet
Add stubs for Spring web.util tests
2021-08-12 11:20:48 -07:00
javax-ws-rs-api-2.1.1/javax/ws/rs
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
javax-ws-rs-api-3.0.0/jakarta/ws/rs
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
jaxb-api-2.3.1/javax/xml/bind
Java: Add XXE tests.
2021-04-19 10:58:21 +02:00
jaxen-1.2.0/org/jaxen
Add safe example for dom4j
2021-05-06 10:17:25 +02:00
jaxws-api-2.0
Add stubs for JAX-WS
2021-06-08 15:12:04 +01:00
jdom-1.1.3/org/jdom
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
joddjson-6.0.3/jodd/json
Unsafe deserialization: add support for Jodd JSON library
2021-08-05 16:01:14 +01:00
json-io-4.10.0/com/cedarsoftware/util/io
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
json-java-20210307/org/json
Add models of JSON-java, aka org.json
2021-07-19 17:57:27 +01:00
jsr181-api
Add stubs for JAX-WS
2021-06-08 15:12:04 +01:00
jsr223-api/javax/script
Java: Added JSR 223 sinks for MVEL injections
2020-06-05 17:17:43 +03:00
jsr311-api-1.1.1/javax/ws/rs
Java: Add missing stub.
2021-07-13 15:26:37 +02:00
juel-2.2/de/odysseus/el
Added tests for Jakarta expression injection
2021-03-21 21:19:39 +03:00
junit-4.11/org/junit
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
junit-jupiter-api-5.2.0
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
jwtk-jjwt-0.11.2
Add missing subtype test
2021-05-18 09:38:35 +02:00
jyaml-1.3/org/ho/yaml
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
jython-2.7.2/org/python
Add more methods and update the library name
2021-05-04 02:54:49 +00:00
kryo-4.0.2/com/esotericsoftware/kryo
[Java] Fix Kryo FP & Kryo 5 Support
2021-05-05 17:38:34 -04:00
mongodbClient
Java : add MongoDB injection sinks
2020-08-31 02:24:23 +05:30
mvel2-2.4.7/org/mvel2
Moved from experimental
2021-06-02 09:58:30 +02:00
ognl-3.2.14/ognl
Consider ExpressionAccessor
2021-05-12 12:32:38 +02:00
playframework-2.6.x/play
More Play stubs improvements
2021-03-02 20:39:25 +05:30
projectreactor-3.4.3/reactor/core/publisher
Add URLClassLoader and Spring WebClient SSRF sinks
2021-07-01 03:34:14 +04:00
rundeck-api-java-client-13.2/org/rundeck/api/parser
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
2021-09-10 13:49:31 +01:00
saxon-xqj-9.x
*)add XQExpression.executeCommand(0) sink
2021-02-12 11:17:42 +08:00
scriptengine
Include more scenarios and update qldoc
2021-05-18 16:12:22 +00:00
servlet-api-2.4/javax/servlet
Merge pull request #5663 from smowton/luchua/java/sensitive-cookie-not-httponly
2021-04-13 12:08:53 +01:00
shiro-core-1.4.0
Add Apache Shiro third-party notice
2019-08-17 16:31:18 +01:00
shiro-core-1.5.2/org/apache/shiro/jndi
Moved JNDI injection related files from experimental to standard
2021-05-19 11:32:51 +02:00
simple-xml-2.7.1/org/simpleframework/xml
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
snakeyaml-1.21/org/yaml/snakeyaml
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
spring-data-commons-2.5.1/org/springframework/data
Add necessary stubs for Spring
2021-07-14 04:57:56 -07:00
spring-ldap-2.3.2/org/springframework/ldap
Consider search methods with unsafe SearchControls
2021-05-21 15:21:04 +02:00
springframework-5.3.8
Add stubs for Spring web.util tests
2021-08-12 11:20:48 -07:00
struts2-core-2.5.22/com/opensymphony/xwork2/ognl
Moved from experimental to standard
2021-05-11 15:42:13 +02:00
unboundid-ldap-4.0.14/com/unboundid/ldap/sdk
Java: Adjust stubs and unit test.
2020-01-30 11:27:33 +01:00
validation-api-2.0.1.Final/javax/validation
remove compiled classes from stubs
2020-10-27 15:56:26 +01:00
xstream-1.4.10/com/thoughtworks/xstream
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
yamlbeans-1.09/com/esotericsoftware/yamlbeans
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
README.md
Add Java stubs readme
2019-08-17 18:57:50 +01:00

README.md

The stubs in this directory are derived from various open-source projects, and used to test that the relevant APIs are correctly modelled. Where a disclaimer or third-party-notice is required, this is included in the top-level directory for each particular library.