hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-02 05:43:54 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
5923e5cbb0bc15401a0923ced5489a5e71411fb4
codeql/java/ql/lib/semmle/code/java/security
History
Michael Nebel 77113b2e42 Java: Fix some Ql4Ql violations.
2025-09-01 15:04:08 +02:00
..
internal
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
regexp
Shared: Make approximate location filtering the default behaviour
2025-07-02 14:41:02 +02:00
AndroidCertificatePinningQuery.qll
Update Android app detection
2024-07-07 00:24:25 +01:00
AndroidIntentRedirection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
AndroidIntentRedirectionQuery.qll
Java: Delete deprecated extension points referencing deleted api.
2024-12-03 20:08:44 +01:00
AndroidLocalAuthQuery.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
AndroidSensitiveCommunicationQuery.qll
[DIFF-INFORMED] Java: (Android)SensitiveCommunication
2025-07-17 18:59:06 +02:00
AndroidWebViewCertificateValidationQuery.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ArbitraryApkInstallation.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ArbitraryApkInstallationQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
ArithmeticCommon.qll
Java: Simplify ArithmeticCommon using BarrierGuards.
2025-08-07 15:43:00 +02:00
ArithmeticTaintedLocalQuery.qll
Java: Deprecate the content of ArithmeticTaintedLocalQuery and remove the arithmetic tainted local query variant.
2024-05-01 08:59:51 +02:00
ArithmeticTaintedQuery.qll
[DIFF-INFORMED] Java: ArithmeticTainted
2025-07-17 18:59:09 +02:00
ArithmeticUncontrolledQuery.qll
[DIFF-INFORMED] Java: ArithmeticUncontrolled
2025-07-17 18:59:11 +02:00
ArithmeticWithExtremeValuesQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
BrokenCryptoAlgorithmQuery.qll
Java: Diff-informed BrokenCryptoAlgorithm.ql
2024-12-20 13:01:04 +01:00
CleartextStorageAndroidDatabaseQuery.qll
all: use my script to delete outdated deprecations
2025-01-27 22:16:48 +01:00
CleartextStorageAndroidFilesystemQuery.qll
Java: Fix some Ql4Ql violations.
2025-09-01 15:04:08 +02:00
CleartextStorageClassQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
CleartextStorageCookieQuery.qll
Java: Diff-informed CleartextStorageCookie.ql
2025-06-26 09:31:11 +02:00
CleartextStoragePropertiesQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
CleartextStorageQuery.qll
Java: Diff-informed CleartextStorageCookie.ql
2025-06-26 09:31:11 +02:00
CleartextStorageSharedPrefsQuery.qll
all: use my script to delete outdated deprecations
2025-01-27 22:16:48 +01:00
CommandArguments.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
CommandLineQuery.qll
Java: adjust CommandLineQuery locations
2025-01-31 11:37:16 +01:00
ConditionalBypassQuery.qll
[DIFF-INFORMED] Java: ConditionalBypass
2025-07-17 18:59:14 +02:00
ControlledString.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
Cookies.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
CsrfUnprotectedRequestTypeQuery.qll
Java: Prune PathGraph for CsrfUnprotectedRequestType.ql
2025-07-17 15:06:38 +02:00
Encryption.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ExecTaintedLocalQuery.qll
Java: Deprecate the content of ExecTaintedLocalQuery as this is unused.
2024-05-01 13:07:21 +02:00
ExternalAPIs.qll
[DIFF-INFORMED] Java: UntrustedDataToExternalAPI
2025-07-17 18:59:15 +02:00
ExternallyControlledFormatStringLocalQuery.qll
Java: Deprecate the content of ExternallyControlledFormatStringLocalQuery and remove the externally controlled format string local query variant.
2024-05-01 13:07:21 +02:00
ExternallyControlledFormatStringQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ExternalProcess.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
FileReadWrite.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
FileWritable.qll
Java: Fix some Ql4Ql violations.
2025-09-01 15:04:08 +02:00
FragmentInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
FragmentInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
GroovyInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
GroovyInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
HardcodedCredentials.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
HardcodedCredentialsApiCallQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
HardcodedCredentialsComparison.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
HardcodedCredentialsSourceCallQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
HardcodedPasswordField.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
HttpsUrls.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
HttpsUrlsQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
ImplicitlyExportedAndroidComponent.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ImplicitPendingIntents.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ImplicitPendingIntentsQuery.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ImproperIntentVerificationQuery.qll
Fix QLL and add change notes with tests
2025-03-05 10:23:35 +01:00
ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
[DIFF-INFORMED] Java: ImproperValidationOfArray…
2025-07-17 19:01:50 +02:00
ImproperValidationOfArrayConstructionLocalQuery.qll
Java: Deprecate the content of ImproperValidationOrArray and remove local query variants.
2024-05-01 13:07:21 +02:00
ImproperValidationOfArrayConstructionQuery.qll
[DIFF-INFORMED] Java: ImproperValidationOfArray…
2025-07-17 19:01:50 +02:00
ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
[DIFF-INFORMED] Java: ImproperValidationOfArray…
2025-07-17 19:01:50 +02:00
ImproperValidationOfArrayIndexLocalQuery.qll
Java: Deprecate the content of ImproperValidationOrArray and remove local query variants.
2024-05-01 13:07:21 +02:00
ImproperValidationOfArrayIndexQuery.qll
[DIFF-INFORMED] Java: ImproperValidationOfArray…
2025-07-17 19:01:50 +02:00
InformationLeak.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
InsecureBasicAuth.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
InsecureBasicAuthQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
InsecureBeanValidationQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
InsecureCookieQuery.qll
[DIFF-INFORMED] Java: InsecureCookie
2025-07-17 19:01:52 +02:00
InsecureLdapAuth.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
InsecureLdapAuthQuery.qll
[DIFF-INFORMED] Java: InsecureLdapAuth
2025-07-17 19:01:56 +02:00
InsecureRandomnessQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
InsecureTrustManager.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
InsecureTrustManagerQuery.qll
Java: Diff-informed InsecureTrustManager.ql
2024-12-20 11:22:58 +01:00
InsufficientKeySize.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
InsufficientKeySizeQuery.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
IntentUriPermissionManipulation.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
IntentUriPermissionManipulationQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
JexlInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
JndiInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
JndiInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
JWT.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
LdapInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
LdapInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ListOfConstantsSanitizer.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
LogInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
LogInjectionQuery.qll
[DIFF-INFORMED] Java: LogInjection
2025-07-17 19:01:58 +02:00
Mail.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
MaybeBrokenCryptoAlgorithmQuery.qll
[DIFF-INFORMED] Java: MaybeBrokenCryptoAlgorithm
2025-07-17 19:02:00 +02:00
MissingJWTSignatureCheckQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
MvelInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
MvelInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
NumericCastTaintedQuery.qll
Java: precise diff-informed NumericCastTainted
2025-02-11 13:49:15 +01:00
OgnlInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
OgnlInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
PartialPathTraversal.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
PartialPathTraversalQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
PathSanitizer.qll
Java: Enable validation wrappers in BarrierGuards.
2025-08-07 15:42:59 +02:00
QueryInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
RandomDataSource.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
RandomQuery.qll
Java: Diff-informed PredictableSeed.ql
2024-12-20 13:01:05 +01:00
RelativePaths.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
RequestForgery.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
RequestForgeryConfig.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ResponseSplitting.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
ResponseSplittingLocalQuery.qll
Java: Deprecate the content of ResponseSplittingLocalQuery and remove local query variant.
2024-05-01 13:07:21 +02:00
ResponseSplittingQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
RsaWithoutOaepQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
Sanitizers.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SecurityFlag.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SecurityTests.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SensitiveActions.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SensitiveApi.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SensitiveDataExposureThroughErrorMessageQuery.qll
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
2024-07-25 18:12:45 +02:00
SensitiveKeyboardCacheQuery.qll
Implement checks for calls that may safely mask information
2024-01-29 16:25:37 +00:00
SensitiveLoggingQuery.qll
[DIFF-INFORMED] Java: SensitiveLogging
2025-07-17 19:02:02 +02:00
SensitiveResultReceiverQuery.qll
mass rename to ActiveThreatModelSource
2024-09-12 10:16:55 +02:00
SensitiveUiQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
SpelInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SpelInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
SpringBootActuatorsConfigQuery.qll
Java: remove version debugging from alert message
2025-07-19 13:01:00 -04:00
SpringBootActuatorsQuery.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SpringCsrfProtection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SqlConcatenatedLib.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
SqlConcatenatedQuery.qll
[DIFF-INFORMED] Java: SqlConcatenated
2025-07-17 19:02:04 +02:00
SqlInjectionQuery.qll
Java: Diff-informed SqlTainted.ql
2024-12-20 11:22:57 +01:00
SqlTaintedLocalQuery.qll
Java: Deprecate the content of SqlTaintedLocalQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
StackTraceExposureQuery.qll
Now alerts about exposing exception.getMessage() in servlet responses are split out of java/stack-trace-exposure into its own alert java/error-message-exposure because this is a better fit.
2024-07-25 18:12:45 +02:00
StaticInitializationVectorQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
TaintedEnvironmentVariableQuery.qll
[DIFF-INFORMED] Java: TaintedEnvironmentVariable
2025-07-17 19:02:05 +02:00
TaintedPathQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
TaintedPermissionsCheckQuery.qll
Java: Diff-informed TaintedPermissionsCheck.ql
2024-12-20 13:01:06 +01:00
TempDirLocalInformationDisclosureQuery.qll
[DIFF-INFORMED] Java: TempDirLocalInformationDisclosure
2025-07-17 19:02:07 +02:00
TempDirUtils.qll
Java: Fix some Ql4Ql violations.
2025-09-01 15:04:08 +02:00
TemplateInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
TemplateInjectionQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00
TrustBoundaryViolationQuery.qll
[DIFF-INFORMED] Java: TrustBoundaryViolation
2025-07-17 19:02:09 +02:00
UnsafeAndroidAccess.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
UnsafeAndroidAccessQuery.qll
Java: mass enable diff-informed data flow + none() overrides
2025-06-17 14:05:36 +02:00
UnsafeCertTrust.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
UnsafeCertTrustQuery.qll
[DIFF-INFORMED] Java: UnsafeCertTrust
2025-07-17 19:02:13 +02:00
UnsafeContentUriResolution.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
UnsafeContentUriResolutionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
UnsafeDeserializationQuery.qll
Java: Fix some Ql4Ql violations.
2025-09-01 15:04:08 +02:00
UnsafeHostnameVerificationQuery.qll
Java: Diff-informed UnsafeHostnameVerification.ql
2024-12-20 12:58:59 +01:00
UrlForwardQuery.qll
Java: Deprecate redundant basic block predicates.
2025-05-21 09:01:46 +02:00
UrlRedirect.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
UrlRedirectLocalQuery.qll
Java: Deprecate the local content of UrlRedirectLocalQuery and remove the local query variant.
2024-05-01 13:07:21 +02:00
UrlRedirectQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
Validation.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
WebviewDebuggingEnabledQuery.qll
Java: annotate a query as not selecting sources
2025-01-21 12:56:06 +01:00
XmlParsers.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
XPath.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
XPathInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
XsltInjection.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
XsltInjectionQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
XSS.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
XssLocalQuery.qll
Java: Deprecate the content of XssLocalQuery and remove the Xss local query variant.
2024-05-01 08:59:50 +02:00
XssQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
Xxe.qll
Overlay: Add overlay annotations to Java & shared libraries
2025-06-24 10:25:06 +02:00
XxeLocalQuery.qll
use my script to delete outdated deprecations
2024-09-03 20:30:58 +02:00
XxeQuery.qll
Refactor XxeQuery
2023-03-29 22:33:09 -04:00
XxeRemoteQuery.qll
Merge pull request #17424 from RasmusWL/active-threat-model-source
2024-09-26 13:08:17 +02:00
ZipSlipQuery.qll
Java: apply query alert restrictions
2024-09-20 07:47:58 -07:00