hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-08 03:01:10 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
6168b15bbcf1e4099bcf7eb0528ca4de3fb36a69
codeql/java/ql/test/stubs
History
Chris Smowton 8816aa1431 Improve Android stub fidelity to the point that all relevant tests work 
Note these still aren't entirely mechanically generated stubs matching the real Android 9.
2021-10-12 12:35:05 +01:00
..
akka-2.6.x/akka/util
Initial support for Play Framework > 2.6.x
2020-10-22 20:20:49 +05:30
amazon-aws-sdk-1.11.700
Hardcoded AWS credentials
2020-06-17 02:46:02 +00:00
android
Generate tests and stubs
2021-09-29 15:44:21 +01:00
apache-commons-codec-1.14
Add test case
2020-04-28 11:26:43 +02:00
apache-commons-collections4-4.4/org
Fix stub
2021-09-27 16:24:41 +01:00
apache-commons-digester3-3.2/org/apache/commons/digester3
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
2021-09-10 13:49:31 +01:00
apache-commons-email-1.6.0
Add all dependent class stubs
2020-06-09 20:12:05 +00:00
apache-commons-io-2.6
Java: Add LICENSE.txt
2020-02-05 09:38:16 +01:00
apache-commons-jexl-2.1.1/org/apache/commons/jexl2
More csv sinks and sources
2021-05-03 12:44:53 +02:00
apache-commons-jexl-3.1/org/apache/commons/jexl3
Removed commented code from JexlUberspect
2021-02-24 22:31:03 +01:00
apache-commons-lang3-3.7
Add models for Apache Commons Lang's Mutable container
2021-07-15 14:58:25 +01:00
apache-commons-logging-1.2/org/apache/commons/logging
More csv sinks and sources
2021-05-03 12:44:53 +02:00
apache-commons-text-1.9/org/apache/commons/text
Add models for Apache Commons Lang and Text's Str[ing]Substitutor
2021-03-04 11:11:55 +00:00
apache-http-4.4.13/org/apache/http
Convert request forgery tests to inline expectations; add missing models revealed by this process.
2021-06-17 11:43:32 +01:00
apache-http-5/org/apache/hc/core5
Add additional unit tests
2021-02-23 16:17:13 +00:00
apache-ldap-1.0.2/org/apache/directory
Java: Adjust stubs and unit test.
2020-01-30 11:27:33 +01:00
azure-sdk-for-java/com/azure
Query to detect hard-coded Azure credentials
2021-05-07 13:16:41 +00:00
bsh-2.0b5/bsh
BeanShell Injection
2021-06-18 15:54:13 +08:00
castor-1.4.1/org/exolab/castor
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
commons-exec-1.3/org/apache/commons/exec
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
dom4j-2.1.1/org/dom4j
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
2021-09-10 13:49:31 +01:00
ejb-3.2/javax
Add query for enterprise beans
2021-02-20 02:00:42 +00:00
esapi-2.0.1/org/owasp/esapi
Java: Adjust stubs and unit test.
2020-01-30 11:27:33 +01:00
fastjson-1.2.74/com/alibaba/fastjson
*)add JsonHijacking ql query
2021-02-18 18:11:10 +08:00
flexjson-2.1/flexjson
Add support for the Flexjson framework to the unsafe-deserialization query
2021-09-10 16:27:23 +01:00
google-android-9.0.0
Improve Android stub fidelity to the point that all relevant tests work
2021-10-12 12:35:05 +01:00
groovy-all-3.0.7
Add tests for CompilationUnit's subtypes
2021-06-16 13:01:40 +02:00
gson-2.8.6/com/google/gson
Add Gson support to unsafe deserialization query
2021-10-12 12:35:04 +01:00
guava-30.0
Add models for more of methods; update stubs
2021-09-17 16:57:49 +01:00
guice-4.2.2/com/google/inject
Java: add test for Guice framework support
2019-02-15 20:01:08 -05:00
guice-servlet-4.2.2/com/google/inject/servlet
Java: add test for Guice framework support
2019-02-15 20:01:08 -05:00
hamcrest-2.2
Java: Respect Hamcrest assertThat(X, notNullValue())
2019-10-29 17:52:13 +00:00
hessian-4.0.38/com/caucho
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
j2objc
Add j2objc license
2019-08-17 16:31:18 +01:00
jabsorb-1.3.2/org/jabsorb
Add unsafe-deserialization support for Jabsorb
2021-08-04 15:35:50 +01:00
jackson-core-2.12/com/fasterxml/jackson/core
Add tests for JacksonSerializability
2021-08-02 14:03:30 +02:00
jackson-databind-2.12
Fix tests affected by Jackson stubs changes
2021-08-03 14:22:55 +02:00
jakarta-json-2.0.1/jakarta/json
Also cover jakarta version of javax.json, and some missed methods
2021-06-30 15:04:15 +01:00
jakarta-mail-2.0.1/jakarta/mail
Consider Jakarta Mail
2021-10-05 09:18:47 +02:00
java-ee-el/javax/el
Added setVariable() sink
2021-04-08 20:41:43 +03:00
javamail-api-1.6.2
Add all dependent class stubs
2020-06-09 20:12:05 +00:00
javax-faces-2.3/javax/faces
Query to detect XSS with JavaServer Faces (JSF)
2021-09-14 11:47:32 +01:00
javax-json-api-1.1.4/javax/json
Also cover jakarta version of javax.json, and some missed methods
2021-06-30 15:04:15 +01:00
javax-servlet-2.5/javax/servlet
Add stubs for Spring web.util tests
2021-08-12 11:20:48 -07:00
javax-ws-rs-api-2.1.1/javax/ws/rs
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
javax-ws-rs-api-3.0.0/jakarta/ws/rs
Add sources for Jax-RS filters
2021-09-10 16:36:34 +01:00
jaxb-api-2.3.1/javax/xml/bind
Java: Add XXE tests.
2021-04-19 10:58:21 +02:00
jaxen-1.2.0/org/jaxen
Add safe example for dom4j
2021-05-06 10:17:25 +02:00
jaxws-api-2.0
Add stubs for JAX-WS
2021-06-08 15:12:04 +01:00
jdom-1.1.3/org/jdom
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
joddjson-6.0.3/jodd/json
Unsafe deserialization: add support for Jodd JSON library
2021-08-05 16:01:14 +01:00
json-io-4.10.0/com/cedarsoftware/util/io
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
json-java-20210307/org/json
Add models of JSON-java, aka org.json
2021-07-19 17:57:27 +01:00
jsr181-api
Add stubs for JAX-WS
2021-06-08 15:12:04 +01:00
jsr223-api/javax/script
Java: Added JSR 223 sinks for MVEL injections
2020-06-05 17:17:43 +03:00
jsr311-api-1.1.1/javax/ws/rs
Java: Add missing stub.
2021-07-13 15:26:37 +02:00
juel-2.2/de/odysseus/el
Added tests for Jakarta expression injection
2021-03-21 21:19:39 +03:00
junit-4.11/org/junit
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
junit-jupiter-api-5.2.0
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
jwtk-jjwt-0.11.2
Add missing subtype test
2021-05-18 09:38:35 +02:00
jyaml-1.3/org/ho/yaml
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
jython-2.7.2/org/python
Add more methods and update the library name
2021-05-04 02:54:49 +00:00
kryo-4.0.2/com/esotericsoftware/kryo
[Java] Fix Kryo FP & Kryo 5 Support
2021-05-05 17:38:34 -04:00
mongodbClient
Java : add MongoDB injection sinks
2020-08-31 02:24:23 +05:30
mvel2-2.4.7/org/mvel2
Moved from experimental
2021-06-02 09:58:30 +02:00
ognl-3.2.14/ognl
Consider ExpressionAccessor
2021-05-12 12:32:38 +02:00
playframework-2.6.x/play
More Play stubs improvements
2021-03-02 20:39:25 +05:30
projectreactor-3.4.3/reactor/core/publisher
Add URLClassLoader and Spring WebClient SSRF sinks
2021-07-01 03:34:14 +04:00
rundeck-api-java-client-13.2/org/rundeck/api/parser
Add experimental variants of java/xxe, incorporating new sinks and a version that uses local sources.
2021-09-10 13:49:31 +01:00
Saxon-HE-9.9.1-7/net/sf/saxon
Move from experimental
2021-09-27 11:57:53 +02:00
saxon-xqj-9.x
*)add XQExpression.executeCommand(0) sink
2021-02-12 11:17:42 +08:00
scriptengine
Include more scenarios and update qldoc
2021-05-18 16:12:22 +00:00
servlet-api-2.4/javax/servlet
Merge pull request #5663 from smowton/luchua/java/sensitive-cookie-not-httponly
2021-04-13 12:08:53 +01:00
shiro-core-1.4.0
Apply suggestions from code review
2021-09-30 14:26:14 +01:00
shiro-core-1.5.2/org/apache/shiro/jndi
Moved JNDI injection related files from experimental to standard
2021-05-19 11:32:51 +02:00
simple-xml-2.7.1/org/simpleframework/xml
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
snakeyaml-1.21/org/yaml/snakeyaml
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
spring-data-commons-2.5.1/org/springframework/data
Add necessary stubs for Spring
2021-07-14 04:57:56 -07:00
spring-ldap-2.3.2/org/springframework/ldap
Consider search methods with unsafe SearchControls
2021-05-21 15:21:04 +02:00
springframework-5.3.8
Consider subtypes of Expression and ExpressionParser
2021-09-27 11:38:12 +02:00
struts2-core-2.5.22/com/opensymphony/xwork2/ognl
Moved from experimental to standard
2021-05-11 15:42:13 +02:00
unboundid-ldap-4.0.14/com/unboundid/ldap/sdk
Java: Adjust stubs and unit test.
2020-01-30 11:27:33 +01:00
validation-api-2.0.1.Final/javax/validation
remove compiled classes from stubs
2020-10-27 15:56:26 +01:00
xstream-1.4.10/com/thoughtworks/xstream
Migrate Java code to separate QL repo.
2018-08-30 10:48:05 +01:00
yamlbeans-1.09/com/esotericsoftware/yamlbeans
Add UnsafeDeserialization
2021-05-12 12:37:16 +08:00
README.md
Add Java stubs readme
2019-08-17 18:57:50 +01:00

README.md

The stubs in this directory are derived from various open-source projects, and used to test that the relevant APIs are correctly modelled. Where a disclaimer or third-party-notice is required, this is included in the top-level directory for each particular library.