hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-02-24 10:53:49 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
ac6c4add1480fc0ec35d2bf49231f1996226b604
codeql/java/ql/lib/semmle/code/java/security
History
Owen Mansel-Chan ac6c4add14 Apply suggestions from code review 
Co-authored-by: Chris Smowton <smowton@github.com>
2024-03-24 20:20:37 +00:00
..
internal
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
regexp
Merge pull request #15291 from egregius313/egregius313/java/dataflow/default-sanitizers
2024-01-23 13:28:03 -05:00
AndroidCertificatePinningQuery.qll
Java: Fix FPs in Missing certificate pinning
2023-12-12 18:02:12 +01:00
AndroidIntentRedirection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
AndroidIntentRedirectionQuery.qll
Deprecate or remove imports of dataflow library copies
2023-12-08 10:42:10 -05:00
AndroidLocalAuthQuery.qll
Add unit tests
2024-02-12 13:49:45 +00:00
AndroidSensitiveCommunicationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
AndroidWebViewCertificateValidationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ArbitraryApkInstallation.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ArbitraryApkInstallationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ArithmeticCommon.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
ArithmeticTaintedLocalQuery.qll
Sync ArithmeticTaintedLocalQuery
2023-10-12 09:58:08 -04:00
ArithmeticTaintedQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
ArithmeticUncontrolledQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ArithmeticWithExtremeValuesQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
BrokenCryptoAlgorithmQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
CleartextStorageAndroidDatabaseQuery.qll
Add aliases for public, importable renamed classes and predicates.
2023-10-24 10:54:35 +01:00
CleartextStorageAndroidFilesystemQuery.qll
Java: update create/read-file sink kinds to path-injection
2023-05-31 15:49:07 -04:00
CleartextStorageClassQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
CleartextStorageCookieQuery.qll
Deprecate or remove imports of dataflow library copies
2023-12-08 10:42:10 -05:00
CleartextStoragePropertiesQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
CleartextStorageQuery.qll
Deprecate or remove imports of dataflow library copies
2023-12-08 10:42:10 -05:00
CleartextStorageSharedPrefsQuery.qll
Add aliases for public, importable renamed classes and predicates.
2023-10-24 10:54:35 +01:00
CommandArguments.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
CommandLineQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
ConditionalBypassQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ControlledString.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
Cookies.qll
Add cookie sinks
2023-12-13 11:15:27 +01:00
Encryption.qll
delete outdated deprecations
2024-01-22 09:11:35 +01:00
ExecTaintedLocalQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
ExternalAPIs.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
ExternallyControlledFormatStringLocalQuery.qll
Sync ExternallyControlledFormatStringLocalQuery
2023-10-12 09:58:08 -04:00
ExternallyControlledFormatStringQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
ExternalProcess.qll
Convert all command injection sinks to MaD format
2023-05-25 11:41:32 +02:00
FileReadWrite.qll
Autoformat
2023-10-24 11:06:19 +01:00
FileWritable.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
FragmentInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
FragmentInjectionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
GroovyInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
GroovyInjectionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
HardcodedCredentials.qll
Rename class to CredentialsSinkNode to better align with naming convention
2023-10-25 14:31:54 -04:00
HardcodedCredentialsApiCallQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
HardcodedCredentialsComparison.qll
Autoformat
2023-10-24 11:06:19 +01:00
HardcodedCredentialsSourceCallQuery.qll
Add private imports to prevent compile warnings
2023-12-08 10:42:11 -05:00
HardcodedPasswordField.qll
Add java imports
2022-08-23 09:41:00 +01:00
HttpsUrls.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
HttpsUrlsQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
ImplicitlyExportedAndroidComponent.qll
adjusted comments and precision level
2022-08-22 12:41:22 -04:00
ImplicitPendingIntents.qll
Java: Remove/deprecate FlowStateString-based extension points.
2023-12-14 15:15:58 +01:00
ImplicitPendingIntentsQuery.qll
Java: Remove/deprecate FlowStateString-based extension points.
2023-12-14 15:15:58 +01:00
ImproperIntentVerificationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexLocalQuery.qll
Sync ImproperValidationOfArrayIndexLocalQuery
2023-10-12 09:58:08 -04:00
ImproperValidationOfArrayIndexQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
InformationLeak.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
InsecureBasicAuth.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureBasicAuthQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
InsecureBeanValidationQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureCookieQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureLdapAuth.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureLdapAuthQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureRandomnessQuery.qll
Improve source of randomness detection
2023-12-13 11:15:27 +01:00
InsecureTrustManager.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
InsecureTrustManagerQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
InsufficientKeySize.qll
Update java/ql/lib/semmle/code/java/security/InsufficientKeySize.qll
2023-12-15 08:48:50 +01:00
InsufficientKeySizeQuery.qll
Java: Remove/deprecate FlowStateString-based extension points.
2023-12-14 15:15:58 +01:00
IntentUriPermissionManipulation.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
IntentUriPermissionManipulationQuery.qll
Merge pull request #14370 from michaelnebel/java/enablethreatmodels
2023-10-10 09:25:47 +02:00
JexlInjectionQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
JndiInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
JndiInjectionQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
JWT.qll
Add aliases for public, importable renamed classes and predicates.
2023-10-24 10:54:35 +01:00
LdapInjection.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
LdapInjectionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
LogInjection.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
LogInjectionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
Mail.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
MaybeBrokenCryptoAlgorithmQuery.qll
Java: Generelize MaybeBrokenCryptoAlgorithmQuery.qll
2023-12-22 10:15:40 +01:00
MissingJWTSignatureCheckQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
MvelInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
MvelInjectionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
NumericCastTaintedQuery.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
OgnlInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
OgnlInjectionQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
PartialPathTraversal.qll
Autoformat
2023-10-24 11:06:19 +01:00
PartialPathTraversalQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
PathCreation.qll
Migrate path injection sinks to MaD
2024-01-26 12:19:54 +01:00
PathSanitizer.qll
Java: Expand ExactPathSanitizer to work on the argument of 'equals' too
2024-02-15 10:00:24 +01:00
QueryInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
RandomDataSource.qll
Improve source of randomness detection
2023-12-13 11:15:27 +01:00
RandomQuery.qll
Mass rename L/RValue -> VarWrite/Read
2023-10-24 10:58:29 +01:00
RelativePaths.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
RequestForgery.qll
add explicit QLDoc that any method named "contains" is matched
2024-03-12 15:25:27 +01:00
RequestForgeryConfig.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ResponseSplitting.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ResponseSplittingLocalQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
ResponseSplittingQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
RsaWithoutOaepQuery.qll
Documentation for RsaWithoutOaepQuery
2023-03-29 22:33:10 -04:00
Sanitizers.qll
Add UUID and Date to the list of types in the SimpleTypeSanitizer class
2024-01-23 13:36:03 -05:00
SecurityFlag.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SecurityTests.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
SensitiveActions.qll
Add aliases for public, importable renamed classes and predicates.
2023-10-24 10:54:35 +01:00
SensitiveApi.qll
Refactor to using MethodCall instead of MethodAccess
2023-10-25 14:31:56 -04:00
SensitiveKeyboardCacheQuery.qll
Implement checks for calls that may safely mask information
2024-01-29 16:25:37 +00:00
SensitiveLoggingQuery.qll
Apply suggestions from code review
2024-03-24 20:20:37 +00:00
SensitiveResultReceiverQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SensitiveUiQuery.qll
Address reviews - use SimpleTypeSanitizer and alter qldoc style
2024-01-31 11:31:25 +00:00
SpelInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SpelInjectionQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SpringCsrfProtection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SqlConcatenatedLib.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
SqlConcatenatedQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
SqlInjectionQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
SqlTaintedLocalQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
StackTraceExposureQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
StaticInitializationVectorQuery.qll
Java: Switch helper flow from Global to SimpleGlobal in StaticInitializationVectorQuery.
2024-02-19 14:04:43 +01:00
TaintedEnvironmentVariableQuery.qll
Use MapMutation instead of MethodCall
2024-01-08 09:39:05 -05:00
TaintedPathQuery.qll
Migrate path injection sinks to MaD
2024-01-26 12:19:54 +01:00
TaintedPermissionsCheckQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
TempDirLocalInformationDisclosureQuery.qll
Autoformat
2023-10-24 11:06:19 +01:00
TempDirUtils.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
TemplateInjection.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
TemplateInjectionQuery.qll
Java: Remove/deprecate FlowStateString-based extension points.
2023-12-14 15:15:58 +01:00
TrustBoundaryViolationQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
UnsafeAndroidAccess.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
UnsafeAndroidAccessQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
UnsafeCertTrust.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
UnsafeCertTrustQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
UnsafeContentUriResolution.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
UnsafeContentUriResolutionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
UnsafeDeserializationQuery.qll
Apply JMS sink only when there isn't an implementation available
2023-10-30 15:56:24 +01:00
UnsafeHostnameVerificationQuery.qll
Java: update set-hostname-verifier sink kind to hostname-verification
2023-05-31 15:49:07 -04:00
UrlRedirect.qll
Java: Add extension point and default sanitizer to Open Redirect query
2024-02-09 09:11:07 +01:00
UrlRedirectLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
UrlRedirectQuery.qll
Java: Add extension point and default sanitizer to Open Redirect query
2024-02-09 09:11:07 +01:00
Validation.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
WebviewDebuggingEnabledQuery.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
WebviewDubuggingEnabledQuery.qll
Apply suggestions from code review
2023-03-24 09:47:50 -04:00
XmlParsers.qll
delete outdated deprecations
2024-01-22 09:11:35 +01:00
XPath.qll
Java: update xpath sink kind to xpath-injection
2023-05-31 15:49:06 -04:00
XPathInjectionQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
XsltInjection.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
XsltInjectionQuery.qll
Rename SimpleScalarSanitizer to SimpleTypeSanitizer
2024-01-22 23:55:29 -05:00
XSS.qll
Mass-rename MethodAccess -> MethodCall
2023-10-24 10:30:26 +01:00
XssLocalQuery.qll
Sync XSS Local
2023-10-12 09:58:08 -04:00
XssQuery.qll
Java: Opt-in the XSS query to use threat model flow sources.
2023-10-04 10:48:09 +02:00
Xxe.qll
Fix import locations
2023-02-13 17:13:01 +01:00
XxeLocalQuery.qll
Java: Rename references.
2023-03-23 13:06:19 +01:00
XxeQuery.qll
Refactor XxeQuery
2023-03-29 22:33:09 -04:00
XxeRemoteQuery.qll
Java: Re-factor most queries and tests to use threat models.
2023-10-04 14:01:58 +02:00
ZipSlipQuery.qll
Remove reference to PathCreation
2024-01-26 12:45:00 +01:00