hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-01-02 01:08:53 +01:00
Code Issues Packages Projects Releases Wiki Activity
Files
ecbf2d8b1377974fb593139b8a380c46dcfaefdc
codeql/java/ql/lib/semmle/code/java/security
History
Tony Torralba 0f3918af16 Merge pull request #13773 from atorralba/atorralba/java/mdht-xxe-sink 
Java: Add XXE sinks for MDHT
2023-08-23 13:49:49 +02:00
..
internal
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
performance
add deprecated aliases in the old locations, and use the Query.qll pattern for js/polynomial-redos
2022-06-23 14:36:25 +02:00
regexp
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
AndroidCertificatePinningQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
AndroidIntentRedirection.qll
Java: update intent-start sink kind to intent-redirection
2023-05-31 15:49:07 -04:00
AndroidIntentRedirectionQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
AndroidSensitiveCommunicationQuery.qll
Documentation for AndroidSensitiveCommunicationQuery
2023-03-29 22:33:10 -04:00
AndroidWebViewCertificateValidationQuery.qll
Use more precise control flow logic
2022-08-05 12:56:21 +01:00
ArbitraryApkInstallation.qll
Split ArbitraryApkInstallation file into 3 files
2023-03-08 12:12:11 -05:00
ArbitraryApkInstallationQuery.qll
C#/Java/Ruby: Remove superfluous module members.
2023-07-13 11:38:35 +02:00
ArithmeticCommon.qll
Move CWE-190/ArithmeticCommon.qll to semmle.code.java.security
2023-05-04 10:25:16 -04:00
ArithmeticTaintedLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ArithmeticTaintedQuery.qll
Java: Exclude source-to-source flow in 5 queries.
2023-07-17 09:06:49 +02:00
ArithmeticUncontrolledQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ArithmeticWithExtremeValuesQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
BrokenCryptoAlgorithmQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
CleartextStorageAndroidDatabaseQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageAndroidFilesystemQuery.qll
Java: update create/read-file sink kinds to path-injection
2023-05-31 15:49:07 -04:00
CleartextStorageClassQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageCookieQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStoragePropertiesQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CleartextStorageQuery.qll
Replace flow(_, sink) with flowTo(sink)
2023-03-29 22:33:09 -04:00
CleartextStorageSharedPrefsQuery.qll
Refactor CleartextStorage libraries
2023-03-29 22:33:08 -04:00
CommandArguments.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
CommandLineQuery.qll
Java: add sanitizer to command injection query
2023-08-21 12:33:05 -04:00
ConditionalBypassQuery.qll
Documentation for ConditionalBypassQuery
2023-03-29 22:33:10 -04:00
ControlledString.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
Encryption.qll
Add dashes to SHA algorithm names in Encryption.qll
2023-08-15 23:42:17 -04:00
ExecTaintedLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ExternalAPIs.qll
delete old deprecations
2023-06-02 11:58:08 +02:00
ExternallyControlledFormatStringLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ExternallyControlledFormatStringQuery.qll
Updates to imports
2023-03-30 11:03:48 -04:00
ExternalProcess.qll
Convert all command injection sinks to MaD format
2023-05-25 11:41:32 +02:00
FileReadWrite.qll
Java: Remove omittable exists variables
2023-01-10 13:37:19 +01:00
FileWritable.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
FragmentInjection.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
FragmentInjectionQuery.qll
Documentation additions
2023-03-29 22:33:09 -04:00
GroovyInjection.qll
Java: update groovy sink kind to groovy-injection
2023-05-31 15:49:06 -04:00
GroovyInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
HardcodedCredentials.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
HardcodedCredentialsApiCallQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
HardcodedCredentialsComparison.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
HardcodedCredentialsSourceCallQuery.qll
Refactor HardcodedCredentialsSourceCall
2023-04-13 23:06:16 -04:00
HardcodedPasswordField.qll
Add java imports
2022-08-23 09:41:00 +01:00
HttpsUrls.qll
Java: add comment about request-forgery sinks
2023-05-31 15:51:07 -04:00
HttpsUrlsQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
ImplicitlyExportedAndroidComponent.qll
adjusted comments and precision level
2022-08-22 12:41:22 -04:00
ImplicitPendingIntents.qll
Java: update intent-start sink kind to intent-redirection
2023-05-31 15:49:07 -04:00
ImplicitPendingIntentsQuery.qll
C#/Java/Ruby: Remove superfluous module members.
2023-07-13 11:38:35 +02:00
ImproperIntentVerificationQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
ImproperValidationOfArrayConstructionCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayConstructionQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexCodeSpecifiedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ImproperValidationOfArrayIndexQuery.qll
Java: Exclude source-to-source flow in 5 queries.
2023-07-17 09:06:49 +02:00
InformationLeak.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
InsecureBasicAuth.qll
Java: Deprecate StringLiteral.getRepresentedString()
2021-10-29 14:50:15 +02:00
InsecureBasicAuthQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
InsecureBeanValidationQuery.qll
Remove private marker
2023-03-30 11:08:41 -04:00
InsecureCookieQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
InsecureLdapAuth.qll
Move public classes/predicates to top of library file
2023-03-27 12:16:44 -04:00
InsecureLdapAuthQuery.qll
Make configuration public
2023-03-28 10:28:15 -04:00
InsecureTrustManager.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
InsecureTrustManagerQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
InsufficientKeySize.qll
change matches to equality
2022-12-01 11:56:44 -05:00
InsufficientKeySizeQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
IntentUriPermissionManipulation.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
IntentUriPermissionManipulationQuery.qll
Documentation for IntentUriPermissionManipulationQuery
2023-03-29 22:33:10 -04:00
JexlInjectionQuery.qll
Java: update jexl sink kind to jexl-injection
2023-05-31 15:49:06 -04:00
JndiInjection.qll
Move JndiInjectionSanitizer to importable file
2023-03-23 17:05:53 +01:00
JndiInjectionQuery.qll
Fix miscopied isBarrier in JndiInjectionQuery
2023-03-29 07:23:13 -04:00
JWT.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
LdapInjection.qll
Java: update ldap sink kind to ldap-injection
2023-05-31 15:49:07 -04:00
LdapInjectionQuery.qll
Move LdapInjectionLib to LdapInjectionQuery.qll
2023-03-29 17:59:33 -04:00
LogInjection.qll
Java: Add more negation context to reduce string ops and improve perf.
2023-06-08 14:04:57 +02:00
LogInjectionQuery.qll
Java: Exclude source-to-source flow in 5 queries.
2023-07-17 09:06:49 +02:00
Mail.qll
Apply suggestions from code review
2021-10-05 09:40:22 +02:00
MaybeBrokenCryptoAlgorithmQuery.qll
Java: Make the barrier in java/potentially-weak-cryptographic-algorithm less restrictive.
2023-07-31 14:28:53 +02:00
MissingJWTSignatureCheckQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
MvelInjection.qll
Java: update mvel sink kind to mvel-injection
2023-05-31 15:49:06 -04:00
MvelInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
NumericCastTaintedQuery.qll
Java: Exclude source-to-source flow in 5 queries.
2023-07-17 09:06:49 +02:00
OgnlInjection.qll
Java: Remove manual models from QL code.
2022-11-28 12:30:34 +01:00
OgnlInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
OverlyLargeRangeQuery.qll
port the Java regex/redos queries to use the shared pack
2022-11-14 21:29:41 +01:00
PartialPathTraversal.qll
Autoformat ql
2022-08-11 09:55:46 +01:00
PartialPathTraversalQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
PathCreation.qll
Packaging: Java refactoring
2021-08-19 14:09:35 -07:00
PathSanitizer.qll
Adjust getExtensionReceiverParameterIndex predicate name and change note
2022-12-09 10:29:52 +01:00
QueryInjection.qll
Java: update sql sink kind to sql-injection
2023-05-31 15:49:06 -04:00
RandomDataSource.qll
Fix typo, replace getBytes with nextBytes
2023-08-07 00:16:47 -04:00
RandomQuery.qll
Refactor RandomQuery.qll
2023-03-29 22:33:09 -04:00
RelativePaths.qll
Java: convert some block-comments that could be QLDoc to QLDoc
2022-11-16 13:40:15 +01:00
RequestForgery.qll
Java: update open/jdbc-url sink kinds to request-forgery
2023-05-31 15:50:31 -04:00
RequestForgeryConfig.qll
Java: Exclude source-to-source flow in 5 queries.
2023-07-17 09:06:49 +02:00
ResponseSplitting.qll
Java: update header-splitting sink kind to response-splitting
2023-05-31 15:49:07 -04:00
ResponseSplittingLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
ResponseSplittingQuery.qll
Updates to imports
2023-03-30 11:03:48 -04:00
RsaWithoutOaepQuery.qll
Documentation for RsaWithoutOaepQuery
2023-03-29 22:33:10 -04:00
SecurityFlag.qll
Java: Make implicit this receivers explicit
2023-05-03 13:37:35 +02:00
SecurityTests.qll
Java: Performance tweaks
2022-02-21 17:05:00 +00:00
SensitiveActions.qll
Fix getCommonSensitiveInfoRegex
2023-04-13 10:33:03 +02:00
SensitiveApi.qll
Add byte[] signatures
2023-02-27 12:16:14 +01:00
SensitiveKeyboardCacheQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
SensitiveLoggingQuery.qll
Fix name clash
2023-06-19 15:04:33 +02:00
SensitiveResultReceiverQuery.qll
SensitiveResultReceiverFlow needs to be public
2023-04-14 09:04:56 +02:00
SpelInjection.qll
Java: Autoformat
2023-03-10 09:39:41 +01:00
SpelInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
SqlConcatenatedLib.qll
Java: improve naming and description of SqlUnescaped.ql
2023-01-09 10:56:13 +00:00
SqlConcatenatedQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
SqlInjectionQuery.qll
Deprecate old predicate
2023-03-24 10:07:40 -04:00
SqlTaintedLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
StackTraceExposureQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
StaticInitializationVectorQuery.qll
Remove unnecessary private markers
2023-03-29 22:33:09 -04:00
TaintedPathQuery.qll
Add PathCreation.qll sinks to models-as-data
2023-06-02 09:14:35 +02:00
TaintedPermissionsCheckQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
TempDirLocalInformationDisclosureQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
TempDirUtils.qll
Add TempDirLocalInformationDisclosureQuery
2023-05-04 10:25:16 -04:00
TemplateInjection.qll
Java: update ssti sink kind to template-injection
2023-05-31 15:49:06 -04:00
TemplateInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
TrustBoundaryViolationQuery.qll
Add default sanitizers
2023-08-17 13:05:37 -04:00
UnsafeAndroidAccess.qll
Java: Add support for Kotlin's apply to java/android/unsafe-android-webview-fetch
2023-07-10 17:40:16 +02:00
UnsafeAndroidAccessQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
UnsafeCertTrust.qll
make some acronyms camelCase
2022-08-22 21:22:35 +02:00
UnsafeCertTrustQuery.qll
Documentation for UnsafeCertTrustQuery
2023-03-29 22:33:09 -04:00
UnsafeContentUriResolution.qll
Revert "Decouple from #10177"
2022-10-06 16:30:23 +02:00
UnsafeContentUriResolutionQuery.qll
Documentation for UnsafeContentUriResolutionQuery
2023-03-29 22:33:10 -04:00
UnsafeDeserializationQuery.qll
Update java/ql/lib/semmle/code/java/security/UnsafeDeserializationQuery.qll
2023-06-26 11:14:31 +02:00
UnsafeHostnameVerificationQuery.qll
Java: update set-hostname-verifier sink kind to hostname-verification
2023-05-31 15:49:07 -04:00
UrlRedirect.qll
Java: update url-redirect sink kind to url-redirection
2023-05-31 15:49:06 -04:00
UrlRedirectLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
UrlRedirectQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
Validation.qll
Java: Fix join-order.
2022-04-26 13:43:41 +02:00
WebviewDebuggingEnabledQuery.qll
Update to DataFlow::Global
2023-03-24 09:54:53 -04:00
WebviewDubuggingEnabledQuery.qll
Apply suggestions from code review
2023-03-24 09:47:50 -04:00
XmlParsers.qll
Java: Add XXE sinks for MDHT
2023-07-31 11:13:17 +02:00
XPath.qll
Java: update xpath sink kind to xpath-injection
2023-05-31 15:49:06 -04:00
XPathInjectionQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
XsltInjection.qll
Java: update xslt sink kind to xslt-injection
2023-05-31 15:49:07 -04:00
XsltInjectionQuery.qll
Refactor to DataFlow::Global
2023-03-24 10:04:46 -04:00
XSS.qll
Add Hudson models
2023-06-02 11:06:24 +02:00
XssLocalQuery.qll
Privacy markers and fixed imports
2023-05-04 10:25:17 -04:00
XssQuery.qll
Move XssConfig to XssQuery.qll
2023-03-29 17:59:33 -04:00
Xxe.qll
Fix import locations
2023-02-13 17:13:01 +01:00
XxeLocalQuery.qll
Java: Rename references.
2023-03-23 13:06:19 +01:00
XxeQuery.qll
Refactor XxeQuery
2023-03-29 22:33:09 -04:00
XxeRemoteQuery.qll
Java: Rename references.
2023-03-23 13:06:19 +01:00
ZipSlipQuery.qll
Improve ZipSlip exclusion to take varargs into account
2023-06-07 09:25:56 +02:00