Tony Torralba cbb64cc8c1 Merge pull request #10352 from atorralba/atorralba/promote-template-injection ...

Java: Promote Server-side template injection from experimental

2022-09-20 16:11:58 +02:00

..

CWE-020

apply changes based on docs review

2022-08-09 13:51:40 +02:00

CWE-022

Introduce TaintedPathAdditionalTaintStep

2022-09-16 10:42:15 +02:00

CWE-023

Remove extra closing tag

2022-08-15 11:31:53 +01:00

CWE-074

Add missing security-severity scores

2022-03-14 09:50:14 +01:00

CWE-078

Deduplicate shared body of regular and experimental versions of java/command-line-injection query.

2021-07-01 14:53:56 +01:00

CWE-079

Update java/ql/src/Security/CWE/CWE-079/XSS.java

2022-09-13 16:49:20 +02:00

CWE-089

update java/sql-injection to match go/javascript/python/ruby

2022-08-22 21:41:45 +02:00

CWE-090

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-094

Update java/ql/src/Security/CWE/CWE-094/TemplateInjection.qhelp

2022-09-20 11:48:40 +02:00

CWE-113

Address PR comments.

2022-08-19 17:33:35 +07:00

CWE-117

Java: Report log-injection at the source rather than the sink

2022-06-22 13:05:20 +01:00

CWE-129

Java: Make JumpStmt a proper superclass

2022-03-30 00:30:27 +02:00

CWE-134

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-190

Kotlin: Add types for the different kinds of casts that Kotlin has

2022-05-10 19:51:13 +01:00

CWE-200

add explicit this

2022-08-17 13:33:31 +02:00

CWE-209

add all remaining explicit this

2021-11-26 13:50:10 +01:00

CWE-266

Don't capitalize the term content provider

2022-01-20 13:23:52 +01:00

CWE-273

Add missing security-severity scores

2022-03-14 09:50:14 +01:00

CWE-295

Change man-in-the-middle back to machine-in-the-middle

2022-08-05 12:56:21 +01:00

CWE-297

Java: Performance tweaks

2022-02-21 17:05:00 +00:00

CWE-312

allowBackup documentation updates

2022-09-09 09:30:49 -04:00

CWE-319

make some acronyms camelCase

2022-08-22 21:22:35 +02:00

CWE-327

Java: Replace uses of deprecated variableTrack.

2022-09-13 13:30:40 +02:00

CWE-335

Java: Add cwe-377 tag to predictable-seed

2022-05-03 12:28:14 +01:00

CWE-338

add all remaining explicit this

2021-11-26 13:50:10 +01:00

CWE-347

Apply suggestions from code review

2021-08-04 13:15:49 +02:00

CWE-352

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-367

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-421

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-470

Update java/ql/src/Security/CWE/CWE-470/FragmentInjection.inc.qhelp

2022-01-17 11:20:39 +01:00

CWE-489

added commas to help file

2022-08-15 15:50:00 -04:00

CWE-502

Add change note and update qhelp

2021-10-12 12:35:05 +01:00

CWE-522

Add missing security-severity scores

2022-03-14 09:50:14 +01:00

CWE-532

Add security severity

2022-03-15 10:42:41 +00:00

CWE-601

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-611

update {java/rb}/xxe to match python/javascript

2022-08-22 21:41:46 +02:00

CWE-614

Insecure cookie query: accept ServletRequest.isSecure(), and allow more than one possible input to a setSecure(...) call.

2022-05-11 11:59:37 +01:00

CWE-643

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-676

Add security-severity metadata

2021-06-10 20:11:08 +01:00

CWE-681

Java: Move sink-constraints into the configuration.

2022-08-17 15:06:55 +02:00

CWE-730

Add CWE-1333 tag to Java ReDoS queries

2022-08-23 09:56:59 +02:00

CWE-732

Update security-severity scores

2021-06-15 13:25:17 +01:00

CWE-749

Add missing security-severity scores

2022-03-14 09:50:14 +01:00

CWE-780

Apply docs suggestions from code review

2022-08-18 14:21:40 +01:00

CWE-798

Convert tests to inline expectations and fix one bug revealed doing so

2022-08-13 14:02:05 +01:00

CWE-807

add all remaining explicit this

2021-11-26 13:50:10 +01:00

CWE-829

rename existing getUrl predicate to getRepositoryUrl

2022-04-06 15:32:33 +02:00

CWE-833

Java: Performance tweaks

2022-02-21 17:05:00 +00:00

CWE-835

Java: Make JumpStmt a proper superclass

2022-03-30 00:30:27 +02:00

CWE-917

Add missing security-severity scores

2022-03-14 09:50:14 +01:00

CWE-918

Update Security-Severity for CWE-918

2021-08-04 12:17:21 +02:00

CWE-925

Fix misspellings

2022-06-14 15:34:08 +01:00

CWE-926

update query description

2022-08-22 12:41:22 -04:00

CWE-927

Update java/ql/src/Security/CWE/CWE-927/ImplicitPendingIntents.qhelp

2022-01-21 11:57:11 +01:00

CWE-940

Apply suggestions from code review

2021-11-04 10:08:53 +01:00

CWE-1104

rename existing getUrl predicate to getRepositoryUrl

2022-04-06 15:32:33 +02:00

CWE-1204

Apply doc suggestions

2022-08-17 10:35:16 +01:00