Code

Java: add CSRF query#18288

Code

Open

jcogs33 wants to merge 24 commits intogithub:maingithub/codeql:mainfrom jcogs33:jcogs33/csrf-unprotected-request-typejcogs33/codeql:jcogs33/csrf-unprotected-request-typeCopy head branch name to clipboard

+1,561-120

Commits

Commits on Dec 20, 2024

• Java: add qhelp

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  360e2ad

• Java: add class for Spring request mapping methods that are not default-protected from CSRF

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  39d0d61

• Java: add a class for MyBatis Mapper methods that update a database

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0fec69e

• Java: move contents of MyBatisMapperXML.qll in src to MyBatis.qll in lib so importable, and fix experimental files broken by the move

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  ffad583

• Java: add a class for PreparedStatement methods that update a database

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  5901068

• Java: add a class for methods that update a sql database (found using sql-injection nodes)

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  e027c11

• Java: add CallGraph module for displaying call graph paths

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  e56c792

• Java: add query

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  f9c28fb

• Java: initial tests

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  80acfe4

• Java: handle MyBatis annotations for insert/update/delete

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  30e7336

• Java: add taint-tracking config for execute to exclude FPs from non-update queries like select

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  6c8bbef

• Java: add class for Stapler web methods that are not default-protected from CSRF

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  a8e762b

• Java: add name-based heuristic

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  48c7e17

• Java: update .expected file contents

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  9f0cbc8

• Java: remove exists variable

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  5ed5af6

• Java: remove exists variable in test

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  c417533

• Java: performance fix

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  fd399dd

• Java: update InlineExpectationsTest import for new location

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  801972e

• Java: add change note

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  bfb884c

• Java: qldocs for CallGraph module

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  00c74a1

• Java: Stapler tests and stubs

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  e3283bb

• Java: more database update tests and stubs

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  77a781e

• Java: more name-based heuristic tests to test regex

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  b2d84c6

• Java: some clean-up and refactoring

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  b56a8d8