Code

Java: add CSRF query#18288

Code

Merged

jcogs33 merged 38 commits intogithub:maingithub/codeql:mainfrom jcogs33:jcogs33/csrf-unprotected-request-typejcogs33/codeql:jcogs33/csrf-unprotected-request-typeCopy head branch name to clipboardFeb 11, 2025

+1,654-4

Commits

Commits on Jan 30, 2025

• Java: add qhelp

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0c69253

  Copy full SHA for 0c69253

• Java: add class for Spring request mapping methods that are not default-protected from CSRF

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  506d668

  Copy full SHA for 506d668

• Java: add a class for MyBatis Mapper methods that update a database

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  8e9f21d

  Copy full SHA for 8e9f21d

• Java: move contents of MyBatisMapperXML.qll in src to MyBatis.qll in lib so importable, and fix experimental files broken by the move

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  b88731d

  Copy full SHA for b88731d

• Java: add a class for PreparedStatement methods that update a database

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  43a2880

  Copy full SHA for 43a2880

• Java: add a class for methods that update a sql database (found using sql-injection nodes)

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  87a8746

  Copy full SHA for 87a8746

• Java: add CallGraph module for displaying call graph paths

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  c553e31

  Copy full SHA for c553e31

• Java: add query

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  178b032

  Copy full SHA for 178b032

• Java: initial tests

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  df77d49

  Copy full SHA for df77d49

• Java: handle MyBatis annotations for insert/update/delete

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  97aaf4c

  Copy full SHA for 97aaf4c

• Java: add taint-tracking config for execute to exclude FPs from non-update queries like select

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0f39011

  Copy full SHA for 0f39011

• Java: add class for Stapler web methods that are not default-protected from CSRF

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  286c655

  Copy full SHA for 286c655

• Java: add name-based heuristic

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  39ccde0

  Copy full SHA for 39ccde0

• Java: update .expected file contents

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  c9ad15c

  Copy full SHA for c9ad15c

• Java: remove exists variable

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  48d1fe0

  Copy full SHA for 48d1fe0

• Java: remove exists variable in test

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  ede9e78

  Copy full SHA for ede9e78

• Java: performance fix

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  48d55ec

  Copy full SHA for 48d55ec

• Java: update InlineExpectationsTest import for new location

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  fa27689

  Copy full SHA for fa27689

• Java: add change note

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  27aa9c9

  Copy full SHA for 27aa9c9

• Java: qldocs for CallGraph module

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  26b7c1a

  Copy full SHA for 26b7c1a

• Java: Stapler tests and stubs

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  3bf6dc2

  Copy full SHA for 3bf6dc2

• Java: more database update tests and stubs

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0ab3768

  Copy full SHA for 0ab3768

• Java: more name-based heuristic tests to test regex

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  d4114f6

  Copy full SHA for d4114f6

• Java: some clean-up and refactoring

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  20e8eb4

  Copy full SHA for 20e8eb4

• Java: rename getMethod to getMethodValue

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0462425

  Copy full SHA for 0462425

• Java: use two negations

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  8173fd0

  Copy full SHA for 8173fd0

• Java: refactor into canTargetDatabaseUpdateMethod

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  530a77e

  Copy full SHA for 530a77e

• Java: refactor unprotectedDatabaseUpdate

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  f3721eb

  Copy full SHA for f3721eb

• Java: precision to medium

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  096f6f8

  Copy full SHA for 096f6f8

• Java: expand qhelp, include Stapler examples

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  ead224c

  Copy full SHA for ead224c

• Java: narrow query

  Show description for 530103e
  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  530103e

  Copy full SHA for 530103e

• Java: minor qhelp update

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  577152e

  Copy full SHA for 577152e

• Java: resolve merge conflict

  Show description for 0071e1a
  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0071e1a

  Copy full SHA for 0071e1a

Commits on Feb 3, 2025

• Java: qhelp wording updates

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  516df3b

  Copy full SHA for 516df3b

Commits on Feb 4, 2025

• Java: minor qhelp updates

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  283c3b1

  Copy full SHA for 283c3b1

• Java: rewrite qhelp overview section; aligns with overview section used by Python and Ruby

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  f438282

  Copy full SHA for f438282

• Java: remove token section from qhelp overview

  Show description for 0367846
  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  0367846

  Copy full SHA for 0367846

Commits on Feb 5, 2025

• Java: minor qhelp updates

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  c6a71cd

  Copy full SHA for c6a71cd