Code

[DRAFT] Java: add CSRF query#18288

Code

Draft

jcogs33 wants to merge 22 commits intogithub:maingithub/codeql:mainfrom jcogs33:jcogs33/csrf-unprotected-request-typejcogs33/codeql:jcogs33/csrf-unprotected-request-typeCopy head branch name to clipboard

+1,460-120

Commits

Commits on Dec 18, 2024

• Java: add qhelp

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  ce505b9

• Java: add class for Spring request mapping methods that are not default-protected from CSRF

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  d086c9f

• Java: add a class for MyBatis Mapper methods that update a database

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  b457461

• Java: move contents of MyBatisMapperXML.qll in src to MyBatis.qll in lib so importable, and fix experimental files broken by the move

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  7451777

• Java: add a class for PreparedStatement methods that update a database

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  77fb4d1

• Java: add a class for methods that update a sql database (found using sql-injection nodes)

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  186afe0

• Java: add CallGraph module for displaying call graph paths

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  ffbd5f3

• Java: add query

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  3ecfc59

• Java: initial tests

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  3693b9d

• Java: handle MyBatis annotations for insert/update/delete

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  76f7976

• Java: add taint-tracking config for execute to exclude FPs from non-update queries like select

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  89fab60

• Java: add class for Stapler web methods that are not default-protected from CSRF

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  6336c77

• Java: add name-based heuristic

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  3331fe3

• Java: update .expected file contents

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  50225ec

• Java: remove exists variable

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  6450572

• Java: remove exists variable in test

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  45ad3aa

• Java: performance fix

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  ee467b8

• Java: update InlineExpectationsTest import for new location

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  4223314

• Java: add change note

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  9ae4667

• Java: qldocs for CallGraph module

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  c213533

• Java: Stapler tests and stubs

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  a4b5584

• Java: more database update tests and stubs

  

  Jami Cogswell

  authored and

  Jami Cogswell

  committed
  2472aad