Commits

Breadcrumbs

History for

on50497eb

User selector

All users

All time

Commit History

Commits on Jul 28, 2021

• Make imports as private as possible

  artem-smotrakov

  committed
  50497eb

  Copy full SHA for 50497eb

Commits on Jul 20, 2021

• Import UnsafeDeserializationQuery in unsafeDeserialization.ql

  artem-smotrakov

  committed
  158a75e

  Copy full SHA for 158a75e

Commits on Jul 19, 2021

• Make UnsafeDeserializationSink public

  artem-smotrakov

  committed
  47e4cf4

  Copy full SHA for 47e4cf4

• Refactored libs for unsafe deserialization

  artem-smotrakov

  committed
  035f7ac

  Copy full SHA for 035f7ac

• Apply suggestions from code review

  Show description for e025307
  

  artem-smotrakov

  and

  smowton

  committed
  e025307

  Copy full SHA for e025307

Commits on Jul 16, 2021

• Merge branch 'unsafe-jackson-deserialization' of github.com:artem-smotrakov/ql into unsafe-jackson-deserialization

  artem-smotrakov

  committed
  c367c7e

  Copy full SHA for c367c7e

• Refactored the query for unsafe deserialization

  artem-smotrakov

  committed
  6d7cb48

  Copy full SHA for 6d7cb48

Commits on Jul 13, 2021

• Apply suggestions from code review

  Show description for 1b3516a
  

  artem-smotrakov

  and

  smowton

  authored
  1b3516a

  Copy full SHA for 1b3516a

Commits on Jul 12, 2021

• Removed fromSource() check in looksLikeResolveClassStep()

  artem-smotrakov

  committed
  09ae779

  Copy full SHA for 09ae779

Commits on Jul 9, 2021

• Better taint propagation in UnsafeTypeConfig

  artem-smotrakov

  committed
  c98f1a4

  Copy full SHA for c98f1a4

• Added comments for Jackson in UnsafeDeserialization.qll

  artem-smotrakov

  committed
  476843a

  Copy full SHA for 476843a

• Minor improvements for Jackson in UnsafeDeserialization.qll

  artem-smotrakov

  committed
  e9731cd

  Copy full SHA for e9731cd

• Removed getAnAccess() calls for Jackson

  artem-smotrakov

  committed
  24e4b68

  Copy full SHA for 24e4b68

• Added tests for UnsafeDeserialization.ql and Jackson

  artem-smotrakov

  committed
  aefd210

  Copy full SHA for aefd210

• Added Jackson to UnsafeDeserialization.qhelp

  artem-smotrakov

  committed
  ea0991c

  Copy full SHA for ea0991c

• Cover attacker-controlled types for deserialization with Jackson

  artem-smotrakov

  committed
  97fca62

  Copy full SHA for 97fca62

• First draft of sinks for unsafe deserialization with Jackson

  artem-smotrakov

  committed
  3eb2af1

  Copy full SHA for 3eb2af1

Commits on Jul 2, 2021

• Deduplicate Jexl configuration

  smowton

  committed
  a51154a

  Copy full SHA for a51154a

• Add docs to RandomQuery.qll

  smowton

  committed
  bbd3ecb

  Copy full SHA for bbd3ecb

• Split Android XSS sink defintions out of XSS.qll

  Show description for e661fc0
  smowton

  committed
  e661fc0

  Copy full SHA for e661fc0

• Split up JexlInjection.qll

  Show description for 747a8e4
  smowton

  committed
  747a8e4

  Copy full SHA for 747a8e4

• Split up Random.qll

  Show description for 643f7df
  smowton

  committed
  643f7df

  Copy full SHA for 643f7df

• Merge pull request #5487 from joefarebrother/sql-sinks

  Show description for 80124df
  aschackmull

  authored
  80124df

  Copy full SHA for 80124df

• Merge pull request #6202 from smowton/smowton/admin/cleanup-duplicated-experimental-query

  Show description for 4e1155c
  aschackmull

  authored
  4e1155c

  Copy full SHA for 4e1155c

• Merge pull request #6185 from aschackmull/java/perf-fix-request-forgery

  Show description for f9da044
  aschackmull

  authored
  f9da044

  Copy full SHA for f9da044

Commits on Jul 1, 2021

• Merge pull request #5408 from p0wn4j/urlclassloader-webclient-ssrf-sinks

  Show description for 8b7db8a
  smowton

  authored
  8b7db8a

  Copy full SHA for 8b7db8a

• Deduplicate shared body of regular and experimental versions of `java/command-line-injection` query.

  smowton

  committed
  d5a9f3d

  Copy full SHA for d5a9f3d

• Remove ArrayElement from sink specifications

  joefarebrother

  committed
  160f3b4

  Copy full SHA for 160f3b4

• Use ArrayElement of to handle arargs case in SpringJdbc.qll

  joefarebrother

  committed
  1a06c13

  Copy full SHA for 1a06c13

• Use ArrayElementOf in Android sinks

  joefarebrother

  committed
  29f82fc

  Copy full SHA for 29f82fc

• Include overrides for SQLiteQueryBuilder sinks

  joefarebrother

  committed
  95d8018

  Copy full SHA for 95d8018

• Use Argument ranges in CSV rows

  joefarebrother

  committed
  0d4f8ae

  Copy full SHA for 0d4f8ae

• Convert SQL sinks to CSV format

  joefarebrother

  committed
  7926d16

  Copy full SHA for 7926d16

• Merge pull request #5590 from github/sauyon/java-spring-errors

  Show description for cda5c22
  aschackmull

  authored
  cda5c22

  Copy full SHA for cda5c22

• Merge pull request #6165 from edoardopirovano/fix-regression

  Show description for 37f8794
  aschackmull

  authored
  37f8794

  Copy full SHA for 37f8794