Java: CWE-200: Temp directory local information disclosure vulnerability - #4388

Merged

smowton merged 39 commits into

github:mainfrom

JLLeitschuh:feat/JLL/java/CWE-200_temp_directory_local_information_disclosure

Feb 14, 2022

Commits on Feb 4, 2022

Java: CWE-200: Temp directory local information disclosure vulnerability
JLLeitschuh
committed
3a15678
Add TempDir taint tracking for Files.write
JLLeitschuh
committed
cf0ed81
Add mkdirs check
JLLeitschuh
committed
ecad753
Add `java.nio.file.Files` API checks
JLLeitschuh
committed
bc12e99
Temp Dir Info Disclosure: Final pass and add documentation
JLLeitschuh
committed
13fed0e
Apply suggestions from code review

JLLeitschuh
and
aibaars
committed
e4c017e
Remove path flow tracking in 'TempDirLocalInformationDisclosureFromMethodCall'
JLLeitschuh
committed
f910fd4
Apply suggestions from code review

JLLeitschuh
and
felicitymay
committed
7929fae
Apply suggestions from code review

JLLeitschuh
and
felicitymay
committed
41b5011
Fix file names and formatting from PR feedback
JLLeitschuh
committed
f6067d2
Add release notes for "Temporary Directory Local information disclosure"
JLLeitschuh
committed
c19f52c
Apply suggestions from code review

JLLeitschuh
and
aschackmull
committed
7e55c92
Add QLdoc to TempDirUtils
JLLeitschuh
committed
6683198
Revert changes to MethodAccessSystemGetProperty
JLLeitschuh
committed
df716cb
Update java/ql/src/Security/CWE/CWE-200/TempDirUtils.qll

JLLeitschuh
and
aschackmull
committed
cb30385
Add QLdoc and fix Compiler Errors in Tests
JLLeitschuh
committed
7e514e9
Autoformat TempDirUtils.qll

smowton
authored and
JLLeitschuh
committed
e795823
Apply suggestions from code review

JLLeitschuh
and
smowton
committed
a8d25b6
Apply suggestions from code review

JLLeitschuh
and
smowton
committed
a4b5573
Apply suggestions from code review

JLLeitschuh
and
smowton
committed
f7a4aac
Fixup documentation/code from PR feedback
JLLeitschuh
committed
d5c9af3
Fix test failures TempDirLocalInformationDisclosureFromSystemProperty
JLLeitschuh
committed
79db76d
Fix the formatting in TempDirLocalInformationDisclosureFromMethodCall
JLLeitschuh
committed
0a621c2
Add information disclosure test fix suggestions
JLLeitschuh
committed
9299c79
Add file creation sanitizer
JLLeitschuh
committed
0268dd9
Update to new change note format
JLLeitschuh
committed
1f47ea5

Commits on Feb 7, 2022

Combine CWE-200 queries

smowton
authored and
JLLeitschuh
committed
de38638
Post refactor fixiup
JLLeitschuh
committed
c4112e6

Commits on Feb 8, 2022

Apply suggestions from code review
smowton
authored
7965459
Fix test requirements, formatting
smowton
committed
a6596ea
Consider calls to setReadable(false, false) then setReadable(true, true) to be safe
JLLeitschuh
committed
7f46640

Commits on Feb 9, 2022

Update java/ql/src/Security/CWE/CWE-200/TempDirLocalInformationDisclosure.ql

JLLeitschuh
and
smowton
authored
787e3da
Fix FP from mkdirs call on exact temp directory
JLLeitschuh
committed
49a7367

Commits on Feb 10, 2022

Apply suggestions from code review

JLLeitschuh
and
smowton
authored
bafcce1
Fix test failure for TempDirLocalInformationDisclosure
JLLeitschuh
committed
eee521e

Commits on Feb 14, 2022