feat(rules): Add security rules and sanitizers#153

Draft

misonijnik wants to merge 40 commits into

mainfrom

misonijnik/codeql-rules

Commits on May 18, 2026

More Java/Kotlin rules

dvvrd
authored and
misonijnik
committed
Wire missing -in-servlet-app/-in-spring-app rules and add CodeQL sanitizers
misonijnik
committed
Add CodeQL-aligned LDAP/SSRF/XSS sanitizers and exercising negative tests
misonijnik
committed
Add minimal repros for analyzer FN gaps + the propagators that fix them
misonijnik
committed
Add JVM-level regression tests for pattern-matcher behaviours touched by rules/test FNs
misonijnik
committed
Add Servlet API propagators + widen servlet entry-point pattern
misonijnik
committed
Drive rules/test FN from 281 to 7 with CI-style JVM flags
misonijnik
committed
Add CodeQL-aligned barriers with test bank for path, ssrf, ldap, log, xss, cmd
misonijnik
committed
More CodeQL-aligned barriers: XPath, SSTI, deser, log line-breaks, reflection
misonijnik
committed
Add SMTP CRLF, unvalidated-redirect, and Spring/XSS barrier sanitizers
misonijnik
committed
Add ValidatingObjectInputStream deserialization barrier test
misonijnik
committed
More XSS encoder barriers: Apache escapeEcmaScript, OWASP ESAPI suite
misonijnik
committed
Extend response-injection barriers to match XSS encoder set
misonijnik
committed
Extend spring-response-injection barriers to match XSS encoder set
misonijnik
committed
Add CodeQL external barrierModel sanitizers: File.getName + ESAPI Validator
misonijnik
committed
Treat URL encoders as CRLF/http-response-splitting barriers
misonijnik
committed
Add Jenkins hudson.Util.escape as XSS / response-injection barrier
misonijnik
committed
Drop ESAPI Validator.getValidURI — not in current ESAPI surface
misonijnik
committed
Add pixee java-security-toolkit barriers: HtmlEncoder, Newlines
misonijnik
committed
Add pixee Urls.create as SSRF barrier
misonijnik
committed
Add pixee Urls.create as unvalidated-redirect barrier
misonijnik
committed
Add pixee deser + reflection barriers
misonijnik
committed
Drop runCommandAsString sanitizer (not in pixee 1.2.3 API)
misonijnik
committed
Add pixee jakarta.PathValidator.validateDispatcherPath as url-forward barrier
misonijnik
committed
Eliminate remaining 7 FN by fixing sink + propagator gaps
misonijnik
committed
Revert propagators
misonijnik
committed
Remove rule tests
misonijnik
committed
Polish rules: dedupe, fix typos, consolidate provenance
misonijnik
committed
Activate rule-test suite end-to-end: rename test IDs, add propagators
misonijnik
committed
ssrf-sinks: add inline URL/URI wrapper variants for 9 missing sinks
misonijnik
committed
ssrf-sinks: refactor URL/URI wrappers into pattern-inside let-bindings
misonijnik
committed
ssrf-sinks: chain pattern-inside let-bindings via shared metavars
misonijnik
committed
ssrf-sinks: collapse builder-chain steps into a single multi-line pattern
misonijnik
committed
ssrf-sinks: document why `$_` is the .uri/.url receiver
misonijnik
committed
ssrf-sinks: use literal `new Request.Builder()` for OkHttp, keep `$_` for HttpRequest
misonijnik
committed
opentaint-config: split third-party propagators into per-jar files
misonijnik
committed

Commits on May 20, 2026

ssrf-sinks: bind HttpRequest newBuilder() receiver via $NEW_BUILDER
misonijnik
committed

Commits on May 22, 2026