On Saturday 30 May 2020 06:40:10 CEST, Jim DeLaHunt wrote:
If CodeQL queries can do that sort of detection, then it seems to me we might be able to get queries written that detect which URL or domain name class a Java program uses. Or we might be able to detect that an email address is compared to a regular expression. Or perhaps other UA-obstructing behaviour. Might the Technology WG want to take on the task of figuring out how to get the queries written?
FYI, in the case of a Java program no CodeQL is necessary. unzip -l /path/to/program.jar lists the classes, not necessarily completely but typically complete enough for this particular use. Or if you have source code but cannot or don't want to build the program, running either 'mvn dependency:tree' or 'gradle dependencies' in the root directory list what's used (if neither of those work, the program is vanishingly unlikely to support any EAI anyway). Arnt