semmle-qlci
3b126d9c4e
Merge pull request #1488 from asger-semmle/call-graph-metric
...
Approved by xiemaisi
2019-07-01 16:09:34 +01:00
Max Schaefer
895055f30e
JavaScript: Avoid unhelpful magic.
...
The constraint `exists(callback.getParameter(i))` was getting pushed into `higherOrderCall`, which isn't a bad thing to do. However, this then led to a join on `i`, which is a very bad thing to do.
2019-07-01 15:45:57 +01:00
Max Schaefer
b5b89c0eac
JavaScript: Track flow into method receivers.
2019-07-01 15:45:57 +01:00
Esben Sparre Andreasen
062778bdd8
JS: heuristically recognize x.spec.y and x.test.y as test files
2019-07-01 15:49:17 +02:00
Esben Sparre Andreasen
7cab308205
fixup! JS: classify numeric file names as generated
2019-07-01 15:49:03 +02:00
Asger F
ff4d6ece80
JS: Rename metrics to ResolvableCallX
2019-07-01 12:34:48 +01:00
Asger F
16e6dd12d0
JS: Address review comments part 1
2019-07-01 12:30:51 +01:00
Esben Sparre Andreasen
41e568d1f7
JS: classify files with many short variables as minified
2019-07-01 13:25:07 +02:00
Esben Sparre Andreasen
2eb7e4a818
JS: classify x.test.js files with test(...) calls as jest tests
2019-07-01 10:28:10 +02:00
Esben Sparre Andreasen
5ebcef41fa
JS: classify numeric file names as generated
2019-07-01 10:25:38 +02:00
Max Schaefer
3c3422e221
JavaScript: Refactor unpromoted-candidate queries to no longer rely on tracked nodes.
2019-06-28 10:25:23 +01:00
Max Schaefer
ff62c56df1
JavaScript: Replace remaining uses of TrackedExpr with type tracking.
2019-06-28 09:21:41 +01:00
Max Schaefer
b3e8103dce
JavaScript: Track flow through property getter functions.
2019-06-28 08:51:27 +01:00
Max Schaefer
1c175cbe71
JavaScript: Rename loadStep to basicLoadStep.
2019-06-28 08:51:27 +01:00
Asger F
8f4228b7c3
JS: Ignore RemoteFlowSource case due to bad join ordering
2019-06-27 12:23:07 +01:00
semmle-qlci
44bd540c44
Merge pull request #1495 from asger-semmle/array-taint-step
...
Approved by xiemaisi
2019-06-27 12:16:17 +01:00
semmle-qlci
1a9f3624c2
Merge pull request #1504 from xiemaisi/js/shift-bigint
...
Approved by asger-semmle
2019-06-26 18:30:48 +01:00
Max Schaefer
e35fde322b
JavaScript: Teach ShiftOutOfRange about BigInt.
2019-06-26 09:16:34 -07:00
Asger F
102fd11e8d
JS: Change to queries of @kind metric
2019-06-25 22:12:11 +01:00
Asger F
71100bb68a
JS: Do not require predecessor to be a SourceNode
2019-06-25 14:03:57 +01:00
Chris Gavin
bce153648e
JavaScript: Update link to the OWASP XSS prevetion cheat sheet.
2019-06-24 23:21:14 +01:00
Asger F
207ed1e14a
JS: Add query for measuring call graph quality
2019-06-24 01:01:13 +01:00
Max Schaefer
4370f25b32
JavaScript: Remove dependency of module import on globalVarRef.
2019-06-20 21:08:34 +01:00
Ellen Arteca
99c32f08fb
JavaScript: Recognize imports from TypeScript type annotations
2019-06-20 10:45:30 +01:00
Mark Shannon
77030c4dde
Merge branch 'rc/1.21' into 'master'
2019-06-13 12:32:45 +01:00
semmle-qlci
8a43fdc806
Merge pull request #1448 from xiemaisi/js/fix-access-paths-perf-regression
...
Approved by esben-semmle
2019-06-13 10:13:27 +01:00
semmle-qlci
bffc3307b5
Merge pull request #1450 from esben-semmle/js/classify-json-js-as-generated
...
Approved by xiemaisi
2019-06-13 09:45:37 +01:00
semmle-qlci
913544600a
Merge pull request #1449 from xiemaisi/js/fix-http-response-sink-perf-regression
...
Approved by esben-semmle
2019-06-12 21:36:23 +01:00
Max Schaefer
60964efce5
JavaScript: Avoid bad context pushing in ReflectedXss::HttpResponseSink.
2019-06-12 16:20:35 +01:00
Esben Sparre Andreasen
6e022f66c4
JS: formatting of Express and NodeJSLib.qll
2019-06-12 12:45:01 +02:00
Esben Sparre Andreasen
59b7b0757a
JS: make Express' res/req extend Node's res/req
2019-06-12 12:45:01 +02:00
Esben Sparre Andreasen
29f9103b39
JS: classify single-line JSON files as generated
2019-06-12 09:05:12 +02:00
semmle-qlci
7790ac45bd
Merge pull request #1409 from esben-semmle/js/more-command-injection
...
Approved by xiemaisi
2019-06-11 11:59:18 +01:00
Esben Sparre Andreasen
299d4c6e93
JS: add additional SystemCommandExecutors
2019-06-11 09:38:10 +02:00
Max Schaefer
b32a037ff2
JavaScript: Refactor a few access path computation predicates.
2019-06-10 11:15:52 +01:00
Max Schaefer
16c33b54b6
JavaScript: Recognise references to the process global.
2019-06-06 11:48:18 +01:00
Max Schaefer
d233cea79d
JavaScript: Lower precision of PasswordInConfigurationFile.
...
In spite of recent improvements, this query is still too noisy to show
by default.
2019-06-05 08:09:19 +01:00
Max Schaefer
d723ab76d8
JavaScript: Fix getDelimiterMatchingRegexp to work on multi-line strings.
2019-06-05 08:09:19 +01:00
Max Schaefer
a4876270ec
JavaScript: Tweak PasswordInConfigurationFile alerts.
...
Only highlight first line, and include the password in the alert
message.
2019-06-05 08:09:19 +01:00
Max Schaefer
c09b859aa7
JavaScript: Add three missing @metricType annotations.
2019-06-04 17:17:14 +01:00
semmle-qlci
1fa975b4c9
Merge pull request #1393 from xiemaisi/js/concretify
...
Approved by esben-semmle
2019-06-04 11:34:47 +01:00
semmle-qlci
80ff63a3bb
Merge pull request #1387 from esben-semmle/js/unanchored-url-regex
...
Approved by mc-semmle, xiemaisi
2019-06-03 17:27:08 +01:00
Esben Sparre Andreasen
04868e5b97
JS: format qhelp examples
2019-06-03 17:05:19 +02:00
Esben Sparre Andreasen
9e0a97e82f
JS: address qhelp review comments
2019-06-03 16:39:39 +02:00
Esben Sparre Andreasen
bf51c54338
JS: add RegExpPatternSource::getAParse to hide the subclasses
2019-06-03 14:23:22 +02:00
Esben Sparre Andreasen
7b652214c5
JS: address docstring comments
2019-06-03 13:59:39 +02:00
Max Schaefer
d8a101df6d
JavaScript: Shrink Configurations.qll some more.
2019-06-03 10:32:25 +01:00
Esben Sparre Andreasen
14644270ac
JS: fix comment typo
2019-06-03 08:32:35 +02:00
Esben Sparre Andreasen
7018a38691
JS: improve tests and regexp for js/regex/missing-regexp-anchor
2019-06-03 08:29:52 +02:00
Esben Sparre Andreasen
3289c629f7
JS: address minor review comments
2019-06-03 08:29:52 +02:00
