Max Schaefer
7b7f92c19e
JavaScript: Introduce SSA::definition and SSA::variable.
2019-05-20 16:22:01 +01:00
Max Schaefer
fb744a6c53
JavaScript: Introduce Parameter.getVariable().
2019-05-20 16:01:12 +01:00
Max Schaefer
2cb33f6088
JavaScript: Introduce DataFlow::ExprNode and exprNode for consistency with other languages.
2019-05-20 15:55:03 +01:00
Asger F
87e0831872
JS: Fix flow for nested destructurings
2019-05-20 09:22:02 +01:00
Esben Sparre Andreasen
8256f2e736
Merge pull request #1308 from asger-semmle/exceptional-flow
...
JS: Add flow through exceptions
2019-05-17 08:33:44 +02:00
Asger F
65cbd47a2d
Merge pull request #1314 from xiemaisi/js/fix-hardcoded-pw-fps
...
JavaScript: Further broaden the whitelist in `PasswordInConfigurationFile`.
2019-05-16 14:42:09 +01:00
Asger F
9293010e4c
JS: Fix some FPs in IncorrectSuffixCheck
2019-05-16 10:56:17 +01:00
Asger F
8fe2319a23
JS: Fix lurking cartesian product in Express
2019-05-15 18:07:24 +01:00
Asger F
682f2790cd
JS: Address comments
2019-05-15 10:09:56 +01:00
Asger F
778244878a
JS: Normalize whitespace
2019-05-14 10:31:28 +01:00
Asger F
fd9765b99f
JS: Add qhelp
2019-05-13 17:31:12 +01:00
Asger F
0c715f7540
JS: Lower precision to medium
2019-05-13 15:20:40 +01:00
Asger F
aaf503837d
JS: Move prototype pollution into real query
2019-05-13 15:20:25 +01:00
Asger F
4db7aa6ed2
JS: Relax type inference to account for overriding
2019-05-13 10:18:19 +01:00
Max Schaefer
b478c0ddaa
JavaScript: Further broaden the whitelist in PasswordInConfigurationFile.
2019-05-09 17:07:59 +01:00
semmle-qlci
9653fbd4f7
Merge pull request #1311 from emarteca/unreachableThrows
...
Approved by xiemaisi
2019-05-09 10:37:41 +01:00
Ellen Arteca
a12d12d59a
JavaScript: Update UnreachableStmt query so unreachable throws no longer gives an alert
2019-05-08 16:25:54 +01:00
Asger F
27e8ea85f7
JS: Fix bug from sorting lines
2019-05-08 10:42:14 +01:00
Max Schaefer
c16e9a77f3
JavaScript: Fix a few false positives in PasswordInConfigurationFile.
2019-05-08 08:26:05 +01:00
Asger F
86885f4ff0
JS: Address comments
2019-05-07 18:00:36 +01:00
Asger F
7c9d20ae81
JS: Implement for TrackedNode to maintain consistency
2019-05-07 17:38:43 +01:00
Asger F
a3cf07af7e
JS: Add flow steps through iteration callback
2019-05-07 13:52:31 +01:00
Asger F
1f897b4b63
JS: step through Error constructor and accept the potential FP
2019-05-07 10:11:41 +01:00
Asger F
36cefd8fc6
JS: Track taint through exceptions
2019-05-07 10:11:41 +01:00
semmle-qlci
3f70d91a11
Merge pull request #1288 from xiemaisi/js/fix-end-node-labels
...
Approved by asger-semmle
2019-04-30 07:32:29 +01:00
Max Schaefer
7ca5cc22d8
Merge pull request #1257 from asger-semmle/jsdoc
...
JS: Add common interface between TypeExpr and JSDocTypeExpr
2019-04-29 16:20:17 +01:00
Max Schaefer
8a34ea8b71
Merge pull request #1284 from esben-semmle/js/fix-azure-performance
...
JS: fix azure performance
2019-04-29 13:15:16 +01:00
semmle-qlci
52d6626547
Merge pull request #1242 from esben-semmle/js/whitelist-trailing-newline-removal
...
Approved by xiemaisi
2019-04-29 07:35:15 +01:00
Asger F
3e7bac465b
JS: fix join ordering in SimpleParameter.getJSDocTag
2019-04-26 16:56:04 +01:00
Asger F
db3060d336
JS: Add missing override
2019-04-26 16:56:04 +01:00
Asger F
a17756c3d5
JS: Fix formatting
2019-04-26 16:56:04 +01:00
Asger F
9086dfdc6f
JS: TypeAnnotation.getType() for backwards compatibility
2019-04-26 16:56:04 +01:00
Asger F
e9fcb670ff
JS: Provide source locations for JSDocTypeExpr
2019-04-26 16:56:04 +01:00
Asger F
cf8c327a10
JS: make TypeAnnotation extend Locatable
2019-04-26 16:56:04 +01:00
Max Schaefer
c44f99a204
Update javascript/ql/src/semmle/javascript/Variables.qll
...
Co-Authored-By: asger-semmle <42069257+asger-semmle@users.noreply.github.com >
2019-04-26 16:56:04 +01:00
Asger F
6eb8c692b1
JS: Add partial backwards compatibility with ASTNode
2019-04-26 16:56:04 +01:00
Asger F
c9c9a32a37
JS: hasQualifiedName
2019-04-26 16:56:04 +01:00
Asger F
454fff1398
JS: Implement getAnUnderlyingType().
2019-04-26 16:56:04 +01:00
Asger F
8458a64642
JS: implement isXXX methods in JSDocTypeExpr classes
2019-04-26 16:56:04 +01:00
Asger F
c92a6b72b5
JS: Update getTypeAnnotation() to return TypeAnnotations
2019-04-26 16:56:04 +01:00
Asger F
be5d90d4e7
JS: Make use of JSDocParamTag
2019-04-26 16:56:04 +01:00
Asger F
967752c6c1
JS: Add TypeAnnotations class
2019-04-26 16:56:04 +01:00
Max Schaefer
e2666a9203
Update javascript/ql/src/semmle/javascript/frameworks/SocketIO.qll
...
Co-Authored-By: esben-semmle <42067045+esben-semmle@users.noreply.github.com >
2019-04-26 11:58:40 +02:00
Esben Sparre Andreasen
27f88c38ac
JS: help the optimizer with NPMPackage/File relations
2019-04-26 11:49:07 +02:00
semmle-qlci
3231b60e6b
Merge pull request #1272 from asger-semmle/access-path-capture
...
Approved by xiemaisi
2019-04-25 11:32:54 +01:00
Asger F
47ba7d3004
Merge pull request #1278 from xiemaisi/js/symbolic-constants
...
JavaScript: Generalise `ConstantComparison` sanitisers.
2019-04-25 11:17:22 +01:00
Max Schaefer
a8470a984a
JavaScript: Generalise ConstantComparison sanitisers.
...
In addition to treating comparisons with literals as sanitisers, we now
also treat comparisons with variables that have a single assignment as
sanitisers.
Proving that such a variable is actually a constant is not easy, but for
this use case a simple approximation works fine.
2019-04-25 07:38:31 +01:00
semmle-qlci
a504ad4261
Merge pull request #1270 from xiemaisi/odasa/7904
...
Approved by esben-semmle
2019-04-24 21:50:07 +01:00
Asger F
a16753c125
JS: Add documentation
2019-04-24 10:12:55 +01:00
Max Schaefer
465be47574
JavaScript: Only follow level flow steps when summarising functions.
...
It is not only wasteful to consider paths with unmatched calls/returns,
but also wrong; see test case in next commit.
2019-04-23 13:16:30 +01:00
