Esben Sparre Andreasen
b90dd89746
JS: move js/resource-exhaustion to experimental
2021-01-21 09:09:01 +01:00
Esben Sparre Andreasen
9e3cc3b1b2
JS: add qhelp and changenotes for js/server-crash
2021-01-21 08:43:13 +01:00
Erik Krogh Kristensen
a44aefa6c9
add test for top-level closure modules - and simplify
2021-01-20 19:47:32 +01:00
Erik Krogh Kristensen
bf518f1c90
flag less overly general functions with js/unneeded-defensive-code
2021-01-20 15:48:12 +01:00
Erik Krogh Kristensen
2e024c3c61
fix that type inference assumed every compound-assignment have type number
2021-01-20 15:26:39 +01:00
Erik Krogh Kristensen
fbfbe70deb
add support for unnamed/default exports in PackageExports.qll
2021-01-19 22:40:45 +01:00
CodeQL CI
bdfb81064d
Merge pull request #4969 from asgerf/js/angular-dom-santizier-from-core
...
Approved by erik-krogh
2021-01-19 08:45:15 -08:00
Erik Krogh Kristensen
2a8a2832e2
Merge pull request #4946 from erik-krogh/libRedos
...
JS: Add library input as source for `js/polynomial-redos`
2021-01-19 17:30:20 +01:00
Esben Sparre Andreasen
3015dcd310
JS: reformulate js/server-crash. Support promises and shorter paths.
2021-01-19 09:08:52 +01:00
Erik Krogh Kristensen
01900d7ca2
remove false positive due to "\n" not being in the relevant relation
2021-01-18 14:47:29 +01:00
CodeQL CI
fc2fe6cccb
Merge pull request #4928 from esbena/js/rewrite-multi-sanitization
...
Approved by asgerf
2021-01-18 05:11:42 -08:00
Asger Feldthaus
d8c9dba990
JS: Autoformat
2021-01-18 12:19:09 +00:00
Asger Feldthaus
5f4016be76
JS: Cache Import.getImportedModule
2021-01-18 12:19:09 +00:00
Asger Feldthaus
c5f2c04f16
JS: Add upgrade script
2021-01-18 12:19:09 +00:00
Asger Feldthaus
44c5d36e83
JS: Simple RxJS model
2021-01-18 12:19:09 +00:00
Asger Feldthaus
00cd0644f0
JS: Implement getAResponseDataNode
2021-01-18 12:19:09 +00:00
Asger Feldthaus
2f3cef177b
JS: More steps in Angular2 model
2021-01-18 12:19:09 +00:00
Asger Feldthaus
2ba98da107
JS: Only extract local vars in TemplateTopLevel
...
Angular template expressions cannot refer to global variables, any
unqualified identifier is a reference to a property provided by the
component.
We extract them as implicitly declared local variables which the
QL model can then connect with data flow steps.
2021-01-18 12:19:08 +00:00
Asger Feldthaus
3c0867125b
JS: Remove FP in TargetBlank
2021-01-18 12:19:08 +00:00
Asger Feldthaus
898d22d2f4
JS: Simplify HTML element access
2021-01-18 12:19:08 +00:00
Asger Feldthaus
f24af58a60
JS: Extract mapping from HTML node to parent Expression
2021-01-18 12:19:08 +00:00
Asger Feldthaus
3b666a5646
JS: Extract mapping from TopLevel to parent HTML node
2021-01-18 12:19:08 +00:00
Asger Feldthaus
8848ee2d10
JS: Extract HTML from inline templates
2021-01-18 12:19:08 +00:00
Asger Feldthaus
1ab36dc81f
JS: Flow through *ngFor loops
2021-01-18 12:19:08 +00:00
Asger Feldthaus
d80313be4f
JS: Model pipe classes
2021-01-18 12:18:27 +00:00
Asger Feldthaus
debb5691a1
JS: Make PipeRefExpr a SourceNode
2021-01-18 12:18:27 +00:00
Asger Feldthaus
fcb8124376
JS: Expose data flow node for field declaration
2021-01-18 12:18:26 +00:00
Asger Feldthaus
9ee893c9c1
JS: Add data flow steps in Angular2 model
2021-01-18 12:16:13 +00:00
Asger Feldthaus
b1d45a6773
JS: Mark angular pipe refs as incomplete
2021-01-18 12:16:13 +00:00
Asger Feldthaus
16a2a60b9a
JS: Add AngularPipeRef
2021-01-18 12:16:13 +00:00
Asger Feldthaus
ff1d0cc4c7
JS: Recognize DomSanitizer from @angular/core
2021-01-18 10:54:27 +00:00
Erik Krogh Kristensen
26783b6ab0
make getTopmostPackageJSON public again, and update PackageExports test
2021-01-15 16:05:49 +01:00
Erik Krogh Kristensen
1506ac09e5
limit the number of characters produced by getAThreewayIntersect
2021-01-15 13:54:16 +01:00
Erik Krogh Kristensen
0117a0fac1
specialize the getAValueExportedBy predicate to only topmost package.jsons
2021-01-15 13:54:16 +01:00
Erik Krogh Kristensen
0c9d46a7f9
changes based on review
...
Co-authored-by: Esben Sparre Andreasen <esbena@github.com >
2021-01-15 13:54:05 +01:00
Erik Krogh Kristensen
c5595f4cbd
improve alert message for js/polynomial-redos
2021-01-14 13:48:26 +01:00
Erik Krogh Kristensen
86e33d9d79
select the shortest possible reason
2021-01-14 13:38:37 +01:00
Erik Krogh Kristensen
03d8aeb7b6
refactor PolynomialBackTrackingTerm, to allow getting the pump string and the prefix-message
2021-01-14 13:35:32 +01:00
Erik Krogh Kristensen
a520a51d42
highlight the use of the regular expression, instead of the sink for user input
2021-01-14 11:22:20 +01:00
Erik Krogh Kristensen
e8ea720650
adjust description to not mention user-provided values
2021-01-14 10:36:10 +01:00
CodeQL CI
4229f556cb
Merge pull request #4751 from erik-krogh/logInjection
...
Approved by asgerf, mchammer01
2021-01-14 00:32:46 -08:00
Esben Sparre Andreasen
12b985be87
Update javascript/ql/src/Security/CWE-730/ServerCrash.ql
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2021-01-13 14:49:29 +01:00
Erik Krogh Kristensen
c98dacf842
changes based on doc review
2021-01-13 10:38:19 +01:00
Erik Krogh Kristensen
d71adff079
dont sanitize global replacements where the regexp is a char class
2021-01-13 10:12:12 +01:00
Esben Sparre Andreasen
d591c519a8
JS: reformulate js/server-crash as a path problem
2021-01-13 00:08:28 +01:00
Erik Krogh Kristensen
0a17b04650
refactor copy-pasted code into getAnLibraryInputParameter
2021-01-12 20:21:37 +01:00
Erik Krogh Kristensen
eaee5c2d87
add library input as source for js/polynomial-redos
2021-01-12 20:21:33 +01:00
Esben Sparre Andreasen
3c9c79a550
JS: remove flow labels from js/resource-exhaustion
2021-01-12 13:20:20 +01:00
Esben Sparre Andreasen
5965035c09
JS: add query js/resource-exhaustion
2021-01-12 13:20:20 +01:00
CodeQL CI
1c8547c897
Merge pull request #4774 from erik-krogh/forms
...
Approved by asgerf
2021-01-12 02:01:38 -08:00
