Max Schaefer
aeda2d68f8
JavaScript: Introduce localTaintStep predicate.
...
It's sometimes useful for exploratory queries, and the other languages have it as well.
2019-12-02 09:43:08 +00:00
Jonas Jensen
5b24b1efc3
Merge remote-tracking branch 'upstream/rc/1.23' into mergeback-20191202
...
Conflicts solved:
javascript/extractor/src/com/semmle/js/extractor/Main.java
javascript/ql/test/query-tests/Statements/UseOfReturnlessFunction/tst.js
2019-12-02 09:57:34 +01:00
Erik Krogh Kristensen
c6c1ebe81a
Merge remote-tracking branch 'upstream/master' into typeAheadSink
2019-12-02 08:41:49 +01:00
Max Schaefer
f958916c76
Merge pull request #2330 from erik-krogh/exceptionXss
...
JS: Added query for detecting XSS that happens through an exception
2019-11-29 09:04:45 +00:00
semmle-qlci
73e08eba43
Merge pull request #2468 from max-schaefer/js/regexp-predecessor
...
Approved by asgerf
2019-11-28 16:57:31 +00:00
Max Schaefer
7487c79271
JavaScript: Add missing qldoc.
2019-11-28 15:54:52 +00:00
Max Schaefer
47cbf0bf88
JavaScript: Override Locatable.getLocation() for @files.
2019-11-28 15:54:03 +00:00
Max Schaefer
a788bf87a0
JavaScript: Fix RegExpTerm.getPredecessor and getSuccessor.
...
These were originally meant to give you the term that is textually matched right before/right after the receiver. When I introduced support for lookbehinds, I changed the behaviour to give you the term that is _operationally_ matched before/after the receiver (remember that lookbehinds are implemented by reverse-matching).
However, I think that's rarely ever what you want, and is wrong for the only two uses of these predicates, where it's the textual matching order that we are after, not the operational order.
Consequently, I've changed the semantics back and updated the comments to hopefully clarify the intention.
2019-11-28 15:14:50 +00:00
Esben Sparre Andreasen
4e0dfce427
JS: cache charpred for NodeJS::Require
2019-11-28 08:10:25 +01:00
Esben Sparre Andreasen
d909653a6b
JS: simplify charpred for NodeJS::Require
2019-11-28 08:10:25 +01:00
Erik Krogh Kristensen
34e44e89fd
Merge remote-tracking branch 'upstream/master' into typeAheadSink
2019-11-27 15:19:06 +01:00
Erik Krogh Kristensen
9351cd44e4
Merge remote-tracking branch 'githubsemmle/master' into HEAD
2019-11-27 13:45:59 +01:00
semmle-qlci
a2827e9503
Merge pull request #2362 from erik-krogh/promiseAll
...
Approved by max-schaefer
2019-11-27 12:35:04 +00:00
Erik Krogh Kristensen
bafd57d7d5
refactor classes in typeahead.js model
2019-11-27 13:33:38 +01:00
semmle-qlci
4916bed9cd
Merge pull request #2433 from asger-semmle/import-js-file
...
Approved by max-schaefer
2019-11-27 10:55:59 +00:00
semmle-qlci
9ca4f6aecb
Merge pull request #2392 from asger-semmle/window-name-flow
...
Approved by max-schaefer
2019-11-27 10:55:26 +00:00
semmle-qlci
793988afe4
Merge pull request #2344 from asger-semmle/element-pattern-prop-read
...
Approved by max-schaefer
2019-11-27 10:54:46 +00:00
Erik Krogh Kristensen
967ecbad24
Merge remote-tracking branch 'upstream/master' into promiseAll
2019-11-27 11:28:37 +01:00
Erik Krogh Kristensen
e27a69960d
update description
2019-11-27 11:17:19 +01:00
Erik Krogh Kristensen
60f7a7a274
changes based on review feedback
2019-11-27 11:11:49 +01:00
Asger F
605c8834c6
JS: Avoid redundant window.name sources
2019-11-27 06:15:12 +00:00
Erik Krogh Kristensen
9b608e9ec4
simplify multiple parameter selection
2019-11-26 21:07:37 +01:00
Erik Krogh Kristensen
b5a57986c6
small changes based on review feedback
2019-11-26 15:57:31 +01:00
Erik Krogh Kristensen
5a0cabb039
Merge remote-tracking branch 'upstream/master' into typeAheadSink
2019-11-26 14:37:40 +01:00
Erik Krogh Kristensen
ace484a519
change the typeahead.js model to be semantically correct
2019-11-26 14:35:13 +01:00
Erik Krogh Kristensen
4a94c49d37
changes based on review feedback
2019-11-26 13:40:48 +01:00
Erik Krogh Kristensen
97718bf1d4
the callback function can both be the second and third argument
2019-11-26 13:00:00 +01:00
Erik Krogh Kristensen
b6106f9638
keep the ResolvedPromiseDefinition class as a subclass of PromiseCreationCall
2019-11-26 11:16:59 +01:00
Erik Krogh Kristensen
f284b3a2bb
Merge remote-tracking branch 'upstream/master' into exceptionXss
2019-11-26 10:54:04 +01:00
Erik Krogh Kristensen
7ee12a3420
change doc based on review feedback
2019-11-26 10:48:24 +01:00
Erik Krogh Kristensen
fed2675f76
remove FP in use-of-returnless-function FP related to calls to super()
2019-11-26 10:17:04 +01:00
Erik Krogh Kristensen
89dac23969
remove 3 FP sources from use-of-returnless-function
2019-11-26 10:16:18 +01:00
semmle-qlci
fb44aa18bd
Merge pull request #2428 from erik-krogh/useOfReturnlessFunctionSuperCalls
...
Approved by max-schaefer
2019-11-26 09:14:08 +00:00
Asger F
82b35a116c
JS: Handle .js import of .ts file
2019-11-25 14:58:12 +00:00
Erik Krogh Kristensen
9bd6363521
Merge remote-tracking branch 'upstream/master' into promiseAll
2019-11-25 14:34:58 +01:00
Erik Krogh Kristensen
4efc71b7a2
remove FP in use-of-returnless-function FP related to calls to super()
2019-11-25 11:48:16 +01:00
Erik Krogh Kristensen
c7235bb372
add sources and sinks for typeahead.js
2019-11-25 10:46:54 +01:00
Erik Krogh Kristensen
7d825af9a3
Added an XSS sink for Handlebars.SafeString
2019-11-22 15:56:21 +01:00
semmle-qlci
5c3c8eb35d
Merge pull request #2406 from erik-krogh/returnlessFp
...
Approved by asgerf
2019-11-22 13:06:03 +00:00
Erik Krogh Kristensen
f40d79271d
cleanup module imports and update expected outputs
2019-11-22 13:55:47 +01:00
Erik Krogh Kristensen
85b22536d0
adjust formatting
2019-11-22 13:36:16 +01:00
Esben Sparre Andreasen
5d34806e50
Merge pull request #2379 from asger-semmle/typescript-fixes
...
TS: A bunch of TypeScript fixes
2019-11-22 13:31:30 +01:00
Max Schaefer
6fbaa7a5ea
JavaScript: Make File not extend Locatable anymore.
...
Files have strange `:0:0:0:0` locations for... reasons. This makes the predicates inherited from `Locatable` meaningless. A particularly bad case is `getNumLines()`, which will always return one. The right predicate to use is, of course, `getNumberOfLines()`, which is defined in `File` itself.
2019-11-22 11:57:06 +00:00
Max Schaefer
83f5b614e9
JavaScript: Switch detection of callback-based string replacement to data flow.
2019-11-22 09:24:34 +00:00
Max Schaefer
1951461f55
JavaScript: Simplify DoubleEscaping.
...
Undo previous work on generalising the concept of a replacement, which did not work out.
2019-11-22 09:24:34 +00:00
Max Schaefer
ff002a7af4
JavaScript: Whitelist more harmless incomplete escapes.
2019-11-22 09:24:34 +00:00
Max Schaefer
659cc812fe
JavaScript: Rephrase two predicates to help the optimiser.
2019-11-22 09:24:34 +00:00
Max Schaefer
db3eaa23ef
JavaScript: Introduce modelling of String.prototype.replace and use it in two queries.
2019-11-22 09:24:34 +00:00
Max Schaefer
f43e843b20
JavaScript: Introduce class RegExpLiteralNode.
2019-11-22 09:24:34 +00:00
Max Schaefer
12ea81af9c
JavaScript: Move getAMatchedConstant(RegExpTerm) into the library.
2019-11-22 09:24:34 +00:00
