1638 Commits

Author	SHA1	Message	Date
semmle-qlci	7891f8621e	Merge pull request #2982 from esbena/js/request-model-with-chaining ... Approved by asgerf	2020-03-06 08:57:42 +00:00
semmle-qlci	98cee5cc1d	Merge pull request #2967 from asger-semmle/js/flow-through-prop ... Approved by esbena	2020-03-05 09:46:35 +00:00
semmle-qlci	85ee5fc988	Merge pull request #2955 from erik-krogh/BetterHeader ... Approved by asgerf	2020-03-05 08:24:43 +00:00
semmle-qlci	98034aaa53	Merge pull request #2988 from asger-semmle/js/autoformat-again-again ... Approved by esbena	2020-03-04 21:20:52 +00:00
semmle-qlci	c6e3d8df49	Merge pull request #2969 from esbena/js/process-as-event-emitter ... Approved by erik-krogh	2020-03-04 20:24:12 +00:00
Asger Feldthaus	53569453ba	JS: Autoformat again	2020-03-04 19:28:24 +00:00
semmle-qlci	c5d39039bc	Merge pull request #2962 from erik-krogh/YetAnotherSanitizer ... Approved by asgerf	2020-03-04 15:27:09 +00:00
Esben Sparre Andreasen	db335ae89b	JS: add default/chaining for request	2020-03-04 12:36:49 +01:00
Esben Sparre Andreasen	92b3e8c060	JS: add default/chaining tests for request	2020-03-04 12:25:23 +01:00
Esben Sparre Andreasen	ae43e90a67	JS: model process as an EventEmitter	2020-03-04 09:49:16 +01:00
Esben Sparre Andreasen	4625217a68	Merge branch 'master' of github.com:Semmle/ql into js/more-fs-modules	2020-03-03 15:07:51 +01:00
Esben Sparre Andreasen	dfa07130b5	JS: add process EventEmitter test	2020-03-03 14:26:03 +01:00
Erik Krogh Kristensen	f03c67266a	add taint step for replace call that only removes dots	2020-03-03 12:58:06 +01:00
Erik Krogh Kristensen	95819c8731	use RegExpTerm to generalize predicate	2020-03-03 12:34:18 +01:00
Asger Feldthaus	98524556c3	JS: Add some tests	2020-03-03 11:32:23 +00:00
Erik Krogh Kristensen	622a2fcfdc	use regexp term instead of char class	2020-03-03 12:24:13 +01:00
semmle-qlci	57b3e6addf	Merge pull request #2958 from erik-krogh/InnerPrefix ... Approved by asgerf	2020-03-03 11:10:44 +00:00
Erik Krogh Kristensen	bc13204193	refactor header checks to be based on dominance	2020-03-03 12:04:31 +01:00
semmle-qlci	7f3f629d39	Merge pull request #2913 from asger-semmle/js/prototype-pollution-path ... Approved by erik-krogh	2020-03-03 10:29:47 +00:00
semmle-qlci	b3cbf8baa8	Merge pull request #2960 from erik-krogh/OverloadsWithThis ... Approved by asgerf	2020-03-03 10:10:00 +00:00
Esben Sparre Andreasen	adddebf039	Merge branch 'master' of github.com:Semmle/ql into js/more-fs-modules	2020-03-03 10:55:16 +01:00
semmle-qlci	e1c5449885	Merge pull request #2867 from erik-krogh/UselessCat ... Approved by esbena	2020-03-03 09:10:25 +00:00
Erik Krogh Kristensen	9016f43d80	update expected output	2020-03-03 10:04:57 +01:00
Erik Krogh Kristensen	53d1cd33f6	support sanitizers that remove all forward slashes	2020-03-02 21:34:40 +01:00
Erik Krogh Kristensen	68fb8c52e9	check the type of the this-type, instead of the AST-node	2020-03-02 16:35:16 +01:00
Erik Krogh Kristensen	e0fcc4af6a	handle this parameters when finding unreachable overloads	2020-03-02 16:26:00 +01:00
Erik Krogh Kristensen	26fd17bf39	recognize utility functions implementing a StartsWith check	2020-03-02 13:00:58 +01:00
Asger Feldthaus	e405a9769c	JS: Really autoformat everything	2020-03-02 10:48:33 +00:00
Erik Krogh Kristensen	c14a485ca7	recognize more HttpResponseSink by restricting the hasNonHtmlHeader check	2020-03-02 10:10:34 +01:00
Erik Krogh Kristensen	71ff32e930	recognize another prefix check for js/path-injection	2020-02-28 14:55:41 +01:00
Esben Sparre Andreasen	a589061bee	JS: add type-tracking to the fs-module and model the original-fs	2020-02-28 12:54:59 +01:00
Esben Sparre Andreasen	5a3a1c480d	JS: add tests for the fs-module and friends	2020-02-28 12:21:10 +01:00
Erik Krogh Kristensen	ce9cd53bf1	Merge remote-tracking branch 'upstream/master' into UselessCat	2020-02-28 09:56:23 +01:00
semmle-qlci	ec90627a64	Merge pull request #2909 from yo-h/experimental ... Approved by aschackmull, jbj, max-schaefer, tausbn	2020-02-28 03:15:58 +00:00
Asger Feldthaus	52ebe49a0b	JS: Flag deep assignments in prototype pollution query	2020-02-27 12:17:55 +00:00
Asger Feldthaus	fefcf1a7a6	JS: Autoformat everything	2020-02-27 09:41:01 +00:00
Erik Krogh Kristensen	9c06c48dc7	Merge pull request #2884 from esbena/js/practically-exploitable-redos ... JS: add query js/exploitable-polynomial-redos	2020-02-27 10:19:17 +01:00
Esben Sparre Andreasen	1b73cee692	JS: add js/exploitable-polynomial-redos	2020-02-27 08:42:43 +01:00
Erik Krogh Kristensen	dc6bfad023	Merge remote-tracking branch 'upstream/master' into CVE481	2020-02-25 16:25:03 +01:00
semmle-qlci	03b882381a	Merge pull request #2723 from esbena/js/support-path-is-inside ... Approved by asgerf	2020-02-25 11:21:24 +00:00
Erik Krogh Kristensen	87d283aa6c	add tests for third party command execution libraries (and two small fixes)	2020-02-25 10:50:59 +01:00
Asger F	160fc48803	Merge pull request #2896 from asger-semmle/typescript-3.8 ... TS: Support Typescript 3.8	2020-02-25 08:19:01 +00:00
Esben Sparre Andreasen	5baba62154	JS: model path-is-inside+is-path-inside for js/path-injection	2020-02-24 23:10:15 +01:00
Esben Sparre Andreasen	86b836cd29	JS: add tests for js/path-injection	2020-02-24 23:03:42 +01:00
semmle-qlci	aadb148c1c	Merge pull request #2855 from asger-semmle/js/returned-partial-call ... Approved by esbena	2020-02-24 21:37:41 +00:00
yo-h	43bcd5b26c	Add guidelines for experimental CodeQL queries and libraries	2020-02-24 15:08:31 -05:00
semmle-qlci	317356e591	Merge pull request #2898 from asger-semmle/js/prototype-pollution-isobject-sanitizers ... Approved by erik-krogh	2020-02-24 13:35:32 +00:00
Erik Krogh Kristensen	fb94af9764	remove the last dependency on PrettyPrinting	2020-02-24 13:18:15 +01:00
Erik Krogh Kristensen	473787a426	refactor the getOptionsArg predicate into the SystemCommandExecution class	2020-02-24 12:59:20 +01:00
Asger Feldthaus	01309d7c2e	TS: Add test for named re-export and exportsAs	2020-02-24 11:40:28 +00:00