1958 Commits

Author	SHA1	Message	Date
Erik Krogh Kristensen	73f2e89f3e	Merge pull request #8165 from erik-krogh/protoWrite ... JS: support more property writes in js/prototype-pollution-utility	2022-02-22 21:30:22 +01:00
Erik Krogh Kristensen	b6b93065ff	Merge pull request #8157 from erik-krogh/lodash-clone ... JS: add lodash.{clone, cloneDeep} as a clone step	2022-02-22 18:12:10 +01:00
Erik Krogh Kristensen	c487bb73a7	Merge pull request #8143 from erik-krogh/pred-ql-style ... QL: add ql-for-ql query for detecting bad predicate qldoc	2022-02-22 17:49:12 +01:00
Esben Sparre Andreasen	2c527f7b35	model hapi handler returns as reflected-xss sinks	2022-02-22 14:12:01 +01:00
Erik Krogh Kristensen	517e17d422	support more property writes in js/prototype-pollution-utility, and generalize ObjectDefinePropertyAsPropWrite	2022-02-22 13:23:34 +01:00
Stephan Brandauer	6722c17bb0	JS: Functionality from untrusted sources query (CWE-830)	2022-02-22 11:41:52 +01:00
Asger Feldthaus	1be47db2e6	JS: Factor out more JS-specific code	2022-02-22 09:51:56 +01:00
Asger Feldthaus	2d509eb345	JS: Make Impl.qll determine the location of AccessPathSyntax.qll	2022-02-22 09:51:52 +01:00
Asger Feldthaus	42a3d8c689	JS: Treat Member[x] as a language-specific token ... In Ruby it is ambiguous whether Member[foo] means x.foo or x::foo	2022-02-22 09:51:52 +01:00
Asger Feldthaus	acf95d6178	JS: Move summary resolution into JS-specific code	2022-02-22 09:51:52 +01:00
Asger Feldthaus	ab1642dd3f	JS: Rename {Shared,Impl} -> ApiGraphModels{,Specific}	2022-02-22 09:51:48 +01:00
Erik Krogh Kristensen	e8df6a14ca	add lodash.{clone, cloneDeep} as a clone step	2022-02-21 22:27:29 +01:00
Asger Feldthaus	8194c041cc	JS: Merge sources to one class	2022-02-21 16:26:02 +01:00
Asger F	00ed72ed83	Apply suggestions from code review ... Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>	2022-02-21 16:24:50 +01:00
Erik Krogh Kristensen	cd4685c4c5	cache RegExpCreationNode::getAReference	2022-02-21 15:04:00 +01:00
Erik Krogh Kristensen	1407b49a8f	fix some instances of ql/pred-doc-style for JS	2022-02-21 15:02:21 +01:00
Asger F	02c4966109	Merge pull request #7878 from asgerf/dot-separated-access-paths ... Shared: Switch to dot-separated access paths in summary specs	2022-02-21 13:29:09 +01:00
Esben Sparre Andreasen	1d437dd722	Merge pull request #8043 from github/esbena/sharpen-hardcoded-credentials ... JS: Sharpen hardcoded credentials	2022-02-21 10:02:58 +01:00
Erik Krogh Kristensen	5f9bd7a4a1	Merge pull request #7984 from erik-krogh/fix-ql-for-ql-js ... JS: fix most ql-for-ql warnings	2022-02-21 09:15:06 +01:00
Asger Feldthaus	d7f07167ac	Shared: Remove getLastToken again	2022-02-21 08:21:53 +01:00
Asger Feldthaus	2c2a82a070	Shared: allow spaces between arguments in a token	2022-02-21 08:21:53 +01:00
Asger Feldthaus	7fcbdbeada	Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll	2022-02-21 08:21:52 +01:00
Asger Feldthaus	2907d53e17	Shared: sync AccessPathSyntax.qll and FlowSummaryImpl.qll	2022-02-21 08:21:52 +01:00
Asger Feldthaus	c189df2341	Revert "JS: Add support for " of " syntax to help during transition" ... This reverts commit 9bf522b3048c3b11f7e6d734ed797a613614a095.	2022-02-21 08:21:51 +01:00
Asger Feldthaus	753c557dbe	Java: use AccessPathSyntax.qll to parse input/output summary specs	2022-02-21 08:16:54 +01:00
Asger Feldthaus	53935db6c6	JS: Add support for " of " syntax to help during transition	2022-02-21 08:16:54 +01:00
Asger Feldthaus	30254686d8	JS: Move ".."-parsing trick into AccessPathSyntax.qll	2022-02-21 08:16:54 +01:00
Asger Feldthaus	7c2cff3227	JS: Factor out AccessPathSyntax.qll	2022-02-21 08:16:54 +01:00
Asger Feldthaus	e2cbf47b16	JS: Fix accidental recursion	2022-02-21 08:16:53 +01:00
Asger Feldthaus	260638c68b	JS: Add ClientSideRequestForgery and split request-forgery results between the two	2022-02-16 13:35:01 +01:00
Esben Sparre Andreasen	816d79692b	ignore deliberately hardcoded password strings	2022-02-16 09:47:01 +01:00
Arthur Baars	ebb87c4b36	Merge pull request #7975 from github/post-release-prep/codeql-cli-2.8.1 ... Post-release preparation for codeql-cli-2.8.1	2022-02-15 20:17:35 +01:00
CodeQL CI	8f8621f82c	Merge pull request #8022 from asgerf/js/url-parse-qs ... Approved by esbena	2022-02-15 09:34:21 +01:00
Asger Feldthaus	8b55a24e7c	JS: Add url-parse.qs as an alias for the querystringify library	2022-02-14 15:29:50 +01:00
Chuan-kai Lin	9b4dbb9dd8	Merge pull request #7895 from github/cklin/upgrades-initial-dbscheme ... Upgrade scripts testing: set initial dbschemes	2022-02-11 11:06:12 -08:00
Erik Krogh Kristensen	a1c5724be7	fix most ql-for-ql warnings in JS	2022-02-11 17:57:37 +01:00
github-actions[bot]	21bf29353f	Post-release preparation for codeql-cli-2.8.1	2022-02-11 11:07:31 +00:00
Taus	327e0dad72	Merge pull request #7674 from erik-krogh/dbTypeInNonLib ... QL: Use of db-type outside language core.	2022-02-11 12:00:14 +01:00
Erik Krogh Kristensen	36e02ae9ac	Merge pull request #7912 from erik-krogh/moarApi ... JS: convert more type-trackers to API-graphs	2022-02-11 10:32:45 +01:00
Erik Krogh Kristensen	3791b159fb	Merge pull request #7892 from erik-krogh/nanSan ... JS: Add a `isNaN` sanitizer, and use it in queries that already had a typeof check	2022-02-11 10:13:06 +01:00
Erik Krogh Kristensen	2ffd79d451	Merge pull request #7921 from erik-krogh/snapdragon ... JS: add model for the snapdragon library	2022-02-11 10:10:55 +01:00
Esben Sparre Andreasen	a4447ce372	Update javascript/ql/lib/semmle/javascript/frameworks/Snapdragon.qll	2022-02-11 08:20:02 +01:00
github-actions[bot]	f25fc70b7c	Release preparation for version 2.8.1	2022-02-10 22:08:24 +00:00
Arthur Baars	61ba896343	Javascript: move change note	2022-02-10 20:58:49 +01:00
Erik Krogh Kristensen	eb56a5aef3	support more patterns that recognize valid numbers	2022-02-10 19:50:35 +01:00
CodeQL CI	9ebbd9efa1	Merge pull request #7591 from asgerf/js/mysql-sinks ... Approved by esbena	2022-02-10 12:50:36 +00:00
CodeQL CI	1a91a79b5b	Merge pull request #5841 from erik-krogh/libCode ... Approved by esbena, ethanpalm	2022-02-10 11:36:45 +00:00
Erik Krogh Kristensen	d55920ad27	add model for the snapdragon library	2022-02-10 11:32:59 +01:00
Erik Krogh Kristensen	12d31d750a	convert more type-trackers to API-graphs	2022-02-10 09:54:52 +01:00
Stephan Brandauer	a73cdf3527	Merge pull request #7911 from kaeluka/javascript/add-getFlowLabel-to-PathNode ... JS: add a getFlowLabel method to the PathNode class	2022-02-10 09:10:08 +01:00