github-actions[bot]
6ec9b95072
Release preparation for version 2.15.3
2023-11-16 13:07:16 +00:00
Rasmus Wriedt Larsen
43d9d2ceb7
Merge pull request #14603 from github/max-schaefer/broken-crypto-algorithm-link
...
JavaScript/Python/Ruby: Improve alert message for `*/weak-cryptographic-algorithm`.
2023-11-08 14:29:24 +01:00
Geoffrey White
e8a466a02c
Update dead link.
2023-11-07 09:26:07 +00:00
amammad
c858e4974d
fix Sqlite and BetterSqlite3 issues according to Review
2023-11-06 14:57:40 +01:00
Arthur Baars
01e7d57dba
Add changenote
2023-11-06 13:38:33 +01:00
amammad
e1d42fad2c
move new secret key sinks to existing CredentialsNode class,
...
add new additional global taint and dataflow steps
update tests of CWE-798
add a new sanitizer for `semmle.javascript.security.dataflow.HardcodedCredentialsQuery`
2023-11-02 16:09:01 +01:00
Arthur Baars
5cc94e1105
Express.js: add req.path as remote input source
2023-10-31 12:44:26 +01:00
Chris Smowton
79e1aa0498
Merge pull request #14634 from github/post-release-prep/codeql-cli-2.15.2
...
Post-release preparation for codeql-cli-2.15.2
2023-10-31 10:24:53 +00:00
github-actions[bot]
2b939fdf08
Post-release preparation for codeql-cli-2.15.2
2023-10-30 16:06:51 +00:00
Harry Maclean
083be305e1
Shared: Add neutralModel extensible predicate
...
The neutralModel extensible predicate already exists in Java and C#, so
this change brings the dynamic languages more in line with static
languages. The Model Editor uses this predicate to mark endpoints as
"not interesting" from a data flow perspective.
2023-10-30 11:31:57 +00:00
github-actions[bot]
4641990021
Release preparation for version 2.15.2
2023-10-30 11:05:53 +00:00
Max Schaefer
08cc8b8e80
Autoformat.
2023-10-26 15:36:06 +01:00
Max Schaefer
abef8483bd
Merge pull request #14600 from github/max-schaefer/express-rate-limit
...
JavaScript: Add support for importing `express-rate-limit` using a named import.
2023-10-26 15:15:22 +01:00
Max Schaefer
741735cc83
Port changes to JavaScript.
2023-10-26 14:47:24 +01:00
Max Schaefer
aff848b038
Update javascript/ql/lib/semmle/javascript/security/dataflow/MissingRateLimiting.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2023-10-26 13:06:52 +01:00
Max Schaefer
bb146a1758
JavaScript: Add support for rateLimit export from express-rate-limit package.
2023-10-26 12:14:57 +01:00
amammad
e3dbdc3887
add custom query builder and active record querybuilder support
2023-10-22 21:39:59 +02:00
Erik Krogh Kristensen
f562d5319f
Merge pull request #14539 from flyboss/main
...
fix typo ('Configration' to ‘Configuration’)
2023-10-20 14:10:42 +02:00
flyboss
ee813c1e61
Update UnsafeHtmlConstructionQuery.qll
...
add a deprecated alias in case anyone depends on the misspelled name.
2023-10-20 17:57:23 +08:00
flyboss
86336565eb
fix typo
2023-10-19 02:34:31 +00:00
github-actions[bot]
8dcd8b9e5b
Post-release preparation for codeql-cli-2.15.1
2023-10-17 20:24:00 +00:00
github-actions[bot]
3b3c036626
Release preparation for version 2.15.1
2023-10-16 17:49:39 +00:00
Arthur Baars
0e3369f93f
Merge pull request #14484 from aibaars/ts53-js
...
JS: Support import attributes
2023-10-16 10:47:49 +02:00
erik-krogh
69c3e62965
add change-note
2023-10-13 15:16:39 +02:00
Arthur Baars
a4d0ef6350
Add changenote
2023-10-12 13:04:00 +02:00
Arthur Baars
a9a21aa313
Rename DynamicImportExpr::getImport{Attributes => Options}
2023-10-12 13:00:39 +02:00
Arthur Baars
c28004f2a6
Rename 'getImportAssertion()' to 'getImportAttributes()' in QL library
2023-10-12 13:00:39 +02:00
Henry Mercer
1a370bfbbe
Merge pull request #14443 from github/post-release-prep/codeql-cli-2.15.0
...
Post-release preparation for codeql-cli-2.15.0
2023-10-11 17:39:04 +01:00
github-actions[bot]
ae6af17c74
Post-release preparation for codeql-cli-2.15.0
2023-10-11 14:19:20 +00:00
Erik Krogh Kristensen
85bb14f04f
Merge pull request #14405 from erik-krogh/tagCall
...
JS: recognize tagged template literals as `DataFlow::CallNode`
2023-10-11 11:25:34 +02:00
Erik Krogh Kristensen
6377e92067
Update javascript/ql/lib/semmle/javascript/dataflow/DataFlow.qll
...
Co-authored-by: Asger F <asgerf@github.com >
2023-10-11 09:52:48 +02:00
amammad
242f7e1c53
update pg :)
2023-10-10 11:42:32 +02:00
amammad
bbeb7b39d7
add better-sqlite3
2023-10-10 11:17:04 +02:00
erik-krogh
a7ab9fd93b
add change-notes
2023-10-09 09:43:06 +02:00
erik-krogh
f48b47c656
JavaScript: add import that populate the shared abstract classes
2023-10-09 09:14:55 +02:00
erik-krogh
c2942b37a7
JS: delete various outdated deprecations
2023-10-09 09:14:55 +02:00
erik-krogh
0d992a3d1f
delete old deprecated aliases of various regex libraries
2023-10-09 09:14:54 +02:00
erik-krogh
d261cec3cd
add change-note
2023-10-07 15:41:08 +02:00
erik-krogh
56e9eda2b9
fix performance by caching getArgument
2023-10-07 13:06:45 +02:00
erik-krogh
18e6a5491c
recognize tagged templates as DataFlow::CallNode
2023-10-06 21:14:00 +02:00
Asger F
97b3ebe385
Merge pull request #14380 from asgerf/js/amd-range
...
JS: Add AmdModuleDefinition::Range
2023-10-05 21:05:28 +02:00
Cornelius Riemenschneider
96edc1d349
Add skeleton bazel files for accessing the dbschemes.
2023-10-05 09:00:38 +02:00
Asger F
162c477236
JS: Add AmdModuleDefinition::Range
2023-10-04 20:38:37 +02:00
github-actions[bot]
9fe993bec3
Release preparation for version 2.15.0
2023-10-04 14:15:27 +00:00
Henry Mercer
da92da2204
Bump minor versions of packs we regularly release
2023-10-03 16:31:23 +01:00
Henry Mercer
f3847b3f51
Merge branch 'main' into henrymercer/rc-3.11-mergeback
2023-10-03 16:30:23 +01:00
amammad
97c27ac11b
revert SqlInjection.ql changes
2023-09-29 01:36:00 +10:00
amammad
58f4cd77dc
add TypeORM to javascript.qll file
...
add tests
improvement on comments
2023-09-29 01:23:22 +10:00
Anders Schack-Mulligen
855c89667d
JavaScript: Use shared FileSystem library.
2023-09-28 08:58:55 +02:00
amammad
0eb0c238f3
stash
2023-09-23 20:28:34 +10:00
