80 Commits

Author	SHA1	Message	Date
jorgectf	2ac334bf15	Adapt Webix modeling to support HTML use-cases	2023-06-28 15:26:30 +02:00
jorgectf	1e663b8889	Update HeuristicSourceCodeInjection.expected	2023-06-26 13:32:20 +02:00
Jorge	08b9a5e2b2	Add missing ;	2023-06-23 23:10:06 +02:00
jorgectf	6947e99c15	Add models for webix ... Co-authored-by: Kevin Stubbings <Kwstubbs@users.noreply.github.com>	2023-06-22 01:07:33 +02:00
Asger F	20e8ee8423	Merge pull request #12748 from JarLob/yi ... JS: Add more sources, more unit tests, fixes to the GitHub Actions injection query	2023-05-15 11:03:00 +02:00
Asger F	1a9956354e	JS: Restrict getInput to indirect command injection query	2023-05-03 16:10:03 +02:00
Asger F	08785a4063	JS: Add sources from actions/core	2023-05-01 11:42:17 +02:00
Asger F	cb95dbfa14	JS: Add tests	2023-05-01 11:42:17 +02:00
jarlob	6e9f54ef55	Use double curly braces	2023-04-21 19:03:38 +02:00
jarlob	d80c541da6	Encapsulate composite actions	2023-04-14 10:06:35 +02:00
jarlob	9c7eecf547	Add support for composite actions	2023-04-06 22:53:59 +02:00
jarlob	baefeab2d1	fix tests	2023-04-06 19:11:04 +02:00
jarlob	0a878d4db9	Support yAml extensions	2023-04-06 19:07:38 +02:00
jarlob	eef1973b93	Change UI message	2023-04-05 10:05:24 +02:00
jarlob	5c5b9f99a8	Add simple taint tracking for env variables	2023-04-05 10:03:46 +02:00
jarlob	8ea418216c	Look for script injections in actions/github-script	2023-04-03 23:13:28 +02:00
jarlob	c6eaf194a5	Remove empty.js as it is not needed anymore	2023-04-03 15:09:40 +02:00
jarlob	99d634c8a4	Add more sources, more unit tests, fixes to the GitHub Actions injection query	2023-04-03 15:02:02 +02:00
erik-krogh	34fe1a8f5e	use SSA in the GetLaterAccess module	2023-03-21 15:19:15 +01:00
erik-krogh	6192544fb4	add test for express-ws as a source	2023-02-13 15:26:50 +01:00
erik-krogh	02da718786	add code-injection sink for node-pty	2023-01-30 15:14:25 +01:00
Asger F	83291f378b	Merge pull request #11157 from asgerf/js/yaml-locations ... JS: fix issue with zero-column yaml locations	2022-11-09 15:57:54 +01:00
Asger F	92e8f059c8	JS: Avoid emitting column zero in yaml files	2022-11-08 11:38:26 +01:00
Asger F	a887ff4f09	JS: Add test cases to include results with column-zero end locations	2022-11-07 15:13:25 +01:00
erik-krogh	fc38bf0429	Merge branch 'main' into aliasFlow	2022-11-07 09:46:48 +01:00
erik-krogh	368f84785b	fix some more style-guide violations in the alert-messages	2022-10-07 11:22:22 +02:00
erik-krogh	dcdff7a995	Merge branch 'main' into aliasFlow	2022-09-22 16:01:31 +02:00
erik-krogh	843fce4bcd	expand localFieldStep to use access-paths, and build access-paths in more cases	2022-09-13 21:43:06 +02:00
erik-krogh	6ec03d4738	apply suggestions from doc review	2022-09-12 13:16:39 +02:00
erik-krogh	a35fe1ffab	Merge branch 'main' into js-followMsg	2022-09-08 13:09:15 +02:00
erik-krogh	6447234428	recognize calls to Function where spread arguments are used	2022-09-07 22:55:51 +02:00
erik-krogh	e829387cdb	add failing test for call the Function with a spread argument	2022-09-07 22:54:21 +02:00
erik-krogh	aa56ca37ae	make the alert messages of taint-tracking queries more consistent	2022-09-05 14:04:52 +02:00
Erik Krogh Kristensen	f71a64b99d	recognize when the js engine in gray-matter is set to something safe	2022-06-30 09:00:10 +02:00
Erik Krogh Kristensen	22d285f777	add model for the gray-matter libary to js/code-injection	2022-06-30 09:00:10 +02:00
Erik Krogh Kristensen	2a65d1d3ec	move js/actions/injection out of experimental	2022-05-04 16:14:19 +02:00
Erik Krogh Kristensen	d1d4ebb3b5	add values written to the global scope as exports	2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen	d790f3ccbb	add test for unsafe-code-construction query	2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen	955ad8c458	add JSON.stringify as a code-injection sanitizer	2022-02-07 13:34:18 +01:00
Erik Krogh Kristensen	68a5c1f5b5	add code-injection sink for calls to node	2022-02-07 13:34:18 +01:00
Asger Feldthaus	cb0075f15a	JS: Remove use of deprecated API	2021-08-12 09:30:43 +02:00
Max Schaefer	ce24215dd5	JavaScript: Improve modelling of Module.prototype._compile sink.	2021-07-12 15:32:21 +01:00
Erik Krogh Kristensen	2ba2642c7a	add more template sinks for the js/code-injection query	2021-06-22 20:24:42 +02:00
Asger Feldthaus	710cca5395	JS: Update expectations with new sources	2021-03-16 13:28:12 +00:00
Erik Krogh Kristensen	aae69c6537	update expected output	2021-02-01 09:33:52 +01:00
Erik Krogh Kristensen	39591687ba	add js/code-injection sink for script tags in React	2021-01-29 12:50:17 +01:00
Asger Feldthaus	68d2bc861d	JS: Update test expectations	2020-12-03 15:01:50 +00:00
Asger Feldthaus	6211fe718b	JS: Add test	2020-12-01 17:05:48 +00:00
Max Schaefer	e1d90e90ad	JavaScript: Add modelling for Module.prototype._compile.	2020-10-19 09:42:17 +01:00
Erik Krogh Kristensen	b8154d41b1	type-track objects where the "$where" property has been written	2020-09-24 20:55:25 +02:00