65 Commits

Author	SHA1	Message	Date
Napalys	9c2366a660	JS: Added tests for ReDos with unknownFlags, everything seems to be good	2024-11-28 11:26:46 +01:00
erik-krogh	bf22f4a870	update expected output	2024-02-22 13:21:11 +01:00
erik-krogh	0bce42410a	support arbitrary codepoints in NfaUtils.qll	2023-08-08 22:14:51 +02:00
erik-krogh	92db7b047c	escape unicode chars in the output for the ReDoS queries	2023-08-08 00:15:54 +02:00
erik-krogh	f7419c9250	add expected output	2023-05-23 09:56:06 +02:00
erik-krogh	f85b3e13c2	update expected output	2023-05-23 09:56:06 +02:00
erik-krogh	e189b36e3f	materialize less strings when ranking states	2023-03-23 10:35:58 +01:00
erik-krogh	b071d3557e	JS/PY/RB: add a worst-case test, that now performs OK	2023-03-22 10:13:18 +01:00
erik-krogh	801e0ff050	ReDoS: implement a better super-linear algorithm, with better worst-case performance	2023-03-22 10:13:16 +01:00
erik-krogh	54ec047433	ReDoS: put an artificial limitation on the analysis in polynomial-redos for large regular expressions	2023-03-16 12:20:53 +01:00
erik-krogh	c17d057520	default to index.js when no main: is specified in package.json, and recognize more classes as library inputs	2023-02-13 21:24:41 +01:00
Erik Krogh Kristensen	54c780bdf9	Merge pull request #11853 from erik-krogh/assignMore ... JS: add local flow when recognizing Object.assign calls for library-inputs	2023-01-10 17:04:29 +01:00
erik-krogh	9f100ef2c6	add local flow when recognizing Object.assign calls for library-inputs	2023-01-09 17:44:11 +01:00
erik-krogh	90f9e3f825	recognize an infinite repetition of a char-class like regex as a char-class like regex	2023-01-09 17:25:08 +01:00
Erik Krogh Kristensen	6b9cab23d4	Merge pull request #11248 from erik-krogh/js-redosMod ... JS: use the shared regex pack	2022-12-05 14:48:37 +01:00
erik-krogh	6b5cd9abc3	use RegExpTreeView insteaed of RegexTreeView in JS	2022-11-22 12:55:48 +01:00
erik-krogh	29cf695b07	update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)	2022-11-15 17:14:38 +01:00
erik-krogh	e18ceba49e	port the JS regex/redos queries to use the shared pack	2022-11-15 17:14:38 +01:00
erik-krogh	851d53d56b	don't sanitize calls through substring calls that just remove the start	2022-11-01 22:51:07 +01:00
erik-krogh	08bc14f598	add failing test	2022-11-01 22:50:13 +01:00
erik-krogh	368f84785b	fix some more style-guide violations in the alert-messages	2022-10-07 11:22:22 +02:00
erik-krogh	6ec03d4738	apply suggestions from doc review	2022-09-12 13:16:39 +02:00
erik-krogh	aa56ca37ae	make the alert messages of taint-tracking queries more consistent	2022-09-05 14:04:52 +02:00
erik-krogh	a57981ea69	apply suggestions from review	2022-08-23 10:18:14 +02:00
erik-krogh	2f11f3760e	simplify getALibraryInputParameter by adding more general dataflow for the arguments object	2022-08-22 08:32:43 +02:00
Erik Krogh Kristensen	d86b7f6c54	recognize an access to the arguments object as library-input	2022-08-22 08:29:24 +02:00
Erik Krogh Kristensen	da4da229b1	move tests to new test location	2022-08-09 16:25:00 +02:00
Erik Krogh Kristensen	49276b1f38	Merge branch 'main' into refacReDoS	2022-08-09 16:18:46 +02:00
Erik Krogh Kristensen	2e4c2df67e	move the JS ReDoS test to a more appropriate folder	2022-06-23 14:36:25 +02:00
Asger Feldthaus	6e0322dc60	JS: Add DeepResourceExhaustion test	2021-03-02 13:56:43 +00:00
Asger Feldthaus	88e5348da9	JS: Move RemotePropertyInjection test into subfolder	2021-03-02 13:56:39 +00:00
Asger Feldthaus	0a7513fdfb	JS: Move and rename test cases as well	2020-12-07 10:16:38 +00:00
Erik Krogh Kristensen	bffb12725b	add test and change-note to prototype-polution	2020-05-05 13:49:11 +02:00
Asger Feldthaus	506ddaf3f4	JS: Add explanation for test failure	2020-03-18 11:55:13 +00:00
Asger Feldthaus	028022158d	JS: Add variant of test that passes	2020-03-18 11:55:13 +00:00
Asger Feldthaus	a7e337ab28	JS: Add some lines in test case	2020-03-18 11:55:13 +00:00
Asger Feldthaus	3e68072e38	JS: Accept test case change	2020-03-18 11:55:13 +00:00
Asger Feldthaus	52ebe49a0b	JS: Flag deep assignments in prototype pollution query	2020-02-27 12:17:55 +00:00
Asger Feldthaus	f923b24bc5	JS: Fix test	2020-02-24 11:19:23 +00:00
Asger Feldthaus	d1df251b92	JS: Proto pollution: Add is-plain-object sanitizer	2020-02-21 14:38:33 +00:00
Asger Feldthaus	f84af74d1d	JS: Handle more libraries	2020-02-06 14:59:52 +00:00
Asger Feldthaus	c559ab13e7	JS: Add test and handle parameter with source object	2020-02-06 14:59:52 +00:00
Asger Feldthaus	c185cededf	JS: More pruning and more data flow	2020-02-04 15:06:42 +00:00
Asger F	2c05ee8ab8	JS: Add regression test	2020-01-14 10:53:00 +00:00
Asger F	9bd3c4a11c	JS: Add sanitizer for "in" exprs	2020-01-14 10:53:00 +00:00
Asger Feldthaus	7ac30e2289	JS: Add test for rephinement nodes	2020-01-14 10:53:00 +00:00
Asger F	a447645c10	JS: Add test with typeof on value	2020-01-14 10:52:59 +00:00
Asger F	bd9405ab84	JS: Guard against more FPs	2020-01-14 10:52:59 +00:00
Asger F	f7543aec95	JS: Support Reflect.ownKeys	2020-01-14 10:52:59 +00:00
Asger F	8af233307a	JS: Support enumeration through Object.entries	2020-01-14 10:52:59 +00:00