4104 Commits

Author	SHA1	Message	Date
erik-krogh	e98d1df5f4	add dataflow support	2022-11-15 22:07:25 +01:00
erik-krogh	a8973c1147	add test for dataflow	2022-11-15 22:07:24 +01:00
erik-krogh	75ef5b1b0b	add support for satisfies-expressions	2022-11-15 22:07:24 +01:00
erik-krogh	29cf695b07	update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)	2022-11-15 17:14:38 +01:00
erik-krogh	e18ceba49e	port the JS regex/redos queries to use the shared pack	2022-11-15 17:14:38 +01:00
Erik Krogh Kristensen	90382c4d1c	Merge pull request #11178 from erik-krogh/passcode ... JS/RB/PY: Recognize `passcode` as sensitive	2022-11-10 17:58:34 +01:00
Erik Krogh Kristensen	724a31b746	fix comment that wasn't updated in test ... Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>	2022-11-10 15:56:44 +01:00
Asger F	83291f378b	Merge pull request #11157 from asgerf/js/yaml-locations ... JS: fix issue with zero-column yaml locations	2022-11-09 15:57:54 +01:00
Erik Krogh Kristensen	c537c80ed6	Merge pull request #11095 from erik-krogh/exportRead ... JS: recognize more re-exported values as exported	2022-11-09 12:39:41 +01:00
erik-krogh	23add8a72b	recognize passcode as sensitive	2022-11-09 11:30:57 +01:00
erik-krogh	e0bcfe2afb	add failing test	2022-11-09 11:30:31 +01:00
Asger F	694d987365	JS: Update test output	2022-11-09 09:36:03 +01:00
Erik Krogh Kristensen	e01cbb2ffa	Merge pull request #10378 from erik-krogh/aliasFlow ... JS: expand localFieldStep to use access-paths, and build access-paths in more cases	2022-11-08 14:26:12 +01:00
Asger F	92e8f059c8	JS: Avoid emitting column zero in yaml files	2022-11-08 11:38:26 +01:00
Asger F	a887ff4f09	JS: Add test cases to include results with column-zero end locations	2022-11-07 15:13:25 +01:00
Erik Krogh Kristensen	d67235b3c1	Merge pull request #11071 from erik-krogh/fixCanon ... ReDoS: fix canonicalization in NfaUtils	2022-11-07 14:10:50 +01:00
erik-krogh	fc38bf0429	Merge branch 'main' into aliasFlow	2022-11-07 09:46:48 +01:00
erik-krogh	40032f295a	treat arrays that gets executed with shell:true as a sink for js/shell-command-constructed-from-input	2022-11-07 09:19:05 +01:00
erik-krogh	bc5b7455cf	add failing test	2022-11-07 09:14:52 +01:00
Erik Krogh Kristensen	c82d8cbacc	Merge pull request #11013 from erik-krogh/sndCmd ... JS: second-order-command-injection	2022-11-04 10:58:50 +01:00
erik-krogh	655b4a4d17	recognize more re-exported values as exported	2022-11-03 11:08:00 +01:00
erik-krogh	94e864e933	add failing test	2022-11-03 11:04:04 +01:00
erik-krogh	851d53d56b	don't sanitize calls through substring calls that just remove the start	2022-11-01 22:51:07 +01:00
erik-krogh	08bc14f598	add failing test	2022-11-01 22:50:13 +01:00
erik-krogh	15416a9c86	fix getCanonicalCharClass in NfaUtils	2022-11-01 21:35:07 +01:00
erik-krogh	78e35e2f29	add failing test	2022-11-01 21:33:19 +01:00
Dave Bartolomeo	9d5e5e3ee7	${workspace} all the things	2022-11-01 13:29:05 -04:00
erik-krogh	6f3ca40fed	expand the explanation to include with arguments make the commands vulnerable	2022-11-01 14:24:23 +01:00
erik-krogh	fc2112831c	add second-order-command-injection query	2022-10-30 21:20:47 +01:00
erik-krogh	0a7e797090	update expected outputs after reordering tests	2022-10-28 10:16:21 +02:00
erik-krogh	946720f414	reorder the CWE-078 tests into subdirectories	2022-10-28 10:16:21 +02:00
Erik Krogh Kristensen	bbdda9ef70	Merge pull request #10727 from erik-krogh/js-last-msg ... JS: fix some more style-guide violations in the alert-messages	2022-10-27 15:48:12 +02:00
Erik Krogh Kristensen	cecb498bf3	Merge pull request #10984 from tyage/add-next-js-source ... JS: Add Next.js parameters as source	2022-10-27 10:36:12 +02:00
tyage	54050bf1b6	update test result XssWithAdditionalSources	2022-10-27 10:23:37 +09:00
erik-krogh	0f9b4334cc	remove some FPs in js/password-in-configuration-file	2022-10-26 11:51:56 +02:00
tyage	232893aafa	make query parameters in ServerSideProps and next/router ... as a RemoteFlowSource	2022-10-26 14:41:07 +09:00
tyage	1f4fc7fc2d	add params, query to test	2022-10-26 10:53:11 +09:00
tyage	06925681b0	add test for context.params	2022-10-26 10:53:11 +09:00
Alvaro Muñoz	a80b691358	Remove unnecessary TaggedTemplateEntryPoint	2022-10-25 11:44:45 +02:00
Alvaro Muñoz	37ea3f23f1	Refactored ReplySource to ReplyCall. Got rid of unnecessary ref()	2022-10-25 11:42:48 +02:00
Alvaro Muñoz	c7ac237968	Update test results after merging new XSS improvements	2022-10-19 23:41:37 +02:00
Alvaro Muñoz	2ad5a70cf1	Merge branch 'main' into restify_improvements	2022-10-19 21:57:37 +02:00
Alvaro Muñoz	245be44eac	Merge branch 'main' into javascript_xss_improvements	2022-10-19 18:18:19 +02:00
Alvaro Muñoz	31d271b8e1	Fix format errors	2022-10-19 17:32:34 +02:00
Alvaro Muñoz	b79f7f3e95	Address code review comments ... Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>	2022-10-18 21:42:15 +02:00
Alvaro Muñoz	6ab62da015	Add Restify/Spife support	2022-10-18 21:41:34 +02:00
Alvaro Muñoz	744cea9baa	add tests	2022-10-13 15:19:29 +02:00
Alvaro Muñoz	468628525e	Change to camelcase	2022-10-13 12:18:07 +02:00
Alvaro Muñoz	ea8edb8408	initial tests	2022-10-13 11:32:21 +02:00
erik-krogh	7500a31814	fix that js/file-system-race could have FPs related to loops	2022-10-11 13:41:51 +02:00