4104 Commits

Author	SHA1	Message	Date
erik-krogh	2f11f3760e	simplify getALibraryInputParameter by adding more general dataflow for the arguments object	2022-08-22 08:32:43 +02:00
Erik Krogh Kristensen	11b039c1f1	add tests	2022-08-22 08:29:28 +02:00
Erik Krogh Kristensen	31c09ba678	implement flow for .apply() by adding a ReflectiveParametersNode data-flow node	2022-08-22 08:29:28 +02:00
Erik Krogh Kristensen	d86b7f6c54	recognize an access to the arguments object as library-input	2022-08-22 08:29:24 +02:00
Erik Krogh Kristensen	7b1ef7473e	change ArrayCreationStep to a PreCallGraphStep and unrestrict the storeStep	2022-08-22 08:15:54 +02:00
erik-krogh	0aebc90b61	don't lowercase the endpointExample, and correctly handle root states	2022-08-21 18:38:47 +02:00
erik-krogh	bcf4c57060	Merge branch 'main' into redosPrefix	2022-08-19 19:22:49 +02:00
erik-krogh	d052b1e3c9	also support regular expressions without repetitions	2022-08-19 19:21:44 +02:00
Tom Hvitved	663096fe3a	Remove redundant overrides	2022-08-19 13:57:41 +02:00
erik-krogh	26fcf6b25b	apply suggestions from review	2022-08-18 15:00:57 +02:00
Asger F	349331d6ca	Merge pull request #10082 from asgerf/js/exports-handling2 ... JS: Handle nested conditions in "exports" section	2022-08-18 11:10:59 +02:00
erik-krogh	de3e1c39e4	use the shared regular expression libraries in js/case-sensitive-middleware-path	2022-08-18 10:07:55 +02:00
Harry Maclean	70ec70940a	Merge pull request #8142 from github/hmac/incomplete-multi-char-sanitization	2022-08-18 10:02:39 +12:00
Erik Krogh Kristensen	e93ff8672c	Merge pull request #10075 from erik-krogh/depOld ... delete old deprecations	2022-08-17 21:21:57 +02:00
Erik Krogh Kristensen	bd4947fdbd	Merge pull request #10046 from erik-krogh/protoFunc ... JS: generalize `BarrierGuardFunction`to work on function that have multiple parameters	2022-08-17 14:50:54 +02:00
Harry Maclean	f1a546c4d6	Rename IncompleteMultiCharacterSanitization[Query]	2022-08-17 16:03:49 +12:00
erik-krogh	04173b7e93	fix test that was using old code	2022-08-16 23:35:29 +02:00
Asger F	449e697761	JS: Handle nested conditions in "exports" section	2022-08-16 11:45:48 +02:00
Erik Krogh Kristensen	f106e064fa	Merge pull request #9422 from erik-krogh/refacReDoS ... Refactorizations of the ReDoS libraries	2022-08-16 09:32:08 +02:00
erik-krogh	3355a7a046	generalize BarrierGuardFunctionto work on function that have multiple parameters	2022-08-16 09:13:15 +02:00
Erik Krogh Kristensen	0adb588fe8	Merge pull request #9712 from erik-krogh/badRange ... JS/RB/PY/Java: add suspicious range query	2022-08-15 13:55:44 +02:00
erik-krogh	4cbfbfe170	add call-edge for dynamic dispatch to unknown property from an object literal	2022-08-11 12:29:50 +02:00
Erik Krogh Kristensen	da4da229b1	move tests to new test location	2022-08-09 16:25:00 +02:00
Erik Krogh Kristensen	49276b1f38	Merge branch 'main' into refacReDoS	2022-08-09 16:18:46 +02:00
Erik Krogh Kristensen	add9e9dac4	Merge pull request #9548 from erik-krogh/exports ... JS: support the "exports" property in a package.json	2022-08-09 12:16:12 +02:00
Asger F	fdcb1fa115	Merge pull request #9928 from asgerf/js/source-node-type ... JS: Simplify type hierarchy for SourceNode	2022-08-08 16:53:20 +02:00
Esben Sparre Andreasen	da44340334	formatting	2022-08-08 12:22:41 +02:00
Esben Sparre Andreasen	a3cf81d419	js: add filter taint test (post rebase conflicts)	2022-08-08 11:00:11 +02:00
Asger F	98a9cb0b55	JS: Simplify type hierarchy for SourceNode ... The charpred caused spurious type to appear	2022-07-29 19:44:10 +02:00
Asger F	855d4c2ea1	Merge pull request #9718 from asgerf/js/case-sensitive-middleware ... JS: Add 'case sensitive middleware' query	2022-07-14 10:47:58 +02:00
Asger F	18c5a8c8da	Merge branch 'main' into js/case-sensitive-middleware	2022-07-14 09:38:35 +02:00
Erik Krogh Kristensen	fd10947ca0	use small steps in TypeBackTracker correctly	2022-07-13 10:29:57 +02:00
Erik Krogh Kristensen	ff25451699	rename query to overly-large-range, and rewrite the @description	2022-07-12 16:02:46 +02:00
Erik Krogh Kristensen	7dd095c0d2	Merge pull request #9756 from erik-krogh/greyMatter ... JS: add model for the gray-matter library to js/code-injection	2022-07-01 12:19:12 +02:00
Erik Krogh Kristensen	ef0ec396c4	Merge pull request #9754 from erik-krogh/chownr ... JS: add model for chownr	2022-06-30 22:02:45 +02:00
Erik Krogh Kristensen	f71a64b99d	recognize when the js engine in gray-matter is set to something safe	2022-06-30 09:00:10 +02:00
Erik Krogh Kristensen	22d285f777	add model for the gray-matter libary to js/code-injection	2022-06-30 09:00:10 +02:00
Erik Krogh Kristensen	7cef4322e7	add model for chownr	2022-06-29 22:09:23 +02:00
Erik Krogh Kristensen	0e4954a68c	add navigation.navigate as an XSS / URL sink	2022-06-29 14:56:20 +02:00
Erik Krogh Kristensen	a343ceaf8b	add suspicious-regexp-range query	2022-06-28 09:49:27 +02:00
Erik Krogh Kristensen	34e7589844	sanitize non-strings from unsafe-html-construction	2022-06-27 13:53:44 +02:00
Asger F	d92430b0e7	JS: Fix FP from char class	2022-06-27 09:08:37 +02:00
Asger F	9e4116618a	JS: Add CaseSensitiveMiddlewarePath query	2022-06-27 09:08:37 +02:00
Erik Krogh Kristensen	2e4c2df67e	move the JS ReDoS test to a more appropriate folder	2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen	13482fc97b	rename ReDoSUtil to NfaUtils, and rename the "performance" folder to "regexp"	2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen	7fb3d81d2f	add further normalization of char classses	2022-06-23 14:36:25 +02:00
Erik Krogh Kristensen	e1c34c11ed	add all jquery plugin parameters as source to js/html-constructed-from-input	2022-06-21 13:22:56 +02:00
Erik Krogh Kristensen	dde7e9e2e8	add test for jquery plugin parameters in js/html-constructed-from-input	2022-06-21 13:21:57 +02:00
Asger F	835c9bb0b9	JS: Add test	2022-06-20 20:16:07 +02:00
Erik Krogh Kristensen	cb0a6936ad	add support for the "exports" property in a package.json	2022-06-14 13:31:47 +02:00