Max Schaefer
4a7e0fe104
Merge pull request #766 from asger-semmle/ts-compiler-3.2
...
TS: Support TypeScript 3.2
2019-01-16 08:49:45 +00:00
semmle-qlci
5bc17923b1
Merge pull request #665 from asger-semmle/js-property-concat-sanitizer
...
Approved by esben-semmle, xiemaisi
2019-01-16 08:44:55 +00:00
semmle-qlci
cf3a4ac956
Merge pull request #767 from esben-semmle/js/unknown-bound-event-handler-receiver
...
Approved by xiemaisi
2019-01-16 08:36:11 +00:00
semmle-qlci
8655e5ae17
Merge pull request #768 from xiemaisi/js/call-summaries
...
Approved by asger-semmle
2019-01-16 08:35:31 +00:00
Asger F
3ed9575529
TS: add support for bigints
2019-01-14 18:26:09 +00:00
Asger F
1c6deb65cd
TS: update test expectation
2019-01-14 18:15:30 +00:00
Asger F
f4c89601ff
JS: fix typo
2019-01-14 15:34:01 +00:00
Asger F
ad6add383c
JS: improve concatenation-sanitizer for property injection
2019-01-14 15:34:01 +00:00
semmle-qlci
955bad0618
Merge pull request #640 from asger-semmle/lodash-case
...
Approved by esben-semmle
2019-01-14 07:59:59 +00:00
Esben Sparre Andreasen
b35c4b2a9a
JS: support FP pattern for js/unbound-event-handler-receiver
2019-01-14 08:47:37 +01:00
semmle-qlci
9c41b214ee
Merge pull request #748 from esben-semmle/js/fix/js/useless-assignment-to-property
...
Approved by xiemaisi
2019-01-13 21:40:35 +00:00
semmle-qlci
04c15028ab
Merge pull request #750 from aschackmull/javascript/autoformat
...
Approved by xiemaisi
2019-01-11 16:35:38 +00:00
Anders Schack-Mulligen
db9407bae5
Javascript: Update .expected files.
2019-01-11 14:27:16 +01:00
semmle-qlci
b0dd3dfeb1
Merge pull request #502 from xiemaisi/js/summaries
...
Approved by asger-semmle
2019-01-11 10:27:03 +00:00
Max Schaefer
f9d704bdcf
JavaScript: Add example of indirect command injection.
2019-01-11 10:24:41 +00:00
Anders Schack-Mulligen
e58094c732
Javascript: Autoformat.
2019-01-11 11:02:42 +01:00
Max Schaefer
7d2d33840a
JavaScript: Track flow through forwarding higher-order calls.
2019-01-11 09:15:58 +00:00
Max Schaefer
edc5117dfd
JavaScript: Track flow into (simple) higher-order function calls.
...
The only case we support for now are functions that invoke one of their arguments, passing another argument as input.
2019-01-11 08:11:15 +00:00
Esben Sparre Andreasen
d3543b74c0
JS: fixup: use the basic block of the actual write (ODASA-7636)
2019-01-11 08:34:17 +01:00
Max Schaefer
583734a4e2
JavaScript: Fix semantic merge conflict.
...
https://github.com/Semmle/ql/pull/698 removed `document.cookie` as a remote flow source, which some of the tests relied on. We now use `location.search` instead.
2019-01-09 16:09:06 +00:00
Max Schaefer
97e6c75b94
JavaScript: Remove a few other deprecated predicates and classes.
2019-01-09 09:23:59 +00:00
Max Schaefer
8f1c5db8be
JavaScript: Change encoding of member and parameter portals for readability.
2019-01-09 09:10:45 +00:00
Max Schaefer
8e36c60326
JavaScript: Add a few examples that cause cyclic portals.
2019-01-09 09:09:58 +00:00
Max Schaefer
132570940a
JavaScript: Add support for annotation comments specifying additional sources and sinks.
2019-01-09 09:09:58 +00:00
Max Schaefer
f4fed3657d
JavaScript: Add flow summary extraction queries.
2019-01-09 09:09:58 +00:00
Max Schaefer
98a763ae4b
JavaScript: Add QL library for modelling portals between npm packages.
2019-01-09 09:06:55 +00:00
Asger F
6816f33a3d
JS: Handle case-insensitive lodash imports
2019-01-08 12:29:28 +00:00
Max Schaefer
b4f400fb23
Merge remote-tracking branch 'upstream/next' into qlucie/master
2019-01-04 10:35:57 +00:00
semmle-qlci
8174fb51ae
Merge pull request #705 from asger-semmle/loop-index-concurrent-modification
...
Approved by mc-semmle, xiemaisi
2019-01-03 17:06:12 +00:00
Max Schaefer
0a2df6c00d
JavaScript: Highlight id attribute (not entire element) in AmbiguousIdAttribute.
2019-01-02 11:44:02 +00:00
Asger F
9f22da4557
JS: rename query to "Loop iteration skipped due to shifting"
2019-01-02 11:34:06 +00:00
Asger F
8c3b44a525
JS: address comments
2019-01-02 11:12:52 +00:00
Esben Sparre Andreasen
c57f8a6d6e
Merge pull request #691 from asger-semmle/sendfile-root
...
JS: Recognize 'root' option in Express res.sendFile
2018-12-19 16:06:15 +01:00
semmle-qlci
495a1fcf3b
Merge pull request #698 from asger-semmle/remove-cookie-as-source
...
Approved by esben-semmle
2018-12-19 15:05:44 +00:00
semmle-qlci
b11b714152
Merge pull request #696 from esben-semmle/js/host-request-forgery
...
Approved by asger-semmle
2018-12-19 15:04:08 +00:00
Asger F
ce18aca62b
JS: update expected output
2018-12-19 11:30:46 +00:00
Asger F
0e40717358
JS: recognize res.sendfile root option
2018-12-19 10:25:15 +00:00
Asger F
f84301e476
JS: add tests with res.sendFile root option
2018-12-19 10:25:15 +00:00
Asger F
7f538e82c0
JS: add test case for non-whitelisted use of location
2018-12-18 13:55:05 +00:00
Asger F
02978c97f1
JS: whitelist $(location) in simple cases
2018-12-18 13:11:42 +00:00
Asger F
c17eca90a1
JS: add test case for $(location)
2018-12-18 13:06:12 +00:00
semmle-qlci
c37d655fe8
Merge pull request #697 from esben-semmle/js/fix-heuristics-compilation-time
...
Approved by asger-semmle
2018-12-18 09:07:36 +00:00
Asger F
280382e91e
JS: whitelist if array access at another index is seen
2018-12-17 15:19:26 +00:00
Asger F
5040d3e26c
JS: add query for loop index bug
2018-12-17 13:35:44 +00:00
Jonas Jensen
5ac5aa0c2a
Merge remote-tracking branch 'upstream/master' into mergeback-20181217
2018-12-17 13:42:45 +01:00
Asger F
7adf1d9958
Merge pull request #631 from esben-semmle/js/bad-url-regexing
...
JS: add query: js/incomplete-url-regexp
2018-12-17 11:53:22 +00:00
Esben Sparre Andreasen
50cba92f5f
JS: remove slow test Security/heuristics/AdditionalCommandInjections
2018-12-17 10:58:46 +01:00
Esben Sparre Andreasen
c6b4e29b93
JS: add "host" as a sink for js/request-forgery
2018-12-17 10:32:30 +01:00
Esben Sparre Andreasen
60fe0176ed
JS: add ClientRequest::getHost
2018-12-17 10:32:30 +01:00
Aditya Sharad
7bc729a7dc
Merge master into next.
2018-12-14 10:16:47 +00:00
