aegilops
|
1744a98017
|
Added full stop to end of message
|
2024-07-01 16:53:22 +01:00 |
|
aegilops
|
ceda46e317
|
Fixed ending <p> tags
|
2024-07-01 16:52:28 +01:00 |
|
aegilops
|
a1b0703690
|
Added detection for specific Polyfill.io CDN compromise - edited existing library and added new query and tests
|
2024-07-01 16:21:34 +01:00 |
|
aegilops
|
fc6fba8d06
|
Fixed CWE tags
|
2024-07-01 14:25:47 +01:00 |
|
aegilops
|
d1d082982a
|
More external references
|
2024-07-01 14:25:29 +01:00 |
|
am0o0
|
b360c8adb8
|
Update hardcodedCredentials query file to only exclude 'jwt key' kind from with the isTestFile predicate.
According to expected test results, with a new query, the jwt sinks of __test__/ dir have been exluded from query results.
|
2024-07-01 15:00:08 +02:00 |
|
am0o0
|
5a1877547f
|
update test cases of __tests__/ dir
since we want to check if a jwt related sink is in this dir or not
|
2024-07-01 14:50:07 +02:00 |
|
am0o0
|
6ecd8b7ee8
|
add new default cred kind
|
2024-07-01 14:42:34 +02:00 |
|
am0o0
|
fa8c457015
|
move the TextEncoder and Buffer jose.base64url taint steps to a local query taint step
|
2024-07-01 12:11:53 +02:00 |
|
am0o0
|
60aa711005
|
implement TextEncoderStep taint step with globalVarRef predicate
|
2024-07-01 11:59:05 +02:00 |
|
am0o0
|
65fdb8ccce
|
move jose SharedTaintStep to a local taint step, add more additional steps with test cases, update test cases and expected test results
|
2024-07-01 11:38:17 +02:00 |
|
Arthur Baars
|
b12b33c8f9
|
Merge remote-tracking branch 'upstream/main' into 'rc/3.14'
|
2024-06-28 19:50:35 +02:00 |
|
Erik Krogh Kristensen
|
60811116ab
|
Merge pull request #16332 from erik-krogh/ts55
JS: upgrade TypeScript to 5.5
|
2024-06-28 13:59:52 +02:00 |
|
Maiky
|
d0cf2a978c
|
Merge branch 'main' into maikypedia/javascript-cors
|
2024-06-27 20:24:42 +02:00 |
|
aegilops
|
f22778960b
|
Fixed expected test results for Helmet query
|
2024-06-26 11:31:57 +01:00 |
|
github-actions[bot]
|
fd385736e6
|
Post-release preparation for codeql-cli-2.17.6
|
2024-06-25 06:39:45 +00:00 |
|
github-actions[bot]
|
e32a587078
|
Release preparation for version 2.17.6
|
2024-06-24 14:33:10 +00:00 |
|
Mauro Baluda
|
b75514c990
|
Merge branch 'github:main' into main
|
2024-06-21 13:36:38 +02:00 |
|
Erik Krogh Kristensen
|
db768960f4
|
Merge pull request #15060 from am0o0/amammad-js-envinjection
JS: Env Injection query
|
2024-06-20 21:27:21 +02:00 |
|
Erik Krogh Kristensen
|
555d7e5958
|
Merge pull request #14293 from am0o0/amammad-js-CodeInjection_dynamic_import
JS: Dynamic import as code injection sink
|
2024-06-20 21:19:57 +02:00 |
|
erik-krogh
|
0de4fd8430
|
add test for the better type-narrowing in TS 5.5
|
2024-06-20 20:55:44 +02:00 |
|
erik-krogh
|
9966be6975
|
update to the stable release of TypeScript 5.5
|
2024-06-20 20:47:43 +02:00 |
|
erik-krogh
|
b936f725b5
|
update to 5.5.1-rc
|
2024-06-20 20:43:01 +02:00 |
|
erik-krogh
|
a691ec01b3
|
add test for the inferred type predicates in TS5.5
|
2024-06-20 20:42:59 +02:00 |
|
erik-krogh
|
5336a1a251
|
upgrade TypeScript to 5.5-beta
|
2024-06-20 20:42:57 +02:00 |
|
Erik Krogh Kristensen
|
60ed51781e
|
Merge pull request #16790 from github/max-schaefer-patch-1
JavaScript: Fix CodeQL alert in extractor
|
2024-06-20 20:20:00 +02:00 |
|
Erik Krogh Kristensen
|
e84028d01e
|
Merge pull request #14088 from am0o0/amammad-js-JWT
JS: decoding JWT without signature verification
|
2024-06-20 20:13:40 +02:00 |
|
Asger F
|
a36e39359f
|
Merge pull request #16739 from RasmusWL/js-array-steps
JS: Allow many Array steps to be used in type-tracking
|
2024-06-20 11:39:46 +02:00 |
|
Rasmus Wriedt Larsen
|
596102d3fb
|
Update javascript/ql/lib/change-notes/2024-06-14-type-tracking-array-steps.md
Co-authored-by: Asger F <asgerf@github.com>
|
2024-06-20 10:07:49 +02:00 |
|
aegilops
|
1ecd72727d
|
Renamed README to CUSTOMIZING, removed details from qhelp and referenced md doc instead
|
2024-06-19 17:59:43 +01:00 |
|
aegilops
|
a07639f4f6
|
Set severity to 7.0, in line with other configuration queries
|
2024-06-19 17:43:41 +01:00 |
|
aegilops
|
26f1b36736
|
Fixed formatting
|
2024-06-19 17:41:58 +01:00 |
|
aegilops
|
252c9e9416
|
Added data extension to set defaults, updated help, added README to explain customization
|
2024-06-19 17:27:17 +01:00 |
|
Max Schaefer
|
2be171746b
|
JavaScript: Fix CodeQL alert in extractor
This doesn't make a difference in practice because we only run the method on arrays of even length, but we might as well fix it.
|
2024-06-19 17:13:01 +01:00 |
|
Paul Hodgkinson
|
3a98edb60b
|
Merge branch 'main' into aegilops/js/insecure-helmet-middleware
|
2024-06-19 12:53:32 +01:00 |
|
aegilops
|
d142f830da
|
Change note and changed name of query in .ql file
|
2024-06-19 12:04:32 +01:00 |
|
aegilops
|
8a3cec4977
|
Fix formatting for check
|
2024-06-19 11:38:20 +01:00 |
|
Paolo Tranquilli
|
b7a2ea8981
|
CI: accept other diagnostic format related test changes
|
2024-06-19 11:33:50 +02:00 |
|
aegilops
|
de96d3951d
|
Renamed to helmetProperty everywhere
|
2024-06-19 10:15:06 +01:00 |
|
aegilops
|
f4691b1919
|
Changed to more-modern Dataflow libraries
|
2024-06-19 10:11:06 +01:00 |
|
aegilops
|
81ef255a87
|
Change to helmetProperty from helmetSetting variable name
|
2024-06-19 10:09:50 +01:00 |
|
aegilops
|
da9e1e61a4
|
Moved examples into separate files
|
2024-06-18 19:50:06 +01:00 |
|
Rasmus Wriedt Larsen
|
3fc8401370
|
JS: Add change-note
|
2024-06-14 15:37:25 +02:00 |
|
Rasmus Wriedt Larsen
|
3f2befc3e5
|
JS: Support spread arguments in array.splice
|
2024-06-14 15:33:17 +02:00 |
|
Rasmus Wriedt Larsen
|
269f8ca2cd
|
JS: Add splice(...arr) test
|
2024-06-14 15:19:56 +02:00 |
|
Rasmus Wriedt Larsen
|
68ccec3d43
|
JS: Prepare for new test
|
2024-06-14 15:18:47 +02:00 |
|
Rasmus Wriedt Larsen
|
194ef607f7
|
JS: Updated .expected
|
2024-06-14 14:49:34 +02:00 |
|
am0o0
|
4e1f7a930d
|
fix invalid js file sample in qlhelp
|
2024-06-14 13:47:01 +02:00 |
|
Cornelius Riemenschneider
|
ede0b5bdf4
|
Merge remote-tracking branch 'origin/main' into criemen/codeql-pack-group
|
2024-06-13 21:53:31 +02:00 |
|
am0o0
|
bb03a9faba
|
format the query file
|
2024-06-13 14:54:29 +02:00 |
|