Napalys
f8d623e905
JS: Bumped TS version to 5.7.2
2024-11-25 09:08:51 +01:00
Napalys Klicius
61e00861e5
Merge pull request #18008 from Napalys/napalys/ES2024-group-functions
...
JS: Added support for [Object, Map].groupBy ES2024 feature
2024-11-21 19:03:57 +01:00
Alexander Eyers-Taylor
c0474c4e45
Revert "Revert "Post-release preparation for codeql-cli-2.19.4""
2024-11-21 15:37:52 +00:00
Alexander Eyers-Taylor
4effe9e364
Revert "Post-release preparation for codeql-cli-2.19.4"
2024-11-21 14:43:15 +00:00
Napalys Klicius
7ee0a7b398
Update javascript/ql/lib/semmle/javascript/Collections.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2024-11-21 14:02:42 +01:00
Napalys Klicius
edb9b47111
Merge pull request #18047 from Napalys/napalys/ES2023-string-protytpe-toWellFormed
...
JS: Added taint-step String.prototype.toWellFormed ES2023 feature
2024-11-21 14:01:21 +01:00
Asger F
930a7b6e28
JS: Update output changes to nodes/edges/subpaths
2024-11-21 13:33:39 +01:00
Asger F
7a77432024
JS: Update lost result in insecure-download
...
The VariableCapture library consumes one component of the access path limit, which means we lose this result
2024-11-21 13:33:10 +01:00
Asger F
1ac7591faf
JS: Update missed flow in capture-flow.js
...
We previously caught this flow because of a heuristic in capture flow. We'll have to fix it properly later.
2024-11-21 12:57:34 +01:00
Asger F
9dad2d62d7
JS: Update DataFlowConsistency
2024-11-21 12:54:11 +01:00
Asger F
ce00bd2cc9
JS: More docs
2024-11-21 11:06:43 +01:00
Asger F
4e62a512c5
JS: Only apply exception propagator when no other summary applies
...
Previously a few Promise-related methods were special-cased, which is no longer needed.
2024-11-21 11:01:05 +01:00
Asger F
84820adf3c
Add test for exception flow out of finally()
2024-11-21 11:01:03 +01:00
Asger F
948d21ca07
JS: Propagate exceptions from summarized callables by default
2024-11-21 10:24:31 +01:00
Asger F
dcdb2e5133
JS: Fix callback check so it works without parameters
2024-11-21 10:24:29 +01:00
Asger F
b7dd455aff
JS: Add test case
2024-11-21 09:21:36 +01:00
Napalys Klicius
82ca369dce
Merge pull request #18005 from Napalys/napalys/ES2022-find-functions
...
JS: Added support for Array.prototype.[findLastIndex, findLast] ES2022 feature
2024-11-21 08:01:19 +01:00
Napalys
43eda58f83
Added change notes
2024-11-20 17:44:36 +01:00
Napalys
afc2d3e6d2
JS: Add: String.protytpe.toWellFormed to StringManipulationTaintStep
2024-11-20 17:42:25 +01:00
Napalys
09f73d8d6f
JS: Add: test cases for toWellFormed
2024-11-20 17:36:43 +01:00
Napalys
64c45debdb
JS: removed unnecessary getALocalSource from ArrayCallBackDataFlowStep
2024-11-20 14:57:00 +01:00
Napalys
9dbf7d1828
JS: removed unnecessary getALocalSource from ArrayCallBackDataTaintStep
2024-11-20 14:54:06 +01:00
Napalys
cdf43f7118
Added change notes
2024-11-20 14:06:44 +01:00
Asger F
d52bc971b8
Merge branch 'main' into js/shared-dataflow-merge-main
2024-11-20 14:05:03 +01:00
Napalys Klicius
a957e00fe5
Merge branch 'main' into napalys/ES2024-group-functions
2024-11-20 14:03:31 +01:00
Napalys
58faa2d71e
JS: Add: dataflow step for static method of groupBy from Map.
2024-11-20 13:34:11 +01:00
Napalys
6344f83e4b
JS: Add: tests for taint tracking in groupBy functions
2024-11-20 13:22:53 +01:00
github-actions[bot]
3909df75dc
Post-release preparation for codeql-cli-2.19.4
2024-11-19 17:54:03 +00:00
Alex Eyers-Taylor
ef3fc5e29f
Fix broken changelog.
2024-11-19 16:34:30 +00:00
github-actions[bot]
9783a11565
Release preparation for version 2.19.4
2024-11-19 16:21:37 +00:00
Napalys
28ead4011a
JS: Add: taint step to handle propagation of data flow from the array to callback
2024-11-19 14:15:15 +01:00
Napalys
f1e95a8a1d
JS: Add: taint step test cases for findLastIndex, findLast, find
2024-11-19 14:09:58 +01:00
Asger F
d1c9e47d23
JS: More aggressive test file classification
2024-11-19 13:23:32 +01:00
Asger F
01669908f2
JS: Block InsecureRandomness flow into test files
2024-11-19 13:23:31 +01:00
Asger F
80a5a5909e
JS: Use getUnderlyingValue() a few places in VariableCapture
2024-11-19 13:23:29 +01:00
Asger F
d2daec4c66
JS: Add tests explaining why the IIFE in f2 didn't work
2024-11-19 13:23:24 +01:00
Napalys
c03d69af1e
JS: Add: dataflow step for find, findLast, findLastIndex callback functions
2024-11-19 09:42:11 +01:00
Napalys
b64b837db3
JS: Add: test cases for find, findLast, findLastIndex with callbacks
2024-11-19 09:35:43 +01:00
Napalys
1b0f8aa657
JS: removed unnecessary findlast module import
2024-11-19 09:30:05 +01:00
Napalys
72a69cfa17
Added change notes
2024-11-19 08:24:36 +01:00
Asger F
023dcce400
JS: Disable variable capture heuristic
...
Bailing out can be more expensive as the resulting jump steps themselves
cause perf issues. The limit of 100 variables per scope has also been
added in the interim, which handles the cases that this needed to cover.
2024-11-18 13:44:10 +01:00
Asger F
37676f41aa
JS: Remove jump steps from IIFE steps
2024-11-18 13:38:34 +01:00
Asger F
7f2eae0966
JS: Add test case for false flow through IIFEs
...
We generate local flow steps into and out of IIFEs, but these come jump steps automatically, resulting in FPs.
2024-11-18 13:34:35 +01:00
Asger F
7acc5689cf
JS: Port exception steps to a universal summary
2024-11-18 13:27:58 +01:00
Asger F
5ed362f7d6
JS: Add exception test case
2024-11-18 13:23:09 +01:00
Napalys
213ce225e0
JS: Add: taint step for Object.groupBy function, fixed test cases from 8ae05d8be4
2024-11-18 12:58:07 +01:00
Napalys
8ae05d8be4
JS: Add: test case for Object.groupBy
2024-11-18 12:55:17 +01:00
Napalys
c02ad65fdc
JS: Add: taint step for Map.groupBy function
2024-11-18 12:50:06 +01:00
Napalys
3786ad4277
JS: Add: test case for Map.groupBy
2024-11-18 12:44:49 +01:00
Napalys
1304ab7065
Added change notes
2024-11-18 08:05:51 +01:00
