github-actions[bot]
|
980f822983
|
Post-release preparation for codeql-cli-2.8.2
|
2022-03-01 09:24:30 +00:00 |
|
Erik Krogh Kristensen
|
4c58f9781b
|
add support for TypeScript 4.6
|
2022-03-01 09:56:21 +01:00 |
|
Erik Krogh Kristensen
|
2b7c819135
|
fix extension of change-note
|
2022-03-01 09:54:19 +01:00 |
|
Erik Krogh Kristensen
|
4fba5e4dfb
|
step through parentheses in barrier functions
|
2022-02-25 17:47:12 +01:00 |
|
Asger F
|
a8bfebaeb6
|
Merge pull request #8149 from asgerf/shared/use-shared-access-path-syntax
Shared: use shared access path syntax to parse arguments in CSV rows
|
2022-02-25 14:04:18 +01:00 |
|
Tom Bolton
|
8dfc0d25d1
|
Merge pull request #8232 from github/tombolton/use-updated-counting-query
Add new xss queries to result counting query
|
2022-02-24 16:38:53 +00:00 |
|
github-actions[bot]
|
20fe22c8c8
|
Release preparation for version 2.8.2
|
2022-02-24 14:57:08 +00:00 |
|
tombolton
|
d80ef6566d
|
add new xss queries to result counting query
|
2022-02-24 13:31:40 +00:00 |
|
Erik Krogh Kristensen
|
ad3399733b
|
recognize more module exports from the factory pattern
|
2022-02-23 21:29:45 +01:00 |
|
Erik Krogh Kristensen
|
e13b2df86f
|
Merge pull request #8185 from erik-krogh/amdImp
JS: recognize modules imported by AMD imports as library inputs
|
2022-02-23 20:21:45 +01:00 |
|
Asger Feldthaus
|
f1bfb31403
|
Shared: fix typo in a comment
|
2022-02-23 14:13:41 +01:00 |
|
Asger Feldthaus
|
abd4933d6c
|
Shared: move numeric parsing into AccessPathSyntax.qll
|
2022-02-23 14:13:37 +01:00 |
|
CodeQL CI
|
7d55771092
|
Merge pull request #8150 from asgerf/js/prep-sharing-api-graph-mad
Approved by erik-krogh
|
2022-02-23 11:59:31 +00:00 |
|
CodeQL CI
|
62ee8fce3a
|
Merge pull request #8186 from asgerf/js/request-forgery-docs-followup
Approved by esbena, hubwriter
|
2022-02-23 11:46:37 +00:00 |
|
Stephan Brandauer
|
a664e02d04
|
Merge pull request #8014 from kaeluka/js/functionality-from-untrusted-source
JS: Functionality from untrusted sources query (CWE-830)
|
2022-02-23 12:45:31 +01:00 |
|
Stephan Brandauer
|
1ed71e15f3
|
apply docreview feedback
|
2022-02-23 11:21:22 +01:00 |
|
Stephan Brandauer
|
517d6969e1
|
Merge pull request #8171 from kaeluka/js/update-atm-query-docs-for-nosql-sql-injection
update ATM NosqlInjection and SqlInjection query docs
|
2022-02-23 10:54:37 +01:00 |
|
Asger Feldthaus
|
22ba43fff6
|
JS: Minor fixup in the client-side request forgery qhelp
|
2022-02-23 10:54:26 +01:00 |
|
Erik Krogh Kristensen
|
203212657e
|
recognize modules imported by AMD imports as library inputs
|
2022-02-23 10:39:45 +01:00 |
|
Stephan Brandauer
|
c17d8b145a
|
Merge pull request #8054 from asgerf/js/split-request-forgery
JS: split request forgery query into server-side and client-side variants
|
2022-02-23 10:27:16 +01:00 |
|
Esben Sparre Andreasen
|
58e0d54744
|
Merge pull request #8168 from github/esbena/hapi-reflected-xss
JS: model hapi handler returns as reflected-xss sinks
|
2022-02-23 08:53:15 +01:00 |
|
Erik Krogh Kristensen
|
73f2e89f3e
|
Merge pull request #8165 from erik-krogh/protoWrite
JS: support more property writes in js/prototype-pollution-utility
|
2022-02-22 21:30:22 +01:00 |
|
Erik Krogh Kristensen
|
b6b93065ff
|
Merge pull request #8157 from erik-krogh/lodash-clone
JS: add lodash.{clone, cloneDeep} as a clone step
|
2022-02-22 18:12:10 +01:00 |
|
Erik Krogh Kristensen
|
c487bb73a7
|
Merge pull request #8143 from erik-krogh/pred-ql-style
QL: add ql-for-ql query for detecting bad predicate qldoc
|
2022-02-22 17:49:12 +01:00 |
|
Stephan Brandauer
|
6a9186cdef
|
update ATM NosqlInjection and SqlInjection query docs
|
2022-02-22 16:56:18 +01:00 |
|
Esben Sparre Andreasen
|
2c527f7b35
|
model hapi handler returns as reflected-xss sinks
|
2022-02-22 14:12:01 +01:00 |
|
Erik Krogh Kristensen
|
517e17d422
|
support more property writes in js/prototype-pollution-utility, and generalize ObjectDefinePropertyAsPropWrite
|
2022-02-22 13:23:34 +01:00 |
|
Henry Mercer
|
4f7604f0dd
|
Merge pull request #8151 from github/henrymercer/separate-atm-model-pack
|
2022-02-22 11:47:35 +00:00 |
|
Stephan Brandauer
|
2278e7f6e6
|
CWE 830 polish error messages
|
2022-02-22 11:41:54 +01:00 |
|
Stephan Brandauer
|
82330391c3
|
CWE-830 add support for setting attributes via setAttribute method
|
2022-02-22 11:41:54 +01:00 |
|
Stephan Brandauer
|
d80cd1aeb5
|
CWE 830 test where both branches in a ternary are unsafe
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
2934aa1a3a
|
rewrite docs, improve error messages, etc
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
d2335b65d5
|
stylistic improvements after review
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
9aec4437e2
|
polish qhelp for CWE-830 and add test file
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
44d86569ac
|
remove illegal chars from comments
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
fd77e27ed9
|
replace taint tracking by type tracking and merge remaining queries for CWE-830
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
8cafa6d562
|
improve error message in CWE-830
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
780fa97869
|
always require integrity checking for certain CDNs
|
2022-02-22 11:41:53 +01:00 |
|
Stephan Brandauer
|
83764df4f5
|
rename tests for CW-830 to clarify responsibilities
|
2022-02-22 11:41:52 +01:00 |
|
Stephan Brandauer
|
8d397fea09
|
JS: query to find dynamic creations of DOM elements that use untrusted sources
|
2022-02-22 11:41:52 +01:00 |
|
Stephan Brandauer
|
b35c70994f
|
permit http urls to 127.0.0.1 and others
|
2022-02-22 11:41:52 +01:00 |
|
Stephan Brandauer
|
dd2b779a3c
|
add CWE 830 link to references
|
2022-02-22 11:41:52 +01:00 |
|
Stephan Brandauer
|
b170422c22
|
add changenotes for functionality from untrusted source query
|
2022-02-22 11:41:52 +01:00 |
|
Stephan Brandauer
|
6722c17bb0
|
JS: Functionality from untrusted sources query (CWE-830)
|
2022-02-22 11:41:52 +01:00 |
|
Asger Feldthaus
|
1be47db2e6
|
JS: Factor out more JS-specific code
|
2022-02-22 09:51:56 +01:00 |
|
Asger Feldthaus
|
2d509eb345
|
JS: Make Impl.qll determine the location of AccessPathSyntax.qll
|
2022-02-22 09:51:52 +01:00 |
|
Asger Feldthaus
|
42a3d8c689
|
JS: Treat Member[x] as a language-specific token
In Ruby it is ambiguous whether Member[foo] means x.foo or x::foo
|
2022-02-22 09:51:52 +01:00 |
|
Asger Feldthaus
|
acf95d6178
|
JS: Move summary resolution into JS-specific code
|
2022-02-22 09:51:52 +01:00 |
|
Asger Feldthaus
|
ab1642dd3f
|
JS: Rename {Shared,Impl} -> ApiGraphModels{,Specific}
|
2022-02-22 09:51:48 +01:00 |
|
Erik Krogh Kristensen
|
e8df6a14ca
|
add lodash.{clone, cloneDeep} as a clone step
|
2022-02-21 22:27:29 +01:00 |
|