Erik Krogh Kristensen
|
cbad705029
|
general performance improvements in the ReDoS utility library
|
2020-12-21 11:49:21 +01:00 |
|
Erik Krogh Kristensen
|
05569187b4
|
improve performance of suffix checking
|
2020-12-18 17:21:15 +01:00 |
|
Erik Krogh Kristensen
|
6369374224
|
implement new algorithm for detecting superlinear backtracking in regular expressions
|
2020-12-18 17:21:15 +01:00 |
|
Erik Krogh Kristensen
|
7ce91e9146
|
introduce cannonical representatives of RegExpTerms to decrease the number of InputSymbols in the NFA
|
2020-12-18 17:21:11 +01:00 |
|
Erik Krogh Kristensen
|
b2116dc5b4
|
add more tests for polynomial/exponential redos
|
2020-12-18 13:19:17 +01:00 |
|
CodeQL CI
|
41ef7a3fce
|
Merge pull request #4733 from erik-krogh/args
Approved by esbena
|
2020-12-16 06:51:26 -08:00 |
|
CodeQL CI
|
287954e0d8
|
Merge pull request #4686 from erik-krogh/buildFp
Approved by esbena
|
2020-12-16 06:42:41 -08:00 |
|
CodeQL CI
|
66f4120cdd
|
Merge pull request #4721 from github/nextReDoS
Approved by asgerf
|
2020-12-14 01:48:12 -08:00 |
|
CodeQL CI
|
9ff6d68a9b
|
Merge pull request #4778 from asgerf/js/more-prototype-pollution
Approved by erik-krogh, mchammer01
|
2020-12-11 13:58:09 -08:00 |
|
CodeQL CI
|
8129d0c0ac
|
Merge pull request #4762 from asgerf/js/template-sinks-in-code-injection
Approved by erik-krogh, mchammer01
|
2020-12-07 04:35:11 -08:00 |
|
Asger Feldthaus
|
254ac7f963
|
JS: Fix TypeofCheck
|
2020-12-07 10:46:00 +00:00 |
|
Asger Feldthaus
|
f132b4a279
|
JS: Add type confusion sink for prototype pollution checks
|
2020-12-07 10:16:38 +00:00 |
|
Asger Feldthaus
|
daab3c1437
|
JS: Add tests and fix some bugs
|
2020-12-07 10:16:38 +00:00 |
|
Asger Feldthaus
|
0a7513fdfb
|
JS: Move and rename test cases as well
|
2020-12-07 10:16:38 +00:00 |
|
CodeQL CI
|
0f5f0ed99e
|
Merge pull request #4776 from asgerf/js/electron-openshell
Approved by erik-krogh
|
2020-12-04 09:12:44 +00:00 |
|
Erik Krogh Kristensen
|
cc98c41dd6
|
revert marking repetitions with possibly empty body as forks
|
2020-12-03 20:08:07 +01:00 |
|
Erik Krogh Kristensen
|
3bad75dae5
|
better support for forms in js/xss-through-dom
|
2020-12-03 16:57:41 +01:00 |
|
Asger Feldthaus
|
20d9848f07
|
JS: Add test case
|
2020-12-03 15:08:43 +00:00 |
|
Asger Feldthaus
|
68d2bc861d
|
JS: Update test expectations
|
2020-12-03 15:01:50 +00:00 |
|
Asger Feldthaus
|
5676891e44
|
JS: Add TemplateLiteralTypeExpr
|
2020-12-03 13:58:39 +00:00 |
|
CodeQL CI
|
edbbc846d0
|
Merge pull request #4753 from max-schaefer/js/more-nosql-query-args
Approved by asgerf, mchammer01
|
2020-12-03 08:46:47 +00:00 |
|
Asger Feldthaus
|
6211fe718b
|
JS: Add test
|
2020-12-01 17:05:48 +00:00 |
|
Erik Krogh Kristensen
|
9a31ed13ac
|
add test case
|
2020-12-01 09:18:40 +01:00 |
|
Max Schaefer
|
978d2db252
|
JavaScript: Add models for more Mongoose methods.
|
2020-11-30 16:32:13 +00:00 |
|
Erik Krogh Kristensen
|
33b2701551
|
refine isFork to remove false positive when a state has epsilon transition to itself
|
2020-11-29 21:42:50 +01:00 |
|
Erik Krogh Kristensen
|
d7b22e3b1b
|
update expected output for PolynomialBackTracking
|
2020-11-27 20:15:27 +01:00 |
|
Erik Krogh Kristensen
|
729073fb43
|
detect ReDoS when the choices are "match some string" or "match Epsilon"
|
2020-11-27 20:15:23 +01:00 |
|
Erik Krogh Kristensen
|
e177d46c0a
|
add two test cases that demonstrate the limits of the suffix construction
|
2020-11-27 13:45:34 +01:00 |
|
Erik Krogh Kristensen
|
fd0d5c9e46
|
add command parsing model for "commander"
|
2020-11-27 09:58:00 +00:00 |
|
Erik Krogh Kristensen
|
653ebf7668
|
add command parsing model for "dashdash"
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
269de49196
|
add model for "meow"
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
c5ac98d2e8
|
add command parsing model for command-line-args
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
f33cd8bc8e
|
add command parsing model for argparse
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
45067ee651
|
add command parsing model for "arg"
|
2020-11-27 09:57:05 +00:00 |
|
Erik Krogh Kristensen
|
821b4be522
|
more accurately model command parsers that take process.argv as an argument
|
2020-11-27 09:56:50 +00:00 |
|
Erik Krogh Kristensen
|
9468a6e8dc
|
update expected output
|
2020-11-26 12:32:55 +01:00 |
|
Erik Krogh Kristensen
|
1b3c3ef4cb
|
adjust comments in ReDoS test case
|
2020-11-26 10:31:44 +01:00 |
|
Erik Krogh Kristensen
|
b418cb5fe0
|
add test case where the successor of the repeating term matches epsilon
|
2020-11-25 13:59:10 +01:00 |
|
Erik Krogh Kristensen
|
c5f5206174
|
update expected output
|
2020-11-25 13:57:20 +01:00 |
|
Erik Krogh Kristensen
|
a8944c8953
|
model accept states more accurately by adding an AcceptAny state, modelling $, and checking the existence of rejecting suffixes
|
2020-11-25 13:57:20 +01:00 |
|
Erik Krogh Kristensen
|
d9ebb7b20e
|
escape tabs
|
2020-11-25 13:57:20 +01:00 |
|
Erik Krogh Kristensen
|
bcb2f2768d
|
search for a prefix to the state that causes exponential backtracking
|
2020-11-25 13:57:20 +01:00 |
|
CodeQL CI
|
395403789e
|
Merge pull request #4585 from erik-krogh/moreReDoS
Approved by asgerf
|
2020-11-24 18:52:36 +00:00 |
|
CodeQL CI
|
4be158b362
|
Merge pull request #4708 from erik-krogh/emptyName
Approved by asgerf
|
2020-11-24 17:34:55 +00:00 |
|
Erik Krogh Kristensen
|
33dab1717e
|
treat nodes with type "Location" as a location source - but not if we can track it from an original node with type "Location"
|
2020-11-23 17:03:50 +01:00 |
|
Erik Krogh Kristensen
|
f7f9beeefd
|
avoid reporting empty names in js/exposure-of-private-files
|
2020-11-23 14:24:42 +01:00 |
|
Erik Krogh Kristensen
|
02d5fbf46b
|
remove superfluous space
|
2020-11-23 14:22:16 +01:00 |
|
Asger Feldthaus
|
f737f34dcd
|
JS: Add UntrustedDataToExternalApi query
|
2020-11-19 13:42:25 +00:00 |
|
Erik Krogh Kristensen
|
c4153a617e
|
remove duplicated test cases from ReDoS, and adjust variables names to match test output
|
2020-11-18 14:49:09 +01:00 |
|
Erik Krogh Kristensen
|
8270bf5bb9
|
make the character search skip unencodable characters
|
2020-11-18 11:55:49 +01:00 |
|