github-actions[bot]
|
462da63970
|
Release preparation for version 2.12.4
|
2023-03-03 14:11:51 +00:00 |
|
Asger F
|
37999eaea0
|
JS: Fix implicit this
|
2023-03-03 13:43:17 +01:00 |
|
Asger F
|
7f96fe725b
|
JS: Change note
|
2023-03-03 12:21:20 +01:00 |
|
Asger F
|
38194c6ae7
|
JS: Extract import assertions to DB
|
2023-03-03 12:21:20 +01:00 |
|
erik-krogh
|
a6c9af4182
|
add the html argument to the jQuery functions as an XSS sink
|
2023-03-03 11:09:53 +01:00 |
|
erik-krogh
|
a928f4c9ef
|
add change-notes
|
2023-03-03 09:23:10 +01:00 |
|
erik-krogh
|
f96d6accbb
|
delete old deprecations
|
2023-03-03 09:23:02 +01:00 |
|
Erik Krogh Kristensen
|
64dad3db8a
|
Merge pull request #12333 from kaspersv/kaspersv/fix-join-order
ReflectedXss: Prevent bad join order
|
2023-03-01 12:48:30 +01:00 |
|
Kasper Svendsen
|
86925646f3
|
ReflectedXss: Prevent bad join order
|
2023-02-28 12:06:27 +01:00 |
|
Erik Krogh Kristensen
|
50aa5e072a
|
Merge pull request #12177 from erik-krogh/alias-html
JS: More precise type-test sanitizer guards in unsafe-html-construction
|
2023-02-27 18:16:11 +01:00 |
|
Erik Krogh Kristensen
|
927c322b7b
|
Merge pull request #11769 from erik-krogh/moreSan
JS: Sanitizer for `sanitizer(x) === true`
|
2023-02-27 15:48:34 +01:00 |
|
Alex Ford
|
7c85448cba
|
Merge pull request #12080 from alexrford/js-use-shared-cryptography
JS: Use shared `CryptographicOperation` concept
|
2023-02-27 12:26:38 +00:00 |
|
erik-krogh
|
0e60fc5512
|
Merge branch 'main' into alias-html
|
2023-02-27 09:16:25 +01:00 |
|
Erik Krogh Kristensen
|
f8f926ad50
|
Merge pull request #12175 from erik-krogh/reg-input
JS: add process.env and process.argv etc. as source for `js/regex-injection`
|
2023-02-27 09:12:02 +01:00 |
|
Erik Krogh Kristensen
|
4ffe20ae75
|
Merge pull request #12189 from erik-krogh/more-export
JS: also consider relative exports when finding library inputs
|
2023-02-27 09:02:55 +01:00 |
|
github-actions[bot]
|
8eb8daa4d4
|
Post-release preparation for codeql-cli-2.12.3
|
2023-02-16 17:23:25 +00:00 |
|
github-actions[bot]
|
b0315119c6
|
Release preparation for version 2.12.3
|
2023-02-16 11:49:06 +00:00 |
|
Alex Ford
|
9cfd0f5f46
|
JS: fix qldoc
|
2023-02-16 11:00:37 +00:00 |
|
Alex Ford
|
1556b1a728
|
Merge branch 'main' into js-use-shared-cryptography
|
2023-02-15 17:13:53 +00:00 |
|
Alex Ford
|
1958b9dcd5
|
JS: add missing qldoc
|
2023-02-15 16:59:03 +00:00 |
|
Alex Ford
|
43af306d60
|
dynamic: more detailed qldoc for CryptographicOperation#getBlockMode()
|
2023-02-15 16:55:18 +00:00 |
|
Alex Ford
|
e8cbf7287d
|
JS: breaking change note for CryptographicOperation sync
|
2023-02-15 16:50:24 +00:00 |
|
Alex Ford
|
925b4a3fa8
|
JS: improve documentation on deprecated CryptographicOperation#getInput() predicate
|
2023-02-15 16:23:46 +00:00 |
|
Alex Ford
|
d4d0b91085
|
dynamic: switch CryptographicOperation::Range#getBlockMode() back to being an abstract predicate
|
2023-02-15 16:23:46 +00:00 |
|
Alex Ford
|
c7aaad9ed0
|
JS: avoid adding a deprecated CryptographicOperation#getInput to py/ruby
|
2023-02-15 16:23:46 +00:00 |
|
erik-krogh
|
51ddb55d7b
|
use tainted-object to precisely model that plain object are fine, but their properties are not
|
2023-02-15 15:02:03 +01:00 |
|
erik-krogh
|
09794fa836
|
delete PrefixStringSanitizer
|
2023-02-15 14:55:02 +01:00 |
|
Rasmus Wriedt Larsen
|
c72dbc49fc
|
Merge pull request #12165 from RasmusWL/crypto-updates
Python/Ruby/JS Crypto: Add a few algorithms + block modes
|
2023-02-15 14:35:40 +01:00 |
|
erik-krogh
|
bec8dc6775
|
add explicit this
|
2023-02-15 10:44:57 +01:00 |
|
erik-krogh
|
b7305fd229
|
also consider relative exports when finding library inputs
|
2023-02-14 21:08:13 +01:00 |
|
erik-krogh
|
de4f5017e1
|
add change-note
|
2023-02-14 18:36:07 +01:00 |
|
Alex Ford
|
8d90c02a67
|
JS: remove unused field
|
2023-02-14 15:24:22 +00:00 |
|
erik-krogh
|
393649b7ce
|
don't call environment variables for command-line arguments
|
2023-02-14 14:27:41 +01:00 |
|
erik-krogh
|
36478124ae
|
add process.env and process.argv etc. as source for js/regex-injection
|
2023-02-14 14:21:53 +01:00 |
|
erik-krogh
|
943bdeca6d
|
make appliesTo recursive
|
2023-02-14 14:16:45 +01:00 |
|
erik-krogh
|
9549cac3e5
|
add an additional barrier guard that finds "=== true" versions of previous barrier guards
|
2023-02-14 14:15:23 +01:00 |
|
erik-krogh
|
3f0fe96f85
|
add getBoolValue() as a utility predicate on BooleanLiteral
|
2023-02-14 14:12:35 +01:00 |
|
Erik Krogh Kristensen
|
2f8c9a5a2c
|
Merge pull request #12171 from erik-krogh/reg-dot
JS: dont recognize regexps that match dot as sanitizers
|
2023-02-14 14:10:44 +01:00 |
|
Erik Krogh Kristensen
|
e3e2df3247
|
Merge pull request #12166 from erik-krogh/more-html-san
JS: add `HtmlSanitizer` as a sanitizer DOMBasedXss
|
2023-02-14 14:09:56 +01:00 |
|
Erik Krogh Kristensen
|
028fcc7edf
|
Merge pull request #11959 from erik-krogh/ssrfSan
JS: add encodeURIComponent as a sanitizer for request-forgery
|
2023-02-14 13:39:53 +01:00 |
|
Erik Krogh Kristensen
|
a498936f16
|
Merge pull request #12170 from erik-krogh/more-lib
JS: More library inputs
|
2023-02-14 13:38:00 +01:00 |
|
erik-krogh
|
c17d057520
|
default to index.js when no main: is specified in package.json, and recognize more classes as library inputs
|
2023-02-13 21:24:41 +01:00 |
|
erik-krogh
|
68656274f4
|
dont recognize regexps that match dot as sanitizers
|
2023-02-13 17:36:51 +01:00 |
|
erik-krogh
|
b85bfc8ba6
|
add HtmlSanitizer as a sanitizer for DOMBasedXss
|
2023-02-13 11:57:29 +01:00 |
|
Rasmus Wriedt Larsen
|
5235964b07
|
sync files
|
2023-02-13 10:44:12 +01:00 |
|
erik-krogh
|
91393a7bc8
|
add change-note
|
2023-02-12 23:28:01 +01:00 |
|
erik-krogh
|
6474cfd4c8
|
add support for express-ws
|
2023-02-12 23:25:27 +01:00 |
|
erik-krogh
|
ecafce8191
|
improve the CryptoJS model by using API::Node
|
2023-02-03 21:44:23 +01:00 |
|
Alex Ford
|
7768026e70
|
Merge branch 'main' into js-use-shared-cryptography
|
2023-02-03 15:18:30 +00:00 |
|
Alex Ford
|
6c35feaa98
|
ConceptsShared: add a default implementation of BlockMode CryptographicOperation#getBlockMode() for compatibility with external code
|
2023-02-03 14:39:32 +00:00 |
|