Erik Krogh Kristensen
bd121b98ae
Merge pull request #15893 from erik-krogh/more-filter-taint
...
JS: allow more flow through .filter()
2024-03-13 16:19:28 +01:00
Asger F
8ecdb5cefe
Update VariableCapture.qll
2024-03-13 15:24:20 +01:00
Asger F
82abd867a0
JS: Update uses of AccessPathSyntax
...
This doesn't yet migrate to the FlowSummaryImpl.qll in a qlpack, just trying to make things compile first
2024-03-13 15:17:58 +01:00
Asger F
e5bc8db2f0
JS: Fix conflicting default for visbleImplInCallContext
2024-03-13 15:17:08 +01:00
Asger F
bb1f729a3f
Update VariableCapture.qll
2024-03-13 15:16:37 +01:00
Asger F
97567f412e
JS: Update VariableCapture.qll after changes to API
2024-03-13 14:53:00 +01:00
Asger F
5e7d1d5c2c
Merge branch 'main' into js/shared-dataflow-merged
2024-03-13 14:27:16 +01:00
Erik Krogh Kristensen
53502a8662
Merge pull request #15510 from yoff/ts-54
...
JS: Add support for TS 5.4
2024-03-13 14:22:24 +01:00
Tom Hvitved
16cef92106
JS: Add DataFlow::Node.getLocation
2024-03-13 13:06:16 +01:00
Asger F
c5a02dae2b
Merge pull request #15768 from asgerf/js/amd-pseudo-deps
...
JS: Do not treat AMD pseudo-dependencies as imports
2024-03-13 12:49:17 +01:00
Asger F
fa8933eb41
JS: Reduce duplication in UnsafeDynamicMethodAccessQuery
2024-03-13 12:30:05 +01:00
Asger F
ea4bc9cdbb
JS: Comment about manually applying taint steps
2024-03-13 12:30:05 +01:00
erik-krogh
129286aa1c
allow more flow through .filter()
2024-03-13 12:03:00 +01:00
Asger F
406b080ce3
JS: Add comment about allowImplicitRead in PostMessageStar
2024-03-13 11:30:52 +01:00
Asger F
0a2050bc42
JS: Deduplicate predicate in HostHeaderPoisoningQuery
2024-03-13 11:27:18 +01:00
Asger F
11983faccf
JS: Remove out-commented code
2024-03-13 11:26:56 +01:00
Asger F
b31f20a64e
JS: Explain why ObjetWrapperFlowLabel is deprecated
2024-03-13 11:08:25 +01:00
Asger F
e0aae53ac7
JS: Remove unnecessary BarrierGuardLegacy class
2024-03-13 11:05:23 +01:00
Asger F
fce2be0af3
JS: Use BarrierGuardLegacy in TaintedPath
2024-03-13 11:02:09 +01:00
Asger F
e640154048
JS: Be backwards compatible with AdditionalBarrierGuardNode
...
I've confirmed that the 'legacyBarrier' predicate does not occur in the DIL
2024-03-13 10:54:02 +01:00
Asger F
14e75be510
JS: Expand comments and synthetic node name in ForOfLoops
2024-03-13 09:27:00 +01:00
Asger F
e66f27cfe3
JS: Move hasWildcardReplaceRegExp to a shared place
2024-03-13 09:19:26 +01:00
Asger F
4043bc13ab
JS: Explicit mark comment as a TODO
2024-03-13 09:19:03 +01:00
Asger F
858c79e395
JS: Add plain taint step through Promise.all()
2024-03-13 08:57:42 +01:00
Asger F
13a8e0fbf0
JS: Add failing test for Promise.all()
2024-03-13 08:54:06 +01:00
Asger F
2c1aa08f79
JS: Rename Strings2 -> Strings
2024-03-12 21:18:14 +01:00
Asger F
478dd25f3e
JS: Rename Sets2 -> Sets
2024-03-12 21:17:29 +01:00
Asger F
433489478d
JS: Rename Promise2 -> Promise
2024-03-12 21:16:43 +01:00
Asger F
e2f3565227
JS: Rename Maps2 -> Maps
2024-03-12 21:14:29 +01:00
erik-krogh
f2d6640003
fix ambiguous import. It could refer both to a module or a file
2024-03-12 15:15:50 +01:00
Asger F
b3fad7a8dc
JS: Rename Iterators2 -> Iterators
2024-03-12 15:12:07 +01:00
Asger F
5aafd33cec
JS: Rename Arrays2 -> Arrays
2024-03-12 15:11:29 +01:00
erik-krogh
c1fd7a6190
autoformat
2024-03-12 15:09:45 +01:00
Asger F
76e0445af0
JS: Be consistent about caching in PreCallGraphStep
2024-03-12 15:08:59 +01:00
Asger F
28fc8ba0c1
JS: Remove EmptyType
2024-03-12 14:59:04 +01:00
Asger F
f94aa2ceec
Update javascript/ql/lib/semmle/javascript/dataflow/internal/DataFlowNode.qll
2024-03-12 14:41:11 +01:00
erik-krogh
6be0ed1dc3
narrow the version specifier used for TypeScript
2024-03-12 13:42:58 +01:00
erik-krogh
95a5ec7f27
add test that the new Object.groupBy method has a type
2024-03-12 13:22:11 +01:00
erik-krogh
9f410eb2d6
Merge branch 'main' into ts-54
2024-03-11 18:07:52 +01:00
Henry Mercer
c325ff8a23
Mark lines of code queries as telemetry queries
...
The new file coverage metrics are available in all supported GHES
versions. This PR tags lines of code queries as telemetry queries. Lines
of code information will still be available in the SARIF file, but it
will no longer be displayed in the logging output of the CLI.
The one exception is the metric queries for Java/Kotlin that provides
separate lines of code information for Java and Kotlin. I've kept these
since separate file coverage information for languages like Java and
Kotlin is only available for GHES 3.12 and later.
2024-03-11 16:40:31 +00:00
Rasmus Lerchedahl Petersen
d73f43477f
update ts to released version 54
2024-03-11 16:32:19 +01:00
Asger F
7c35309732
Merge pull request #15823 from asgerf/js/lift-cg-restriction
...
JS: Call graph improvements
2024-03-08 13:40:38 +01:00
Asger F
245cd5c0b5
Merge pull request #15760 from asgerf/js/summarised-tt-store-steps
...
JS: Summarise store steps for type tracking
2024-03-08 13:16:25 +01:00
Asger F
ac4601cb8f
Update javascript/ql/lib/semmle/javascript/dataflow/internal/CallGraphs.qll
...
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com >
2024-03-08 13:01:38 +01:00
Asger F
fc5b9e2796
JS: Expand test case
2024-03-08 10:34:39 +01:00
maikypedia
699d8d4719
x
2024-03-07 18:15:22 +01:00
Asger F
81b04863b2
JS: Change note
2024-03-07 13:35:50 +01:00
Asger F
c7295a09cd
JS: Benign test output update
2024-03-07 11:55:56 +01:00
github-actions[bot]
dc9092c9ec
Post-release preparation for codeql-cli-2.16.4
2024-03-06 22:19:33 +00:00
github-actions[bot]
2f058ffb4d
Release preparation for version 2.16.4
2024-03-06 20:56:51 +00:00
