Max Schaefer
3cabc12be3
JavaScript: Teach InvalidExport to never flag module.exports = exports = ... and similar.
...
This was previously flagged if `exports` wasn't used any further. While it's true that the assignment to `exports` is redundant in this case, the assignment is also flagged by DeadStorOfLocal, so there is no point in InvalidExport flagging it as well.
2019-03-04 09:53:37 +00:00
semmle-qlci
4c3ecf0f76
Merge pull request #989 from asger-semmle/class-node-get-this-access
...
Approved by xiemaisi
2019-03-01 19:40:31 +00:00
Max Schaefer
83e0f3bc8d
Merge pull request #946 from esben-semmle/js/captured-nodes-query-and-type-inference-1
...
JS: Captured Nodes, type inference + a query
2019-03-01 10:48:52 +00:00
semmle-qlci
6cafe222c4
Merge pull request #1013 from asger-semmle/closure-string-ops
...
Approved by esben-semmle
2019-03-01 10:31:27 +00:00
Max Schaefer
a6f3305edc
Merge pull request #1006 from asger-semmle/express-end
...
JS: Treat res.end() as alias for res.send() in Express
2019-03-01 10:30:06 +00:00
Max Schaefer
8dcd8715b9
Merge pull request #889 from jcreedcmu/jcreed/tarslip
...
JavaScript: Add new query for ZipSlip (CWE-022).
2019-03-01 08:16:35 +00:00
Jason Reed
c1b218a5ff
JS: Documentation fixes
2019-02-28 15:46:19 -05:00
Jason Reed
c5e57dacf8
JS: Actually use fileName in examples
2019-02-28 15:46:14 -05:00
Jason Reed
674d2790b4
JS: Address review comments
2019-02-28 15:46:07 -05:00
Jason Reed
caebdd2f68
JS: Fix incorrect sample link
2019-02-28 15:46:00 -05:00
Jason Reed
2fc2a393b7
JS: Address review comments
2019-02-28 15:45:52 -05:00
Jason Reed
09b9a57783
JS: More efficient reasoning through pipe
2019-02-28 15:45:38 -05:00
Jason Reed
b0636dd410
JS: Better local flow through .pipe chaining
2019-02-28 15:45:33 -05:00
Jason Reed
32d48ba98b
JS: Run auto-formatter
2019-02-28 15:45:20 -05:00
Jason Reed
abd2644af7
JS: Address review comments
2019-02-28 15:45:13 -05:00
Jason Reed
baa4f08259
JS: Add new query for ZipSlip (CWE-022)
2019-02-28 15:45:08 -05:00
Asger F
2bfb015218
JS: Add closure string ops
2019-02-28 16:47:53 +00:00
Max Schaefer
2ecabad553
Merge pull request #1004 from asger-semmle/suffix-check-bug
...
JS: Recognize '+' in suffix check
2019-02-28 14:23:26 +00:00
Asger F
03ef167c56
JS: Treat res.end() as alias for res.send() in Express
2019-02-28 12:37:11 +00:00
Max Schaefer
c8a37297f3
Merge pull request #997 from asger-semmle/closure-promise
...
JS: model of closure Promises
2019-02-28 10:05:12 +00:00
Max Schaefer
1b5887014b
Merge pull request #988 from asger-semmle/spread-taint-step
...
JS: add taint step through object/array spread operators
2019-02-28 09:58:23 +00:00
semmle-qlci
6602b4dbda
Merge pull request #992 from xiemaisi/js/socket.io
...
Approved by asger-semmle
2019-02-27 18:43:40 +00:00
Asger F
9497199cbd
JS: add localFieldStep
2019-02-27 14:20:47 +00:00
Asger F
b6648def19
JS: Add ClassNode.getAReceiverNode
2019-02-27 14:20:47 +00:00
Asger F
3d400cc57f
JS: basic model of closure Promises
2019-02-27 11:58:51 +00:00
semmle-qlci
999e0c8b95
Merge pull request #947 from asger-semmle/string-ops-concat
...
Approved by xiemaisi
2019-02-27 09:54:46 +00:00
Max Schaefer
37a3085466
Merge pull request #993 from asger-semmle/getacallee
...
JS: document new behavior of overriding InvokeNode.getACallee()
2019-02-27 09:00:59 +00:00
Max Schaefer
0648d7aa09
JavaScript: Sharpen result type of getAReceivedItem.
2019-02-27 08:51:43 +00:00
Max Schaefer
cd9ccd4c8d
Merge pull request #983 from asger-semmle/closure-global-ref
...
JS: add closure library in globalObjectRef
2019-02-26 16:55:58 +00:00
Max Schaefer
db5fbe29a3
Merge pull request #941 from esben-semmle/js/vue-support-2
...
JS: Vue security improvements
2019-02-26 16:49:38 +00:00
Asger F
eaf3f52372
JS: document new behavior of overriding InvokeNode.getACallee()
2019-02-26 16:09:19 +00:00
Max Schaefer
739705865b
JavaScript: Add basic model of socket.io.
2019-02-26 15:53:29 +00:00
semmle-qlci
86e646beb4
Merge pull request #975 from asger-semmle/global-closure-dataflow
...
Approved by esben-semmle
2019-02-26 13:57:39 +00:00
Asger F
29d2d620e4
JS: add taint step through object/array spread operators
2019-02-26 11:43:59 +00:00
Esben Sparre Andreasen
f9111f68e9
Update javascript/ql/src/semmle/javascript/dataflow/TypeInference.qll
...
Co-Authored-By: asger-semmle <42069257+asger-semmle@users.noreply.github.com >
2019-02-26 11:11:44 +01:00
Asger F
6b9157540b
JS: mark globalFlowPred as internal
2019-02-26 09:56:22 +00:00
semmle-qlci
74a4103857
Merge pull request #976 from asger-semmle/closure-import-deep
...
Approved by esben-semmle
2019-02-26 09:34:04 +00:00
semmle-qlci
00d490e84d
Merge pull request #945 from asger-semmle/extensible-module-import
...
Approved by xiemaisi
2019-02-26 09:26:28 +00:00
Esben Sparre Andreasen
9511bdf6ae
JS: address review comment
2019-02-26 10:07:00 +01:00
Max Schaefer
c2a5350bf2
Merge pull request #982 from asger-semmle/closure-string-lib
...
JS: model string functions from closure library
2019-02-26 08:26:14 +00:00
Asger F
93440014a0
JS: only propagate through first argument of truncate()
2019-02-25 17:11:55 +00:00
Asger F
d45f670646
JS: remove duplicate modelling of urlDecode/urlEncode
2019-02-25 17:04:56 +00:00
Asger F
29de1411b7
JS: remove restriction on truncate calls
2019-02-25 17:00:47 +00:00
Asger F
50e8f83ad5
JS: use globalVarRef/SourceNode instead
2019-02-25 16:54:45 +00:00
Asger F
8354909d46
JS: add closure library in globalObjectRef
2019-02-25 16:45:47 +00:00
Asger F
d70d0e21cc
JS: add format function
2019-02-25 16:30:44 +00:00
Asger F
fab0afd755
JS: model string functions from closure library
2019-02-25 16:08:47 +00:00
Esben Sparre Andreasen
8e01ccd892
JS: fix docstring: s/node1/pred + s/node2/succ
2019-02-25 16:51:30 +01:00
semmle-qlci
58cc8d0ecc
Merge pull request #936 from xiemaisi/js/revive-electron-support
...
Approved by esben-semmle
2019-02-25 15:23:20 +00:00
Esben Sparre Andreasen
ab1b1c1431
JS: update docstring
2019-02-25 16:11:35 +01:00
