hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 18:33:16 +01:00
Code Issues Packages Projects Releases Wiki Activity
76,593 Commits 1,671 Branches 157 Tags
codeql-cli-2.20.6
Commit Graph

6144 Commits

Author SHA1 Message Date
Max Schaefer
11d6259dbf JavaScript: Move from Node to PathNode. 2018-11-14 09:16:40 +00:00
Max Schaefer
8d87f556e1 JavaScript: Add import DataFlow::PathGraph. 2018-11-14 09:16:40 +00:00
Max Schaefer
4860364d91 JavaScript: Add explicit nodes query predicate in PathGraph. 
This is needed to correctly handle the case where `edges` is empty.
 2018-11-14 09:16:40 +00:00
Max Schaefer
60a1357092 JavaScript: Make all taint-based security queries have @kind path-problem. 2018-11-14 09:16:40 +00:00
Max Schaefer
65bcf0f526 JavaScript: Refactor security queries for uniformity. 2018-11-14 09:16:40 +00:00
Max Schaefer
9b4ae9e4d3 JavaScript: Refactor HostHeaderPoisoningInEmailGeneration query. 2018-11-14 09:16:40 +00:00
Max Schaefer
c51cd50133 JavaScript: Remove a few unnecessary imports. 2018-11-14 09:16:40 +00:00
Arthur Baars
969c2796a0 Merge pull request #457 from adityasharad/merge/1.18-master-131118 
Merge rc/1.18 into master.
 2018-11-13 22:25:03 +01:00
Max Schaefer
a499009f59 Merge pull request #395 from esben-semmle/js/useless-defensive-code 
JS: add query: js/useless-defensive-code
 2018-11-13 16:55:59 +00:00
Max Schaefer
4fdfbb77cc Merge pull request #444 from esben-semmle/js/browser-based-client-requests 
JS: add models of $.ajax, $.getJSON and XMLHttpRequst
 2018-11-13 16:53:52 +00:00
Max Schaefer
96989a1fd6 Merge pull request #427 from adityasharad/eclipse/remove-plugin-metadata 
Eclipse plugins: Remove plugin metadata.
 2018-11-13 13:12:49 +00:00
Aditya Sharad
bc06831d01 Merge rc/1.18 into master. 2018-11-13 10:55:08 +00:00
Esben Sparre Andreasen
daed0653cb JS: support property tracking of custom abstract values 2018-11-13 11:42:09 +01:00
Esben Sparre Andreasen
1d87c580b3 JS: introduce DefinedCustomAbstractValue 2018-11-13 11:40:31 +01:00
semmle-qlci
86e31a584e Merge pull request #447 from esben-semmle/js/indirect-sanitization 
Approved by asger-semmle
 2018-11-13 09:14:28 +00:00
Esben Sparre Andreasen
5666deac14 JS: rename js/useless-defensive-code to js/unneeded-defensive-code 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
1db2e6ca55 JS: add source code examples to docstrings 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
3aae1d17db JS: avoid two uses of getChildExpr(0) 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
15123da0b7 JS: minor fixup: only traverse LogNotExprs 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
8ea9fd4cca JS: address review comments 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
7d4cf49545 JS: fixup double reporting of alerts 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
f440c9221a JS: replace some Expr.stripParens with Expr.getUnderlyingValue 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
358e6188d9 JS: downgrade other alerts to js/useless-defensive-code 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
e29c57a58e JS: add whitelist to js/useless-defensive-code 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
b073fcfca2 JS: add query: js/useless-defensive-code 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
7b215ecb2b JS: recognize defensive programming patterns using typeof 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
c403416fef JS: recognize defensive expressions that prevents exceptions 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
6e77489a3b JS: add utilities for expression guards to DefensiveProgramming.qll 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
a2ecf40878 JS: recognize defensive expressions for null/undefined 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
2b6ef24bc2 JS: add utilities to DefensiveProgramming.qll 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
8086e88587 JS: add utilities to DefensiveProgramming.qll 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
a5eeba3c3a JS: prepare DefensiveProgramming.qll for additions 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
c2fb14640e JS: move isDefensiveInit to DefensiveProgramming.qll 2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen
ce0dd241f6 JS: add models of $.ajax, $.getJSON and XMLHttpRequst 2018-11-13 08:14:51 +01:00
Max Schaefer
663bdd60a0 Merge pull request #396 from esben-semmle/js/unconditional-property-override 
JS: add query: js/unconditional-property-override
 2018-11-12 17:10:32 +00:00
Aditya Sharad
271628c280 Version: Bump to 1.18.3 dev. 2018-11-12 14:55:26 +00:00
Jonas Jensen
1500237009 Merge remote-tracking branch 'upstream/master' into mergeback-20181112 2018-11-12 13:24:27 +01:00
Esben Sparre Andreasen
eaad84bb4f JS: add support for dis- and conjunctions in SanitizingFunction 2018-11-12 10:23:52 +01:00
Esben Sparre Andreasen
6d0c93b6a8 JS: introduce TaintTracking::AdditionalSanitizingCall 2018-11-12 10:21:39 +01:00
Esben Sparre Andreasen
2033bf81cc JS: address docstring review comments 2018-11-12 10:03:08 +01:00
semmle-qlci
c9d77a2d6d Merge pull request #443 from xiemaisi/js/improve-stack-trace-exposure 
Approved by asger-semmle
 2018-11-12 08:40:26 +00:00
Aditya Sharad
761e5efd60 Merge master into next. 
JavaScript semantic conflicts fixed by referring to the `LegacyLanguage` enum.
C++ conflicts fixed by accepting Qltest output.
 2018-11-09 18:49:35 +00:00
Max Schaefer
fa8736adbc JavaScript: Introduce aliases for compatibility with other language libraries. 2018-11-09 11:27:14 +00:00
Max Schaefer
bdfe938d02 JavaScript: Improve StackTraceExposure query. 
It now also flags exposure of the entire exception object (not just the `stack` property).
 2018-11-09 09:42:09 +00:00
semmle-qlci
a7290e5aeb Merge pull request #434 from esben-semmle/js/type-confusion-with-taint-kinds 
Approved by asger-semmle
 2018-11-09 08:25:55 +00:00
semmle-qlci
c19747803b Merge pull request #425 from xiemaisi/js/lodash-recognition-extensible 
Approved by esben-semmle
 2018-11-09 08:08:40 +00:00
Esben Sparre Andreasen
ca215391b4 JS: substitute Assignment for DataFlow::PropWrite 2018-11-08 13:23:19 +01:00
Esben Sparre Andreasen
b7f424df41 JS: introduce DataFlow::PropWrite::getWriteNode 2018-11-08 13:23:19 +01:00
Esben Sparre Andreasen
d813a7cad2 JS: push negation 2018-11-08 13:23:19 +01:00
Esben Sparre Andreasen
470c241c82 JS: use range instead of ad hoc LT/GT 2018-11-08 13:23:19 +01:00