2325 Commits

Author	SHA1	Message	Date
Asger F	b2216627be	JS: Port RequestForgery	2023-10-13 13:15:03 +02:00
Asger F	d7b4e0c206	JS: Port ExceptionXss	2023-10-13 13:15:03 +02:00
Asger F	cf5450dbd5	JS: Port XssThroughDom	2023-10-13 13:15:03 +02:00
Asger F	5f05232e02	JS: Port StoredXss	2023-10-13 13:15:03 +02:00
Asger F	46b90e51fc	JS: Port ReflectedXss	2023-10-13 13:15:03 +02:00
Asger F	e091fdefa4	JS: Port DomBasedXss	2023-10-13 13:15:03 +02:00
Asger F	547a8a958a	JS: Port SqlInjection	2023-10-13 13:15:03 +02:00
Asger F	65e9706c8e	JS: Port TaintedPath	2023-10-13 13:15:03 +02:00
Asger F	fcfab5238e	JS: Port CodeInjection	2023-10-13 13:15:03 +02:00
Asger F	17233a6749	JS: Port CommandInjection	2023-10-13 13:15:03 +02:00
amammad	6f73e9c3ba	revert for in additional steps	2023-10-10 22:12:37 +02:00
amammad	aff6f00450	comments improvement,separate module file, fix tests	2023-10-07 12:02:39 +02:00
amammad	5a49f6bb9b	fix tests	2023-10-06 22:10:57 +02:00
Max Schaefer	e722e3288f	Merge pull request #13771 from github/max-schaefer/server-side-url-redirect-help ... JavaScript: Improve query help for `js/server-side-unvalidated-url-redirection`.	2023-09-13 13:20:48 +01:00
Max Schaefer	a9e81672f0	Make suggestion to replace example.com more explicit.	2023-09-12 16:54:05 +01:00
Max Schaefer	a02f373e79	Use better sanitiser.	2023-09-06 14:06:16 +01:00
Max Schaefer	87364137df	Use more sensible validator in example.	2023-08-21 15:14:01 +01:00
erik-krogh	0bce42410a	support arbitrary codepoints in NfaUtils.qll	2023-08-08 22:14:51 +02:00
erik-krogh	92db7b047c	escape unicode chars in the output for the ReDoS queries	2023-08-08 00:15:54 +02:00
Max Schaefer	7823ff968c	JavaScript: Improve query help for js/server-side-unvalidated-url-redirection.	2023-07-19 13:23:25 +01:00
Asger F	d57276ca35	Merge pull request #13719 from asgerf/js/barrier-inout ... JS: Replace barrier edges with barrier nodes	2023-07-13 16:36:52 +02:00
Asger F	944a2ca825	JS: Replace ClearTextLogging::isSanitizerEdge with a node	2023-07-11 14:20:17 +02:00
Asger F	27085b1fd0	JS: Fix whitespace	2023-07-10 12:07:13 +02:00
Asger F	fe90146a16	JS: Add test for path.join with spread argument	2023-07-10 12:07:07 +02:00
Asger F	06bc0f6957	JS: Add test for fs/promises	2023-07-10 12:05:03 +02:00
Erik Krogh Kristensen	b2a60bf3d1	Merge pull request #13642 from erik-krogh/san-script ... JS/RB: Fix FP in incomplete-multi-character-sanitization	2023-07-06 15:38:39 +02:00
erik-krogh	f9eee906cf	fix FP by requiring that the regular expression mention on of the chars important in the prefix	2023-07-01 20:30:09 +02:00
erik-krogh	bd400be6ec	add FP for incomplete-multi-char-sanitization	2023-07-01 20:28:31 +02:00
jorgectf	2ac334bf15	Adapt Webix modeling to support HTML use-cases	2023-06-28 15:26:30 +02:00
amammad	c7a7594821	merge all ql files into one	2023-06-27 01:56:23 +10:00
jorgectf	1e663b8889	Update HeuristicSourceCodeInjection.expected	2023-06-26 13:32:20 +02:00
Jorge	08b9a5e2b2	Add missing ;	2023-06-23 23:10:06 +02:00
Jorge	3c980db93a	Format webix.js	2023-06-23 18:08:01 +02:00
Kevin Stubbings	3605269e13	Add webix copy function	2023-06-22 22:16:28 -07:00
amammad	307187f6c1	V1	2023-06-23 06:06:37 +10:00
jorgectf	6947e99c15	Add models for webix ... Co-authored-by: Kevin Stubbings <Kwstubbs@users.noreply.github.com>	2023-06-22 01:07:33 +02:00
erik-krogh	3fd9f26b52	use consistent indentation in mongoose.js	2023-06-12 16:40:42 +02:00
erik-krogh	cd6f738f72	add mongoose.Types.ObjectId.isValid as a sanitizer-guard for NoSQL injection	2023-06-12 16:38:11 +02:00
Asger F	76a8e9827e	Merge pull request #13283 from asgerf/js/restrict-regex-search-function ... JS: Be more conservative about flagging "search" call arguments as regex	2023-06-08 10:50:51 +02:00
Erik Krogh Kristensen	b78cd48954	Merge pull request #13329 from erik-krogh/sqlhelp ... JS: improve the sql-injection help page	2023-06-06 08:44:44 +02:00
erik-krogh	b343dcaadd	put string/object in the alert-message for sql-injection	2023-05-31 08:06:04 +02:00
Asger F	c637b6f59a	JS: Update test for RegExpAlwaysMatches	2023-05-26 14:10:26 +02:00
Asger F	9df9ca2916	JS: Update test and expectations for MissingRegExpAnchor	2023-05-26 14:07:34 +02:00
Asger F	40daa9c906	JS: Update RegExpInjection test and expectations	2023-05-26 14:05:36 +02:00
erik-krogh	f7419c9250	add expected output	2023-05-23 09:56:06 +02:00
erik-krogh	f85b3e13c2	update expected output	2023-05-23 09:56:06 +02:00
erik-krogh	3293a55e8f	require arguments to be shell interpreted to be flagged by indirect-command-injection	2023-05-17 11:07:45 +02:00
Asger F	20e8ee8423	Merge pull request #12748 from JarLob/yi ... JS: Add more sources, more unit tests, fixes to the GitHub Actions injection query	2023-05-15 11:03:00 +02:00
Asger F	c376eeb133	Merge pull request #12978 from asgerf/js/github-actions-sources ... JS: Add sources and sinks related to GitHub Actions	2023-05-10 09:55:24 +02:00
Asger F	1a9956354e	JS: Restrict getInput to indirect command injection query	2023-05-03 16:10:03 +02:00