4466 Commits

Author	SHA1	Message	Date
erik-krogh	6192544fb4	add test for express-ws as a source	2023-02-13 15:26:50 +01:00
erik-krogh	b85bfc8ba6	add HtmlSanitizer as a sanitizer for DOMBasedXss	2023-02-13 11:57:29 +01:00
erik-krogh	c258e44772	add failing test for spurious edge through sanitizer	2023-02-13 11:49:57 +01:00
Alex Ford	7768026e70	Merge branch 'main' into js-use-shared-cryptography	2023-02-03 15:18:30 +00:00
Alex Ford	e17b3d975d	JS: pick up CryptographicKeys used in asmCrypto encrypt/decrypt calls	2023-02-03 12:16:25 +00:00
Alex Ford	6b2a92a7ca	JS: update CryptographicKey.expected	2023-02-03 12:12:47 +00:00
Alex Ford	b0b8f8725e	JS: add some CryptographicOperation#getBlockMode() tests	2023-02-02 20:30:30 +00:00
Alex Ford	aa2c532a78	JS: adjust test whitespace	2023-02-02 20:30:30 +00:00
Alex Ford	c25dc978df	JS: add blockMode to CryptographicOperation tests	2023-02-02 20:30:30 +00:00
Alex Ford	983055b8f9	JS: Use shared CryptographicOperation concept and implement BlockMode getBlockMode()	2023-02-02 20:30:30 +00:00
yoff	7ae389bb28	Merge pull request #12026 from erik-krogh/nodePty ... JS: add code-injection sink for node-pty	2023-01-31 13:27:32 +01:00
erik-krogh	02da718786	add code-injection sink for node-pty	2023-01-30 15:14:25 +01:00
erik-krogh	e3455a9b21	add support for axios used as a global variable	2023-01-29 22:55:20 +01:00
Erik Krogh Kristensen	99bad77972	Merge pull request #11906 from erik-krogh/moreStem ... JS: expand what is parsed as the stem of a pathexpr	2023-01-25 08:44:44 +01:00
erik-krogh	49f5e89f36	update expected output for experimental query	2023-01-23 22:29:49 +01:00
Erik Krogh Kristensen	fc66c905ff	Merge pull request #11859 from erik-krogh/moreShell ... JS: slightly broaden the regular expression that recognizes bad string-concats used as shell commands	2023-01-23 22:26:17 +01:00
Erik Krogh Kristensen	a10b45e0db	Merge pull request #11927 from mvogelgesang/express-rate-limit ... JS: Updated express-rate-limit example to match implementation examples f…	2023-01-23 14:37:50 +01:00
erik-krogh	3cece50f78	add encodeURIComponent as a sanitizer for request-forgery	2023-01-23 13:53:53 +01:00
erik-krogh	be8ef1b324	add failing test	2023-01-23 13:52:36 +01:00
Erik Krogh Kristensen	1ee9957838	Merge pull request #9807 from erik-krogh/endFilter ... JS: recognize "-->" as a bad tag filter	2023-01-23 10:06:50 +01:00
Mark Vogelgesang	c9119848d9	Updated express-rate-limit example to match implementation examples found on packages README	2023-01-18 14:42:40 -05:00
erik-krogh	4b74dec18f	expand what is parsed as the stem of a pathexpr	2023-01-17 21:28:21 +01:00
Erik Krogh Kristensen	8ccc384043	Merge pull request #11858 from erik-krogh/moreSpawn ... JS: track shell:true more in js/shell-command-constructed-from-input	2023-01-16 13:24:50 +01:00
erik-krogh	7ae27bcc34	fix errors in JS printAst	2023-01-12 15:37:52 +01:00
erik-krogh	38ca68febb	recognize "-->" as a bad tag filter	2023-01-10 18:09:56 +01:00
Erik Krogh Kristensen	54c780bdf9	Merge pull request #11853 from erik-krogh/assignMore ... JS: add local flow when recognizing Object.assign calls for library-inputs	2023-01-10 17:04:29 +01:00
Tony Torralba	72a11e737d	Merge pull request #11775 from atorralba/atorralba/all/omittable-exists ... All: Remove omittable exists variables	2023-01-10 16:07:06 +01:00
erik-krogh	23a847b1cf	track shell:true more in js/shell-command-constructed-from-input	2023-01-10 15:27:37 +01:00
erik-krogh	5c388c554c	fix that the TypeTracker was unrestricted for the base-case of nonFirstLocationType	2023-01-10 13:39:50 +01:00
erik-krogh	e02b67af63	add failing test	2023-01-10 13:39:50 +01:00
Tony Torralba	3b6dae41cd	JavaScript: Remove omittable exists variables	2023-01-10 13:37:21 +01:00
erik-krogh	79e161e046	slightly broaden the regular expression that recognizes bad string-concats used as shell commands	2023-01-10 12:49:37 +01:00
erik-krogh	9f100ef2c6	add local flow when recognizing Object.assign calls for library-inputs	2023-01-09 17:44:11 +01:00
erik-krogh	90f9e3f825	recognize an infinite repetition of a char-class like regex as a char-class like regex	2023-01-09 17:25:08 +01:00
Calum Grant	ad55706527	Merge branch 'main' into calumgrant/remove-lgtm	2023-01-03 10:27:30 +00:00
Arthur Baars	98c5b81456	Merge pull request #11723 from aibaars/alert-suppression ... CodeQL alert suppression	2022-12-21 10:59:57 +01:00
Jacques	b99c500435	Fix associated test	2022-12-20 12:51:13 +09:00
Calum Grant	e982e144a4	JS: Update qltest output	2022-12-19 17:22:51 +00:00
Arthur Baars	0f313231bc	AlertSuppression: add more tests	2022-12-19 16:43:11 +01:00
Calum Grant	4a37c01c5f	JavaScript: Remove references to LGTM	2022-12-19 15:15:17 +00:00
Arthur Baars	c176606be5	AlertSuppression: allow //lgtm comments to scope over the next line	2022-12-19 16:10:26 +01:00
Erik Krogh Kristensen	1500fa5f67	Merge pull request #10663 from pwntester/restify_improvements ... Javascript: Improve Restify support and add new Spife support	2022-12-15 11:08:22 +01:00
Alvaro Muñoz	818c2da1aa	fix Spife tests (without heuristics)	2022-12-14 15:42:27 +01:00
Alvaro Muñoz	14faff4477	fix restify tests	2022-12-14 15:38:35 +01:00
Alvaro Muñoz	a71fc930a6	add tests	2022-12-14 13:11:02 +01:00
Asger F	6b15839221	JS: Add tests for the examples used in the docs	2022-12-13 11:33:12 +01:00
Asger F	afe7872838	Merge pull request #11565 from asgerf/js/rephined-variable-in-access-path ... JS: handle rephined variable in access path	2022-12-07 09:26:38 +01:00
Asger F	80777b8c50	JS: handle rephined variables in local access paths	2022-12-05 15:11:50 +01:00
Asger F	025cfe4064	JS: Add reproduction test case	2022-12-05 15:11:43 +01:00
Erik Krogh Kristensen	6b9cab23d4	Merge pull request #11248 from erik-krogh/js-redosMod ... JS: use the shared regex pack	2022-12-05 14:48:37 +01:00