22 Commits

Author	SHA1	Message	Date
am0o0	65fdb8ccce	move jose SharedTaintStep to a local taint step, add more additional steps with test cases, update test cases and expected test results	2024-07-01 11:38:17 +02:00
am0o0	d77513579f	update tests	2024-05-25 12:15:25 +02:00
am0o0	4e365e242c	fix conflict	2024-05-25 12:08:05 +02:00
am0o0	20c087ce39	update tests	2024-05-25 12:06:07 +02:00
am0o0	1860af075d	fix conflict	2024-05-25 12:01:12 +02:00
amammad	e1d42fad2c	move new secret key sinks to existing CredentialsNode class, ... add new additional global taint and dataflow steps update tests of CWE-798 add a new sanitizer for `semmle.javascript.security.dataflow.HardcodedCredentialsQuery`	2023-11-02 16:09:01 +01:00
erik-krogh	0a5ff1b79a	recognize another kind of dummy passwords to fix an FP in hardcoded-credentials	2022-09-29 21:25:40 +02:00
Esben Sparre Andreasen	78744a0182	add additional tests	2022-02-16 09:44:56 +01:00
Esben Sparre Andreasen	e67c09f9ab	change example passwords in test	2022-02-16 08:56:00 +01:00
Erik Krogh Kristensen	87c0c60c22	don't report dummy authentication headers as hardcoded-crendentials	2021-08-02 22:56:14 +02:00
Erik Krogh Kristensen	5ecae55e77	add keys used by jsonwebtoken as CredentialsExpr	2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen	d814e73023	update comment position to match alert location for CWE-798	2020-07-08 10:12:12 +02:00
Erik Krogh Kristensen	a1940979ba	support credentials in a Buffer	2020-06-03 12:02:00 +02:00
Erik Krogh Kristensen	ba44ebe8a8	better support for browser based fetch API	2020-06-03 11:51:24 +02:00
Erik Krogh Kristensen	3622fb8716	support more variants of the Headers API	2020-06-03 11:50:10 +02:00
Erik Krogh Kristensen	3c802007a3	add support for string concatenations and base64-encoding of hardcoded credentials	2020-06-02 23:15:13 +02:00
Erik Krogh Kristensen	b6dc94fccb	add fetch.Headers.Authorization as a CredentialsExpr	2020-06-02 23:02:16 +02:00
Esben Sparre Andreasen	a5645e168a	JS: exclude keys from whitelist	2019-09-16 10:13:18 +02:00
Esben Sparre Andreasen	aa3f4a7048	JS: change passwords in tests	2019-09-16 10:09:59 +02:00
Asger F	378b0bfb74	JS: Do not treat the empty string as a credential	2019-07-30 17:29:12 +01:00
Asger F	3245142203	JS: Dont flag empty string as hardcoded username	2019-01-28 13:01:52 +00:00
Pavel Avgustinov	b55526aa58	QL code and tests for C#/C++/JavaScript.	2018-08-02 17:53:23 +01:00