1899 Commits

Author	SHA1	Message	Date
Erik Krogh Kristensen	e6d46b9279	add test for new prefix check on TaintedPath	2020-01-31 12:35:03 +01:00
Erik Krogh Kristensen	162c19c348	changes based on review	2020-01-30 14:04:04 +01:00
Erik Krogh Kristensen	7637ebcc03	Merge remote-tracking branch 'upstream/master' into exceptionFPs	2020-01-30 10:56:41 +01:00
Asger Feldthaus	b98db62e82	JS: Recognize req.user a cookie access	2020-01-24 09:44:20 +00:00
Asger Feldthaus	a68bb9ffd1	JS: Ignore calls and csrf/captcha access	2020-01-23 15:32:05 +00:00
Asger Feldthaus	b1ec3e1bf2	JS: Add test and dont check predecessors	2020-01-23 14:59:03 +00:00
Erik Krogh Kristensen	6494649125	fix a number of FPs in js/exception-xss	2020-01-20 15:11:57 +01:00
Asger F	2c05ee8ab8	JS: Add regression test	2020-01-14 10:53:00 +00:00
Asger F	9bd3c4a11c	JS: Add sanitizer for "in" exprs	2020-01-14 10:53:00 +00:00
Asger Feldthaus	7ac30e2289	JS: Add test for rephinement nodes	2020-01-14 10:53:00 +00:00
Asger F	a447645c10	JS: Add test with typeof on value	2020-01-14 10:52:59 +00:00
Asger F	bd9405ab84	JS: Guard against more FPs	2020-01-14 10:52:59 +00:00
Asger F	f7543aec95	JS: Support Reflect.ownKeys	2020-01-14 10:52:59 +00:00
Asger F	8af233307a	JS: Support enumeration through Object.entries	2020-01-14 10:52:59 +00:00
Asger F	96bf9db200	JS: Add another test and more barriers	2020-01-14 10:52:59 +00:00
Asger F	bc7871078a	JS: Fix FPs from Object.create(null)	2020-01-14 10:52:59 +00:00
Asger F	c889420dd3	JS: Add qhelp samples to test suite	2020-01-14 10:52:59 +00:00
Asger F	654f145772	JS: Add PrototypePollutionUtility query	2020-01-14 10:52:59 +00:00
semmle-qlci	06d812a6ff	Merge pull request #2556 from erik-krogh/RegexpVoidCxt ... Approved by max-schaefer	2020-01-03 08:38:56 +00:00
Erik Krogh Kristensen	15d74b7d03	remove FP from js/regexpinjection where no regexp was constructed	2019-12-19 10:47:03 +01:00
Erik Krogh Kristensen	bf56797ad7	update expected output of tests	2019-12-17 16:27:55 +01:00
Erik Krogh Kristensen	7c931452d9	autoformat	2019-12-16 13:45:42 +01:00
Erik Krogh Kristensen	904976c7ac	update tests after removing control-flow checks from error-callbacks	2019-12-16 08:30:21 +01:00
Erik Krogh Kristensen	e164f46330	changes based on review feedback	2019-12-13 11:44:31 +01:00
Erik Krogh Kristensen	f35dc5d274	Merge remote-tracking branch 'upstream/master' into moarExceptions	2019-12-12 16:13:52 +01:00
Erik Krogh Kristensen	08d0cb795b	revert the introduction of getEnclosingCall	2019-12-12 15:14:02 +01:00
Erik Krogh Kristensen	62512dd3e9	expand the js/exception-xss to handle more types of exceptional flow	2019-12-11 10:43:50 +01:00
Asger F	2acd616e6f	JS: Review comments	2019-12-06 11:53:06 +00:00
Asger F	bbb6dad726	JS: Update koa testcase	2019-12-06 11:49:59 +00:00
Asger F	a6e75259d6	JS: More fine-grained regexp-based sanitizer guards	2019-12-06 11:49:59 +00:00
Erik Krogh Kristensen	ea9d6189de	update expected test outpu	2019-12-02 12:52:39 +01:00
Erik Krogh Kristensen	c6c1ebe81a	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-12-02 08:41:49 +01:00
Erik Krogh Kristensen	d212394058	update expected output	2019-11-27 15:21:47 +01:00
Erik Krogh Kristensen	34e44e89fd	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-11-27 15:19:06 +01:00
Erik Krogh Kristensen	9351cd44e4	Merge remote-tracking branch 'githubsemmle/master' into HEAD	2019-11-27 13:45:59 +01:00
Erik Krogh Kristensen	42fbcbf007	update expected test output	2019-11-27 11:14:04 +01:00
Asger F	605c8834c6	JS: Avoid redundant window.name sources	2019-11-27 06:15:12 +00:00
Erik Krogh Kristensen	7b262fa9cf	update expected output	2019-11-26 14:39:09 +01:00
Erik Krogh Kristensen	5a0cabb039	Merge remote-tracking branch 'upstream/master' into typeAheadSink	2019-11-26 14:37:40 +01:00
Erik Krogh Kristensen	4a94c49d37	changes based on review feedback	2019-11-26 13:40:48 +01:00
Erik Krogh Kristensen	f284b3a2bb	Merge remote-tracking branch 'upstream/master' into exceptionXss	2019-11-26 10:54:04 +01:00
Erik Krogh Kristensen	c7235bb372	add sources and sinks for typeahead.js	2019-11-25 10:46:54 +01:00
Erik Krogh Kristensen	7d825af9a3	Added an XSS sink for Handlebars.SafeString	2019-11-22 15:56:21 +01:00
Erik Krogh Kristensen	f40d79271d	cleanup module imports and update expected outputs	2019-11-22 13:55:47 +01:00
Max Schaefer	0edb70f373	JavaScript: Deal with escape-unescape-escape (and similar) chains.	2019-11-22 09:24:34 +00:00
Max Schaefer	cb54618a5d	JavaScript: Deal with (un-)escaping on captured variables.	2019-11-22 09:24:34 +00:00
Max Schaefer	61aa075e8d	JavaScript: Fix regexes for escaping schemes.	2019-11-22 09:24:34 +00:00
Max Schaefer	4f899a9b0d	JavaScript: Recognize string escaping using .replace with a callback.	2019-11-22 09:24:34 +00:00
Erik Krogh Kristensen	94e9c0203d	add test for exceptional taint-flow	2019-11-21 17:16:13 +01:00
semmle-qlci	77c869f528	Merge pull request #2220 from erik-krogh/processEnvTaint ... Approved by esbena, max-schaefer	2019-11-20 13:16:43 +00:00