Asger F
|
80777b8c50
|
JS: handle rephined variables in local access paths
|
2022-12-05 15:11:50 +01:00 |
|
Asger F
|
025cfe4064
|
JS: Add reproduction test case
|
2022-12-05 15:11:43 +01:00 |
|
Erik Krogh Kristensen
|
6b9cab23d4
|
Merge pull request #11248 from erik-krogh/js-redosMod
JS: use the shared regex pack
|
2022-12-05 14:48:37 +01:00 |
|
Asger F
|
2d578c1a73
|
Merge branch 'main' into merge-package-type-columns
|
2022-12-02 10:00:44 +01:00 |
|
Erik Krogh Kristensen
|
1eec067474
|
Merge pull request #11294 from erik-krogh/fileDoc
QL: improve the "this block-comment should have been a QLDoc"-query
|
2022-11-23 22:23:36 +01:00 |
|
Asger F
|
2e3413c9b8
|
JS: Merge package/type columns
|
2022-11-23 11:17:42 +01:00 |
|
Erik Krogh Kristensen
|
f67219965e
|
Merge pull request #11082 from erik-krogh/shellArr
JS: treat arrays that gets executed with shell:true as a sink for `js/shell-command-constructed-from-input`
|
2022-11-22 13:03:50 +01:00 |
|
Erik Krogh Kristensen
|
06386b2cdd
|
Merge pull request #11072 from erik-krogh/slicing
JS: poly-redos: don't sanitize calls through substring calls that just remove the start
|
2022-11-22 13:02:09 +01:00 |
|
erik-krogh
|
6b5cd9abc3
|
use RegExpTreeView insteaed of RegexTreeView in JS
|
2022-11-22 12:55:48 +01:00 |
|
erik-krogh
|
ba2734909f
|
JS: don't use deprecated files in tests
|
2022-11-17 22:12:50 +01:00 |
|
erik-krogh
|
fe49e41d7b
|
JS: convert some block-comments that could be QLDoc to QLDoc
|
2022-11-16 13:45:35 +01:00 |
|
Mauro Baluda
|
784475dd66
|
Merge branch 'main' into main
|
2022-11-16 11:06:27 +01:00 |
|
Mauro Baluda
|
ec04f0c88f
|
hapi/glue tests
|
2022-11-15 23:45:27 +01:00 |
|
erik-krogh
|
d4c6f873af
|
add test for auto-accessors
|
2022-11-15 22:07:25 +01:00 |
|
erik-krogh
|
65567fa1ce
|
add test for the more precise type-narrowing with the in operator
|
2022-11-15 22:07:25 +01:00 |
|
erik-krogh
|
e98d1df5f4
|
add dataflow support
|
2022-11-15 22:07:25 +01:00 |
|
erik-krogh
|
a8973c1147
|
add test for dataflow
|
2022-11-15 22:07:24 +01:00 |
|
erik-krogh
|
75ef5b1b0b
|
add support for satisfies-expressions
|
2022-11-15 22:07:24 +01:00 |
|
erik-krogh
|
29cf695b07
|
update expected output of the queries (some sorting changed due to locations being used slightly differently in the shared pack)
|
2022-11-15 17:14:38 +01:00 |
|
erik-krogh
|
e18ceba49e
|
port the JS regex/redos queries to use the shared pack
|
2022-11-15 17:14:38 +01:00 |
|
Erik Krogh Kristensen
|
90382c4d1c
|
Merge pull request #11178 from erik-krogh/passcode
JS/RB/PY: Recognize `passcode` as sensitive
|
2022-11-10 17:58:34 +01:00 |
|
Erik Krogh Kristensen
|
724a31b746
|
fix comment that wasn't updated in test
Co-authored-by: Rasmus Wriedt Larsen <rasmuswriedtlarsen@gmail.com>
|
2022-11-10 15:56:44 +01:00 |
|
Asger F
|
83291f378b
|
Merge pull request #11157 from asgerf/js/yaml-locations
JS: fix issue with zero-column yaml locations
|
2022-11-09 15:57:54 +01:00 |
|
Erik Krogh Kristensen
|
c537c80ed6
|
Merge pull request #11095 from erik-krogh/exportRead
JS: recognize more re-exported values as exported
|
2022-11-09 12:39:41 +01:00 |
|
erik-krogh
|
23add8a72b
|
recognize passcode as sensitive
|
2022-11-09 11:30:57 +01:00 |
|
erik-krogh
|
e0bcfe2afb
|
add failing test
|
2022-11-09 11:30:31 +01:00 |
|
Asger F
|
694d987365
|
JS: Update test output
|
2022-11-09 09:36:03 +01:00 |
|
Erik Krogh Kristensen
|
e01cbb2ffa
|
Merge pull request #10378 from erik-krogh/aliasFlow
JS: expand localFieldStep to use access-paths, and build access-paths in more cases
|
2022-11-08 14:26:12 +01:00 |
|
Asger F
|
92e8f059c8
|
JS: Avoid emitting column zero in yaml files
|
2022-11-08 11:38:26 +01:00 |
|
Asger F
|
a887ff4f09
|
JS: Add test cases to include results with column-zero end locations
|
2022-11-07 15:13:25 +01:00 |
|
Erik Krogh Kristensen
|
d67235b3c1
|
Merge pull request #11071 from erik-krogh/fixCanon
ReDoS: fix canonicalization in NfaUtils
|
2022-11-07 14:10:50 +01:00 |
|
erik-krogh
|
fc38bf0429
|
Merge branch 'main' into aliasFlow
|
2022-11-07 09:46:48 +01:00 |
|
erik-krogh
|
40032f295a
|
treat arrays that gets executed with shell:true as a sink for js/shell-command-constructed-from-input
|
2022-11-07 09:19:05 +01:00 |
|
erik-krogh
|
bc5b7455cf
|
add failing test
|
2022-11-07 09:14:52 +01:00 |
|
Erik Krogh Kristensen
|
c82d8cbacc
|
Merge pull request #11013 from erik-krogh/sndCmd
JS: second-order-command-injection
|
2022-11-04 10:58:50 +01:00 |
|
erik-krogh
|
655b4a4d17
|
recognize more re-exported values as exported
|
2022-11-03 11:08:00 +01:00 |
|
erik-krogh
|
94e864e933
|
add failing test
|
2022-11-03 11:04:04 +01:00 |
|
erik-krogh
|
851d53d56b
|
don't sanitize calls through substring calls that just remove the start
|
2022-11-01 22:51:07 +01:00 |
|
erik-krogh
|
08bc14f598
|
add failing test
|
2022-11-01 22:50:13 +01:00 |
|
erik-krogh
|
15416a9c86
|
fix getCanonicalCharClass in NfaUtils
|
2022-11-01 21:35:07 +01:00 |
|
erik-krogh
|
78e35e2f29
|
add failing test
|
2022-11-01 21:33:19 +01:00 |
|
Dave Bartolomeo
|
9d5e5e3ee7
|
${workspace} all the things
|
2022-11-01 13:29:05 -04:00 |
|
erik-krogh
|
6f3ca40fed
|
expand the explanation to include with arguments make the commands vulnerable
|
2022-11-01 14:24:23 +01:00 |
|
erik-krogh
|
fc2112831c
|
add second-order-command-injection query
|
2022-10-30 21:20:47 +01:00 |
|
erik-krogh
|
0a7e797090
|
update expected outputs after reordering tests
|
2022-10-28 10:16:21 +02:00 |
|
erik-krogh
|
946720f414
|
reorder the CWE-078 tests into subdirectories
|
2022-10-28 10:16:21 +02:00 |
|
Erik Krogh Kristensen
|
bbdda9ef70
|
Merge pull request #10727 from erik-krogh/js-last-msg
JS: fix some more style-guide violations in the alert-messages
|
2022-10-27 15:48:12 +02:00 |
|
Erik Krogh Kristensen
|
cecb498bf3
|
Merge pull request #10984 from tyage/add-next-js-source
JS: Add Next.js parameters as source
|
2022-10-27 10:36:12 +02:00 |
|
tyage
|
54050bf1b6
|
update test result XssWithAdditionalSources
|
2022-10-27 10:23:37 +09:00 |
|
erik-krogh
|
0f9b4334cc
|
remove some FPs in js/password-in-configuration-file
|
2022-10-26 11:51:56 +02:00 |
|