Asger F
82d61e4194
Merge branch 'js/shared-dataflow-branch' into js/shared-dataflow-merge-main
2024-11-26 15:36:16 +01:00
Napalys Klicius
61e00861e5
Merge pull request #18008 from Napalys/napalys/ES2024-group-functions
...
JS: Added support for [Object, Map].groupBy ES2024 feature
2024-11-21 19:03:57 +01:00
Alexander Eyers-Taylor
c0474c4e45
Revert "Revert "Post-release preparation for codeql-cli-2.19.4""
2024-11-21 15:37:52 +00:00
Alexander Eyers-Taylor
4effe9e364
Revert "Post-release preparation for codeql-cli-2.19.4"
2024-11-21 14:43:15 +00:00
Napalys Klicius
7ee0a7b398
Update javascript/ql/lib/semmle/javascript/Collections.qll
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2024-11-21 14:02:42 +01:00
Napalys Klicius
edb9b47111
Merge pull request #18047 from Napalys/napalys/ES2023-string-protytpe-toWellFormed
...
JS: Added taint-step String.prototype.toWellFormed ES2023 feature
2024-11-21 14:01:21 +01:00
Asger F
9dad2d62d7
JS: Update DataFlowConsistency
2024-11-21 12:54:11 +01:00
Asger F
ce00bd2cc9
JS: More docs
2024-11-21 11:06:43 +01:00
Asger F
4e62a512c5
JS: Only apply exception propagator when no other summary applies
...
Previously a few Promise-related methods were special-cased, which is no longer needed.
2024-11-21 11:01:05 +01:00
Asger F
948d21ca07
JS: Propagate exceptions from summarized callables by default
2024-11-21 10:24:31 +01:00
Asger F
dcdb2e5133
JS: Fix callback check so it works without parameters
2024-11-21 10:24:29 +01:00
Napalys Klicius
82ca369dce
Merge pull request #18005 from Napalys/napalys/ES2022-find-functions
...
JS: Added support for Array.prototype.[findLastIndex, findLast] ES2022 feature
2024-11-21 08:01:19 +01:00
Napalys
43eda58f83
Added change notes
2024-11-20 17:44:36 +01:00
Napalys
afc2d3e6d2
JS: Add: String.protytpe.toWellFormed to StringManipulationTaintStep
2024-11-20 17:42:25 +01:00
Napalys
64c45debdb
JS: removed unnecessary getALocalSource from ArrayCallBackDataFlowStep
2024-11-20 14:57:00 +01:00
Napalys
9dbf7d1828
JS: removed unnecessary getALocalSource from ArrayCallBackDataTaintStep
2024-11-20 14:54:06 +01:00
Napalys
cdf43f7118
Added change notes
2024-11-20 14:06:44 +01:00
Asger F
d52bc971b8
Merge branch 'main' into js/shared-dataflow-merge-main
2024-11-20 14:05:03 +01:00
Napalys Klicius
a957e00fe5
Merge branch 'main' into napalys/ES2024-group-functions
2024-11-20 14:03:31 +01:00
Napalys
58faa2d71e
JS: Add: dataflow step for static method of groupBy from Map.
2024-11-20 13:34:11 +01:00
github-actions[bot]
3909df75dc
Post-release preparation for codeql-cli-2.19.4
2024-11-19 17:54:03 +00:00
Alex Eyers-Taylor
ef3fc5e29f
Fix broken changelog.
2024-11-19 16:34:30 +00:00
github-actions[bot]
9783a11565
Release preparation for version 2.19.4
2024-11-19 16:21:37 +00:00
Napalys
28ead4011a
JS: Add: taint step to handle propagation of data flow from the array to callback
2024-11-19 14:15:15 +01:00
Asger F
d1c9e47d23
JS: More aggressive test file classification
2024-11-19 13:23:32 +01:00
Asger F
01669908f2
JS: Block InsecureRandomness flow into test files
2024-11-19 13:23:31 +01:00
Asger F
80a5a5909e
JS: Use getUnderlyingValue() a few places in VariableCapture
2024-11-19 13:23:29 +01:00
Napalys
c03d69af1e
JS: Add: dataflow step for find, findLast, findLastIndex callback functions
2024-11-19 09:42:11 +01:00
Napalys
1b0f8aa657
JS: removed unnecessary findlast module import
2024-11-19 09:30:05 +01:00
Napalys
72a69cfa17
Added change notes
2024-11-19 08:24:36 +01:00
Asger F
023dcce400
JS: Disable variable capture heuristic
...
Bailing out can be more expensive as the resulting jump steps themselves
cause perf issues. The limit of 100 variables per scope has also been
added in the interim, which handles the cases that this needed to cover.
2024-11-18 13:44:10 +01:00
Asger F
37676f41aa
JS: Remove jump steps from IIFE steps
2024-11-18 13:38:34 +01:00
Asger F
7acc5689cf
JS: Port exception steps to a universal summary
2024-11-18 13:27:58 +01:00
Napalys
213ce225e0
JS: Add: taint step for Object.groupBy function, fixed test cases from 8ae05d8be4
2024-11-18 12:58:07 +01:00
Napalys
c02ad65fdc
JS: Add: taint step for Map.groupBy function
2024-11-18 12:50:06 +01:00
Napalys
1304ab7065
Added change notes
2024-11-18 08:05:51 +01:00
Napalys
fcb65534a8
JS: Add: Array.protype.findLast as taint step
2024-11-15 14:10:01 +01:00
Napalys
bed1f25b3f
JS: Fix: Now Array.prototype.with is properly flagged as taint step
2024-11-15 10:35:34 +01:00
Napalys
631a3770ec
JS: Add: change notes
2024-11-15 09:16:21 +01:00
Napalys Klicius
6fa3ff39a0
Merge branch 'main' into napalys/toSpliced-support
2024-11-14 16:56:32 +01:00
Napalys Klicius
c8c15a0899
Merge pull request #17910 from Napalys/napalys/matchAll-support
...
JS: Support for matchAll
2024-11-14 15:36:20 +01:00
Napalys
b333f523df
JS: Fix: now one can determine regex via Array.prototype.toSpliced function call.
2024-11-14 15:35:03 +01:00
Napalys
84234d59b9
JS: Fix: Ensure toSpliced with spread operator is flagged
2024-11-13 17:21:34 +01:00
Napalys
2df3d1b251
JS: Fix: Ensure toSpliced is flagged by taint tracking in test suite ( ed44358143)
2024-11-13 15:58:20 +01:00
Napalys
df4b596180
Added toSpliced as part ArraySliceStep and ArraySpliceStep, fixed tests from 2d9bc43506
2024-11-13 13:47:34 +01:00
Napalys
b4c84d3d3c
Added taint step for toSpliced, handles test from a65f80ef76
2024-11-13 12:41:41 +01:00
Napalys
5f8ff125e9
Added change notes
2024-11-12 12:21:39 +01:00
Napalys
7427a24ca1
Added test case for Array.prototype.toReversed, which is currently not flagged as a taint sink.
2024-11-12 12:02:37 +01:00
Napalys
3f0a54c2e8
Added support for Array.prototype.toSorted function
2024-11-12 12:02:04 +01:00
Asger F
80ee372ddf
JS: Replace an unused value with _
2024-11-12 11:24:17 +01:00
