Asger F
1ee93cf51b
JS: Manually fix two comments in JSX
2025-02-28 13:28:37 +01:00
Asger F
0f23c33d3c
JS: Fix a comment
...
Apparently this comment used to say 'NOT OK' but clearly 'OK' was meant
2025-02-28 13:28:36 +01:00
Asger F
cd788bc509
JS: Mark what seems to be missing alerts for fflate
...
The query doesn't seem to model or even mention fflate. Not sure if the library is safe or just not modeled.
2025-02-28 13:28:35 +01:00
Asger F
3f7f74b925
JS: Accept alerts for DecompressionBomb
2025-02-28 13:28:33 +01:00
Asger F
48760d66b2
JS: Accept alerts for HardcodedDataInterpretedAsCode
2025-02-28 13:28:32 +01:00
Asger F
260c66b3cf
JS: Mark a spurious alert in missing-x-frame-options
2025-02-28 13:28:30 +01:00
Asger F
cea53371f2
JS: Accept alerts for missing-x-frame-options
2025-02-28 13:28:29 +01:00
Asger F
cded75766f
JS: Add a query ID
2025-02-28 13:28:28 +01:00
Asger F
a0f8e28790
JS: Accept a fixed FN
2025-02-28 13:28:27 +01:00
Asger F
1fcebcec87
JS: Move some ReDoS alerts
2025-02-28 13:28:25 +01:00
Asger F
266ac09637
JS: Add query iDs
2025-02-28 13:28:24 +01:00
Asger F
082e16b3d3
JS: More Alert comments in ReDoS/tst.js based on variable naming
...
Again just trying to translate the original intent behind the test, without taking actual query results into account
2025-02-28 13:28:23 +01:00
Asger F
607b184a7f
JS: Fix a bug in test case
2025-02-28 13:28:22 +01:00
Asger F
51fb3dad74
JS: Accept ReDoS alerts in regexplib
2025-02-28 13:28:21 +01:00
Asger F
d298d8740f
JS: Accept some exponenital redos alerts in the polynomial redos test suite
2025-02-28 13:28:19 +01:00
Asger F
283b14207d
JS: Accept some ReDoS alerts
2025-02-28 13:28:18 +01:00
Asger F
92c3939457
JS: Accept InsecureRandomness alerts
2025-02-28 13:28:17 +01:00
Asger F
0f8e85fa2f
JS: Accept alerts for InsufficientKeySize
2025-02-28 13:28:15 +01:00
Asger F
fc95702341
JS: Accept some more alerts from CleartextStorage
2025-02-28 13:28:14 +01:00
Asger F
51b45598c4
JS: Move an alert and add query ID
2025-02-28 13:28:13 +01:00
Asger F
e91a046a17
JS: Mark a spurious alert
2025-02-28 13:28:12 +01:00
Asger F
b54ff3b5b3
JS: Accept an alert
2025-02-28 13:28:10 +01:00
Asger F
576dbcb020
JS: Stop overriding entire module.exports object in test
...
Doing `module.exports = blah` prevents other exports from being seen as library inputs.
2025-02-28 13:28:09 +01:00
Asger F
f72cd21a55
JS: Some more test changes in SpuriousArguments
2025-02-28 13:28:08 +01:00
Asger F
d3de6d18a4
JS: Accept other changes to UnusedVariable
2025-02-28 13:28:07 +01:00
Asger F
e745f42291
JS: Remove alert expectation from step
...
This is just a step on the path, not a sink
2025-02-28 13:28:06 +01:00
Asger F
319ee2ccd5
JS: Track deep flow through qs.stringify
2025-02-28 13:28:04 +01:00
Asger F
c593853710
JS: Record some missing alerts in FileAccessToHttp
2025-02-28 13:28:03 +01:00
Asger F
cf33db78cc
JS: Fix the spurious flow
2025-02-28 13:28:02 +01:00
Asger F
c051b4c98d
JS: Add spurious alert marker
2025-02-28 13:28:00 +01:00
Asger F
b095fe2a19
JS: Fix some bugs in a test case
...
'args' was a redeclared block-level variable, and 'myArgs' was not used when clearly intended to be used
2025-02-28 13:27:59 +01:00
Asger F
22c218d665
JS: Mark a 'good' test as 'bad' and add Alert marker
...
The lack of whitespace around '&&' is problematic
2025-02-28 13:27:58 +01:00
Asger F
a9b263f465
JS: Remove incorrect alert expectation
...
This is not flagged and AFAICT it shouldn't be
2025-02-28 13:27:57 +01:00
Asger F
287753187e
JS: Remove invalid syntax from test
...
TS decorators may not appear on functions and enums
2025-02-28 13:27:56 +01:00
Asger F
426a871405
JS: Remove incorrect Alert marker
...
This is expected, based on a comment earlier in the file about the 'y' variable
2025-02-28 13:27:54 +01:00
Asger F
2c46e10678
JS: Mark an alert as missing
2025-02-28 13:27:53 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
e5bee19b19
JS: Accept a double-flagged line
...
This is flagged by two queries but for two separate issues. Seems valid to flag it twice.
2025-02-28 13:27:51 +01:00
Asger F
68fae9ded8
JS: Accept alerts about newline replacement
2025-02-28 13:27:49 +01:00
Asger F
1f3c49638b
JS: Accept some less obvious alerts
...
These are listed in a function called 'good' but it's difficult to say in isolation whether they should be flagged or not. Accepting the changes as they seem reasonable.
2025-02-28 13:27:48 +01:00
Asger F
f395651807
JS: Mark alert as MISSING
...
See https://github.com/github/codeql-javascript-team/issues/447
2025-02-28 13:27:47 +01:00
Asger F
07a876b4e9
JS: Accept some alerts at the SystemCommandExecution location
2025-02-28 13:27:46 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
0453ded338
JS: Add query ID to some alerts
2025-02-28 13:27:41 +01:00
Asger F
86932c51bc
JS: Move some alerts to their correct location
...
One of the diffs look confusing but:
Previously parameter {2,3} where flagged, now parameter {1,2} are flagged.
Note that for command injection, the SystemCommandExecution is flagged
despite the test file claiming otherwise.
2025-02-28 13:27:40 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
795c1100fc
JS: Disable for SyntaxError
...
The presence of a syntax error sometimes prevents us from parsing the inline comment correctly.
2025-02-28 13:27:37 +01:00
Asger F
789a7bdb48
JS: Disable for test with alerts in a JSON file
...
JSON does not support comments so we can't use inline expectations
2025-02-28 13:27:36 +01:00
Asger F
ac6547fd01
JS: Disable for comment-related alerts
2025-02-28 13:27:35 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
