Asger F
169ae19015
Merge pull request #19391 from asgerf/js/typescript-path-resolution
...
JS: Overhaul import resolution
2025-05-13 15:46:38 +02:00
Asger F
aea676df3c
Merge pull request #19445 from asgerf/js/summaries-with-fallback
...
JS: Generate flow summaries from summaryModels; only generate steps as a fallback
2025-05-13 14:49:38 +02:00
Napalys Klicius
d1e769ba54
Merge pull request #19422 from Napalys/js/shelljs
...
JS: Modeling of `ShellJS` functions
2025-05-02 14:18:44 +02:00
Asger F
16fc8c3d9e
JS: Benign test updates
2025-05-02 11:09:19 +02:00
Asger F
a44bdf3be2
JS: Generate summaries from summaryModel, and only generate steps as a fallback
2025-05-01 15:22:47 +02:00
Napalys Klicius
d4b5ef6a66
Refactor process.env handling in CleartextLogging and IndirectCommandInjection modules to use ThreatModelSource
2025-05-01 11:14:15 +02:00
Napalys Klicius
33d8ffa83e
Added test cases for shelljs.env
2025-05-01 11:11:29 +02:00
Napalys Klicius
71f1b82a56
Added support for fastify.all
2025-04-30 14:54:09 +02:00
Napalys Klicius
6d61766366
Added test case for fastify.all
2025-04-30 14:50:35 +02:00
Napalys Klicius
18cea2d6a5
Added support for shelljs.cmd and async-shelljs.asyncExec
2025-04-30 13:37:02 +02:00
Napalys Klicius
25d04f1cdd
Added support for shelljs.which
2025-04-30 13:35:17 +02:00
Napalys Klicius
f6fae7ad60
Added test cases for cmd, which and asyncExec
2025-04-30 13:33:31 +02:00
Napalys Klicius
6de38b1827
Merge pull request #19300 from Napalys/js/fastify
...
JS: Added support for `fastify.addHook`
2025-04-29 18:32:25 +02:00
Asger F
b0f73f1cbd
JS: Update test output now that we import .d.ts files more liberally
2025-04-29 16:06:39 +02:00
Asger F
70a5ec5607
JS: Add package.json files in tests relying on node_modules
...
We don't extract node_modules folders by default so these tests aren't
that relevant anymore, and we no longer follow node_modules resolution
rules directly.
Instead, these imports are resolved based on the monorepo support which
simply requires a package.json file to exist. There is not a good enough
reason to support node_modules directly, so we're accepting some
minor regression in these tests.
2025-04-29 16:06:38 +02:00
Asger F
be5de9c080
JS: Update test output
...
path.resolve() and template expressions are now working.
Previously they could not be resolved because Import.getImportedPath() returned a PathExpr,
and these were not instances of PathExpr.
2025-04-29 16:06:35 +02:00
Asger F
ed2a832a55
JS: Deprecate PathExpr and related classes
2025-04-29 13:23:47 +02:00
Asger F
d724874969
JS: Implement babel-plugin-root-import as a PathMapping
2025-04-29 13:23:40 +02:00
Asger F
e4420f63fb
JS: Move babel-root-import test
...
This moves the test for the babel `root-import` plugin into the new
unit test for import resolution, so we only have one set of tests to
maintain.
The actual implementation is added in the next commit.
2025-04-29 13:23:38 +02:00
Asger F
6725cb5b8c
JS: Implement import resolution
2025-04-29 13:23:37 +02:00
Asger F
565cb434fc
JS: Add test
2025-04-29 13:07:10 +02:00
Asger F
8c0b0c4800
JS: Ensure json files are extracted properly in tests
2025-04-29 12:46:20 +02:00
Napalys Klicius
73309fb9dd
Updated modeling of aws-sdk with MaD
2025-04-28 14:00:12 +02:00
Napalys Klicius
42d5b80e81
Added support for AWS.Credentials hardcoded credentials
2025-04-28 14:00:12 +02:00
Napalys Klicius
f69037c176
Added ability to detect direct write to global AWS.config
2025-04-28 14:00:12 +02:00
Napalys Klicius
05e4677fd1
Added ability to detect new AWS.ServiceName cases with hardcoded credentials
2025-04-28 14:00:12 +02:00
Napalys Klicius
e6450a17ec
Added test cases for individual AWS services, direct modification of global credentials and AWS.Credentials
2025-04-28 14:00:12 +02:00
Michael Nebel
2e0ce44fde
Javascript: Update test files.
2025-04-23 15:41:41 +02:00
Napalys
fdfdcc0d93
Undo unnecessary name tracking for request, response objects
2025-04-22 14:16:45 +02:00
Asger F
00661b62dc
JS: Add isMiddlewareSetup() hook to Routing model
2025-04-22 12:00:02 +02:00
Asger F
c2cab184ac
Merge pull request #19283 from asgerf/js/rest-pattern-fix
...
JS: Fix missing flow into rest pattern lvalue
2025-04-22 10:37:36 +02:00
Napalys
5c3556da66
Add user-controlled property tracking and update code injection alerts in Fastify hooks
2025-04-15 09:41:52 +02:00
Napalys
9b194ea613
Added addHook to RouteSetup thus now it is recognized now as rouute handler
2025-04-15 09:37:13 +02:00
Napalys
c175081698
Added test cases for fastify.addHook
2025-04-15 09:33:41 +02:00
Napalys Klicius
86313715a4
Merge pull request #19184 from Napalys/js/request_handlers
...
JS: Support for `Request` and `NextRequest`
2025-04-14 08:07:24 +02:00
Asger F
6c01709048
JS: Update more test output
2025-04-11 15:15:22 +02:00
Napalys Klicius
3d7c0201d9
Merge pull request #19231 from Napalys/js/typed_array
...
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
2025-04-11 11:29:01 +02:00
Napalys Klicius
d17d29a387
Merge pull request #19218 from Napalys/js/upgrade_websocket
...
JS: Refactor `WebSocket` to use `API` graphs
2025-04-11 10:05:54 +02:00
Napalys
678eccb417
Added searchParams.get as potential source for SSRF
2025-04-11 09:42:07 +02:00
Napalys
8674b61e5a
Added SSRF test case with searchParams for NextRequest
2025-04-11 09:26:16 +02:00
Napalys
6e09a65da0
Added support for NextRequest middleware SSRF.
2025-04-11 08:43:36 +02:00
Napalys
734ad2d767
Removed legacy Consistency check as it is redundant now with inline test expectations.
2025-04-11 08:43:08 +02:00
Napalys
208487f236
Added middleware test
2025-04-11 08:39:47 +02:00
Asger F
719456e27d
JS: Fix missing flow into rest pattern lvalue
2025-04-11 08:37:09 +02:00
Asger F
7703b1fab5
JS: Add test for missing getALocalSource flow for rest pattern
2025-04-11 08:37:07 +02:00
Napalys Klicius
43bf0beae9
Merge pull request #19263 from Napalys/js/make-dir-lib
...
JS: Add support for `make-dir` package
2025-04-10 15:09:43 +02:00
Napalys
86b64afa13
Added NextResponse to the ResponseCall class it models similar near idential behaviour.
2025-04-10 15:06:44 +02:00
Napalys
8acb0243ad
Added test cases for NextResponse and Response
2025-04-10 14:57:40 +02:00
Napalys
63a3953b0c
Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures.
2025-04-10 14:48:17 +02:00
Napalys
81cba7fa2f
Added test cases with missing alerts for Request and NextRequest.
2025-04-10 14:43:48 +02:00
