Asger Feldthaus
1a1b7d4ee0
JS: Switch to whitelisting allowed properties
2020-03-11 16:09:14 +00:00
Erik Krogh Kristensen
d32d14f572
model responseText and responseXml on jqXHR objects
2020-03-11 17:00:44 +01:00
Erik Krogh Kristensen
26d8e33434
Autoformat
2020-03-11 16:42:48 +01:00
Jonas Jensen
86ad4d0357
Docs: Remove some Semmle references
...
The only Semmle references now left in the public Markdown files are in
URLs and in legal text. There are also two Semmle references left in
`docs/language/vale-styles/README.md` because I didn't understand them
well enough to change them.
2020-03-11 15:20:15 +01:00
Erik Krogh Kristensen
e88dac3dea
remove FP for js/redundant-operation
2020-03-11 14:42:32 +01:00
Asger Feldthaus
6645df93ad
JS: Blacklist another cyclic property
2020-03-11 13:09:37 +00:00
semmle-qlci
1d5fba85f9
Merge pull request #3034 from esbena/js/sharpen-useless-regexp-character-escape
...
Approved by asgerf
2020-03-11 12:29:45 +00:00
Erik Krogh Kristensen
cb5ef7dbed
add basic support for jqXHR with ajax calls
2020-03-11 13:05:41 +01:00
Erik Krogh Kristensen
b987f2cf29
autoformat
2020-03-11 10:54:20 +01:00
Erik Krogh Kristensen
7f147221f5
refactor to include promise tracking as a core part of type tracking
2020-03-11 10:44:11 +01:00
Erik Krogh Kristensen
fa26ce9f4b
update expected output
2020-03-11 09:36:12 +01:00
Esben Sparre Andreasen
4dac835bb0
JS: loosen qldoc for barrierGuardIsRelevant
2020-03-11 07:54:38 +01:00
Erik Krogh Kristensen
13e855910e
add more ClientRequest models for JQuery
2020-03-10 17:21:22 +01:00
semmle-qlci
e3fed39f88
Merge pull request #3000 from asger-semmle/js/late-barrier-guards
...
Approved by erik-krogh
2020-03-10 15:38:35 +00:00
Erik Krogh Kristensen
62ae484545
autoformat and update expected output
2020-03-10 14:01:40 +01:00
semmle-qlci
570f095ae3
Merge pull request #2998 from asger-semmle/js/typescript-memory
...
Approved by erik-krogh
2020-03-10 12:24:52 +00:00
Esben Sparre Andreasen
5c8800a1c7
JS: make autoformatter happy
2020-03-10 13:11:31 +01:00
Erik Krogh Kristensen
066568ea60
add promise tracking to Files.qll
2020-03-10 12:36:42 +01:00
Erik Krogh Kristensen
a24bc564a4
add extra tests for file-name with promises
2020-03-10 12:35:34 +01:00
Erik Krogh Kristensen
97f2760583
refactor Files.qll to use type-tracking (without tracking anything)
2020-03-10 12:34:20 +01:00
Erik Krogh Kristensen
6110f85748
refactor chrome-remote-interface to use type-tracking promise steps
2020-03-10 12:27:21 +01:00
Esben Sparre Andreasen
5b1b945c35
JS: distinguishes escapes in strings and regular expression literals
2020-03-10 12:26:20 +01:00
Erik Krogh Kristensen
3ddfd7ba73
add extra promise test for chrome-remote-interface
2020-03-10 12:24:16 +01:00
Erik Krogh Kristensen
69d8cf643d
add type tracking predicates for promises
2020-03-10 12:23:23 +01:00
Esben Sparre Andreasen
3bfda6cd38
JS: refactoring: make separate modules for mongoose Model and Query
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
480be06d86
JS: replace Model class with opaque type tracking predicate
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
dbeb216af0
JS: make use of TypeScript types for mongoose Model and Query
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
0c46e4d1af
JS: fixup typetracking usage: t2 -> t2.continue()
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
aae92ad795
JS: add test for DatabaseAccess
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
6b9bd8bd97
JS: adjust tests slightly to also support DatabaseAccess testing
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
7a2faa0b6b
JS: add additional mongoose and mongodb js/nosql-injection sinks
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
b6c616efd3
JS: support optional options argument to MongoClient.connect
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
f24f03e1f8
JS: add mongodb .connect tests
2020-03-10 09:57:45 +01:00
Esben Sparre Andreasen
21e6e69f22
JS: support mongodb v3 (minimally)
...
https://github.com/github/codeql-javascript-team/issues/79
2020-03-10 09:57:45 +01:00
Erik Krogh Kristensen
ad52d6446e
add test case for tuple-like use
2020-03-09 19:47:05 +01:00
Erik Krogh Kristensen
981eef2587
expose arrayFunctionTaintStep in TaintTracking.qll
2020-03-09 17:22:29 +01:00
Erik Krogh Kristensen
509941649c
remove redundant qldoc, and change parameter names to better reflect behavior
2020-03-09 17:20:12 +01:00
Erik Krogh Kristensen
a476fc5c3b
revert Array.from change
2020-03-09 17:09:31 +01:00
Erik Krogh Kristensen
68ffd52d4c
update expected output
2020-03-09 16:45:10 +01:00
Erik Krogh Kristensen
b4b05696e1
two bugfixes
2020-03-09 16:45:03 +01:00
Max Schaefer
3c785ecaa7
JavaScript: Move flow summaries to experimental.
...
Also update description and change note to call out their experimental character more clearly.
2020-03-09 12:57:20 +00:00
Asger Feldthaus
6c1f98a5ae
JS: Update vague variable name
2020-03-09 11:58:38 +00:00
Erik Krogh Kristensen
0f0187d585
move Array.from to ArrayCreationNode
2020-03-09 10:26:21 +01:00
Erik Krogh Kristensen
dc4e361d75
add data-flow steps for arrays
2020-03-09 09:53:08 +01:00
Erik Krogh Kristensen
8e3cf5c9c8
add test for data-flow on arrays
2020-03-09 09:25:17 +01:00
Erik Krogh Kristensen
14740d4ccc
move existing array taint stracking into Arrays.qll
2020-03-09 09:20:45 +01:00
Asger Feldthaus
a1d479e975
JS: Declassify sensitive exprs with special characters
2020-03-07 15:15:13 +00:00
Asger Feldthaus
759631ae56
JS: Raise default memory limit to 2.4G
2020-03-07 15:13:53 +00:00
Asger Feldthaus
c55dcf88d5
JS: Improve error reporting
2020-03-07 15:13:52 +00:00
Asger Feldthaus
549d4e9b57
JS: Do not restart in the middle of a message
2020-03-07 15:13:52 +00:00
