Asger F
|
00661b62dc
|
JS: Add isMiddlewareSetup() hook to Routing model
|
2025-04-22 12:00:02 +02:00 |
|
Asger F
|
c2cab184ac
|
Merge pull request #19283 from asgerf/js/rest-pattern-fix
JS: Fix missing flow into rest pattern lvalue
|
2025-04-22 10:37:36 +02:00 |
|
github-actions[bot]
|
d78736b1bf
|
Post-release preparation for codeql-cli-2.21.1
|
2025-04-15 16:33:15 +00:00 |
|
Napalys
|
5c3556da66
|
Add user-controlled property tracking and update code injection alerts in Fastify hooks
|
2025-04-15 09:41:52 +02:00 |
|
Napalys
|
9b194ea613
|
Added addHook to RouteSetup thus now it is recognized now as rouute handler
|
2025-04-15 09:37:13 +02:00 |
|
Napalys
|
c175081698
|
Added test cases for fastify.addHook
|
2025-04-15 09:33:41 +02:00 |
|
Napalys
|
f1a3293f4c
|
Added change note
|
2025-04-15 09:27:51 +02:00 |
|
github-actions[bot]
|
b961c5961d
|
Release preparation for version 2.21.1
|
2025-04-14 09:53:06 +00:00 |
|
Napalys Klicius
|
86313715a4
|
Merge pull request #19184 from Napalys/js/request_handlers
JS: Support for `Request` and `NextRequest`
|
2025-04-14 08:07:24 +02:00 |
|
Asger F
|
6c01709048
|
JS: Update more test output
|
2025-04-11 15:15:22 +02:00 |
|
Napalys Klicius
|
3d7c0201d9
|
Merge pull request #19231 from Napalys/js/typed_array
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
|
2025-04-11 11:29:01 +02:00 |
|
Napalys
|
11abbf8c4a
|
Now nextUrl is of type parameter and loosen the restriction for NextAppRouteHandler
|
2025-04-11 11:19:12 +02:00 |
|
Napalys Klicius
|
92e4f112c0
|
Update javascript/ql/lib/semmle/javascript/frameworks/Next.qll
Co-authored-by: Asger F <asgerf@github.com>
|
2025-04-11 11:08:40 +02:00 |
|
Napalys Klicius
|
d0dcf897cb
|
Update javascript/ql/lib/semmle/javascript/internal/flow_summaries/Strings.qll
Co-authored-by: Asger F <asgerf@github.com>
|
2025-04-11 11:04:08 +02:00 |
|
Napalys Klicius
|
d17d29a387
|
Merge pull request #19218 from Napalys/js/upgrade_websocket
JS: Refactor `WebSocket` to use `API` graphs
|
2025-04-11 10:05:54 +02:00 |
|
Napalys
|
e3f1720f9c
|
RenamedDecodeLike to Decode and updated propagatesFlow
|
2025-04-11 10:04:09 +02:00 |
|
Napalys
|
2c4b3527b4
|
Added change note
|
2025-04-11 09:42:12 +02:00 |
|
Napalys
|
678eccb417
|
Added searchParams.get as potential source for SSRF
|
2025-04-11 09:42:07 +02:00 |
|
Napalys
|
8674b61e5a
|
Added SSRF test case with searchParams for NextRequest
|
2025-04-11 09:26:16 +02:00 |
|
Napalys
|
6e09a65da0
|
Added support for NextRequest middleware SSRF.
|
2025-04-11 08:43:36 +02:00 |
|
Napalys
|
734ad2d767
|
Removed legacy Consistency check as it is redundant now with inline test expectations.
|
2025-04-11 08:43:08 +02:00 |
|
Napalys
|
208487f236
|
Added middleware test
|
2025-04-11 08:39:47 +02:00 |
|
Asger F
|
719456e27d
|
JS: Fix missing flow into rest pattern lvalue
|
2025-04-11 08:37:09 +02:00 |
|
Asger F
|
7703b1fab5
|
JS: Add test for missing getALocalSource flow for rest pattern
|
2025-04-11 08:37:07 +02:00 |
|
Napalys Klicius
|
43bf0beae9
|
Merge pull request #19263 from Napalys/js/make-dir-lib
JS: Add support for `make-dir` package
|
2025-04-10 15:09:43 +02:00 |
|
Napalys
|
86b64afa13
|
Added NextResponse to the ResponseCall class it models similar near idential behaviour.
|
2025-04-10 15:06:44 +02:00 |
|
Napalys
|
8acb0243ad
|
Added test cases for NextResponse and Response
|
2025-04-10 14:57:40 +02:00 |
|
Napalys
|
63a3953b0c
|
Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures.
|
2025-04-10 14:48:17 +02:00 |
|
Napalys
|
81cba7fa2f
|
Added test cases with missing alerts for Request and NextRequest.
|
2025-04-10 14:43:48 +02:00 |
|
Asger F
|
eac14b9837
|
Merge pull request #19200 from asgerf/js/web-response
JS: Add sinks for calls to 'new Response()'
|
2025-04-10 14:41:32 +02:00 |
|
Napalys
|
171a84609e
|
Applied copilot suggestion.
|
2025-04-10 14:13:48 +02:00 |
|
Asger F
|
3da1f261f7
|
JS: Change note
|
2025-04-10 07:21:48 +02:00 |
|
Asger F
|
cfa1a9b603
|
JS: Update extractor version string
|
2025-04-10 07:20:53 +02:00 |
|
Asger F
|
1434f7acd2
|
JS: Tolerate trailing comma in JSON array
Previously we'd fail to extract some tsconfig.json files because of this.
|
2025-04-10 07:20:51 +02:00 |
|
Asger F
|
800dd168c2
|
JS: Add failing TRAP test for trailing comma
|
2025-04-10 07:20:49 +02:00 |
|
Napalys
|
5243f90c90
|
Brought back old methods and marked them as deprecated
|
2025-04-09 14:56:24 +02:00 |
|
Napalys
|
5ec71ab9af
|
Added change note
|
2025-04-09 14:42:34 +02:00 |
|
Napalys
|
ce2fc25cdb
|
Added make-dir model as data
|
2025-04-09 14:42:29 +02:00 |
|
Napalys
|
674f40b35f
|
Added test cases for make-dir package.
|
2025-04-09 14:41:12 +02:00 |
|
Napalys Klicius
|
2dca95af92
|
Update javascript/ql/lib/change-notes/2025-04-07-websocket.md
Co-authored-by: Asger F <asgerf@github.com>
|
2025-04-09 14:26:00 +02:00 |
|
Napalys
|
0c52b5ad95
|
Added summary flow for StringFromCharCode
|
2025-04-09 14:24:43 +02:00 |
|
Napalys Klicius
|
f02783a9c6
|
Merge pull request #19210 from Napalys/js/mkdirp
JS: Modeling of `mkdirp` functions
|
2025-04-09 13:43:37 +02:00 |
|
Napalys
|
a3e4e62eac
|
Removed taint from ArrayBuffer constructor as it accepts length
|
2025-04-09 13:27:13 +02:00 |
|
Napalys
|
4bc3e9e736
|
Addressed comments
Co-authored-by: Asgerf <asgerf@github.com>
|
2025-04-09 12:31:45 +02:00 |
|
Asger F
|
da7d6d3346
|
JS: Change note
|
2025-04-09 11:28:21 +02:00 |
|
Napalys
|
4a4d78bbde
|
Added change note
|
2025-04-08 08:12:42 +02:00 |
|
Napalys
|
b8802a29f4
|
Added open package model as data.
|
2025-04-08 08:12:30 +02:00 |
|
Napalys
|
df89739085
|
Added test cases for open package.
|
2025-04-08 08:10:10 +02:00 |
|
Napalys
|
873db7c121
|
Added change note
|
2025-04-07 18:15:24 +02:00 |
|
Napalys
|
b97c61864e
|
Add flow summaries and entry points for TextDecoder
|
2025-04-07 18:15:19 +02:00 |
|