Asger F
699d3a0a0a
JS: Update a RegExp injection test
...
RegExpInjection does not use client-side sources, but one of its tests was using postMessage events
as the taint source. Updating the test to use a different taint source.
2024-08-16 14:20:34 +02:00
Mauro Baluda
be0a60a7f6
Add support for importing NPM modules in XSJS sources
2024-08-13 14:45:03 +02:00
Erik Krogh Kristensen
41506fbfef
Merge pull request #14666 from am0o0/amammad-js-hardcodedJWTKey
...
JS: Extends CredentialsNode class mostly related to JWT authentication packages
2024-08-08 10:20:45 +02:00
Asger F
2d814428d6
JS: Update expected output with provenance
2024-08-06 12:45:08 +02:00
Asger F
df64388d79
Merge branch 'main' into js/shared-dataflow-merge-main
2024-08-02 13:18:38 +02:00
am0o0
354fcbe7fe
apply changes from @erik-krogh
2024-08-01 20:14:36 +02:00
Paul Hodgkinson
c9af53f050
Merge branch 'main' into aegilops/polyfill-io-compromised-script
2024-07-12 12:53:44 +01:00
aegilops
d71be8aeaf
Moved from experimental into default queries
2024-07-11 11:44:01 +01:00
aegilops
86afd54a9b
Moved new query to 'experimental'
...
Moved lists of domains to data extensions, including adding those to the overall qlpack.yml
Expanded scope of new query to further domains operated by the untrusted owners of polyfill.io
2024-07-09 16:38:01 +01:00
aegilops
e2b37f97b0
Added dot to end of test message
2024-07-01 17:41:26 +01:00
aegilops
a1b0703690
Added detection for specific Polyfill.io CDN compromise - edited existing library and added new query and tests
2024-07-01 16:21:34 +01:00
am0o0
b360c8adb8
Update hardcodedCredentials query file to only exclude 'jwt key' kind from with the isTestFile predicate.
...
According to expected test results, with a new query, the jwt sinks of __test__/ dir have been exluded from query results.
2024-07-01 15:00:08 +02:00
am0o0
5a1877547f
update test cases of __tests__/ dir
...
since we want to check if a jwt related sink is in this dir or not
2024-07-01 14:50:07 +02:00
am0o0
6ecd8b7ee8
add new default cred kind
2024-07-01 14:42:34 +02:00
am0o0
65fdb8ccce
move jose SharedTaintStep to a local taint step, add more additional steps with test cases, update test cases and expected test results
2024-07-01 11:38:17 +02:00
Asger F
c3806a2210
JS: Messy test output updates
...
These initially got messed up by a merge conflict where I couldn't rerun the tests due to breaking
changes in the data flow library. I wanted the breaking-change updates to live in their own commits,
not just eaten by a merge resolution commit, so the test output became broken for a while.
The '#select' result set is unchanged in all of these, so they should be safe to accept.
2024-06-27 11:59:56 +02:00
Asger F
ee10702e73
JS: Another provanance test output update
2024-06-27 11:56:01 +02:00
Asger F
2473274681
JS: Benign test output changes
2024-06-27 09:06:45 +02:00
Asger F
53efb5837b
JS: Update some tests with provenance columns
...
Only includes the changes that purely contain the new provenance columns
2024-06-26 13:51:44 +02:00
aegilops
f22778960b
Fixed expected test results for Helmet query
2024-06-26 11:31:57 +01:00
Asger F
ecf418b8f6
Merge branch 'main' into js/shared-dataflow
2024-06-25 11:48:41 +02:00
Asger F
bd3fccd1a8
JS: Update test output with provenance column
2024-06-25 10:30:56 +02:00
am0o0
5a69bbf6b0
use isTestFile from ClassifyFiles module file instead previous where condition, update tests accordingly
2024-06-07 06:11:48 +02:00
am0o0
e4ffdb848e
add tests for new where condition, update expected test results
2024-06-06 14:30:06 +02:00
am0o0
d77513579f
update tests
2024-05-25 12:15:25 +02:00
Paul Hodgkinson
65dfd4c860
Merge branch 'main' into aegilops/js/insecure-helmet-middleware
2024-05-21 14:46:49 +01:00
aegilops
bda794fde7
Fixed wrong filenames in the InsecureHelmet tests
2024-05-21 14:34:58 +01:00
aegilops
8300aeb0a0
Tests for InsecureHelmet
2024-05-20 12:05:42 +01:00
Asger F
499c4df79b
Merge pull request #13554 from am0o0/amammad-js-bombs
...
JS: Decompression Bombs
2024-05-16 13:25:41 +02:00
erik-krogh
39a8b49222
add qhelp recommendation that you can use an obvious placeholder value
2024-05-03 19:37:31 +02:00
erik-krogh
b209fc67cb
test the change to hardcoded-credentials
2024-05-03 19:34:18 +02:00
Asger F
c408ab9e6a
Merge branch 'main' into js/shared-dataflow
2024-05-02 19:43:34 +02:00
Asger F
a0b49b23f5
JS: Add UseServer and UseClient directives
2024-03-26 09:39:39 +01:00
Asger F
5e7d1d5c2c
Merge branch 'main' into js/shared-dataflow-merged
2024-03-13 14:27:16 +01:00
erik-krogh
129286aa1c
allow more flow through .filter()
2024-03-13 12:03:00 +01:00
erik-krogh
bf22f4a870
update expected output
2024-02-22 13:21:11 +01:00
Asger F
75a95ffcd1
Merge pull request #15602 from asgerf/js/block-logical-and-flow
...
JS: Fix flow through &&
2024-02-14 12:29:40 +01:00
Asger F
f5c437694c
Update UselessConditional.expected
2024-02-13 18:31:24 +01:00
erik-krogh
94b7bda3dc
exclude tagged template literals from js/superfluous-trailing-arguments
2024-02-06 09:36:30 +01:00
Sid Shankar
b1d7a635f5
Renames diagnostic query files and tests
...
This commit renames the files relating to the diagnostic query that produces information on the number of files extracted. The files have been renamed from "SuccessfullExtractedFiles.*" to "ExtractedFiles.*". All related tests and test files have been renamed too.
The `@tags` and `@id` attributes of the queries have been left untouched, consistent with the `@tags` and `@id` for similar queries in other languages.
2024-01-29 20:19:20 +00:00
erik-krogh
396da117bb
remove an FP in overly-large-range for [@-Z]
2024-01-25 14:15:06 +01:00
GitHub Security Lab
df10a7e7f0
Merge branch 'main' into amammad-js-bombs
2024-01-25 11:23:38 +01:00
Sid Shankar
2d71294f61
Merge pull request #15256 from sidshank/change/adjust-extracted-files-diagnostics
...
Js/Py/Rb: Report any extracted file as successfully extracted
2024-01-17 11:04:06 -05:00
erik-krogh
1a8a70dc1b
mark the range [0-?] as good in the overly-large-range query
2024-01-17 13:11:57 +01:00
Sid Shankar
59098be8c4
Merge branch 'main' into change/adjust-extracted-files-diagnostics
2024-01-16 21:51:41 -05:00
Sid Shankar
e30a0d1e83
JS: Report any extracted file as successfully extracted
2024-01-08 22:19:33 +00:00
erik-krogh
a9f2b3fad6
promote PropsTaintStep to a PreCallGraphStep
2024-01-04 10:45:22 +01:00
Rafael
1a05c2e704
Added Django test
2023-11-29 08:26:49 +01:00
Max Schaefer
dfffa1e237
Apply suggestions from code review
...
Co-authored-by: Sam Browning <106113886+sabrowning1@users.noreply.github.com >
2023-11-21 10:07:11 +00:00
Max Schaefer
d147faba4e
Update qhelp for js/path-injection.
2023-11-20 11:58:00 +00:00
