Asger F
e745f42291
JS: Remove alert expectation from step
...
This is just a step on the path, not a sink
2025-02-28 13:28:06 +01:00
Asger F
319ee2ccd5
JS: Track deep flow through qs.stringify
2025-02-28 13:28:04 +01:00
Asger F
c593853710
JS: Record some missing alerts in FileAccessToHttp
2025-02-28 13:28:03 +01:00
Asger F
cf33db78cc
JS: Fix the spurious flow
2025-02-28 13:28:02 +01:00
Asger F
c051b4c98d
JS: Add spurious alert marker
2025-02-28 13:28:00 +01:00
Asger F
b095fe2a19
JS: Fix some bugs in a test case
...
'args' was a redeclared block-level variable, and 'myArgs' was not used when clearly intended to be used
2025-02-28 13:27:59 +01:00
Asger F
22c218d665
JS: Mark a 'good' test as 'bad' and add Alert marker
...
The lack of whitespace around '&&' is problematic
2025-02-28 13:27:58 +01:00
Asger F
a9b263f465
JS: Remove incorrect alert expectation
...
This is not flagged and AFAICT it shouldn't be
2025-02-28 13:27:57 +01:00
Asger F
287753187e
JS: Remove invalid syntax from test
...
TS decorators may not appear on functions and enums
2025-02-28 13:27:56 +01:00
Asger F
426a871405
JS: Remove incorrect Alert marker
...
This is expected, based on a comment earlier in the file about the 'y' variable
2025-02-28 13:27:54 +01:00
Asger F
2c46e10678
JS: Mark an alert as missing
2025-02-28 13:27:53 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
e5bee19b19
JS: Accept a double-flagged line
...
This is flagged by two queries but for two separate issues. Seems valid to flag it twice.
2025-02-28 13:27:51 +01:00
Asger F
68fae9ded8
JS: Accept alerts about newline replacement
2025-02-28 13:27:49 +01:00
Asger F
1f3c49638b
JS: Accept some less obvious alerts
...
These are listed in a function called 'good' but it's difficult to say in isolation whether they should be flagged or not. Accepting the changes as they seem reasonable.
2025-02-28 13:27:48 +01:00
Asger F
f395651807
JS: Mark alert as MISSING
...
See https://github.com/github/codeql-javascript-team/issues/447
2025-02-28 13:27:47 +01:00
Asger F
07a876b4e9
JS: Accept some alerts at the SystemCommandExecution location
2025-02-28 13:27:46 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
0453ded338
JS: Add query ID to some alerts
2025-02-28 13:27:41 +01:00
Asger F
86932c51bc
JS: Move some alerts to their correct location
...
One of the diffs look confusing but:
Previously parameter {2,3} where flagged, now parameter {1,2} are flagged.
Note that for command injection, the SystemCommandExecution is flagged
despite the test file claiming otherwise.
2025-02-28 13:27:40 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
795c1100fc
JS: Disable for SyntaxError
...
The presence of a syntax error sometimes prevents us from parsing the inline comment correctly.
2025-02-28 13:27:37 +01:00
Asger F
789a7bdb48
JS: Disable for test with alerts in a JSON file
...
JSON does not support comments so we can't use inline expectations
2025-02-28 13:27:36 +01:00
Asger F
ac6547fd01
JS: Disable for comment-related alerts
2025-02-28 13:27:35 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
7e5c24a8ec
JS: Remove uses of old inline expectation test library
2025-02-28 13:27:26 +01:00
Asger F
ff36d1916f
Merge pull request #18810 from asgerf/js/test-related-locations
...
Test: Add support for RelatedLocation tag and use in a JS query
2025-02-25 16:40:41 +01:00
Asger F
baa7e35589
Merge pull request #18834 from Napalys/js/tanstack
...
JS: Support 'response' threat model and @tanstack/react-query
2025-02-25 16:16:06 +01:00
Napalys
bf77ffef37
Applied comment
...
Co-authored-by: Asgerf <asgerf@github.com >
2025-02-25 13:57:39 +01:00
Napalys
e2927b2fad
Updated tanstack to use API graph.
2025-02-25 11:48:44 +01:00
Anders Schack-Mulligen
b2a595596b
JS: Remove irrelevant comment.
2025-02-25 11:33:16 +01:00
Anders Schack-Mulligen
449150e6b5
JS: Accept fixed FP flow.
2025-02-25 10:42:21 +01:00
Asger F
cd2c4d5e3a
JS: Use post-processed inline test in MissingCsrfMiddleware
...
This query flags the cookie-parsing middleware in order to consolidate huge numbers of alerts into a single alert, which is more manageable. But simply annotating the cookie-parsing middleware with 'Alert' isn't a very useful, we want to annotate which middlewares are vulnerable.
2025-02-21 14:44:46 +01:00
Napalys
1227a7eedc
Add Tanstack framework support and enhance data flow tracking for fetch responses
2025-02-21 13:24:00 +01:00
Napalys
05690c21ed
Added a test for tanstack/react-query useQuery
2025-02-21 13:24:00 +01:00
Asger F
a1b7096125
Merge pull request #18783 from asgerf/js/downward-calls
...
JS: Resolve calls downward in class hierarchy
2025-02-20 09:01:58 +01:00
Asger F
58c8b5fa2b
Merge pull request #18790 from asgerf/js/no-implicit-array-taint
...
JS: Do not taint whole array when storing into ArrayElement
2025-02-19 13:23:31 +01:00
Asger F
e1c280500e
Merge pull request #18749 from Kwstubbs/express
...
JS: Add result.download to Express as Path Traversal Sink
2025-02-19 09:08:36 +01:00
Asger F
24e7aad6ba
JS: Overriden -> Overridden
2025-02-18 09:51:13 +01:00
Asger F
c958702830
JS: Accept some unproblematic consistency warnings
2025-02-17 20:30:07 +01:00
Erik Krogh Kristensen
7fa41c438f
Merge pull request #18794 from erik-krogh/v-flag
...
JS: Add support for the regex V flag
2025-02-17 13:56:48 +01:00
Asger F
08b9d934c0
JS: Add a negative test
2025-02-17 11:37:44 +01:00
Asger F
352924fb8c
JS: Handle a few other stringification contexts
2025-02-17 11:36:28 +01:00
Asger F
33ab7db98a
JS: Handle Array.prototype.toString calls
2025-02-17 11:25:03 +01:00
Asger F
a74b203c86
JS: Add test with implicit array stringification
2025-02-17 11:21:46 +01:00
Asger F
d87534c7d0
JS: Model Array#toString
2025-02-17 11:13:36 +01:00
Asger F
e8d1703224
JS: Add test for flow through Buffer.concat
...
This flow was lost since the existing model of concat() boxes its return value in ArrayElement. There is no explicit model of Buffer.concat.
2025-02-17 11:12:51 +01:00
Asger F
d79f429978
JS: Update changes to nodes/edges/subpaths
...
No changes in actual alerts
2025-02-17 10:36:05 +01:00
