4844 Commits

Author	SHA1	Message	Date
Esben Sparre Andreasen	ee7a6af7c7	JS: address review comments	2018-11-20 08:37:23 +01:00
Pavel Avgustinov	16ec9f1aa4	Merge remote-tracking branch 'origin/next' into bump/master-next	2018-11-19 10:37:07 +00:00
Asger F	6ec13feab4	JS: recognize sanitizing slashes in URL redirection queries	2018-11-16 10:43:25 +00:00
semmle-qlci	0647743333	Merge pull request #467 from xiemaisi/js/amd-imports ... Approved by asger-semmle	2018-11-16 09:31:50 +00:00
semmle-qlci	4a14bef507	Merge pull request #466 from xiemaisi/js/more-data-flow-predicates ... Approved by asger-semmle	2018-11-14 16:07:59 +00:00
Max Schaefer	6f6b3b0d5e	JavaScript: Add a convenience method to SourceNode and use it in a few places.	2018-11-14 11:58:45 +00:00
Max Schaefer	a441bfb751	JavaScript: Add a convenience method to AMDModuleDefinition.	2018-11-14 11:36:40 +00:00
Aditya Sharad	f0715b09e1	Merge master into next.	2018-11-14 10:06:27 +00:00
Max Schaefer	9221b62ded	JavaScript: Update expectd test output for security path queries to include nodes and edges query predicates.	2018-11-14 09:32:31 +00:00
Max Schaefer	d57b5d9628	JavaScript: Remove ReflectdXssPath.ql, which is now spurious.	2018-11-14 09:16:40 +00:00
Max Schaefer	a499009f59	Merge pull request #395 from esben-semmle/js/useless-defensive-code ... JS: add query: js/useless-defensive-code	2018-11-13 16:55:59 +00:00
Max Schaefer	4fdfbb77cc	Merge pull request #444 from esben-semmle/js/browser-based-client-requests ... JS: add models of $.ajax, $.getJSON and XMLHttpRequst	2018-11-13 16:53:52 +00:00
Esben Sparre Andreasen	daed0653cb	JS: support property tracking of custom abstract values	2018-11-13 11:42:09 +01:00
Esben Sparre Andreasen	1d87c580b3	JS: introduce DefinedCustomAbstractValue	2018-11-13 11:40:31 +01:00
semmle-qlci	86e31a584e	Merge pull request #447 from esben-semmle/js/indirect-sanitization ... Approved by asger-semmle	2018-11-13 09:14:28 +00:00
Esben Sparre Andreasen	5666deac14	JS: rename js/useless-defensive-code to js/unneeded-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	8b71b25a2a	JS: annotate test file with expected results	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	358e6188d9	JS: downgrade other alerts to js/useless-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	e29c57a58e	JS: add whitelist to js/useless-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	b073fcfca2	JS: add query: js/useless-defensive-code	2018-11-13 08:19:38 +01:00
Esben Sparre Andreasen	ce0dd241f6	JS: add models of $.ajax, $.getJSON and XMLHttpRequst	2018-11-13 08:14:51 +01:00
Max Schaefer	663bdd60a0	Merge pull request #396 from esben-semmle/js/unconditional-property-override ... JS: add query: js/unconditional-property-override	2018-11-12 17:10:32 +00:00
Jonas Jensen	1500237009	Merge remote-tracking branch 'upstream/master' into mergeback-20181112	2018-11-12 13:24:27 +01:00
Esben Sparre Andreasen	eaad84bb4f	JS: add support for dis- and conjunctions in SanitizingFunction	2018-11-12 10:23:52 +01:00
Esben Sparre Andreasen	ffc3d6ba49	JS: simplify test (move alerts four lines up)	2018-11-12 10:21:41 +01:00
Esben Sparre Andreasen	6d0c93b6a8	JS: introduce TaintTracking::AdditionalSanitizingCall	2018-11-12 10:21:39 +01:00
Tom Hvitved	40def8d364	Merge pull request #418 from dave-bartolomeo/dave/FormatConfig ... Allow mixed whitespace in certain test and external directories	2018-11-12 09:43:39 +01:00
Aditya Sharad	761e5efd60	Merge master into next. ... JavaScript semantic conflicts fixed by referring to the `LegacyLanguage` enum. C++ conflicts fixed by accepting Qltest output.	2018-11-09 18:49:35 +00:00
Max Schaefer	bdfe938d02	JavaScript: Improve StackTraceExposure query. ... It now also flags exposure of the entire exception object (not just the `stack` property).	2018-11-09 09:42:09 +00:00
Dave Bartolomeo	55f4839abf	Allow mixed whitespace in JavaScript test sources	2018-11-08 11:06:42 -08:00
Esben Sparre Andreasen	bd2fc33621	JS: annotate tests with expectations	2018-11-08 13:23:19 +01:00
Esben Sparre Andreasen	33a297c829	JS: add query: js/useless-assignment-to-property	2018-11-08 13:23:19 +01:00
Asger F	e0d5557ef4	JS: add email HTML body as XSS sink	2018-11-07 11:31:40 +00:00
Max Schaefer	b058854964	JavaScript: Teach type inference about AMD imports.	2018-11-07 09:18:21 +00:00
semmle-qlci	4225e0bb44	Merge pull request #356 from asger-semmle/parameter-node ... Approved by xiemaisi	2018-11-07 08:31:05 +00:00
semmle-qlci	2457eb98df	Merge pull request #166 from asger-semmle/documentable-self-assign ... Approved by esben-semmle, xiemaisi	2018-11-07 08:30:17 +00:00
semmle-qlci	c20e24d549	Merge pull request #385 from asger-semmle/async-model ... Approved by xiemaisi	2018-11-07 08:28:37 +00:00
semmle-qlci	282d1e2096	Merge pull request #404 from asger-semmle/useless-conditional2 ... Approved by xiemaisi	2018-11-07 08:28:01 +00:00
Max Schaefer	212a78b5fc	Merge pull request #323 from esben-semmle/js/always-return-type-inference ... JS: additional return type inference	2018-11-07 08:25:28 +00:00
Esben Sparre Andreasen	a07c094437	JS: introduce TypeInferredCalleeWithAnalyzedReturnFlow	2018-11-06 16:04:46 +01:00
Asger F	dcf6218d1d	JS: update test expectations	2018-11-06 12:22:05 +00:00
Asger F	b40fa3845f	JS: add model of async package	2018-11-06 12:12:43 +00:00
Aditya Sharad	553c2f5d34	Merge master into next. ... As of 2846d80f1c.	2018-11-06 11:52:51 +00:00
Asger F	87e0027974	JS: address comments	2018-11-06 10:29:04 +00:00
Asger F	56707fc79a	JS: recognize more conditionals in useless-conditional	2018-11-06 10:28:05 +00:00
Esben Sparre Andreasen	651f32514b	JS: use 'Util::describeExpression' in js/trivial-conditional	2018-11-05 13:00:07 +01:00
Esben Sparre Andreasen	4e54af3b41	JS: introduce 'Util::describeExpression'	2018-11-05 12:58:12 +01:00
Asger F	4f4ad2b942	JavaScript: ignore self-assignments with a JSDoc comment	2018-11-05 11:31:02 +00:00
semmle-qlci	b743ee4179	Merge pull request #314 from esben-semmle/js/json-stringify-as-command-line-injection-source-heuristic ... Approved by xiemaisi	2018-11-05 07:37:36 +00:00
Esben Sparre Andreasen	8f3497a7bf	JS: improve tests for interprocedural type inference	2018-11-01 13:51:38 +01:00