Asger F
3cf14d8506
JS: Migrate ClientSideUrlRedirect to flow state
2024-12-13 10:08:03 +01:00
Asger F
cca980298f
JS: Use flow state in barrier and step relations
2024-12-13 10:08:02 +01:00
Asger F
a8fdd759f9
JS: Add FlowState class to TaintedUrlSuffix
2024-12-13 10:08:01 +01:00
Asger F
a53d294d91
Merge pull request #18203 from asgerf/jss/document-url
...
JS: Use TaintedUrlSuffix in ClientSideUrlRedirect
2024-12-12 15:47:51 +01:00
Michael Nebel
0bfc1b6ea8
Also move the postprocessing queries to the library pack.
2024-12-12 15:03:03 +01:00
Michael Nebel
941b0abbf6
Move modules to the library packs.
2024-12-12 15:03:01 +01:00
Geoffrey White
44a0ad2942
Update data-flow -> data flow in all versions of ConceptsShared.qll.
2024-12-12 13:36:26 +00:00
Asger F
97b78e752b
JS: Added more qldoc
2024-12-12 13:10:52 +01:00
Asger F
77f8e8ef4e
JS: Use FlowState::fromFlowLabel instead of Label::toFlowState
...
This works better for other queries where we don't already have a module named Label
2024-12-10 11:57:18 +01:00
Asger F
38c9023dd9
JS: FlowLabel -> FlowState in ZipSlip
2024-12-10 11:16:07 +01:00
Asger F
0cd01cb96f
JS: Use node1,state1,node2,state2 naming convention in tainted path
2024-12-10 11:16:05 +01:00
Asger F
0802107d9a
JS: Flow label -> flow state in TaintedPath
2024-12-10 11:16:04 +01:00
Asger F
66eb458134
JS: Handle match/matchAll and unknown regexps
2024-12-09 15:38:36 +01:00
Asger F
6e7c5a3707
JS: Slightly more general getRoot()
2024-12-09 15:05:45 +01:00
Asger F
be617cee4a
JS: More precise handling of .exec()
2024-12-09 15:03:51 +01:00
Asger F
2a2a4d2b67
JS: Add TaintedUrlSuffixCustomizations
...
Importing TaintedUrlSuffix.qll causes the flow label to materialised in unrelated queries, so:
- Renames TaintedUrlSuffix.qll to TaintedUrlSuffixCustomizations.qll
- Make the flow label class abstract
- Adds a new TaintedUrlSuffix.qll that re-exports the above file and also materialises the flow label
- Import the *Customizations.qll file from contexts where we don't want to materialise the flow label
2024-12-09 14:59:29 +01:00
Asger F
71a6a47713
JS: Fix issue with new RegExp().exec()
2024-12-09 14:59:25 +01:00
Asger F
ef833de60e
JS: Replace DocumentUrl with TaintedUrlSuffix
2024-12-09 14:59:23 +01:00
Henry Mercer
92d614dbcd
Add periods for consistency
2024-12-06 19:13:05 +00:00
github-actions[bot]
8c64648520
Release preparation for version 2.20.0
2024-12-06 19:10:28 +00:00
Henry Mercer
a6a4ad6400
Revert "Release preparation for version 2.20.0"
2024-12-06 19:00:27 +00:00
github-actions[bot]
cf71a1525b
Post-release preparation for codeql-cli-2.20.0
2024-12-04 18:36:17 +00:00
Henry Mercer
e0e82ad7ad
Add periods for consistency
2024-12-04 16:05:15 +00:00
github-actions[bot]
96564b7128
Release preparation for version 2.20.0
2024-12-04 16:01:14 +00:00
Henry Mercer
963f084d87
Merge branch 'main' into henrymercer/merge-back-rc-3.16
2024-12-04 13:39:10 +00:00
Asger F
3f0d0e3a05
JS: Deprecate DataFlow::BarrierGuardNode
2024-12-03 14:30:50 +01:00
Asger F
0d79c7141c
JS: Update two more uses of SanitizerGuardNode
2024-12-03 14:30:35 +01:00
Asger F
f620191da4
JS: Deprecate SanitizerGuardNode
2024-12-03 14:30:33 +01:00
Asger F
2ae7386775
JS: Also apply new BarrierGuardLegacy pattern in Xss.qll
2024-12-03 14:30:32 +01:00
Asger F
21494fbdff
JS: Refactor BarrierGuardLegacy pattern to not depend on SanitizerGuardNode
...
Previously our barrier guard classes were direct descendents of SanitizerGuardNode which made it hard to deprecate that class.
Now our barrier guards are not descending from any shared class. Instead they are contributed to SanitizerGuardNode via a private helper class we can remove in the future.
2024-12-03 14:30:29 +01:00
Asger F
e6680dec8f
JS: Avoid use of LabeledSanitizerGuardNode in TaintedObject
...
Drive-by bugfix: Rename sanitizes -> blocksExpr.
This fixes a bug that caused the sanitizer guard not to work in df2.
The test output reflects the fact that the barrier guard works now.
2024-12-03 14:30:24 +01:00
Asger F
f758b67d30
JS: Openly recommend SummarizedCallable
2024-12-03 14:30:09 +01:00
Asger F
249104b8ae
JS: Update comments referring to old Configuration style
...
Also avoid the term "analysis-specific" because it's not a term we use anywhere else.
2024-12-03 14:30:08 +01:00
Asger F
13ee597848
JS: Add some proper documentation to SummarizedCallable
2024-12-03 14:30:07 +01:00
Asger F
988fa9c0ef
JS: Deprecate AdditionalSanitizerGuardNode
...
We're deprecating the class through an alias, but it is still the base class for a non-deprecated class, for backwards compatibility. For this reason we're also deprecating all of its member predicates so we can remove those in the future.
2024-12-03 14:30:06 +01:00
Asger F
0b1e859e70
JS: Remove uses of AdditionalSanitizerGuardNode
2024-12-03 14:30:05 +01:00
Asger F
c2abb0fbd0
JS: Remove reference to AdditionalSanitizerGuard from CachedStages
2024-12-03 14:30:04 +01:00
Asger F
82682d9a62
JS: Remove a non-deprecated reference to SanitizerGuardNode
2024-12-03 14:30:03 +01:00
Asger F
bc7753de29
JS: Remove non-deprecated reference to AdditionalBarrierGuardNode
2024-12-03 14:30:02 +01:00
Asger F
0cd2e3f9eb
JS: Deprecate old data flow library, except some guard-related nodes
2024-12-03 14:30:01 +01:00
Asger F
054558d7b5
JS: Include content properties in type-tracker properties
...
Reminder: we have two PropertyName classes because the one in Contents.qll can't depend on DataFlow::Node.
2024-12-03 09:58:54 +01:00
Napalys Klicius
08ef0dc1f2
Update javascript/ql/lib/change-notes/2024-11-28-regexp-unknown-flags.md
...
Co-authored-by: Asger F <asgerf@github.com >
2024-12-02 13:35:52 +01:00
Asger F
cab8a40d00
JS: Fix accidental recursion
2024-11-29 14:23:57 +01:00
Asger F
2f0c80a98b
JS: Include summary steps in type tracking
2024-11-29 14:23:55 +01:00
Asger F
e34064e3b5
JS: Initial instantiation of sumamry type tracking
...
Instantiates the library without using it yet.
2024-11-29 14:23:50 +01:00
Asger F
df12f255ac
JS: Rename propagatesFlowExt -> propagatesFlow
2024-11-29 14:23:49 +01:00
Napalys Klicius
13afd6310b
Update javascript/ql/lib/change-notes/2024-11-28-regexp-unknown-flags.md
...
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com >
2024-11-29 08:26:04 +01:00
Napalys
d2de9a2238
Fixed change notes
2024-11-28 14:24:27 +01:00
Napalys Klicius
9ca0fe4cbf
Update RegExp handling and add test case
...
Co-authored-by: erik-krogh <erik-krogh@github.com >
2024-11-28 14:13:40 +01:00
Napalys
fd773603e6
Added change notes
2024-11-28 12:04:09 +01:00
