hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-19 10:23:15 +01:00
Code Issues Packages Projects Releases Wiki Activity
81,788 Commits 1,671 Branches 157 Tags
codeql-cli-2.22.4
Commit Graph

2852 Commits

Author SHA1 Message Date
Asger F
8e95a90d03 JS: Port UntrustedDataToExternalAPI 2023-10-13 13:15:04 +02:00
Asger F
abd937a49d JS: Port DifferentKindsComparisonBypass 2023-10-13 13:15:04 +02:00
Asger F
d324e554f3 JS: Port DeepObjectResourceExhaustion 2023-10-13 13:15:04 +02:00
Asger F
30f1fbc10d JS: Port CorsMisconfigurationForCredentials 2023-10-13 13:15:04 +02:00
Asger F
f14303acea JS: Port ConditionalBypass 2023-10-13 13:15:04 +02:00
Asger F
2296a273c4 JS: Port BuildArtifactLeak 2023-10-13 13:15:04 +02:00
Asger F
85617c292e JS: Port BrokenCryptoAlgorithm 2023-10-13 13:15:04 +02:00
Asger F
395f52303c JS: Port barriers in UrlConcatenation.qll 2023-10-13 13:15:04 +02:00
Asger F
7a1aead831 JS: Port ZipSlip 2023-10-13 13:15:04 +02:00
Asger F
e9189f965f JS: Port LogInjection 2023-10-13 13:15:04 +02:00
Asger F
ae680e747b JS: Port LoopBoundInjection 2023-10-13 13:15:04 +02:00
Asger F
40d68cb4dc JS: Port CleartextStorage 2023-10-13 13:15:04 +02:00
Asger F
b8a6f81669 JS: Port CleartextLogging 2023-10-13 13:15:04 +02:00
Asger F
a5c221fcfc JS: Port PrototypePollutingMergeCall 2023-10-13 13:15:04 +02:00
Asger F
f1f45927b1 JS: Port PrototypePollutingAssignment 2023-10-13 13:15:04 +02:00
Asger F
81d2721248 JS: Port ClientSideUrlRedirect 2023-10-13 13:15:04 +02:00
Asger F
46fd727a55 JS: Port ServerSideUrlRedirect 2023-10-13 13:15:04 +02:00
Asger F
92816b1c9a JS: Port ClientSideRequestForgery 2023-10-13 13:15:03 +02:00
Asger F
b2216627be JS: Port RequestForgery 2023-10-13 13:15:03 +02:00
Asger F
d7b4e0c206 JS: Port ExceptionXss 2023-10-13 13:15:03 +02:00
Asger F
cf5450dbd5 JS: Port XssThroughDom 2023-10-13 13:15:03 +02:00
Asger F
5f05232e02 JS: Port StoredXss 2023-10-13 13:15:03 +02:00
Asger F
46b90e51fc JS: Port ReflectedXss 2023-10-13 13:15:03 +02:00
Asger F
e091fdefa4 JS: Port DomBasedXss 2023-10-13 13:15:03 +02:00
Asger F
2818fa62d6 JS: Updates to shared Xss.qll 2023-10-13 13:15:03 +02:00
Asger F
547a8a958a JS: Port SqlInjection 2023-10-13 13:15:03 +02:00
Asger F
65e9706c8e JS: Port TaintedPath 2023-10-13 13:15:03 +02:00
Asger F
fcfab5238e JS: Port CodeInjection 2023-10-13 13:15:03 +02:00
Asger F
17233a6749 JS: Port CommandInjection 2023-10-13 13:15:03 +02:00
Asger F
aa5a2836f5 JS: Update barriers in TaintedObject 2023-10-13 13:15:03 +02:00
Asger F
bc68b6a7f8 JS: Add AdHocWhitelistSanitizer::getABarrierNode() 
This sanitizer guard is opt-in, i.e. not an AdditionalSanitizerGuardNode.
 2023-10-13 13:15:03 +02:00
Asger F
26f7f94246 JS: Expose default taint steps/sanitizers 
We need access to these in order to port taint-tracking configurations
where only some flow labels should use taint steps. This isn't supported
by the shared data flow library.

Such queries must therefore be converted to plain data-flow
configurations that explicitly add taint steps to the relevant flow
states.
 2023-10-13 13:15:03 +02:00
Asger F
c924b4a220 JS: Expose shared API in DataFlow/TaintTracking modules 2023-10-13 13:15:03 +02:00
Asger F
1ed3235639 JS: use BarrierGuards 2023-10-13 13:15:03 +02:00
Asger F
277292e3b9 JS: Improve performance of barrier guards without pruning 2023-10-13 13:15:03 +02:00
Asger F
06fd9c2359 JS: Add barrier guard library 2023-10-13 13:14:43 +02:00
Asger F
46e4cdc623 JS: Disallow consecutive captured contents 2023-10-13 13:14:43 +02:00
Asger F
7bcf8b858b JS: Capture flow 2023-10-13 13:14:43 +02:00
Asger F
16df2c31bb Create DataFlowImplConsistency.qll 2023-10-13 12:42:41 +02:00
Asger F
3ef478669b JS: Collapse some cached stages 2023-10-13 12:42:41 +02:00
Asger F
9fef8803ed JS: Avoid BarrierGuardNode's range from depending on Configuration 2023-10-13 12:42:41 +02:00
Asger F
e31ae3a1bf JS: Model JSON.stringify with "deep" read operators 2023-10-13 12:42:41 +02:00
Asger F
0c2e52baba JS: Summary/steps for iterators and generators 2023-10-13 12:42:41 +02:00
Asger F
da3a0de814 JS: Port String#replace to flow summary 2023-10-13 12:42:41 +02:00
Asger F
f0c2afe39e JS: Add flow summaries for maps and sets 2023-10-13 12:42:40 +02:00
Asger F
5054c43b18 JS: Add flow summaries/steps for promises and async/await 2023-10-13 12:42:40 +02:00
Asger F
4319b07798 JS: Add flow summaries for Arrays 2023-10-13 12:42:40 +02:00
Asger F
a31e251529 JS: Add flow summaries for core methods 2023-10-13 12:42:40 +02:00
Asger F
46fec8ea7e JS: Add AdditionalFlowInternal 
This provides access to more features than we want to expose publicly at the moment, but is useful for modelling certain language features.
 2023-10-13 12:42:40 +02:00
Asger F
3f20d71a9b JS: Add legacy post-update step 
This is to ensure getALocalSource() can be replaced by getPostUpdateNode() as the base of a store
 2023-10-13 12:42:40 +02:00