Asger F
00661b62dc
JS: Add isMiddlewareSetup() hook to Routing model
2025-04-22 12:00:02 +02:00
Napalys
5c3556da66
Add user-controlled property tracking and update code injection alerts in Fastify hooks
2025-04-15 09:41:52 +02:00
Napalys
9b194ea613
Added addHook to RouteSetup thus now it is recognized now as rouute handler
2025-04-15 09:37:13 +02:00
Napalys
c175081698
Added test cases for fastify.addHook
2025-04-15 09:33:41 +02:00
Napalys Klicius
86313715a4
Merge pull request #19184 from Napalys/js/request_handlers
...
JS: Support for `Request` and `NextRequest`
2025-04-14 08:07:24 +02:00
Napalys Klicius
3d7c0201d9
Merge pull request #19231 from Napalys/js/typed_array
...
JS: Taint propagation from low-level `ArrayBuffer` to `Strings`
2025-04-11 11:29:01 +02:00
Napalys
678eccb417
Added searchParams.get as potential source for SSRF
2025-04-11 09:42:07 +02:00
Napalys
8674b61e5a
Added SSRF test case with searchParams for NextRequest
2025-04-11 09:26:16 +02:00
Napalys
6e09a65da0
Added support for NextRequest middleware SSRF.
2025-04-11 08:43:36 +02:00
Napalys
734ad2d767
Removed legacy Consistency check as it is redundant now with inline test expectations.
2025-04-11 08:43:08 +02:00
Napalys
208487f236
Added middleware test
2025-04-11 08:39:47 +02:00
Napalys Klicius
43bf0beae9
Merge pull request #19263 from Napalys/js/make-dir-lib
...
JS: Add support for `make-dir` package
2025-04-10 15:09:43 +02:00
Napalys
86b64afa13
Added NextResponse to the ResponseCall class it models similar near idential behaviour.
2025-04-10 15:06:44 +02:00
Napalys
8acb0243ad
Added test cases for NextResponse and Response
2025-04-10 14:57:40 +02:00
Napalys
63a3953b0c
Enhance Next.js API endpoint handling for compatibility with both Pages and App Router structures.
2025-04-10 14:48:17 +02:00
Napalys
81cba7fa2f
Added test cases with missing alerts for Request and NextRequest.
2025-04-10 14:43:48 +02:00
Asger F
eac14b9837
Merge pull request #19200 from asgerf/js/web-response
...
JS: Add sinks for calls to 'new Response()'
2025-04-10 14:41:32 +02:00
Napalys
171a84609e
Applied copilot suggestion.
2025-04-10 14:13:48 +02:00
Napalys
ce2fc25cdb
Added make-dir model as data
2025-04-09 14:42:29 +02:00
Napalys
674f40b35f
Added test cases for make-dir package.
2025-04-09 14:41:12 +02:00
Napalys Klicius
f02783a9c6
Merge pull request #19210 from Napalys/js/mkdirp
...
JS: Modeling of `mkdirp` functions
2025-04-09 13:43:37 +02:00
Napalys
b8802a29f4
Added open package model as data.
2025-04-08 08:12:30 +02:00
Napalys
df89739085
Added test cases for open package.
2025-04-08 08:10:10 +02:00
Napalys
e23ff9cf3e
Add TypedArrays flow summaries for Uint8Array and buffer property
2025-04-07 15:15:24 +02:00
Asger F
6c33013788
JS: Enable association with headers without needing a route handler
...
Previously it was not possible to associate a ResponseSendArgument with its header definitions if they did not have the same route handler.
But for calls like `new Response(body, { headers })` the headers are fairly obvious whereas the route handler is unnecessarily hard to find. So we use the direct and obvious association between 'body' and 'headers' in the call.
2025-04-03 11:08:10 +02:00
Asger F
db2720ea5b
JS: Initial model of Response
2025-04-03 11:08:05 +02:00
Napalys
3fa24d6026
Add sink model for mkdirp and update tests for path injection alerts.
2025-04-03 10:45:14 +02:00
Napalys
533f1a93e2
JS: Added test cases for mkdirp.
2025-04-03 10:45:12 +02:00
Napalys Klicius
5c42c0ba4c
Merge pull request #19196 from Napalys/js/rimraf
...
JS: Modeling of `rimraf` functions
2025-04-03 09:51:52 +02:00
Asger F
6c3bc941c5
Merge branch 'main' into js/name-resolution-independent-fixes
2025-04-02 14:15:44 +02:00
Asger F
9ebaac82cf
JS: Add tests for Response object sink
2025-04-02 13:47:18 +02:00
Napalys
b16b407f89
Add rimraf model and update tests for path injection vulnerabilities
2025-04-02 12:49:48 +02:00
Napalys
14999c19da
Added test cases for rimraf library.
2025-04-02 12:46:48 +02:00
Asger F
46f88e7ce7
JS: Updates to DOM model
2025-04-02 10:14:03 +02:00
Asger F
48db2b9315
JS: Add test
2025-04-02 10:12:36 +02:00
Asger F
887942e3e9
Merge pull request #19108 from asgerf/js/api-graph-spread-rest
...
JS: Handle spread/rest in API graphs
2025-04-01 17:48:36 +02:00
Napalys Klicius
4572376e9a
Merge pull request #19143 from Napalys/js/fs-extra-missing
...
JS: Modeling of `fs-extra` functions
2025-03-31 10:35:45 +02:00
Napalys
32d6ac8da7
Add test case to ensure exec calls without middleware injection into Express are not flagged.
2025-03-30 14:09:15 +02:00
Napalys
45c8ec96df
Added test cases for hana db additional sources.
2025-03-28 15:02:03 +01:00
Napalys Klicius
f7264d82d4
Merge branch 'main' into js/hana_db_client
2025-03-28 13:21:15 +01:00
Napalys
75b4d1b771
Applied copilot suggestions.
2025-03-28 13:19:11 +01:00
Napalys
495af56ab5
Added NodeJSFileSystemVectorWrite class for vectored write.
2025-03-28 13:07:23 +01:00
Napalys
e0c6cbb1b7
Added test cases for writev and writevSync.
2025-03-28 13:07:21 +01:00
Napalys
e63e170ac2
Added support for readv and readvSync functions in NodeJSFileSystemAccessRead class .
2025-03-28 13:07:20 +01:00
Napalys
6e7214747c
Added test cases for readv and readvSync
2025-03-28 13:07:14 +01:00
Asger F
1ad471cb32
JS: Track through spread/rest params in API graphs
2025-03-28 09:14:36 +01:00
Napalys
e1bf054056
Added support for lutimes, opendir, and statfs functions from fs-extra.
2025-03-28 08:37:30 +01:00
Napalys
55c74b2bac
Added support for emptydir functions from fs-extra.
2025-03-28 08:37:28 +01:00
Napalys
e386448f60
Added support for missing rm functions from fs-extra
2025-03-28 08:37:22 +01:00
Napalys
7a08f32e16
Added support for cp functions from fs-extra.
2025-03-28 08:36:26 +01:00
