Asger F
cc8fe10801
JS: Update locations in expected files
2025-08-29 12:03:11 +02:00
Asger F
d39b68cd41
Merge pull request #19849 from asgerf/js/remove-legacy-actions-queries
...
JS: Remove legacy actions queries
2025-06-25 09:18:33 +02:00
Asger F
61887beae0
JS: Add test case for false positive
2025-06-23 16:03:41 +02:00
Asger F
76b7228160
JS: Remove js/actions/command-injection
...
Superseded by actions/command-injection/{medium,critical}
2025-06-23 14:41:26 +02:00
Napalys Klicius
71f1b82a56
Added support for fastify.all
2025-04-30 14:54:09 +02:00
Napalys Klicius
6d61766366
Added test case for fastify.all
2025-04-30 14:50:35 +02:00
Napalys
fdfdcc0d93
Undo unnecessary name tracking for request, response objects
2025-04-22 14:16:45 +02:00
Asger F
00661b62dc
JS: Add isMiddlewareSetup() hook to Routing model
2025-04-22 12:00:02 +02:00
Napalys
5c3556da66
Add user-controlled property tracking and update code injection alerts in Fastify hooks
2025-04-15 09:41:52 +02:00
Napalys
9b194ea613
Added addHook to RouteSetup thus now it is recognized now as rouute handler
2025-04-15 09:37:13 +02:00
Napalys
c175081698
Added test cases for fastify.addHook
2025-04-15 09:33:41 +02:00
Asger F
2a194a53af
raw test output
2025-02-28 13:29:39 +01:00
Asger F
64d39da5f8
JS: Accept Sources/Sink tags
2025-02-28 13:29:30 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
0453ded338
JS: Add query ID to some alerts
2025-02-28 13:27:41 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
789a7bdb48
JS: Disable for test with alerts in a JSON file
...
JSON does not support comments so we can't use inline expectations
2025-02-28 13:27:36 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
d79f429978
JS: Update changes to nodes/edges/subpaths
...
No changes in actual alerts
2025-02-17 10:36:05 +01:00
Asger F
52ba91a7f8
JS: Updates to nodes/edges in tests
...
Only changes to nodes/edges for various reasons, no actual result changes
2024-10-29 08:32:13 +01:00
Asger F
2e2181be2c
JS: Update test output that only affects nodes/edges/subpaths
2024-08-27 11:35:33 +02:00
Asger F
2473274681
JS: Benign test output changes
2024-06-27 09:06:45 +02:00
Asger F
53efb5837b
JS: Update some tests with provenance columns
...
Only includes the changes that purely contain the new provenance columns
2024-06-26 13:51:44 +02:00
Asger F
bd3fccd1a8
JS: Update test output with provenance column
2024-06-25 10:30:56 +02:00
Asger F
9b46c4596c
JS: Update HeuristicSoruceCodeInjection test
2023-10-13 13:15:08 +02:00
Asger F
7f4d42ddcd
JS: Port UnsafeDynamicMethodAccess
2023-10-13 13:15:06 +02:00
Asger F
32022ccbda
JS: Port UnsafeCodeConstruction
2023-10-13 13:15:05 +02:00
Asger F
9128722627
JS: Port ImproperCodeSanitization
2023-10-13 13:15:05 +02:00
Asger F
fcfab5238e
JS: Port CodeInjection
2023-10-13 13:15:03 +02:00
jorgectf
2ac334bf15
Adapt Webix modeling to support HTML use-cases
2023-06-28 15:26:30 +02:00
jorgectf
1e663b8889
Update HeuristicSourceCodeInjection.expected
2023-06-26 13:32:20 +02:00
Jorge
08b9a5e2b2
Add missing ;
2023-06-23 23:10:06 +02:00
jorgectf
6947e99c15
Add models for webix
...
Co-authored-by: Kevin Stubbings <Kwstubbs@users.noreply.github.com >
2023-06-22 01:07:33 +02:00
Asger F
20e8ee8423
Merge pull request #12748 from JarLob/yi
...
JS: Add more sources, more unit tests, fixes to the GitHub Actions injection query
2023-05-15 11:03:00 +02:00
Asger F
1a9956354e
JS: Restrict getInput to indirect command injection query
2023-05-03 16:10:03 +02:00
Asger F
08785a4063
JS: Add sources from actions/core
2023-05-01 11:42:17 +02:00
Asger F
cb95dbfa14
JS: Add tests
2023-05-01 11:42:17 +02:00
jarlob
6e9f54ef55
Use double curly braces
2023-04-21 19:03:38 +02:00
jarlob
d80c541da6
Encapsulate composite actions
2023-04-14 10:06:35 +02:00
jarlob
9c7eecf547
Add support for composite actions
2023-04-06 22:53:59 +02:00
jarlob
baefeab2d1
fix tests
2023-04-06 19:11:04 +02:00
jarlob
0a878d4db9
Support yAml extensions
2023-04-06 19:07:38 +02:00
jarlob
eef1973b93
Change UI message
2023-04-05 10:05:24 +02:00
jarlob
5c5b9f99a8
Add simple taint tracking for env variables
2023-04-05 10:03:46 +02:00
jarlob
8ea418216c
Look for script injections in actions/github-script
2023-04-03 23:13:28 +02:00
jarlob
c6eaf194a5
Remove empty.js as it is not needed anymore
2023-04-03 15:09:40 +02:00
jarlob
99d634c8a4
Add more sources, more unit tests, fixes to the GitHub Actions injection query
2023-04-03 15:02:02 +02:00
