Asger F
287753187e
JS: Remove invalid syntax from test
...
TS decorators may not appear on functions and enums
2025-02-28 13:27:56 +01:00
Asger F
426a871405
JS: Remove incorrect Alert marker
...
This is expected, based on a comment earlier in the file about the 'y' variable
2025-02-28 13:27:54 +01:00
Asger F
2c46e10678
JS: Mark an alert as missing
2025-02-28 13:27:53 +01:00
Asger F
e026b9e048
JS: Mark regressions due to lack of local field steps
2025-02-28 13:27:52 +01:00
Asger F
e5bee19b19
JS: Accept a double-flagged line
...
This is flagged by two queries but for two separate issues. Seems valid to flag it twice.
2025-02-28 13:27:51 +01:00
Asger F
68fae9ded8
JS: Accept alerts about newline replacement
2025-02-28 13:27:49 +01:00
Asger F
1f3c49638b
JS: Accept some less obvious alerts
...
These are listed in a function called 'good' but it's difficult to say in isolation whether they should be flagged or not. Accepting the changes as they seem reasonable.
2025-02-28 13:27:48 +01:00
Asger F
f395651807
JS: Mark alert as MISSING
...
See https://github.com/github/codeql-javascript-team/issues/447
2025-02-28 13:27:47 +01:00
Asger F
07a876b4e9
JS: Accept some alerts at the SystemCommandExecution location
2025-02-28 13:27:46 +01:00
Asger F
10a7294327
JS: Accept trivial test changes
...
This adds Alert annotations for alerts that seem intentional by the test
but has not been annotated with 'NOT OK', or the comment was in the wrong
place.
In a few cases I included 'Source' expectations to make it easier to see
what happened. Other 'Source' expectations will be added in bulk a later
commit.
2025-02-28 13:27:43 +01:00
Asger F
0453ded338
JS: Add query ID to some alerts
2025-02-28 13:27:41 +01:00
Asger F
86932c51bc
JS: Move some alerts to their correct location
...
One of the diffs look confusing but:
Previously parameter {2,3} where flagged, now parameter {1,2} are flagged.
Note that for command injection, the SystemCommandExecution is flagged
despite the test file claiming otherwise.
2025-02-28 13:27:40 +01:00
Asger F
f5911c9e5a
JS: Accept raw test output
2025-02-28 13:27:38 +01:00
Asger F
795c1100fc
JS: Disable for SyntaxError
...
The presence of a syntax error sometimes prevents us from parsing the inline comment correctly.
2025-02-28 13:27:37 +01:00
Asger F
789a7bdb48
JS: Disable for test with alerts in a JSON file
...
JSON does not support comments so we can't use inline expectations
2025-02-28 13:27:36 +01:00
Asger F
ac6547fd01
JS: Disable for comment-related alerts
2025-02-28 13:27:35 +01:00
Asger F
d0ce53ed82
JS: Enable post-processing for all .qlref files
2025-02-28 13:27:33 +01:00
Asger F
426edd55f2
JS: Update output after line number change
...
Some OK-style comments had to be moved to the following line, shifting line numbers.
In selected range also included the comments themselves.
Lastly, the result sets were reordered by the CLI in some cases.
2025-02-28 13:27:31 +01:00
Asger F
9be041e27d
JS: Update OK-style comments to $-style
2025-02-28 13:27:28 +01:00
Asger F
7e5c24a8ec
JS: Remove uses of old inline expectation test library
2025-02-28 13:27:26 +01:00
Asger F
ff36d1916f
Merge pull request #18810 from asgerf/js/test-related-locations
...
Test: Add support for RelatedLocation tag and use in a JS query
2025-02-25 16:40:41 +01:00
Napalys
bf77ffef37
Applied comment
...
Co-authored-by: Asgerf <asgerf@github.com >
2025-02-25 13:57:39 +01:00
Napalys
e2927b2fad
Updated tanstack to use API graph.
2025-02-25 11:48:44 +01:00
Asger F
cd2c4d5e3a
JS: Use post-processed inline test in MissingCsrfMiddleware
...
This query flags the cookie-parsing middleware in order to consolidate huge numbers of alerts into a single alert, which is more manageable. But simply annotating the cookie-parsing middleware with 'Alert' isn't a very useful, we want to annotate which middlewares are vulnerable.
2025-02-21 14:44:46 +01:00
Napalys
1227a7eedc
Add Tanstack framework support and enhance data flow tracking for fetch responses
2025-02-21 13:24:00 +01:00
Napalys
05690c21ed
Added a test for tanstack/react-query useQuery
2025-02-21 13:24:00 +01:00
Asger F
58c8b5fa2b
Merge pull request #18790 from asgerf/js/no-implicit-array-taint
...
JS: Do not taint whole array when storing into ArrayElement
2025-02-19 13:23:31 +01:00
Asger F
e1c280500e
Merge pull request #18749 from Kwstubbs/express
...
JS: Add result.download to Express as Path Traversal Sink
2025-02-19 09:08:36 +01:00
Erik Krogh Kristensen
7fa41c438f
Merge pull request #18794 from erik-krogh/v-flag
...
JS: Add support for the regex V flag
2025-02-17 13:56:48 +01:00
Asger F
d79f429978
JS: Update changes to nodes/edges/subpaths
...
No changes in actual alerts
2025-02-17 10:36:05 +01:00
erik-krogh
01d70a6d73
add test of the new v flag
2025-02-16 19:01:02 +01:00
Asger F
25314b61db
JS: Update nodes/edges output
2025-02-14 10:26:21 +01:00
Asger F
654c6bfec7
Merge pull request #18735 from asgerf/inline-test-non-location
...
Test: Support arbitrary locations in inline test post-processor
2025-02-12 10:30:50 +01:00
Kevin Stubbings
d0ed0fdeb3
Add download to Express
2025-02-12 00:10:09 -08:00
Asger F
56ff9351f2
JS: Update test output again
2025-02-11 12:59:11 +01:00
Asger F
5b0eb0f6cc
JS: Move an Alert annotation to its correct line
2025-02-11 12:58:47 +01:00
Asger F
84c02d0863
JS: Enable test post-processing
2025-02-11 12:58:46 +01:00
Asger F
fb79ab1c8c
JS: Update line numbers
2025-02-11 12:58:45 +01:00
Asger F
a1c3dca5de
JS: Convert OK-style to $-style expectations in one test
2025-02-11 12:58:44 +01:00
Asger F
45242977a4
JS: Model query-string parsers that strip off ? or #
2025-02-11 10:41:23 +01:00
Asger F
b123a3c57a
JS: Add test
2025-02-11 10:40:04 +01:00
Asger F
78a7f2670a
JS: Update a JS test case
2025-02-03 11:31:03 +01:00
Asger F
f8694a34e5
Merge pull request #18397 from aegilops/angular-sources-sinks
...
JavaScript CodeQL library updates: new Angular sink(s)
2025-01-29 09:09:23 +01:00
erik-krogh
37a1727043
fix example in clear-text-logging qhelp to actually be bad
2025-01-27 11:31:28 +01:00
aegilops
76da479550
Updated tests
2025-01-24 16:52:11 +00:00
aegilops
522f3d1337
Merge
2025-01-23 17:00:56 +00:00
erik-krogh
17afab7d0f
support that two indexOf() calls use the same string-concatenation in getAnEquivalentIndexOfCall()
2025-01-21 09:43:57 +01:00
erik-krogh
d5529e3a7e
ensure an indexOf call is equivalent with itself. (getAUse() is used later to find matching indexOf calls)
2025-01-21 09:42:30 +01:00
erik-krogh
905d904543
add a few failing tests
2025-01-21 09:40:24 +01:00
Asger F
aa0b9559bf
Merge pull request #18472 from asgerf/js/test-suite
...
JS: Port three tests to use the new post processing-based inline test expectations
2025-01-17 12:06:32 +01:00
