Erik Krogh Kristensen
95fae8155e
fix wrong comment
...
Co-authored-by: Asger F <asgerf@github.com >
2022-05-31 08:38:03 +02:00
Asger F
c188aa87c7
Merge branch 'main' into js/madman-prep
2022-05-30 15:03:14 +02:00
Asger F
5f42866de3
Merge pull request #9318 from asgerf/js/type-confusion-parmaeter-tampering-barrier
...
JS: Fix FP in js/type-confusion-through-parameter-tampering
2022-05-30 12:52:37 +02:00
Max Schaefer
ea70aaff57
Improve detection of UMD modules.
...
We previously required the `define` to appear directly as an expression statement, but there are common patterns where this is not the case.
2022-05-30 12:37:50 +02:00
Max Schaefer
47e425a184
Improve inVoidContext to take conditional expressions into account.
2022-05-30 12:37:50 +02:00
Erik Krogh Kristensen
adb40f9360
Merge pull request #9289 from erik-krogh/es2022
...
JS: Support the remaining of the finished ES2022 proposals
2022-05-30 12:27:19 +02:00
Erik Krogh Kristensen
c7a8008897
Merge pull request #9235 from kaeluka/extractor-update-typescript-4_7
...
JS: Update the extractor to use TypeScript 4.7
2022-05-30 12:02:06 +02:00
Erik Krogh Kristensen
63e637503d
rewrite js/sensitive-get-query to use routing trees
2022-05-30 11:55:09 +02:00
Asger F
cc42f2f824
Merge pull request #8606 from asgerf/js/api-graph-api
...
JS/Python/Ruby: Document how API graphs should be interpreted
2022-05-30 10:49:14 +02:00
Erik Krogh Kristensen
62fd3fd90f
add test that we detect the used type variable in an infer type
2022-05-27 14:15:27 +00:00
Erik Krogh Kristensen
d199173923
add a getAPrimaryQlClass predicate to ExpressionWithTypeArguments
2022-05-25 16:10:13 +00:00
Asger F
5964be4463
Merge branch 'main' into js/type-confusion-parmaeter-tampering-barrier
2022-05-25 15:53:24 +02:00
Erik Krogh Kristensen
efa895e912
update expected output
2022-05-25 10:33:39 +00:00
Erik Krogh Kristensen
f38d1f9a4e
merge main into ts47
2022-05-25 10:13:25 +00:00
Asger F
877a9d8bcc
JS: Fix FP in js/type-confusion-through-parameter-tampering
2022-05-25 09:53:46 +02:00
Asger F
d7e3e9e5db
JS: Fix extraction of identifiers in EXPORT_BASE context
...
This is needed to ensure that the base of the RHS of an ImportEqualsDeclaration is bound to a namespace. That is, B below should be bound to a namespace:
import A = B.C.D;
2022-05-24 14:30:36 +02:00
Asger F
665fa2af59
JS: Add test for export base scope
2022-05-24 14:30:36 +02:00
Asger F
c8bb0e2117
JS: Treat d.ts as a single extension in Folder.getJavaScriptFile
2022-05-24 14:30:36 +02:00
Asger F
987a830029
JS: Add test for import of d.ts file
2022-05-24 14:30:36 +02:00
Asger F
db4b6d620a
JS: Remove Buffer.from as sink for js/resource-exhaustion
2022-05-24 14:18:05 +02:00
Erik Krogh Kristensen
82c6c22d50
make a model for hasOwnProperty calls and similar
2022-05-24 14:13:53 +02:00
Erik Krogh Kristensen
2a97dd9f6f
add support for Object.hasOwn(obj, key)
2022-05-24 13:59:25 +02:00
Erik Krogh Kristensen
1717d17fb3
add flow step for Array.prototype.at
2022-05-24 12:41:27 +02:00
Asger F
631527fe49
JS: Rename Node.{getASource -> asSource, getASink -> asSink}
2022-05-24 11:57:30 +02:00
Asger Feldthaus
9fad4b883b
JS: Autoformat
2022-05-24 11:57:30 +02:00
Asger Feldthaus
76ba78294f
JS: Make API::EntryPoint overrides optional
2022-05-24 11:57:30 +02:00
Asger Feldthaus
ce9c3b3eb5
JS: Also rename predicates on API::EntryPoint
2022-05-24 11:57:30 +02:00
Asger Feldthaus
19a5db9f89
JS: Rename getARhs -> getASink
2022-05-24 11:57:30 +02:00
Asger Feldthaus
4c6192670e
JS: Rename getAnImmediateUse -> getASource
2022-05-24 11:57:30 +02:00
Erik Krogh Kristensen
d58fe8e193
add explicit this
2022-05-24 10:59:13 +02:00
Erik Krogh Kristensen
aa01cf11c2
Merge pull request #9125 from erik-krogh/exportObj
...
JS: recognize functions that return object of methods as library input
2022-05-23 19:57:34 +02:00
Erik Krogh Kristensen
0c10927adc
Merge pull request #9261 from erik-krogh/passport
...
JS: remove support for passport in the session-fixation query
2022-05-23 19:56:42 +02:00
Erik Krogh Kristensen
ba844aa0ab
Merge branch 'main' into exportObj
2022-05-23 14:18:31 +02:00
Asger F
0929f5eb49
JS: Update test assertions to new syntax
2022-05-23 13:12:52 +02:00
Asger Feldthaus
33dac5e95f
JS: API graph support for accessors (and classes)
2022-05-23 13:12:52 +02:00
Erik Krogh Kristensen
7a3bbede1b
remove support for passport in the session-fixation query
2022-05-23 12:55:11 +02:00
Stephan Brandauer
cdceb66b07
add test for moduleSuffixes
2022-05-20 15:10:13 +02:00
Stephan Brandauer
cb4b2e983b
delete test of removed feature
2022-05-20 14:33:07 +02:00
Stephan Brandauer
813fbf27de
support for .mts and .cts file extensions
2022-05-20 13:33:52 +02:00
Stephan Brandauer
0f3448dc24
update tests for typescript 4.7
2022-05-19 15:45:19 +02:00
Erik Krogh Kristensen
23981cb323
Merge pull request #7626 from erik-krogh/CWE-377
...
JS: add query for detecting insecure temporary files
2022-05-16 15:25:17 +02:00
Erik Krogh Kristensen
762f7bf7fe
Merge pull request #9115 from erik-krogh/fileAndFolder
...
JS: resolve main module when there is a folder with the same name as the main file
2022-05-12 14:55:28 +02:00
Erik Krogh Kristensen
4bef451156
Merge pull request #9021 from erik-krogh/actions
...
JS: promote `js/actions/injection` out of experimental
2022-05-12 14:38:38 +02:00
Erik Krogh Kristensen
9050f9999c
recognize functions that return object of methods as library input
2022-05-12 09:56:19 +02:00
Erik Krogh Kristensen
b1e8b3332c
resolve main module when there is a folder with the same name as the main file
2022-05-12 08:20:30 +02:00
Erik Krogh Kristensen
5e02a76dfd
add support for typed NextJS route-handlers
2022-05-11 09:45:34 +02:00
Erik Krogh Kristensen
e80ee46fe4
add model for the cash library
2022-05-09 21:01:07 +02:00
CodeQL CI
e099b94cc4
Merge pull request #9081 from asgerf/js/global-step-refactor
...
Approved by erik-krogh
2022-05-09 06:30:37 -07:00
Erik Krogh Kristensen
53b26eba17
Merge pull request #8724 from erik-krogh/postMessage
...
JS: promote the `js/missing-origin-verification` query
2022-05-09 12:28:58 +02:00
Erik Krogh Kristensen
fe1e47bc17
Merge pull request #8710 from bananabr/dragAndDrop
...
JS: drag and drop API Xss sources
2022-05-09 12:22:28 +02:00
