11726 Commits

Author	SHA1	Message	Date
Erik Krogh Kristensen	cc1d797cef	adjust top comment to reflect what the query does, and add comment about which kind of accepting state is assumed.	2020-11-18 21:32:31 +01:00
Erik Krogh Kristensen	58c31f0eca	prune more regexps initially in the ReDoS query	2020-11-18 15:14:46 +01:00
Erik Krogh Kristensen	c4153a617e	remove duplicated test cases from ReDoS, and adjust variables names to match test output	2020-11-18 14:49:09 +01:00
Erik Krogh Kristensen	8270bf5bb9	make the character search skip unencodable characters	2020-11-18 11:55:49 +01:00
Erik Krogh Kristensen	64828713d6	remove FPs in js/build-artifact-leak where the "leaked" properties are constrained to a safe subset	2020-11-18 10:35:02 +01:00
Erik Krogh Kristensen	06733eadea	remove two unused imports	2020-11-18 10:34:15 +01:00
Erik Krogh Kristensen	55f2f86a26	limit the search of state-pairs to the ones that are reachable within the given length	2020-11-18 09:23:35 +01:00
Erik Krogh Kristensen	c4d7533701	Merge branch 'main' into moreReDoS	2020-11-17 17:34:49 +01:00
Erik Krogh Kristensen	97acf1fd87	fix FP related to inverted character classes choosing a char that was not matched by the char class	2020-11-17 17:34:43 +01:00
CodeQL CI	09cfb24afa	Merge pull request #4648 from erik-krogh/regexpParse ... Approved by asgerf	2020-11-16 08:20:40 +00:00
Erik Krogh Kristensen	a49b99b18c	autoformat	2020-11-13 20:06:17 +01:00
Erik Krogh Kristensen	affb11b0e3	changes based on review	2020-11-13 19:46:37 +01:00
Erik Krogh Kristensen	2f4fcc2f5e	Apply suggestions from code review ... Co-authored-by: Asger F <asgerf@github.com>	2020-11-13 18:03:07 +01:00
Erik Krogh Kristensen	7f68b07665	Merge branch 'main' into regexpParse	2020-11-13 09:33:16 +01:00
Erik Krogh Kristensen	7cf7a44fda	autoformat	2020-11-12 22:33:00 +01:00
Erik Krogh Kristensen	49be7e959f	Merge branch 'main' into jwt	2020-11-12 21:36:09 +01:00
Erik Krogh Kristensen	99d03bab24	only flag the secret key in JWT	2020-11-12 21:36:05 +01:00
Asger Feldthaus	4d3d982bde	JS: Autoformat date-functions file	2020-11-12 10:07:30 +00:00
Erik Krogh Kristensen	044fbc0b49	optimize the regexp parser	2020-11-11 21:13:11 +01:00
Erik Krogh Kristensen	de6b21986c	bump extractor version string	2020-11-11 21:10:03 +01:00
Erik Krogh Kristensen	74d933d475	move change note	2020-11-11 21:09:08 +01:00
Erik Krogh Kristensen	67d581edec	Update javascript/2020-11-09-jwt.md ... Co-authored-by: Asger F <asgerf@github.com>	2020-11-11 21:06:30 +01:00
CodeQL CI	f9d62adcb2	Merge pull request #4567 from asgerf/js/date-functions ... Approved by erik-krogh	2020-11-11 11:17:30 +00:00
Erik Krogh Kristensen	e01d4b104e	update expected output	2020-11-10 23:42:38 +01:00
Erik Krogh Kristensen	6b7f8dd505	fix parse errors related to char escapes and char ranges	2020-11-10 21:02:29 +01:00
Jonas Jensen	fc764db8e1	Merge pull request #4643 from nickrolfe/getFileBySourceArchiveName ... Replace getEncodedFile with shared getFileBySourceArchiveName predicate	2020-11-10 17:36:29 +01:00
Nick Rolfe	ac4a1f1d9b	Update comment to be a QLDoc comment	2020-11-10 14:14:27 +00:00
Nick Rolfe	1e1eb7ee33	Replace getEncodedFile with shared getFileBySourceArchiveName predicate ... While also making it work with paths for databases created on Windows.	2020-11-10 13:55:27 +00:00
Anders Schack-Mulligen	89ef6ea4eb	C++/C#/Java/JavaScript/Python: Autoformat set literals.	2020-11-10 13:32:27 +01:00
Erik Krogh Kristensen	ae7c7607f1	fix typos in documentation strings ... Co-authored-by: intrigus-lgtm <60750685+intrigus-lgtm@users.noreply.github.com>	2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen	b5b4d6d62a	add change note	2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen	5ecae55e77	add keys used by jsonwebtoken as CredentialsExpr	2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen	e75259d3a6	model the verify function in jsonwebtoken	2020-11-10 10:41:39 +01:00
Erik Krogh Kristensen	6732493377	add model for jwt-decode	2020-11-10 10:41:36 +01:00
CodeQL CI	1e048d8045	Merge pull request #4609 from asgerf/js/destructuring-export ... Approved by erik-krogh	2020-11-09 15:47:00 +00:00
Asger Feldthaus	32c5bc4836	JS: Update test case output (new flow is correct)	2020-11-09 11:19:47 +00:00
Erik Krogh Kristensen	3ef5d89e39	update expected output	2020-11-08 23:27:38 +01:00
Erik Krogh Kristensen	17a687b344	testing many possible intersections, instead of a single intersection	2020-11-08 23:24:36 +01:00
Erik Krogh Kristensen	34fd0d89f5	finding the minimum that is not an FP - instead of finding the minimum and then checking if it was an FP. And detecting more FPs by finding when a witness pass through the accept state	2020-11-08 23:24:27 +01:00
Erik Krogh Kristensen	ac514b1739	remove false positives where the analysis would wrongly conclude that the accept state could not be reached	2020-11-08 23:24:03 +01:00
Erik Krogh Kristensen	5f199e8b1a	improve performance by removing bindingset[char]	2020-11-08 23:24:03 +01:00
Erik Krogh Kristensen	d038e9c658	small performance improvements	2020-11-08 23:24:03 +01:00
Erik Krogh Kristensen	a5e75f53ff	add support for escape char classes inside char classes	2020-11-08 23:22:49 +01:00
Erik Krogh Kristensen	0063cb140c	add support for \W, \S, \D	2020-11-08 23:16:56 +01:00
Erik Krogh Kristensen	2dd8b6ffef	support \f and \v in the \s class	2020-11-08 23:16:56 +01:00
Erik Krogh Kristensen	68fe03060d	support \d \s and \w in ReDoS.ql	2020-11-08 23:16:56 +01:00
Erik Krogh Kristensen	fa54ad1a5e	refactor character class implementation in ReDoS.ql - preparing support for RegExpCharacterClassEscape	2020-11-08 23:16:55 +01:00
Erik Krogh Kristensen	a09ffd5cda	expand getAOverlapBetweenCharacterClasses to support overlap between more char classes	2020-11-08 23:16:37 +01:00
Erik Krogh Kristensen	4ede04f4d1	improve performance by pruning based on shared root	2020-11-08 23:16:37 +01:00
Erik Krogh Kristensen	82252c0f1c	detect redos between charclass and inverted charclass	2020-11-08 23:16:34 +01:00