Erik Krogh Kristensen
|
dc8042adeb
|
introduce conistency-checking for CWE-078
|
2020-07-06 12:47:56 +02:00 |
|
semmle-qlci
|
13c3513d76
|
Merge pull request #3905 from erik-krogh/unsafeShellTypo
Approved by esbena
|
2020-07-06 11:41:56 +01:00 |
|
semmle-qlci
|
73d606d2c3
|
Merge pull request #3844 from github/esbena-patch-3
Approved by erik-krogh
|
2020-07-06 09:47:59 +01:00 |
|
Erik Krogh Kristensen
|
8585312271
|
fix typo in js/shell-command-constructed-from-input
|
2020-07-06 10:33:49 +02:00 |
|
Asger Feldthaus
|
b5104ae42d
|
JS: Add StartsWith sanitizer
|
2020-07-03 14:46:07 +01:00 |
|
Asger Feldthaus
|
4c06eb8bfe
|
JS: Add test showing FPs
|
2020-07-03 14:45:42 +01:00 |
|
Erik Krogh Kristensen
|
078b6a8df2
|
autoformat
|
2020-07-03 00:21:55 +02:00 |
|
Erik Krogh Kristensen
|
261821b32c
|
Merge remote-tracking branch 'upstream/master' into queryStuff
|
2020-07-02 16:08:05 +02:00 |
|
semmle-qlci
|
b5c8f2238b
|
Merge pull request #3805 from esbena/js/seal-freeze-flow
Approved by asgerf
|
2020-07-02 13:54:54 +01:00 |
|
Erik Krogh Kristensen
|
ceb19292cb
|
autoformat
|
2020-07-02 14:47:08 +02:00 |
|
Erik Krogh Kristensen
|
2b0a091921
|
split out type-tracking into two predicates, to avoid catastrophic join-order
|
2020-07-02 14:28:28 +02:00 |
|
semmle-qlci
|
97128b1475
|
Merge pull request #3829 from asger-semmle/js/xss-substr
Approved by erik-krogh
|
2020-07-02 11:58:32 +01:00 |
|
Erik Krogh Kristensen
|
f60a7489b5
|
ignore parents that doesn't have all constant roots when deciding which roots to compute getStringValue for
|
2020-07-02 10:39:41 +02:00 |
|
Erik Krogh Kristensen
|
bbdeca367b
|
use getUnderlyingValue() to find leafs of a string-concat
|
2020-07-02 10:38:02 +02:00 |
|
Erik Krogh Kristensen
|
226e066db8
|
use strictconcat instead of concat
|
2020-07-02 10:12:43 +02:00 |
|
semmle-qlci
|
bfb734e1d7
|
Merge pull request #3832 from asger-semmle/js/typescript-in-html-files3
Approved by erik-krogh
|
2020-07-02 08:30:45 +01:00 |
|
semmle-qlci
|
45ef3ec4a8
|
Merge pull request #3619 from erik-krogh/CWE022-Correctness
Approved by asgerf
|
2020-07-01 20:07:58 +01:00 |
|
Erik Krogh Kristensen
|
6f54bb1613
|
only calculate getStringValue for concatenation roots
|
2020-07-01 20:48:20 +02:00 |
|
semmle-qlci
|
66a6fe7317
|
Merge pull request #3853 from max-schaefer/js/canonical-names
Approved by asgerf
|
2020-07-01 16:08:59 +01:00 |
|
Max Schaefer
|
a6d8073987
|
JavaScript: Make getADefinition and getAnAccess available on all CanonicalNames.
|
2020-07-01 14:42:03 +01:00 |
|
Esben Sparre Andreasen
|
3ca6031ae5
|
JS: rename predicate
|
2020-07-01 15:27:28 +02:00 |
|
Esben Sparre Andreasen
|
75451e349a
|
JS: teach the dataflow library identity functions Object.freeze/seal
|
2020-07-01 15:27:28 +02:00 |
|
Esben Sparre Andreasen
|
33c52761d4
|
JS: more dataflow and global access path testing
|
2020-07-01 15:26:25 +02:00 |
|
Erik Krogh Kristensen
|
3157cd724d
|
add noSQL tests for type-tracking req.query
|
2020-07-01 11:45:09 +02:00 |
|
Erik Krogh Kristensen
|
bace2994c3
|
add test for type-tracking req.params
|
2020-07-01 11:38:54 +02:00 |
|
Erik Krogh Kristensen
|
8227010463
|
also use new type-tracking in isUserControlledObject
|
2020-07-01 11:32:51 +02:00 |
|
Erik Krogh Kristensen
|
ed48efe5b4
|
recognize access to a query object through function calls
|
2020-06-30 15:52:08 +02:00 |
|
semmle-qlci
|
224289c55f
|
Merge pull request #3845 from max-schaefer/js/walk-sync
Approved by asgerf
|
2020-06-30 14:45:41 +01:00 |
|
semmle-qlci
|
42bca1a3fa
|
Merge pull request #3824 from asger-semmle/js/static-regexp-capture-group-step
Approved by erik-krogh, esbena
|
2020-06-30 13:20:14 +01:00 |
|
semmle-qlci
|
c850938af0
|
Merge pull request #3833 from asger-semmle/js/vue-class-component
Approved by erik-krogh
|
2020-06-30 13:16:42 +01:00 |
|
semmle-qlci
|
15a0297ca2
|
Merge pull request #3834 from asger-semmle/js/vue-classification
Approved by erik-krogh
|
2020-06-30 13:14:25 +01:00 |
|
Max Schaefer
|
62d56a3d7c
|
JavaScript: Fix module name for walk-sync package.
|
2020-06-30 11:57:16 +01:00 |
|
Esben Sparre Andreasen
|
80981ec8f5
|
Update UnsafeHtmlExpansion-transformed.html
|
2020-06-30 12:01:02 +02:00 |
|
Asger Feldthaus
|
7a2c65f638
|
JS: Fix virtual source root in AutoBuildTest
|
2020-06-30 09:25:06 +01:00 |
|
Esben Sparre Andreasen
|
c7f67fafd9
|
JS: support additional promisification of the fs-module members
|
2020-06-30 09:10:30 +02:00 |
|
Asger Feldthaus
|
182e4ce727
|
JS: Autoformat
|
2020-06-29 19:10:28 +01:00 |
|
Asger Feldthaus
|
cb12d894a6
|
JS: Add test
|
2020-06-29 15:54:06 +01:00 |
|
Asger Feldthaus
|
326c7af4eb
|
JS: Fix incorrect classification of Vue files
|
2020-06-29 15:49:07 +01:00 |
|
semmle-qlci
|
da8725aa5c
|
Merge pull request #3823 from dellalibera/js/fancy-log
Approved by erik-krogh
|
2020-06-29 14:46:51 +01:00 |
|
semmle-qlci
|
b3e68ef81c
|
Merge pull request #3806 from erik-krogh/moreDownloads
Approved by asgerf
|
2020-06-29 13:53:10 +01:00 |
|
Asger Feldthaus
|
b05942b599
|
JS: Add HTML file example
|
2020-06-29 13:45:01 +01:00 |
|
Asger Feldthaus
|
3938856e61
|
JS: Make this work in qltest
|
2020-06-29 13:42:55 +01:00 |
|
Asger Feldthaus
|
1a16d7339a
|
JS: Set SourceType correctly
|
2020-06-29 13:42:22 +01:00 |
|
Asger Feldthaus
|
e46a9dac65
|
JS: Count lines of code correctly
|
2020-06-29 09:59:17 +01:00 |
|
Asger Feldthaus
|
9c65318f99
|
JS: Extract TypeScript in HTML files to a snippet in virtual source root
|
2020-06-29 09:59:17 +01:00 |
|
Asger Feldthaus
|
da58fb5e62
|
JS: Resolve relative imports across real and virtual source roots
|
2020-06-29 09:44:48 +01:00 |
|
Asger Feldthaus
|
d3b9ebe1d2
|
JS: Perform glob matching across source roots
|
2020-06-29 09:44:48 +01:00 |
|
Asger Feldthaus
|
1297d0f414
|
JS: Extract HTML before TypeScript
|
2020-06-29 09:44:48 +01:00 |
|
Asger Feldthaus
|
2c1567aedd
|
JS: Don't extract TypeScript from HTML
|
2020-06-29 09:44:48 +01:00 |
|
Asger Feldthaus
|
805deb13c0
|
JS: Fix whitespace
|
2020-06-29 09:44:45 +01:00 |
|