Erik Krogh Kristensen
|
63036aa444
|
Merge branch 'master' of git.semmle.com:Semmle/ql into CVE74
|
2020-02-20 12:09:06 +01:00 |
|
Erik Krogh Kristensen
|
12c0291dde
|
require that an options object has a known set of properties
|
2020-02-20 11:35:11 +01:00 |
|
Erik Krogh Kristensen
|
b5ef45e6c2
|
add isSync predicate to SystemCommandExecution
|
2020-02-20 11:30:23 +01:00 |
|
Erik Krogh Kristensen
|
a193cb110e
|
support arrow functions in the callbacks
|
2020-02-20 11:13:39 +01:00 |
|
Erik Krogh Kristensen
|
56f3e431f9
|
update expected output
|
2020-02-20 10:28:53 +01:00 |
|
Erik Krogh Kristensen
|
bdab9ee12b
|
change useless cat query to only flag instances that can be re-written to
|
2020-02-19 16:59:28 +01:00 |
|
Asger Feldthaus
|
77105f6572
|
JS: Do not flag void operands MissingAwait
|
2020-02-19 09:30:03 +00:00 |
|
Erik Krogh Kristensen
|
344060e139
|
accept IO redirections as OK
|
2020-02-19 10:12:24 +01:00 |
|
Erik Krogh Kristensen
|
73a7d406a5
|
add query for useless use of cat
|
2020-02-18 19:18:45 +01:00 |
|
Esben Sparre Andreasen
|
abe7aeef7c
|
Merge pull request #2643 from esbena/js/unsafe-jquery
JS: add query js/unsafe-jquery-plugin
|
2020-02-18 09:26:14 +01:00 |
|
Erik Krogh Kristensen
|
56e5bd50f6
|
update expected output
|
2020-02-17 14:55:08 +01:00 |
|
Erik Krogh Kristensen
|
2885d48ad0
|
changes based on review
|
2020-02-17 14:44:10 +01:00 |
|
Erik Krogh Kristensen
|
d1a58f1d17
|
Merge remote-tracking branch 'upstream/master' into CVE74
|
2020-02-17 13:18:52 +01:00 |
|
Erik Krogh Kristensen
|
5375604109
|
calling pop or shift on a SplitPath returns a PosixPath
|
2020-02-17 13:15:46 +01:00 |
|
Erik Krogh Kristensen
|
46cbeb0bc6
|
add more steps to the SplitPath label
|
2020-02-17 12:58:27 +01:00 |
|
Erik Krogh Kristensen
|
a6d644bac0
|
add support for path.normalize(path.realtive(...))
|
2020-02-14 13:10:35 +01:00 |
|
Erik Krogh Kristensen
|
94814fa721
|
fix typos in the test
|
2020-02-14 13:03:35 +01:00 |
|
Erik Krogh Kristensen
|
d765a33b8d
|
add support for "../" prefixes in sanitizer
|
2020-02-14 12:36:54 +01:00 |
|
Erik Krogh Kristensen
|
3a146514ce
|
add sanitizer for relative ".." in js/path-injection
|
2020-02-14 10:51:48 +01:00 |
|
semmle-qlci
|
da566a4484
|
Merge pull request #2828 from erik-krogh/CVE24
Approved by esbena
|
2020-02-14 09:12:48 +00:00 |
|
semmle-qlci
|
769dce511b
|
Merge pull request #2788 from erik-krogh/CVE42-sink
Approved by esbena
|
2020-02-14 08:00:00 +00:00 |
|
Erik Krogh Kristensen
|
897bb4d801
|
add test for chrome-remote-interface
|
2020-02-13 15:12:45 +01:00 |
|
Erik Krogh Kristensen
|
0f511c92b4
|
Merge remote-tracking branch 'upstream/master' into FalsySanitizer
|
2020-02-10 09:54:58 +01:00 |
|
Erik Krogh Kristensen
|
06e13cb3a1
|
Merge branch 'master' of git.semmle.com:Semmle/ql into FalsySanitizer
|
2020-02-07 16:13:02 +01:00 |
|
Erik Krogh Kristensen
|
c6668da02e
|
expand how indirectCommandArguments are found
|
2020-02-07 15:00:05 +01:00 |
|
Esben Sparre Andreasen
|
736ccb98c2
|
JS: model the send library for js/path-injection
|
2020-02-07 12:45:32 +01:00 |
|
Erik Krogh Kristensen
|
8ea6070120
|
add indirect command injection sink for a concatenated array
|
2020-02-07 11:04:34 +01:00 |
|
Asger Feldthaus
|
f84af74d1d
|
JS: Handle more libraries
|
2020-02-06 14:59:52 +00:00 |
|
Asger Feldthaus
|
c559ab13e7
|
JS: Add test and handle parameter with source object
|
2020-02-06 14:59:52 +00:00 |
|
Erik Krogh Kristensen
|
1f7dda7fbc
|
add dataflow barrier for if(xrandr)
|
2020-02-06 12:55:44 +01:00 |
|
Erik Krogh Kristensen
|
d8a30c48a3
|
update expected output of TaintedPath tests
|
2020-02-06 09:47:15 +01:00 |
|
semmle-qlci
|
163285bee7
|
Merge pull request #2735 from asger-semmle/prototype-pollution-manual-dataflow
Approved by esbena
|
2020-02-05 12:52:59 +00:00 |
|
semmle-qlci
|
53763c789f
|
Merge pull request #2741 from esbena/js/split-and-slice-for-tainted-path
Approved by erik-krogh
|
2020-02-05 10:53:39 +00:00 |
|
semmle-qlci
|
52f34d7178
|
Merge pull request #2715 from erik-krogh/PrivateFields
Approved by asgerf
|
2020-02-05 10:20:28 +00:00 |
|
Erik Krogh Kristensen
|
ffc6fddddd
|
update expected test output
|
2020-02-05 10:52:40 +01:00 |
|
Erik Krogh Kristensen
|
76aca02752
|
change the pseudo-property on URL to a two-stage process
|
2020-02-05 10:27:03 +01:00 |
|
Erik Krogh Kristensen
|
8d37c03209
|
using pseudo-properties to model URL parsing
|
2020-02-04 16:30:07 +01:00 |
|
Asger Feldthaus
|
c185cededf
|
JS: More pruning and more data flow
|
2020-02-04 15:06:42 +00:00 |
|
Erik Krogh Kristensen
|
15e26666cd
|
add declaration for private field in syntax error test
|
2020-02-04 14:05:09 +01:00 |
|
semmle-qlci
|
bd51ef35b7
|
Merge pull request #2731 from erik-krogh/CVE527
Approved by esbena
|
2020-02-04 08:38:26 +00:00 |
|
Esben Sparre Andreasen
|
bbd60f52ba
|
JS: add additional flow steps to js/path-injection
|
2020-02-03 16:36:25 +01:00 |
|
Erik Krogh Kristensen
|
e3189aaa47
|
raise syntax error on declaration of private method, and add syntax tests for private fields
|
2020-02-03 16:00:25 +01:00 |
|
Esben Sparre Andreasen
|
c70997febf
|
JS: address review comments for js/unsafe-jquery-plugin
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
2ad9b843ae
|
JS: fix FP for js/unsafe-jquery-plugin
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
cfd567f01d
|
JS: fix FP for js/unsafe-jquery-plugin
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
9e247921fc
|
JS: add FP tests for js/unsafe-jquery-plugin
|
2020-01-31 19:33:04 +01:00 |
|
Esben Sparre Andreasen
|
fef918ac13
|
JS: add query "Unsafe jQuery plugin"
|
2020-01-31 19:33:04 +01:00 |
|
Erik Krogh Kristensen
|
e6d46b9279
|
add test for new prefix check on TaintedPath
|
2020-01-31 12:35:03 +01:00 |
|
Erik Krogh Kristensen
|
162c19c348
|
changes based on review
|
2020-01-30 14:04:04 +01:00 |
|
Erik Krogh Kristensen
|
7637ebcc03
|
Merge remote-tracking branch 'upstream/master' into exceptionFPs
|
2020-01-30 10:56:41 +01:00 |
|