2665 Commits

Author	SHA1	Message	Date
Esben Sparre Andreasen	a9665f53b8	JS: whitelist quote stripping for js/incomplete-sanitization	2019-09-05 09:47:49 +01:00
Asger F	5aa948cd17	JS: Add angular.merge sink to prototype pollution query	2019-09-04 16:14:51 +01:00
Asger F	89b91af6db	JS: Make getDocumentation handle chain assignments	2019-08-30 18:20:54 +01:00
Max Schaefer	b6220998d1	JavaScript: Restrict setAttribute sink to potentially dangerous attribute names.	2019-08-30 11:57:29 +01:00
Max Schaefer	78ce290de3	JavaScript: Fix DomMethodCallExpr.interpretsArgumentsAsHTML.	2019-08-28 11:22:03 +01:00
Pavel Avgustinov	cc854dd937	Merge branch 'master' of github.com:Semmle/ql into attribute	2019-08-23 09:55:35 +01:00
Asger F	45d4b83fc8	TS: Extract type args to tagged template exprs	2019-08-22 18:07:29 +01:00
Pavel Avgustinov	ca951f1669	Add jquery-datatables license to make it clear which option we choose	2019-08-17 16:31:18 +01:00
Asger F	5397da7579	JS: Handle implicit return in getImmediatePredecessor	2019-08-02 20:35:22 +01:00
Asger F	8e1893d0ed	JS: Update range analysis to use getImmediatePredecessor	2019-08-02 20:35:22 +01:00
semmle-qlci	635a8edacc	Merge pull request #1676 from xiemaisi/js/more-tests-classification ... Approved by esben-semmle	2019-08-02 14:02:24 +01:00
Max Schaefer	97c0c97b28	JavaScript: Classify __mocks__ and __tests_ as tests. ... These are conventions used by jest: https://jestjs.io/docs/en/manual-mocks#mocking-user-modules.	2019-08-02 11:15:02 +01:00
semmle-qlci	bb4f00d770	Merge pull request #1015 from esben-semmle/js/cli-cli ... Approved by xiemaisi	2019-08-02 09:57:19 +01:00
Esben Sparre Andreasen	90862fea99	JS: whitelist trivial throwers in js/superfluous-trailing-arguments	2019-08-01 11:49:43 +02:00
semmle-qlci	0e64c84f7e	Merge pull request #1656 from asger-semmle/rephrase-useless-def ... Approved by xiemaisi	2019-07-31 09:55:38 +01:00
Esben Sparre Andreasen	bf4a324a86	JS: add query js/indirect-command-line-injection	2019-07-31 09:24:25 +02:00
Asger F	ea563f8b97	JS: Rephrase dead store of local at declaration site	2019-07-30 18:02:27 +01:00
Asger F	378b0bfb74	JS: Do not treat the empty string as a credential	2019-07-30 17:29:12 +01:00
Max Schaefer	8b3e647ae9	JavaScript: Do not taint for-in loop variable.	2019-07-23 10:52:55 +01:00
semmle-qlci	6cda33c39e	Merge pull request #511 from esben-semmle/js/classify-minified-by-variable-names ... Approved by xiemaisi	2019-07-03 16:31:43 +01:00
semmle-qlci	71c86fa69b	Merge pull request #1527 from esben-semmle/js/classify-more-generated-and-tests ... Approved by asger-semmle	2019-07-02 07:38:10 +01:00
Esben Sparre Andreasen	062778bdd8	JS: heuristically recognize x.spec.y and x.test.y as test files	2019-07-01 15:49:17 +02:00
Esben Sparre Andreasen	41e568d1f7	JS: classify files with many short variables as minified	2019-07-01 13:25:07 +02:00
Esben Sparre Andreasen	2eb7e4a818	JS: classify x.test.js files with test(...) calls as jest tests	2019-07-01 10:28:10 +02:00
Esben Sparre Andreasen	5ebcef41fa	JS: classify numeric file names as generated	2019-07-01 10:25:38 +02:00
semmle-qlci	44bd540c44	Merge pull request #1495 from asger-semmle/array-taint-step ... Approved by xiemaisi	2019-06-27 12:16:17 +01:00
Max Schaefer	e35fde322b	JavaScript: Teach ShiftOutOfRange about BigInt.	2019-06-26 09:16:34 -07:00
Asger F	57dac1d0d5	JS: Update test output to reflect new edge relation	2019-06-25 16:41:29 +01:00
semmle-qlci	bffc3307b5	Merge pull request #1450 from esben-semmle/js/classify-json-js-as-generated ... Approved by xiemaisi	2019-06-13 09:45:37 +01:00
Esben Sparre Andreasen	59b7b0757a	JS: make Express' res/req extend Node's res/req	2019-06-12 12:45:01 +02:00
Esben Sparre Andreasen	29f9103b39	JS: classify single-line JSON files as generated	2019-06-12 09:05:12 +02:00
Esben Sparre Andreasen	299d4c6e93	JS: add additional SystemCommandExecutors	2019-06-11 09:38:10 +02:00
Max Schaefer	d723ab76d8	JavaScript: Fix getDelimiterMatchingRegexp to work on multi-line strings.	2019-06-05 08:09:19 +01:00
Max Schaefer	a4876270ec	JavaScript: Tweak PasswordInConfigurationFile alerts. ... Only highlight first line, and include the password in the alert message.	2019-06-05 08:09:19 +01:00
semmle-qlci	80ff63a3bb	Merge pull request #1387 from esben-semmle/js/unanchored-url-regex ... Approved by mc-semmle, xiemaisi	2019-06-03 17:27:08 +01:00
Esben Sparre Andreasen	bf51c54338	JS: add RegExpPatternSource::getAParse to hide the subclasses	2019-06-03 14:23:22 +02:00
Max Schaefer	d8a101df6d	JavaScript: Shrink Configurations.qll some more.	2019-06-03 10:32:25 +01:00
Esben Sparre Andreasen	7018a38691	JS: improve tests and regexp for js/regex/missing-regexp-anchor	2019-06-03 08:29:52 +02:00
Esben Sparre Andreasen	3289c629f7	JS: address minor review comments	2019-06-03 08:29:52 +02:00
Esben Sparre Andreasen	0fa73b8331	JS: add query js/regex/missing-regexp-anchor	2019-06-03 08:29:52 +02:00
Esben Sparre Andreasen	69db54a03a	JS: add anchors to js/incomplete-hostname-regexp examples	2019-06-03 08:27:49 +02:00
Max Schaefer	3097037a6f	Merge pull request #1290 from esben-semmle/js/semver-lib ... JS: add SemVer library	2019-05-31 08:09:24 +01:00
semmle-qlci	0fa06e5c8d	Merge pull request #1180 from asger-semmle/tainted-path-squashed ... Approved by xiemaisi	2019-05-30 17:20:19 +01:00
Max Schaefer	3c8aea26da	JavaScript: Update expected test output.	2019-05-30 15:05:43 +01:00
Asger F	ef1ad0d3b7	JS: Summary expected output (not taint-tracking config anymore)	2019-05-28 12:05:51 +01:00
Asger F	9f1617a6a8	JS: Update TaintedPath.expected (4x paths)	2019-05-28 11:22:08 +01:00
Max Schaefer	bad5465aad	Merge pull request #1360 from asger-semmle/customize-window-document ... JS: Make some DOM concepts customizable	2019-05-28 07:58:44 +01:00
Esben Sparre Andreasen	eb13ab52cf	JS: sharpen js/prototype-pollution with version analysis	2019-05-27 22:32:32 +02:00
Esben Sparre Andreasen	1cea29d89f	JS: improve prototype pollution tests	2019-05-27 22:32:32 +02:00
Esben Sparre Andreasen	af3f0b1d04	JS: add test for missing support for package-lock.json	2019-05-27 22:32:32 +02:00